### linux 5

#### Sun, 25 Jan 2026 16:27:21 India Standard Time

##### TABLE OF CONTENTS

- Vulnerabilities by Host
  - 172.17.100.54
- Compliance 'FAILED'
- Compliance 'SKIPPED'
- Compliance 'PASSED'
- Compliance 'INFO', 'WARNING', 'ERROR'
- Remediations
  - Suggested Remediations

###### Vulnerabilities by HostExpand All | Collapse All

172.17.100.54

70 | 1233 | 2403 | 73 | 2289
Critical | High | Medium | Low | Info

Scan Information

Start time: | Sun Jan 25 15:12:25 2026
End time: | Sun Jan 25 16:27:19 2026

Host Information

IP: | 172.17.100.54
MAC Address: | 00:50:56:88:97:F8 00:50:56:88:99:E7 00:50:56:88:E1:FB 00:50:56:88:16:57 00:50:56:88:C8:7A
OS: | Linux Kernel 5.14.0-503.11.1.el9_5.x86_64 on Red Hat Enterprise Linux release 9.5 (Plow)

Vulnerabilities

##

220273 - Linux Distros Unpatched Vulnerability : CVE-2017-11720
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- There is a division-by-zero vulnerability in LAME 3.99.5, caused by a malformed input file.
(CVE-2017-11720)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2017-11720

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.8 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0045
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2017-11720

Plugin Information
Published: 2025/03/04, Modified: 2025/09/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- lame-libs
221600 - Linux Distros Unpatched Vulnerability : CVE-2017-6519
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote attackers to cause a denial of service (traffic amplification) and may cause information leakage by obtaining potentially sensitive information from the responding device via port-5353 UDP packets. NOTE: this may overlap CVE-2015-2809. (CVE-2017-6519)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2017-6519

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
9.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
8.2 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0203
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2017-6519

Plugin Information
Published: 2025/03/04, Modified: 2025/09/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- avahi
- avahi-glib
- avahi-libs
- avahi-tools
223923 - Linux Distros Unpatched Vulnerability : CVE-2021-31535
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code. The libX11 XLookupColor request (intended for server-side color lookup) contains a flaw allowing a client to send color-name requests with a name longer than the maximum size allowed by the protocol (and also longer than the maximum packet size for normal-sized packets). The user-controlled data exceeding the maximum size is then interpreted by the server as additional X protocol requests and executed, e.g., to disable X server authorization completely. For example, if the victim encounters malicious terminal control sequences for color codes, then the attacker may be able to take full control of the running graphical session. (CVE-2021-31535)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-31535

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.8 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0233
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2021-31535

Plugin Information
Published: 2025/03/05, Modified: 2025/08/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libX11
- libX11-common
- libX11-devel
- libX11-xcb
224440 - Linux Distros Unpatched Vulnerability : CVE-2021-47378
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nvme-rdma: destroy cm id before destroy qp to avoid use after free We should always destroy cm_id before destroy qp to avoid to get cma event after qp was destroyed, which may lead to use after free. In RDMA connection establishment error flow, don't destroy qp in cm event handler.Just report cm_error to upper level, qp will be destroy in nvme_rdma_alloc_queue() after destroy cm id. (CVE-2021-47378)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47378
https://ubuntu.com/security/CVE-2021-47378

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
9.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0052
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47378

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
251336 - Linux Distros Unpatched Vulnerability : CVE-2023-53159
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host. (CVE-2023-53159)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53159
https://security-tracker.debian.org/tracker/CVE-2023-53159

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
9.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
8.6 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0001
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2023-53159

Plugin Information
Published: 2025/08/18, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
- gjs
- polkit
- polkit-libs
227744 - Linux Distros Unpatched Vulnerability : CVE-2024-11403
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL encoder when doing JPEG recompression (i.e. if using JxlEncoderAddJPEGFrame on untrusted input) does not properly check bounds in the presence of incomplete codes. This could lead to an out-of-bounds write. In jpegli which is released as part of the same project, the same vulnerability is present. However, the relevant buffer is part of a bigger structure, and the code makes no assumptions on the values that could be overwritten. The issue could however cause jpegli to read uninitialised memory, or addresses of functions. (CVE-2024-11403)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-11403

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v4.0 Base Score
6.9 (CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N)
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0006
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-11403

Plugin Information
Published: 2025/03/05, Modified: 2025/08/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
232093 - Linux Distros Unpatched Vulnerability : CVE-2024-11704
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under specific conditions, the same symmetric key could have been freed twice, potentially leading to memory corruption. This vulnerability affects Firefox < 133, Thunderbird < 133, Firefox ESR < 128.7, and Thunderbird < 128.7. (CVE-2024-11704)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-11704
https://ubuntu.com/security/CVE-2024-11704

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
9.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0012
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-11704

Plugin Information
Published: 2025/03/06, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
244289 - Linux Distros Unpatched Vulnerability : CVE-2024-11705
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- `NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL. When it was passed as NULL, a segmentation fault (SEGV) occurred, leading to crashes. This behavior conflicted with the PKCS#11 v3.0 specification, which allows `phKey` to be NULL for certain mechanisms. This vulnerability affects Firefox < 133 and Thunderbird < 133. (CVE-2024-11705)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-11705
https://ubuntu.com/security/CVE-2024-11705

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
9.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
8.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0011
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-11705

Plugin Information
Published: 2025/08/06, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
229544 - Linux Distros Unpatched Vulnerability : CVE-2024-45491
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45491)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-45491
https://security-tracker.debian.org/tracker/CVE-2024-45491
https://ubuntu.com/security/CVE-2024-45491

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
9.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0017
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-45491

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
229213 - Linux Distros Unpatched Vulnerability : CVE-2024-45492
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-45492
https://security-tracker.debian.org/tracker/CVE-2024-45492
https://ubuntu.com/security/CVE-2024-45492

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
9.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0009
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-45492

Plugin Information
Published: 2025/03/05, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
231512 - Linux Distros Unpatched Vulnerability : CVE-2024-5171
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Integer overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers: * Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid. * Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid. * Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid. (CVE-2024-5171)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-5171

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.8 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0061
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-5171

Plugin Information
Published: 2025/03/06, Modified: 2025/08/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
230970 - Linux Distros Unpatched Vulnerability : CVE-2024-5197
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calling vpx_img_wrap() with a large value of the d_w, d_h, or stride_align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. We recommend upgrading to version 1.14.1 or beyond (CVE-2024-5197)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-5197

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v4.0 Base Score
5.9 (CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:L/SA:N)
CVSS v3.0 Base Score
9.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
8.2 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0013
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-5197

Plugin Information
Published: 2025/03/06, Modified: 2025/08/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
248840 - Linux Distros Unpatched Vulnerability : CVE-2024-5535
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash.
In particular this issue could result in up to 255 bytes of arbitrary private data from memory being sent to the peer leading to a loss of confidentiality. However, only applications that directly call the SSL_select_next_proto function with a 0 length list of supported client protocols are affected by this issue. This would normally never be a valid scenario and is typically not under attacker control but may occur by accident in the case of a configuration or programming error in the calling application. The OpenSSL API function SSL_select_next_proto is typically used by TLS applications that support ALPN (Application Layer Protocol Negotiation) or NPN (Next Protocol Negotiation). NPN is older, was never standardised and is deprecated in favour of ALPN. We believe that ALPN is significantly more widely deployed than NPN. The SSL_select_next_proto function accepts a list of protocols from the server and a list of protocols from the client and returns the first protocol that appears in the server list that also appears in the client list. In the case of no overlap between the two lists it returns the first item in the client list. In either case it will signal whether an overlap between the two lists was found. In the case where SSL_select_next_proto is called with a zero length client list it fails to notice this condition and returns the memory immediately following the client list pointer (and reports that there was no overlap in the lists). This function is typically called from a server side application callback for ALPN or a client side application callback for NPN. In the case of ALPN the list of protocols supplied by the client is guaranteed by libssl to never be zero in length. The list of server protocols comes from the application and should never normally be expected to be of zero length. In this case if the SSL_select_next_proto function has been called as expected (with the list supplied by the client passed in the client/client_len parameters), then the application will not be vulnerable to this issue. If the application has accidentally been configured with a zero length server list, and has accidentally passed that zero length server list in the client/client_len parameters, and has additionally failed to correctly handle a no overlap response (which would normally result in a handshake failure in ALPN) then it will be vulnerable to this problem. In the case of NPN, the protocol permits the client to opportunistically select a protocol when there is no overlap. OpenSSL returns the first client protocol in the no overlap case in support of this. The list of client protocols comes from the application and should never normally be expected to be of zero length. However if the SSL_select_next_proto function is accidentally called with a client_len of 0 then an invalid memory pointer will be returned instead. If the application uses this output as the opportunistic protocol then the loss of confidentiality will occur. This issue has been assessed as Low severity because applications are most likely to be vulnerable if they are using NPN instead of ALPN - but NPN is not widely used. It also requires an application configuration or programming error. Finally, this issue would not typically be under attacker control making active exploitation unlikely. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue. Due to the low severity of this issue we are not issuing new releases of OpenSSL at this time. The fix will be included in the next releases when they become available. (CVE-2024-5535)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-5535
https://ubuntu.com/security/CVE-2024-5535

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
9.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
8.6 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0462
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2024-5535

Plugin Information
Published: 2025/08/12, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- compat-openssl11
231326 - Linux Distros Unpatched Vulnerability : CVE-2024-56431
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: this is disputed by third parties because there is no evidence of a security impact, e.g., an application would not crash. (CVE-2024-56431)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56431

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.8 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0186
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-56431

Plugin Information
Published: 2025/03/06, Modified: 2025/09/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
- libtheora
252227 - Linux Distros Unpatched Vulnerability : CVE-2024-58266
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection. (CVE-2024-58266)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-58266
https://security-tracker.debian.org/tracker/CVE-2024-58266
https://ubuntu.com/security/CVE-2024-58266

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
9.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0024
CVSS v2.0 Base Score
9.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:P/A:P)
CVSS v2.0 Temporal Score
7.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-58266

Plugin Information
Published: 2025/08/19, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
- gjs
- polkit
- polkit-libs
247377 - Linux Distros Unpatched Vulnerability : CVE-2025-0247
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Memory safety bugs present in Firefox 133 and Thunderbird 133. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 134 and Thunderbird < 134. (CVE-2025-0247)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-0247
https://ubuntu.com/security/CVE-2025-0247

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
9.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0011
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-0247

Plugin Information
Published: 2025/08/10, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
230491 - Linux Distros Unpatched Vulnerability : CVE-2025-1020
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 135 and Thunderbird < 135. (CVE-2025-1020)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-1020
https://ubuntu.com/security/CVE-2025-1020

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
9.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0013
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-1020

Plugin Information
Published: 2025/03/06, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
278964 - Linux Distros Unpatched Vulnerability : CVE-2025-10543
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly encoded if their length exceeds 65535 bytes. This may lead to unexpected content in packets sent to the server (for example, part of an MQTT topic may leak into the message body in a PUBLISH packet). The issue arises because the length of the data passed in was converted from an int64/int32 (depending upon CPU) to an int16 without checks for overflows. The int16 length was then written, followed by the data (e.g. topic). This meant that when the data (e.g. topic) was over 65535 bytes then the amount of data written exceeds what the length field indicates. This could lead to a corrupt packet, or mean that the excess data leaks into another field (e.g. topic leaks into message body). (CVE-2025-10543)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-10543

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
6.3 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
9.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-10543

Plugin Information
Published: 2025/12/17, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- rhc
272312 - Linux Distros Unpatched Vulnerability : CVE-2025-10966
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.
(CVE-2025-10966)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-10966
https://security-tracker.debian.org/tracker/CVE-2025-10966

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
9.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
8.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-10966

Plugin Information
Published: 2025/11/05, Modified: 2025/11/08
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- curl
- libcurl
277037 - Linux Distros Unpatched Vulnerability : CVE-2025-13836
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS. (CVE-2025-13836)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-13836
https://security-tracker.debian.org/tracker/CVE-2025-13836
https://ubuntu.com/security/CVE-2025-13836

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
6.3 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L)
CVSS v3.0 Base Score
9.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
8.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0004
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-13836

Plugin Information
Published: 2025/12/02, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
- python-unversioned-command
- python3
- python3-libs
244486 - Linux Distros Unpatched Vulnerability : CVE-2025-1941
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245). This vulnerability affects Firefox < 136.
(CVE-2025-1941)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-1941
https://ubuntu.com/security/CVE-2025-1941

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
9.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
7.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0007
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-1941

Plugin Information
Published: 2025/08/06, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
246675 - Linux Distros Unpatched Vulnerability : CVE-2025-1942
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into the result string This vulnerability affects Firefox < 136 and Thunderbird < 136.
(CVE-2025-1942)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-1942
https://ubuntu.com/security/CVE-2025-1942

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
9.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-1942

Plugin Information
Published: 2025/08/09, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
260209 - Linux Distros Unpatched Vulnerability : CVE-2025-27831
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in Artifex Ghostscript before 10.05.0. The DOCXWRITE TXTWRITE device has a text buffer overflow via long characters to devices/vector/doc_common.c. (CVE-2025-27831)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-27831

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0005
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-27831

Plugin Information
Published: 2025/09/01, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- ghostscript
- ghostscript-tools-fonts
- ghostscript-tools-printing
- libgs
260218 - Linux Distros Unpatched Vulnerability : CVE-2025-27836
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in Artifex Ghostscript before 10.05.0. The BJ10V device has a Print buffer overflow in contrib/japanese/gdev10v.c. (CVE-2025-27836)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-27836

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0005
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-27836

Plugin Information
Published: 2025/09/01, Modified: 2025/09/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- ghostscript
- ghostscript-tools-fonts
- ghostscript-tools-printing
- libgs
260208 - Linux Distros Unpatched Vulnerability : CVE-2025-27837
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can occur through a truncated path with invalid UTF-8 characters, for base/gp_mswin.c and base/winrtsup.cpp.
(CVE-2025-27837)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-27837

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0005
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-27837

Plugin Information
Published: 2025/09/01, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- ghostscript
- ghostscript-tools-fonts
- ghostscript-tools-printing
- libgs
269652 - Linux Distros Unpatched Vulnerability : CVE-2025-39898
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- e1000e: fix heap overflow in e1000_set_eeprom Fix a possible heap overflow in e1000_set_eeprom function by adding input validation for the requested length of the change in the EEPROM. In addition, change the variable type from int to size_t for better code practices and rearrange declarations to RCT.
(CVE-2025-39898)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39898
https://ubuntu.com/security/CVE-2025-39898

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
9.0 (CVSS:3.0/E:U/RL:U/RC:C)
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39898

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277477 - Linux Distros Unpatched Vulnerability : CVE-2025-40242
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- gfs2: Fix unlikely race in gdlm_put_lock In gdlm_put_lock(), there is a small window of time in which the DFL_UNMOUNT flag has been set but the lockspace hasn't been released, yet. In that window, dlm may still call gdlm_ast() and gdlm_bast(). To prevent it from dereferencing freed glock objects, only free the glock if the lockspace has actually been released. (CVE-2025-40242)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40242
https://security-tracker.debian.org/tracker/CVE-2025-40242
https://ubuntu.com/security/CVE-2025-40242

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
9.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40242

Plugin Information
Published: 2025/12/04, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277523 - Linux Distros Unpatched Vulnerability : CVE-2025-40251
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- devlink: rate: Unset parent pointer in devl_rate_nodes_destroy The function devl_rate_nodes_destroy is documented to Unset parent for all rate objects. However, it was only calling the driver-specific `rate_leaf_parent_set` or `rate_node_parent_set` ops and decrementing the parent's refcount, without actually setting the `devlink_rate->parent` pointer to NULL. This leaves a dangling pointer in the `devlink_rate` struct, which cause refcount error in netdevsim[1] and mlx5[2]. In addition, this is inconsistent with the behavior of `devlink_nl_rate_parent_node_set`, where the parent pointer is correctly cleared. This patch fixes the issue by explicitly setting `devlink_rate->parent` to NULL after notifying the driver, thus fulfilling the function's documented behavior for all rate objects. [1] repro steps: echo 1 > /sys/bus/netdevsim/new_device devlink dev eswitch set netdevsim/netdevsim1 mode switchdev echo 1 >
/sys/bus/netdevsim/devices/netdevsim1/sriov_numvfs devlink port function rate add netdevsim/netdevsim1/test_node devlink port function rate set netdevsim/netdevsim1/128 parent test_node echo 1 > /sys/bus/netdevsim/del_device dmesg: refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 8 PID: 1530 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0 CPU: 8 UID: 0 PID: 1530 Comm: bash Not tainted 6.18.0-rc4+ #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:refcount_warn_saturate+0x42/0xe0 Call Trace: <TASK> devl_rate_leaf_destroy+0x8d/0x90 __nsim_dev_port_del+0x6c/0x70 [netdevsim] nsim_dev_reload_destroy+0x11c/0x140 [netdevsim] nsim_drv_remove+0x2b/0xb0 [netdevsim] device_release_driver_internal+0x194/0x1f0 bus_remove_device+0xc6/0x130 device_del+0x159/0x3c0 device_unregister+0x1a/0x60 del_device_store+0x111/0x170 [netdevsim] kernfs_fop_write_iter+0x12e/0x1e0 vfs_write+0x215/0x3d0 ksys_write+0x5f/0xd0 do_syscall_64+0x55/0x10f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [2] devlink dev eswitch set pci/0000:08:00.0 mode switchdev devlink port add pci/0000:08:00.0 flavour pcisf pfnum 0 sfnum 1000 devlink port function rate add pci/0000:08:00.0/group1 devlink port function rate set pci/0000:08:00.0/32768 parent group1 modprobe -r mlx5_ib mlx5_fwctl mlx5_core dmesg: refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 7 PID:
16151 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0 CPU: 7 UID: 0 PID: 16151 Comm: bash Not tainted 6.17.0-rc7_for_upstream_min_debug_2025_10_02_12_44 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP:
0010:refcount_warn_saturate+0x42/0xe0 Call Trace: <TASK> devl_rate_leaf_destroy+0x8d/0x90 mlx5_esw_offloads_devlink_port_unregister+0x33/0x60 [mlx5_core] mlx5_esw_offloads_unload_rep+0x3f/0x50 [mlx5_core] mlx5_eswitch_unload_sf_vport+0x40/0x90 [mlx5_core] mlx5_sf_esw_event+0xc4/0x120 [mlx5_core] notifier_call_chain+0x33/0xa0 blocking_notifier_call_chain+0x3b/0x50 mlx5_eswitch_disable_locked+0x50/0x110 [mlx5_core] mlx5_eswitch_disable+0x63/0x90 [mlx5_core] mlx5_unload+0x1d/0x170 [mlx5_core] mlx5_uninit_one+0xa2/0x130 [mlx5_core] remove_one+0x78/0xd0 [mlx5_core] pci_device_remove+0x39/0xa0 device_release_driver_internal+0x194/0x1f0 unbind_store+0x99/0xa0 kernfs_fop_write_iter+0x12e/0x1e0 vfs_write+0x215/0x3d0 ksys_write+0x5f/0xd0 do_syscall_64+0x53/0x1f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 (CVE-2025-40251)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40251
https://security-tracker.debian.org/tracker/CVE-2025-40251
https://ubuntu.com/security/CVE-2025-40251

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
9.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40251

Plugin Information
Published: 2025/12/04, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279623 - Linux Distros Unpatched Vulnerability : CVE-2025-68615
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net-snmp is a SNMP application library, tools and daemon. Prior to versions 5.9.5 and 5.10.pre2, a specially crafted packet to an net-snmp snmptrapd daemon can cause a buffer overflow and the daemon to crash. This issue has been patched in versions 5.9.5 and 5.10.pre2. (CVE-2025-68615)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68615
https://security-tracker.debian.org/tracker/CVE-2025-68615
https://ubuntu.com/security/CVE-2025-68615

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
9.3 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
7.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-68615

Plugin Information
Published: 2025/12/23, Modified: 2026/01/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- net-snmp-libs
252171 - Linux Distros Unpatched Vulnerability : CVE-2025-7458
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An integer overflow in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1 allows an attacker with the ability to execute arbitrary SQL statements to cause a denial of service or disclose sensitive information from process memory via a crafted SELECT statement with a large number of expressions in the ORDER BY clause. (CVE-2025-7458)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-7458
https://security-tracker.debian.org/tracker/CVE-2025-7458
https://ubuntu.com/security/CVE-2025-7458

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v4.0 Base Score
6.9 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
9.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
7.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.2
EPSS Score
0.0001
CVSS v2.0 Base Score
3.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
2.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-7458

Plugin Information
Published: 2025/08/19, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
270585 - RHEL 9 : .NET 9.0 (RHSA-2025:18151)
-
Synopsis
The remote Red Hat host is missing one or more security updates for .NET 9.0.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:18151 advisory.
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.111 and .NET Runtime 9.0.10.Security Fix(es):
* dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)
* dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)
* dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2403083
https://bugzilla.redhat.com/show_bug.cgi?id=2403085
https://bugzilla.redhat.com/show_bug.cgi?id=2403086
http://www.nessus.org/u?eed12fb4
https://access.redhat.com/errata/RHSA-2025:18151

Solution
Update the RHEL .NET 9.0 package based on the guidance in RHSA-2025:18151.
Risk Factor
High
CVSS v3.0 Base Score
9.9 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L)
CVSS v3.0 Temporal Score
8.6 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
10.0
EPSS Score
0.0006
CVSS v2.0 Base Score
8.7 (CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:P)
CVSS v2.0 Temporal Score
6.4 (CVSS2#E:U/RL:OF/RC:C)
STIG Severity
I
References

CVE | CVE-2025-55247
CVE | CVE-2025-55248
CVE | CVE-2025-55315
XREF | RHSA:2025:18151
XREF | IAVA:2025-A-0752
XREF | CWE:319
XREF | CWE:377
XREF | CWE:444

Plugin Information
Published: 2025/10/15, Modified: 2025/10/17
Plugin Output

## tcp/0

Remote package installed : aspnetcore-runtime-9.0-9.0.5-1
Should be : aspnetcore-runtime-9.0-9.0.10-1.el9_6
Remote package installed : aspnetcore-targeting-pack-9.0-9.0.5-1
Should be : aspnetcore-targeting-pack-9.0-9.0.10-1.el9_6
Remote package installed : dotnet-apphost-pack-9.0-9.0.5-1
Should be : dotnet-apphost-pack-9.0-9.0.10-1.el9_6
Remote package installed : dotnet-host-9.0.5-1
Should be : dotnet-host-9.0.10-1.el9_6
Remote package installed : dotnet-hostfxr-9.0-9.0.5-1
Should be : dotnet-hostfxr-9.0-9.0.10-1.el9_6
Remote package installed : dotnet-runtime-9.0-9.0.5-1
Should be : dotnet-runtime-9.0-9.0.10-1.el9_6
Remote package installed : dotnet-targeting-pack-9.0-9.0.5-1
Should be : dotnet-targeting-pack-9.0-9.0.10-1.el9_6
Remote package installed : netstandard-targeting-pack-2.1-9.0.100~preview.7.24407.1-0.2.el9
Should be : netstandard-targeting-pack-2.1-9.0.111-1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
206621 - RHEL 9 : bubblewrap and flatpak (RHSA-2024:6356)
-
Synopsis
The remote Red Hat host is missing a security update for bubblewrap / flatpak.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:6356 advisory.
Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces.
Security Fix(es):
* flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-42472)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?5bf75b6d
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/errata/RHSA-2024:6356

Solution
Update the RHEL bubblewrap / flatpak packages based on the guidance in RHSA-2024:6356.
Risk Factor
High
CVSS v3.0 Base Score
10.0 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
9.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
7.1
EPSS Score
0.003
CVSS v2.0 Base Score
7.1 (CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-42472
XREF | RHSA:2024:6356
XREF | CWE:74

Plugin Information
Published: 2024/09/05, Modified: 2025/08/20
Plugin Output

## tcp/0

Remote package installed : flatpak-1.12.9-1.el9
Should be : flatpak-1.12.9-3.el9_4
Remote package installed : flatpak-libs-1.12.9-1.el9
Should be : flatpak-libs-1.12.9-3.el9_4
Remote package installed : flatpak-selinux-1.12.9-1.el9
Should be : flatpak-selinux-1.12.9-3.el9_4
Remote package installed : flatpak-session-helper-1.12.9-1.el9
Should be : flatpak-session-helper-1.12.9-3.el9_4
Remote package installed : bubblewrap-0.4.1-7.el9
Should be : bubblewrap-0.4.1-7.el9_4
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
210809 - RHEL 9 : bubblewrap and flatpak (RHSA-2024:9449)
-
Synopsis
The remote Red Hat host is missing a security update for bubblewrap / flatpak.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:9449 advisory.
Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces.
Security Fix(es):
* flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-42472)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
http://www.nessus.org/u?7ce0918a
https://access.redhat.com/errata/RHSA-2024:9449

Solution
Update the RHEL bubblewrap / flatpak packages based on the guidance in RHSA-2024:9449.
Risk Factor
High
CVSS v3.0 Base Score
10.0 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
9.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
7.1
EPSS Score
0.003
CVSS v2.0 Base Score
7.1 (CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-42472
XREF | RHSA:2024:9449
XREF | CWE:74

Plugin Information
Published: 2024/11/12, Modified: 2025/08/20
Plugin Output

## tcp/0

Remote package installed : flatpak-1.12.9-1.el9
Should be : flatpak-1.12.9-3.el9_5
Remote package installed : flatpak-libs-1.12.9-1.el9
Should be : flatpak-libs-1.12.9-3.el9_5
Remote package installed : flatpak-selinux-1.12.9-1.el9
Should be : flatpak-selinux-1.12.9-3.el9_5
Remote package installed : flatpak-session-helper-1.12.9-1.el9
Should be : flatpak-session-helper-1.12.9-3.el9_5
Remote package installed : bubblewrap-0.4.1-7.el9
Should be : bubblewrap-0.4.1-8.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
240079 - RHEL 9 : buildah (RHSA-2025:9147)
-
Synopsis
The remote Red Hat host is missing a security update for buildah.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9147 advisory.
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.
Security Fix(es):
* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2358493
http://www.nessus.org/u?83f878db
https://access.redhat.com/errata/RHSA-2025:9147

Solution
Update the RHEL buildah package based on the guidance in RHSA-2025:9147.
Risk Factor
High
CVSS v3.0 Base Score
9.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
7.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
9.4 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N)
CVSS v2.0 Temporal Score
7.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-22871
XREF | RHSA:2025:9147
XREF | CWE:444

Plugin Information
Published: 2025/06/17, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : buildah-1.37.2-1.el9
Should be : buildah-1.39.4-2.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
233458 - RHEL 9 : bzip2 (RHSA-2025:0925)
-
Synopsis
The remote Red Hat host is missing a security update for bzip2.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0925 advisory.
The bzip2 packages contain a freely available, high-quality data compressor. It provides both standalone compression and decompression utilities, as well as a shared library for use with other programs.
Security Fix(es):
* bzip2: bzip2: Data integrity error when decompressing (with data integrity tests fail). (CVE-2019-12900)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2332075
http://www.nessus.org/u?a04e289e
https://access.redhat.com/errata/RHSA-2025:0925

Solution
Update the RHEL bzip2 package based on the guidance in RHSA-2025:0925.
Risk Factor
High
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0125
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2019-12900
XREF | RHSA:2025:0925
XREF | CWE:1214

Plugin Information
Published: 2025/03/28, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : bzip2-1.0.8-8.el9
Should be : bzip2-1.0.8-10.el9_5
Remote package installed : bzip2-devel-1.0.8-8.el9
Should be : bzip2-devel-1.0.8-10.el9_5
Remote package installed : bzip2-libs-1.0.8-8.el9
Should be : bzip2-libs-1.0.8-10.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
240087 - RHEL 9 : containernetworking-plugins (RHSA-2025:9143)
-
Synopsis
The remote Red Hat host is missing a security update for containernetworking-plugins.
Description
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:9143 advisory.
The Container Network Interface (CNI) project consists of a specification and libraries for writing plug- ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted.
Security Fix(es):
* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2358493
http://www.nessus.org/u?b82b759d
https://access.redhat.com/errata/RHSA-2025:9143

Solution
Update the RHEL containernetworking-plugins package based on the guidance in RHSA-2025:9143.
Risk Factor
High
CVSS v3.0 Base Score
9.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
7.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
9.4 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N)
CVSS v2.0 Temporal Score
7.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-22871
XREF | RHSA:2025:9143
XREF | CWE:444

Plugin Information
Published: 2025/06/17, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : containernetworking-plugins-1.5.1-2.el9
Should be : containernetworking-plugins-1.6.2-2.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
210836 - RHEL 9 : cups (RHSA-2024:9470)
-
Synopsis
The remote Red Hat host is missing a security update for cups.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:9470 advisory.
The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.
Security Fix(es):
* cups: libppd: remote command injection via attacker controlled data in PPD file ()
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#low
https://bugzilla.redhat.com/show_bug.cgi?id=2314256
http://www.nessus.org/u?5645129a
https://access.redhat.com/errata/RHSA-2024:9470

Solution
Update the RHEL cups package based on the guidance in RHSA-2024:9470.
Risk Factor
Critical
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
9.1 (CVSS:3.0/E:F/RL:O/RC:C)
VPR Score
8.4
EPSS Score
0.3153
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
8.3 (CVSS2#E:F/RL:OF/RC:C)
References

CVE | CVE-2024-47175
XREF | RHSA:2024:9470
XREF | CWE:77

Exploitable With
Metasploit (true)
Plugin Information
Published: 2024/11/12, Modified: 2025/09/30
Plugin Output

## tcp/0

Remote package installed : cups-2.3.3op2-30.el9
Should be : cups-2.3.3op2-31.el9_5
Remote package installed : cups-client-2.3.3op2-30.el9
Should be : cups-client-2.3.3op2-31.el9_5
Remote package installed : cups-filesystem-2.3.3op2-30.el9
Should be : cups-filesystem-2.3.3op2-31.el9_5
Remote package installed : cups-ipptool-2.3.3op2-30.el9
Should be : cups-ipptool-2.3.3op2-31.el9_5
Remote package installed : cups-libs-2.3.3op2-30.el9
Should be : cups-libs-2.3.3op2-31.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
206802 - RHEL 9 : emacs (RHSA-2024:6510)
-
Synopsis
The remote Red Hat host is missing a security update for emacs.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:6510 advisory.
GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.
Security Fix(es):
* emacs: org-link-expand-abbrev: Do not evaluate arbitrary unsafe Elisp code (CVE-2024-39331)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?48dd5154
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2293942
https://access.redhat.com/errata/RHSA-2024:6510

Solution
Update the RHEL emacs package based on the guidance in RHSA-2024:6510.
Risk Factor
Critical
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0137
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-39331
XREF | RHSA:2024:6510
XREF | CWE:95

Plugin Information
Published: 2024/09/09, Modified: 2024/11/08
Plugin Output

## tcp/0

Remote package installed : emacs-filesystem-27.2-10.el9
Should be : emacs-filesystem-27.2-10.el9_4
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
208684 - RHEL 9 : firefox (RHSA-2024:7958)
-
Synopsis
The remote Red Hat host is missing a security update for firefox.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:7958 advisory.
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* firefox: Use-after-free in Animation timeline (128.3.1 ESR Chemspill) (CVE-2024-9680)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2317442
http://www.nessus.org/u?a8917a58
https://access.redhat.com/errata/RHSA-2024:7958

Solution
Update the RHEL firefox package based on the guidance in RHSA-2024:7958.
Risk Factor
Critical
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
9.1 (CVSS:3.0/E:F/RL:O/RC:C)
VPR Score
7.4
EPSS Score
0.2055
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
8.3 (CVSS2#E:F/RL:OF/RC:C)
STIG Severity
I
References

CVE | CVE-2024-9680
XREF | RHSA:2024:7958
XREF | CISA-KNOWN-EXPLOITED:2024/11/05
XREF | IAVA:2024-A-0641-S
XREF | CWE:416

Plugin Information
Published: 2024/10/10, Modified: 2024/12/06
Plugin Output

## tcp/0

Remote package installed : firefox-128.3.0-1.el9_4
Should be : firefox-128.3.1-2.el9_4
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
210907 - RHEL 9 : firefox (RHSA-2024:9554)
-
Synopsis
The remote Red Hat host is missing one or more security updates for firefox.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:9554 advisory.
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* firefox: Use-after-free in Animation timeline (128.3.1 ESR Chemspill) (CVE-2024-9680)
* firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in the browser (CVE-2024-10464)
* firefox: thunderbird: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response (CVE-2024-10461)
* firefox: thunderbird: Permission leak via embed or object elements (CVE-2024-10458)
* firefox: thunderbird: Use-after-free in layout with accessibility (CVE-2024-10459)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4 (CVE-2024-10467)
* firefox: thunderbird: Clipboard paste button persisted across tabs (CVE-2024-10465)
* firefox: DOM push subscription message could hang Firefox (CVE-2024-10466)
* firefox: thunderbird: Cross origin video frame leak (CVE-2024-10463)
* firefox: thunderbird: Origin of permission prompt could be spoofed by long URL (CVE-2024-10462)
* firefox: thunderbird: Confusing display of origin for external protocol handler prompt (CVE-2024-10460)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2317442
https://bugzilla.redhat.com/show_bug.cgi?id=2322424
https://bugzilla.redhat.com/show_bug.cgi?id=2322425
https://bugzilla.redhat.com/show_bug.cgi?id=2322428
https://bugzilla.redhat.com/show_bug.cgi?id=2322429
https://bugzilla.redhat.com/show_bug.cgi?id=2322433
https://bugzilla.redhat.com/show_bug.cgi?id=2322434
https://bugzilla.redhat.com/show_bug.cgi?id=2322438
https://bugzilla.redhat.com/show_bug.cgi?id=2322439
https://bugzilla.redhat.com/show_bug.cgi?id=2322440
https://bugzilla.redhat.com/show_bug.cgi?id=2322444
http://www.nessus.org/u?b9707328
https://access.redhat.com/errata/RHSA-2024:9554

Solution
Update the RHEL firefox package based on the guidance in RHSA-2024:9554.
Risk Factor
Critical
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
9.1 (CVSS:3.0/E:F/RL:O/RC:C)
VPR Score
7.4
EPSS Score
0.2055
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
8.3 (CVSS2#E:F/RL:OF/RC:C)
References

CVE | CVE-2024-9680
CVE | CVE-2024-10458
CVE | CVE-2024-10459
CVE | CVE-2024-10460
CVE | CVE-2024-10461
CVE | CVE-2024-10462
CVE | CVE-2024-10463
CVE | CVE-2024-10464
CVE | CVE-2024-10465
CVE | CVE-2024-10466
CVE | CVE-2024-10467
XREF | CISA-KNOWN-EXPLOITED:2024/11/05
XREF | RHSA:2024:9554
XREF | CWE:20
XREF | CWE:79
XREF | CWE:120
XREF | CWE:280
XREF | CWE:400
XREF | CWE:416
XREF | CWE:799
XREF | CWE:940
XREF | CWE:942

Plugin Information
Published: 2024/11/13, Modified: 2024/11/13
Plugin Output

## tcp/0

Remote package installed : firefox-128.3.0-1.el9_4
Should be : firefox-128.4.0-1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
241150 - RHEL 9 : firefox (RHSA-2025:10072)
-
Synopsis
The remote Red Hat host is missing one or more security updates for firefox.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10072 advisory.
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* firefox: Content-Disposition header ignored when a file is included in an embed or object tag (CVE-2025-6430)
* firefox: Use-after-free in FontFaceSet (CVE-2025-6424)
* firefox: Incorrect parsing of URLs could have allowed embedding of youtube.com (CVE-2025-6429)
* firefox: The WebCompat WebExtension shipped with Firefox exposed a persistent UUID (CVE-2025-6425)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2374555
https://bugzilla.redhat.com/show_bug.cgi?id=2374559
https://bugzilla.redhat.com/show_bug.cgi?id=2374561
https://bugzilla.redhat.com/show_bug.cgi?id=2374562
http://www.nessus.org/u?5b75fa27
https://access.redhat.com/errata/RHSA-2025:10072

Solution
Update the RHEL firefox package based on the guidance in RHSA-2025:10072.
Risk Factor
Critical
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-6424
CVE | CVE-2025-6425
CVE | CVE-2025-6429
CVE | CVE-2025-6430
XREF | RHSA:2025:10072
XREF | CWE:79
XREF | CWE:200
XREF | CWE:416
XREF | CWE:706

Plugin Information
Published: 2025/07/02, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : firefox-128.3.0-1.el9_4
Should be : firefox-128.12.0-1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
215101 - RHEL 9 : firefox (RHSA-2025:1066)
-
Synopsis
The remote Red Hat host is missing one or more security updates for firefox.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:1066 advisory.
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* firefox: thunderbird: Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7 (CVE-2025-1017)
* firefox: thunderbird: Use-after-free in Custom Highlight (CVE-2025-1010)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7 (CVE-2025-1016)
* firefox: thunderbird: Potential opening of private browsing tabs in normal browsing windows (CVE-2025-1013)
* firefox: thunderbird: A bug in WebAssembly code generation could result in a crash (CVE-2025-1011)
* firefox: thunderbird: Use-after-free in XSLT (CVE-2025-1009)
* firefox: thunderbird: Certificate length was not properly checked (CVE-2025-1014)
* firefox: thunderbird: Use-after-free during concurrent delazification (CVE-2025-1012)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2343748
https://bugzilla.redhat.com/show_bug.cgi?id=2343750
https://bugzilla.redhat.com/show_bug.cgi?id=2343752
https://bugzilla.redhat.com/show_bug.cgi?id=2343754
https://bugzilla.redhat.com/show_bug.cgi?id=2343756
https://bugzilla.redhat.com/show_bug.cgi?id=2343760
https://bugzilla.redhat.com/show_bug.cgi?id=2343764
https://bugzilla.redhat.com/show_bug.cgi?id=2343765
http://www.nessus.org/u?1dcdfa62
https://access.redhat.com/errata/RHSA-2025:1066

Solution
Update the RHEL firefox package based on the guidance in RHSA-2025:1066.
Risk Factor
Critical
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0018
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-1009
CVE | CVE-2025-1010
CVE | CVE-2025-1011
CVE | CVE-2025-1012
CVE | CVE-2025-1013
CVE | CVE-2025-1014
CVE | CVE-2025-1016
CVE | CVE-2025-1017
XREF | RHSA:2025:1066
XREF | CWE:119
XREF | CWE:120
XREF | CWE:362
XREF | CWE:416
XREF | CWE:1284

Plugin Information
Published: 2025/02/07, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : firefox-128.3.0-1.el9_4
Should be : firefox-128.7.0-1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
242686 - RHEL 9 : firefox (RHSA-2025:11748)
-
Synopsis
The remote Red Hat host is missing one or more security updates for firefox.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:11748 advisory.
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* firefox: thunderbird: Large branch table could lead to truncated instruction (CVE-2025-8028)
* firefox: thunderbird: Memory safety bugs (CVE-2025-8035)
* firefox: thunderbird: Incorrect URL stripping in CSP reports (CVE-2025-8031)
* firefox: thunderbird: JavaScript engine only wrote partial return value to stack (CVE-2025-8027)
* firefox: thunderbird: Potential user-assisted code execution in ?Copy as cURL? command (CVE-2025-8030)
* firefox: Memory safety bugs (CVE-2025-8034)
* firefox: thunderbird: Incorrect JavaScript state machine for generators (CVE-2025-8033)
* firefox: thunderbird: XSLT documents could bypass CSP (CVE-2025-8032)
* firefox: thunderbird: javascript: URLs executed on object and embed tags (CVE-2025-8029)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2382701
https://bugzilla.redhat.com/show_bug.cgi?id=2382703
https://bugzilla.redhat.com/show_bug.cgi?id=2382704
https://bugzilla.redhat.com/show_bug.cgi?id=2382707
https://bugzilla.redhat.com/show_bug.cgi?id=2382710
https://bugzilla.redhat.com/show_bug.cgi?id=2382711
https://bugzilla.redhat.com/show_bug.cgi?id=2382717
https://bugzilla.redhat.com/show_bug.cgi?id=2382718
https://bugzilla.redhat.com/show_bug.cgi?id=2382720
http://www.nessus.org/u?552a422c
https://access.redhat.com/errata/RHSA-2025:11748

Solution
Update the RHEL firefox package based on the guidance in RHSA-2025:11748.
Risk Factor
Critical
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0005
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-8027
CVE | CVE-2025-8028
CVE | CVE-2025-8029
CVE | CVE-2025-8030
CVE | CVE-2025-8031
CVE | CVE-2025-8032
CVE | CVE-2025-8033
CVE | CVE-2025-8034
CVE | CVE-2025-8035
XREF | RHSA:2025:11748
XREF | CWE:80
XREF | CWE:94
XREF | CWE:119
XREF | CWE:276
XREF | CWE:457
XREF | CWE:476
XREF | CWE:693
XREF | CWE:1332

Plugin Information
Published: 2025/07/25, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : firefox-128.3.0-1.el9_4
Should be : firefox-128.13.0-1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
270588 - RHEL 9 : firefox (RHSA-2025:18155)
-
Synopsis
The remote Red Hat host is missing one or more security updates for firefox.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:18155 advisory.
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* thunderbird: firefox: Memory safety bugs (CVE-2025-11714)
* thunderbird: firefox: Out of bounds read/write in a privileged process triggered by WebGL textures (CVE-2025-11709)
* thunderbird: firefox: Cross-process information leaked due to malicious IPC messages (CVE-2025-11710)
* thunderbird: firefox: Use-after-free in MediaTrackGraphImpl::GetInstance() (CVE-2025-11708)
* thunderbird: firefox: An OBJECT tag type attribute overrode browser behavior on web resources without a content-type (CVE-2025-11712)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 (CVE-2025-11715)
* thunderbird: firefox: Some non-writable Object properties could be modified (CVE-2025-11711)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2403763
https://bugzilla.redhat.com/show_bug.cgi?id=2403765
https://bugzilla.redhat.com/show_bug.cgi?id=2403768
https://bugzilla.redhat.com/show_bug.cgi?id=2403769
https://bugzilla.redhat.com/show_bug.cgi?id=2403770
https://bugzilla.redhat.com/show_bug.cgi?id=2403774
https://bugzilla.redhat.com/show_bug.cgi?id=2403776
http://www.nessus.org/u?2bfd863b
https://access.redhat.com/errata/RHSA-2025:18155

Solution
Update the RHEL firefox package based on the guidance in RHSA-2025:18155.
Risk Factor
Critical
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-11708
CVE | CVE-2025-11709
CVE | CVE-2025-11710
CVE | CVE-2025-11711
CVE | CVE-2025-11712
CVE | CVE-2025-11714
CVE | CVE-2025-11715
XREF | RHSA:2025:18155
XREF | CWE:119
XREF | CWE:125
XREF | CWE:284
XREF | CWE:416
XREF | CWE:436
XREF | CWE:497

Plugin Information
Published: 2025/10/15, Modified: 2025/10/15
Plugin Output

## tcp/0

Remote package installed : firefox-128.3.0-1.el9_4
Should be : firefox-140.4.0-3.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
278145 - RHEL 9 : firefox (RHSA-2025:23034)
-
Synopsis
The remote Red Hat host is missing one or more security updates for firefox.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23034 advisory.
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146 (CVE-2025-14333)
* firefox: Use-after-free in the WebRTC: Signaling component (CVE-2025-14321)
* firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14325)
* firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2025-14322)
* firefox: Privilege escalation in the Netmonitor component (CVE-2025-14328)
* firefox: Privilege escalation in the Netmonitor component (CVE-2025-14329)
* firefox: Same-origin policy bypass in the Request Handling component (CVE-2025-14331)
* firefox: Privilege escalation in the DOM: Notifications component (CVE-2025-14323)
* firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14330)
* firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14324)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2420502
https://bugzilla.redhat.com/show_bug.cgi?id=2420503
https://bugzilla.redhat.com/show_bug.cgi?id=2420504
https://bugzilla.redhat.com/show_bug.cgi?id=2420506
https://bugzilla.redhat.com/show_bug.cgi?id=2420508
https://bugzilla.redhat.com/show_bug.cgi?id=2420509
https://bugzilla.redhat.com/show_bug.cgi?id=2420512
https://bugzilla.redhat.com/show_bug.cgi?id=2420513
https://bugzilla.redhat.com/show_bug.cgi?id=2420516
https://bugzilla.redhat.com/show_bug.cgi?id=2420517
http://www.nessus.org/u?a39b1383
https://access.redhat.com/errata/RHSA-2025:23034

Solution
Update the RHEL firefox package based on the guidance in RHSA-2025:23034.
Risk Factor
Critical
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
7.1
EPSS Score
0.0004
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
STIG Severity
I
References

CVE | CVE-2025-14321
CVE | CVE-2025-14322
CVE | CVE-2025-14323
CVE | CVE-2025-14324
CVE | CVE-2025-14325
CVE | CVE-2025-14328
CVE | CVE-2025-14329
CVE | CVE-2025-14330
CVE | CVE-2025-14331
CVE | CVE-2025-14333
XREF | RHSA:2025:23034
XREF | IAVA:2025-A-0894
XREF | CWE:94

Plugin Information
Published: 2025/12/10, Modified: 2025/12/12
Plugin Output

## tcp/0

Remote package installed : firefox-128.3.0-1.el9_4
Should be : firefox-140.6.0-1.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
235114 - RHEL 9 : firefox (RHSA-2025:4443)
-
Synopsis
The remote Red Hat host is missing one or more security updates for firefox.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:4443 advisory.
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* firefox: thunderbird: Privilege escalation in Firefox Updater (CVE-2025-2817)
* firefox: thunderbird: Unsafe attribute access during XPath parsing (CVE-2025-4087)
* firefox: thunderbird: Process isolation bypass using javascript: URI links in cross-origin frames (CVE-2025-4083)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10 (CVE-2025-4091)
* firefox: thunderbird: Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10 (CVE-2025-4093)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2362902
https://bugzilla.redhat.com/show_bug.cgi?id=2362904
https://bugzilla.redhat.com/show_bug.cgi?id=2362907
https://bugzilla.redhat.com/show_bug.cgi?id=2362912
https://bugzilla.redhat.com/show_bug.cgi?id=2362915
http://www.nessus.org/u?66e85d8e
https://access.redhat.com/errata/RHSA-2025:4443

Solution
Update the RHEL firefox package based on the guidance in RHSA-2025:4443.
Risk Factor
Critical
CVSS v3.0 Base Score
9.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
7.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0005
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-2817
CVE | CVE-2025-4083
CVE | CVE-2025-4087
CVE | CVE-2025-4091
CVE | CVE-2025-4093
XREF | RHSA:2025:4443
XREF | CWE:94
XREF | CWE:120
XREF | CWE:125
XREF | CWE:653

Plugin Information
Published: 2025/05/05, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : firefox-128.3.0-1.el9_4
Should be : firefox-128.10.0-1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237313 - RHEL 9 : firefox (RHSA-2025:7428)
-
Synopsis
The remote Red Hat host is missing one or more security updates for firefox.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7428 advisory.
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* firefox: thunderbird: Privilege escalation in Firefox Updater (CVE-2025-2817)
* firefox: thunderbird: Unsafe attribute access during XPath parsing (CVE-2025-4087)
* firefox: thunderbird: Process isolation bypass using javascript: URI links in cross-origin frames (CVE-2025-4083)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10 (CVE-2025-4091)
* firefox: thunderbird: Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10 (CVE-2025-4093)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2362902
https://bugzilla.redhat.com/show_bug.cgi?id=2362904
https://bugzilla.redhat.com/show_bug.cgi?id=2362907
https://bugzilla.redhat.com/show_bug.cgi?id=2362912
https://bugzilla.redhat.com/show_bug.cgi?id=2362915
http://www.nessus.org/u?87b7710e
https://access.redhat.com/errata/RHSA-2025:7428

Solution
Update the RHEL firefox package based on the guidance in RHSA-2025:7428.
Risk Factor
Critical
CVSS v3.0 Base Score
9.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
7.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0005
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-2817
CVE | CVE-2025-4083
CVE | CVE-2025-4087
CVE | CVE-2025-4091
CVE | CVE-2025-4093
XREF | RHSA:2025:7428
XREF | CWE:94
XREF | CWE:120
XREF | CWE:125
XREF | CWE:653

Plugin Information
Published: 2025/05/27, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : firefox-128.3.0-1.el9_4
Should be : firefox-128.10.0-1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237139 - RHEL 9 : ghostscript (RHSA-2025:7586)
-
Synopsis
The remote Red Hat host is missing a security update for ghostscript.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7586 advisory.
The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.
Security Fix(es):
* Ghostscript: NPDL device: Compression buffer overflow (CVE-2025-27832)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2354949
http://www.nessus.org/u?2d41cc3e
https://access.redhat.com/errata/RHSA-2025:7586

Solution
Update the RHEL ghostscript package based on the guidance in RHSA-2025:7586.
Risk Factor
Medium
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0005
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-27832
XREF | RHSA:2025:7586
XREF | CWE:120

Plugin Information
Published: 2025/05/22, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : ghostscript-9.54.0-17.el9_4
Should be : ghostscript-9.54.0-19.el9_6
Remote package installed : ghostscript-tools-fonts-9.54.0-17.el9_4
Should be : ghostscript-tools-fonts-9.54.0-19.el9_6
Remote package installed : ghostscript-tools-printing-9.54.0-17.el9_4
Should be : ghostscript-tools-printing-9.54.0-19.el9_6
Remote package installed : libgs-9.54.0-17.el9_4
Should be : libgs-9.54.0-19.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
242125 - RHEL 9 : glib2 (RHSA-2025:11140)
-
Synopsis
The remote Red Hat host is missing one or more security updates for glib2.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:11140 advisory.
GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.
Security Fix(es):
* glib: buffer overflow in set_connect_msg() (CVE-2024-52533)
* glib: Buffer Underflow on GLib through glib/gstring.c via function g_string_insert_unichar (CVE-2025-4373)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2325340
https://bugzilla.redhat.com/show_bug.cgi?id=2364265
http://www.nessus.org/u?59937a77
https://access.redhat.com/errata/RHSA-2025:11140

Solution
Update the RHEL glib2 package based on the guidance in RHSA-2025:11140.
Risk Factor
Critical
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.8 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0029
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.8 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-52533
CVE | CVE-2025-4373
XREF | RHSA:2025:11140
XREF | CWE:124
XREF | CWE:193

Plugin Information
Published: 2025/07/15, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : glib2-2.68.4-14.el9_4.1
Should be : glib2-2.68.4-16.el9_6.2
Remote package installed : glib2-devel-2.68.4-14.el9_4.1
Should be : glib2-devel-2.68.4-16.el9_6.2
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
213127 - RHEL 9 : gstreamer1-plugins-base (RHSA-2024:11123)
-
Synopsis
The remote Red Hat host is missing one or more security updates for gstreamer1-plugins-base.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:11123 advisory.
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.
Security Fix(es):
* gstreamer1-plugins-base: GStreamer has a stack-buffer overflow in vorbis_handle_identification_packet (CVE-2024-47538)
* gstreamer1-plugins-base: out-of-bounds write in Ogg demuxer (CVE-2024-47615)
* gstreamer1-plugins-base: stack-buffer overflow in gst_opus_dec_parse_header (CVE-2024-47607)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2331727
https://bugzilla.redhat.com/show_bug.cgi?id=2331740
https://bugzilla.redhat.com/show_bug.cgi?id=2331754
http://www.nessus.org/u?3bf7cf5f
https://access.redhat.com/errata/RHSA-2024:11123

Solution
Update the RHEL gstreamer1-plugins-base package based on the guidance in RHSA-2024:11123.
Risk Factor
Critical
CVSS v4.0 Base Score
8.6 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0009
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
STIG Severity
I
References

CVE | CVE-2024-47538
CVE | CVE-2024-47607
CVE | CVE-2024-47615
XREF | RHSA:2024:11123
XREF | IAVA:2024-A-0832-S
XREF | CWE:121
XREF | CWE:787

Plugin Information
Published: 2024/12/18, Modified: 2025/11/05
Plugin Output

## tcp/0

Remote package installed : gstreamer1-plugins-base-1.22.1-2.el9
Should be : gstreamer1-plugins-base-1.22.1-3.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
235804 - RHEL 9 : gstreamer1-plugins-base (RHSA-2025:7243)
-
Synopsis
The remote Red Hat host is missing one or more security updates for gstreamer1-plugins-base.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7243 advisory.
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins.
Security Fix(es):
* gstreamer1-plugins-base: ID3v2 parser out-of-bounds read and NULL-pointer dereference (CVE-2024-47542)
* gstreamer1-plugins-base: GStreamer has an out-of-bounds write in SSA subtitle parser (CVE-2024-47541)
* gstreamer1-plugins-base: GStreamer has an OOB-read in format_channel_mask (CVE-2024-47600)
* gstreamer1-plugins-base: NULL-pointer dereference in LRC subtitle parser (CVE-2024-47835)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?a7e51e86
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2331717
https://bugzilla.redhat.com/show_bug.cgi?id=2331724
https://bugzilla.redhat.com/show_bug.cgi?id=2331738
https://bugzilla.redhat.com/show_bug.cgi?id=2331742
http://www.nessus.org/u?80d289df
https://access.redhat.com/errata/RHSA-2025:7243

Solution
Update the RHEL gstreamer1-plugins-base package based on the guidance in RHSA-2025:7243.
Risk Factor
High
CVSS v4.0 Base Score
6.9 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
9.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
8.2 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0011
CVSS v2.0 Base Score
9.4 (CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-47541
CVE | CVE-2024-47542
CVE | CVE-2024-47600
CVE | CVE-2024-47835
XREF | RHSA:2025:7243
XREF | CWE:125
XREF | CWE:476
XREF | CWE:787

Plugin Information
Published: 2025/05/13, Modified: 2025/07/01
Plugin Output

## tcp/0

Remote package installed : gstreamer1-plugins-base-1.22.1-2.el9
Should be : gstreamer1-plugins-base-1.22.12-4.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
213115 - RHEL 9 : gstreamer1-plugins-good (RHSA-2024:11122)
-
Synopsis
The remote Red Hat host is missing one or more security updates for gstreamer1-plugins-good.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:11122 advisory.
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.
Security Fix(es):
* gstreamer1-plugins-good: uninitialized stack memory in Matroska/WebM demuxer (CVE-2024-47540)
* gstreamer1-plugins-good: OOB-write in isomp4/qtdemux.c (CVE-2024-47537)
* gstreamer1-plugins-good: OOB-write in convert_to_s334_1a (CVE-2024-47539)
* gstreamer1-plugins-good: null pointer dereference in gst_gdk_pixbuf_dec_flush (CVE-2024-47613)
* gstreamer1-plugins-good: integer overflows in MP4/MOV demuxer and memory allocator that can lead to out- of-bounds writes (CVE-2024-47606)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2331719
https://bugzilla.redhat.com/show_bug.cgi?id=2331722
https://bugzilla.redhat.com/show_bug.cgi?id=2331726
https://bugzilla.redhat.com/show_bug.cgi?id=2331753
https://bugzilla.redhat.com/show_bug.cgi?id=2331760
http://www.nessus.org/u?efa0b8ff
https://access.redhat.com/errata/RHSA-2024:11122

Solution
Update the RHEL gstreamer1-plugins-good package based on the guidance in RHSA-2024:11122.
Risk Factor
Critical
CVSS v4.0 Base Score
8.6 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0032
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
STIG Severity
I
References

CVE | CVE-2024-47537
CVE | CVE-2024-47539
CVE | CVE-2024-47540
CVE | CVE-2024-47606
CVE | CVE-2024-47613
XREF | RHSA:2024:11122
XREF | IAVA:2024-A-0832-S
XREF | CWE:190
XREF | CWE:457
XREF | CWE:476
XREF | CWE:787

Plugin Information
Published: 2024/12/18, Modified: 2025/05/05
Plugin Output

## tcp/0

Remote package installed : gstreamer1-plugins-good-1.22.1-2.el9
Should be : gstreamer1-plugins-good-1.22.1-3.el9_5
Remote package installed : gstreamer1-plugins-good-gtk-1.22.1-2.el9
Should be : gstreamer1-plugins-good-gtk-1.22.1-3.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
235801 - RHEL 9 : gstreamer1-plugins-good (RHSA-2025:7242)
-
Synopsis
The remote Red Hat host is missing one or more security updates for gstreamer1-plugins-good.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7242 advisory.
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.
Security Fix(es):
* gstreamer1-plugins-good: OOB-read in qtdemux_parse_container (CVE-2024-47543)
* gstreamer1-plugins-good: GStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunk (CVE-2024-47774)
* gstreamer1-plugins-good: OOB-read in gst_wavparse_smpl_chunk (CVE-2024-47777)
* gstreamer1-plugins-good: OOB-read in gst_wavparse_adtl_chunk (CVE-2024-47778)
* gstreamer1-plugins-good: OOB-read in parse_ds64 (CVE-2024-47775)
* gstreamer1-plugins-good: OOB-read in FOURCC_SMI_ parsing (CVE-2024-47596)
* gstreamer1-plugins-good: insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences (CVE-2024-47599)
* gstreamer1-plugins-good: Use-After-Free read in Matroska CodecPrivate (CVE-2024-47834)
* gstreamer1-plugins-good: OOB-read in gst_wavparse_cue_chunk (CVE-2024-47776)
* gstreamer1-plugins-good: NULL-pointer dereferences in MP4/MOV demuxer CENC handling (CVE-2024-47544)
* gstreamer1-plugins-good: NULL-pointer dereference in Matroska/WebM demuxer (CVE-2024-47601)
* gstreamer1-plugins-good: OOB-read in qtdemux_parse_samples (CVE-2024-47597)
* gstreamer1-plugins-good: integer underflow in extract_cc_from_data leading to OOB-read (CVE-2024-47546)
* gstreamer1-plugins-good: NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer (CVE-2024-47602)
* gstreamer1-plugins-good: OOB-read in qtdemux_merge_sample_table (CVE-2024-47598)
* gstreamer1-plugins-good: NULL-pointer dereference in Matroska/WebM demuxer (CVE-2024-47603)
* gstreamer1-plugins-good: integer underflow in FOURCC_strf parsing leading to OOB-read (CVE-2024-47545)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?a7e51e86
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2331723
https://bugzilla.redhat.com/show_bug.cgi?id=2331739
https://bugzilla.redhat.com/show_bug.cgi?id=2331741
https://bugzilla.redhat.com/show_bug.cgi?id=2331743
https://bugzilla.redhat.com/show_bug.cgi?id=2331744
https://bugzilla.redhat.com/show_bug.cgi?id=2331747
https://bugzilla.redhat.com/show_bug.cgi?id=2331748
https://bugzilla.redhat.com/show_bug.cgi?id=2331749
https://bugzilla.redhat.com/show_bug.cgi?id=2331750
https://bugzilla.redhat.com/show_bug.cgi?id=2331751
https://bugzilla.redhat.com/show_bug.cgi?id=2331752
https://bugzilla.redhat.com/show_bug.cgi?id=2331755
https://bugzilla.redhat.com/show_bug.cgi?id=2331756
https://bugzilla.redhat.com/show_bug.cgi?id=2331759
https://bugzilla.redhat.com/show_bug.cgi?id=2331761
https://bugzilla.redhat.com/show_bug.cgi?id=2331762
https://bugzilla.redhat.com/show_bug.cgi?id=2331763
http://www.nessus.org/u?a693896f
https://access.redhat.com/errata/RHSA-2025:7242

Solution
Update the RHEL gstreamer1-plugins-good package based on the guidance in RHSA-2025:7242.
Risk Factor
High
CVSS v4.0 Base Score
6.9 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
9.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
7.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.001
CVSS v2.0 Base Score
9.4 (CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
7.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-47543
CVE | CVE-2024-47544
CVE | CVE-2024-47545
CVE | CVE-2024-47546
CVE | CVE-2024-47596
CVE | CVE-2024-47597
CVE | CVE-2024-47598
CVE | CVE-2024-47599
CVE | CVE-2024-47601
CVE | CVE-2024-47602
CVE | CVE-2024-47603
CVE | CVE-2024-47774
CVE | CVE-2024-47775
CVE | CVE-2024-47776
CVE | CVE-2024-47777
CVE | CVE-2024-47778
CVE | CVE-2024-47834
XREF | RHSA:2025:7242
XREF | CWE:125
XREF | CWE:191
XREF | CWE:416
XREF | CWE:476

Plugin Information
Published: 2025/05/13, Modified: 2025/07/01
Plugin Output

## tcp/0

Remote package installed : gstreamer1-plugins-good-1.22.1-2.el9
Should be : gstreamer1-plugins-good-1.22.12-4.el9
Remote package installed : gstreamer1-plugins-good-gtk-1.22.1-2.el9
Should be : gstreamer1-plugins-good-gtk-1.22.12-4.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
277860 - RHEL 9 : kernel (RHSA-2025:22865)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22865 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: can: j1939: implement NETDEV_UNREGISTER notification handler (CVE-2025-39925)
* kernel: net/mlx5: fs, fix UAF in flow counter release (CVE-2025-39979)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2400629
https://bugzilla.redhat.com/show_bug.cgi?id=2404109
http://www.nessus.org/u?edd1da0d
https://access.redhat.com/errata/RHSA-2025:22865

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:22865.
Risk Factor
Critical
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-39925
CVE | CVE-2025-39979
XREF | RHSA:2025:22865
XREF | CWE:911

Plugin Information
Published: 2025/12/09, Modified: 2025/12/09
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-611.13.1.el9_7
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-611.13.1.el9_7
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-611.13.1.el9_7
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-611.13.1.el9_7
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-611.13.1.el9_7
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-611.13.1.el9_7
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-611.13.1.el9_7
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-611.13.1.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237324 - RHEL 9 : kernel (RHSA-2025:6966)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:6966 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: drm: nv04: Fix out of bounds access (CVE-2024-27008)
* kernel: Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (CVE-2024-27398)
* kernel: pipe: wakeup wr_wait after setting max_usage (CVE-2023-52672)
* kernel: net: phy: micrel: Fix potential null pointer dereference (CVE-2024-35891)
* kernel: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (CVE-2024-35934)
* kernel: Bluetooth: btintel: Fix null ptr deref in btintel_read_version (CVE-2024-35933)
* kernel: Bluetooth: Fix memory leak in hci_req_sync_complete() (CVE-2024-35978)
* kernel: Bluetooth: SCO: Fix not validating setsockopt user input (CVE-2024-35967)
* kernel: Bluetooth: RFCOMM: Fix not validating setsockopt user input (CVE-2024-35966)
* kernel: Bluetooth: L2CAP: Fix not validating setsockopt user input (CVE-2024-35965)
* kernel: Bluetooth: ISO: Fix not validating setsockopt user input (CVE-2024-35964)
* kernel: Bluetooth: hci_sock: Fix not validating setsockopt user input (CVE-2024-35963)
* kernel: Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() (CVE-2024-36013)
* kernel: Bluetooth: msft: fix slab-use-after-free in msft_do_close() (CVE-2024-36012)
* kernel: Bluetooth: HCI: Fix potential null-ptr-deref (CVE-2024-36011)
* kernel: Bluetooth: qca: add missing firmware sanity checks (CVE-2024-36880)
* kernel: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (CVE-2024-36968)
* kernel: of: module: add buffer overflow check in of_modalias() (CVE-2024-38541)
* kernel: sock_map: avoid race between sock_map_close and sk_psock_put (CVE-2024-39500)
* kernel: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list (CVE-2024-40956)
* kernel: bpf: Fix too early release of tcx_entry (CVE-2024-41010)
* kernel: bluetooth/l2cap: sync sock recv cb and release (CVE-2024-41062)
* kernel: Bluetooth: Ignore too large handle values in BIG (CVE-2024-42133)
* kernel: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race (CVE-2024-42253)
* kernel: protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CVE-2024-42265)
* kernel: ASoC: TAS2781: Fix tasdev_load_calibrated_data() (CVE-2024-42278)
* kernel: ice: Add a per-VF limit on number of FDIR filters (CVE-2024-42291)
* kernel: block: fix deadlock between sd_remove & sd_release (CVE-2024-42294)
* kernel: PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal (CVE-2024-42302)
* kernel: ext4: make sure the first directory block is not a hole (CVE-2024-42304)
* kernel: ext4: check dot and dotdot of dx_root before making dir indexed (CVE-2024-42305)
* kernel: sysctl: always initialize i_uid/i_gid (CVE-2024-42312)
* kernel: exfat: fix potential deadlock on __exfat_get_dentry_set (CVE-2024-42315)
* kernel: mm/mglru: fix div-by-zero in vmpressure_calc_level() (CVE-2024-42316)
* kernel: net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE (CVE-2024-42321)
* kernel: dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume (CVE-2024-43820)
* kernel: scsi: lpfc: Fix a possible null pointer dereference (CVE-2024-43821)
* kernel: PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs() (CVE-2024-43823)
* kernel: ext4: fix infinite loop when replaying fast_commit (CVE-2024-43828)
* kernel: xdp: fix invalid wait context of page_pool_destroy() (CVE-2024-43834)
* kernel: lib: objagg: Fix general protection fault (CVE-2024-43846)
* kernel: cgroup/cpuset: Prevent UAF in proc_cpuset_show() (CVE-2024-43853)
* kernel: devres: Fix memory leakage caused by driver API devm_free_percpu() (CVE-2024-43871)
* kernel: vhost/vsock: always initialize seqpacket_allow (CVE-2024-43873)
* kernel: exec: Fix ToCToU between perm check and set-uid/gid usage (CVE-2024-43882)
* kernel: Bluetooth: MGMT: Add error handling to pair_device() (CVE-2024-43884)
* kernel: padata: Fix possible divide-by-0 panic in padata_mt_helper() (CVE-2024-43889)
* kernel: ext4: sanity check for NULL pointer after ext4_force_shutdown (CVE-2024-43898)
* kernel: bpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses (CVE-2024-43910)
* kernel: md/raid5: avoid BUG_ON() while continue reshape after reassembling (CVE-2024-43914)
* kernel: gpio: prevent potential speculation leaks in gpio_device_get_desc() (CVE-2024-44931)
* kernel: idpf: fix UAFs when destroying the queues (CVE-2024-44932)
* kernel: net: bridge: mcast: wait for previous gc cycles when removing port (CVE-2024-44934)
* kernel: driver core: Fix uevent_show() vs driver detach race (CVE-2024-44952)
* kernel: sched/smt: Fix unbalance sched_smt_present dec/inc (CVE-2024-44958)
* kernel: idpf: fix memory leaks and crashes while performing a soft reset (CVE-2024-44964)
* kernel: cgroup/cpuset: fix panic caused by partcmd_update (CVE-2024-44975)
* kernel: ipv6: prevent UAF in ip6_send_skb() (CVE-2024-44987)
* kernel: bonding: fix xfrm real_dev null pointer dereference (CVE-2024-44989)
* kernel: fs/netfs/fscache_cookie: add missing n_accesses check (CVE-2024-45000)
* kernel: mptcp: pm: only decrement add_addr_accepted for MPJ req (CVE-2024-45009)
* kernel: mptcp: pm: only mark 'subflow' endp as available (CVE-2024-45010)
* kernel: netem: fix return value if duplicate enqueue fails (CVE-2024-45016)
* kernel: mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0 (CVE-2024-45022)
* kernel: scsi: aacraid: Fix double-free on probe failure (CVE-2024-46673)
* kernel: usb: dwc3: core: Prevent USB core invalid event buffer address access (CVE-2024-46675)
* kernel: mptcp: pm: fix ID 0 endp usage after multiple re-creations (CVE-2024-46711)
* kernel: drm/amdgpu: fix mc_data out-of-bounds read warning (CVE-2024-46722)
* kernel: drm/amdgpu: fix ucode out-of-bounds read warning (CVE-2024-46723)
* kernel: drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number (CVE-2024-46724)
* kernel: drm/amdgpu: Fix out-of-bounds write warning (CVE-2024-46725)
* kernel: of/irq: Prevent device address out-of-bounds read in interrupt map walk (CVE-2024-46743)
* kernel: Input: uinput - reject requests with unreasonable number of slots (CVE-2024-46745)
* kernel: HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup (CVE-2024-46747)
* kernel: PCI: Add missing bridge lock to pci_bus_lock() (CVE-2024-46750)
* kernel: bpf: Remove tst_run from lwt_seg6local_prog_ops. (CVE-2024-46754)
* kernel: hwmon: (w83627ehf) Fix underflows seen when writing limit attributes (CVE-2024-46756)
* kernel: hwmon: (lm95234) Fix underflows seen when writing limit attributes (CVE-2024-46758)
* kernel: hwmon: (adc128d818) Fix underflows seen when writing limit attributes (CVE-2024-46759)
* kernel: pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv (CVE-2024-46761)
* kernel: tcp_bpf: fix return value of tcp_bpf_sendmsg() (CVE-2024-46783)
* kernel: fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF (CVE-2024-46786)
* kernel: userfaultfd: fix checks for huge PMDs (CVE-2024-46787)
* kernel: sch/netem: fix use after free in netem_dequeue (CVE-2024-46800)
* kernel: drm/amdgpu: fix the waring dereferencing hive (CVE-2024-46805)
* kernel: drm/amdgpu: Fix the warning division or modulo by zero (CVE-2024-46806)
* kernel: drm/amd/amdgpu: Check tbo resource pointer (CVE-2024-46807)
* kernel: drm/amdgpu: the warning dereferencing obj for nbio_v7_4 (CVE-2024-46819)
* kernel: drm/amdgpu/vcn: remove irq disabling in vcn 5 suspend (CVE-2024-46820)
* kernel: arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry (CVE-2024-46822)
* kernel: sched: sch_cake: fix bulk flow accounting logic for host fairness (CVE-2024-46828)
* kernel: drm/amdgpu: Fix smatch static checker warning (CVE-2024-46835)
* kernel: workqueue: Improve scalability of workqueue watchdog touch (CVE-2024-46839)
* kernel: spi: nxp-fspi: fix the KASAN report out-of-bounds bug (CVE-2024-46853)
* kernel: x86/hyperv: fix kexec crash due to VP assist page corruption (CVE-2024-46864)
* kernel: drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX (CVE-2024-46871)
* kernel: fsnotify: clear PARENT_WATCHED flags lazily (CVE-2024-47660)
* kernel: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (CVE-2024-47668)
* kernel: sock_map: Add a cond_resched() in sock_hash_free() (CVE-2024-47710)
* kernel: iommufd: Protect against overflow of ALIGN() during iova allocation (CVE-2024-47719)
* kernel: nfsd: return -EINVAL when namelen is 0 (CVE-2024-47692)
* kernel: block: fix potential invalid pointer dereference in blk_add_partition (CVE-2024-47705)
* kernel: ACPI: sysfs: validate return type of _STR method (CVE-2024-49860)
* kernel: powercap: intel_rapl: Fix off by one in get_rpi() (CVE-2024-49862)
* kernel: padata: use integer wrap around to prevent deadlock on seq_nr overflow (CVE-2024-47739)
* kernel: icmp: change the order of rate limits (CVE-2024-47678)
* kernel: ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir() (CVE-2023-52917)
* kernel: vdpa/mlx5: Fix invalid mr resource destroy (CVE-2024-47687)
* kernel: x86/sgx: Fix deadlock in SGX NUMA node search (CVE-2024-49856)
* kernel: wifi: mt76: mt7915: fix oops on non-dbdc mt7986 (CVE-2024-47715)
* kernel: wifi: rtw88: always wait for both firmware loading attempts (CVE-2024-47718)
* kernel: block, bfq: fix possible UAF for bfqq->bic with merge chain (CVE-2024-47706)
* kernel: nfsd: call cache_put if xdr_reserve_space returns NULL (CVE-2024-47737)
* kernel: wifi: mac80211: don't use rate mask for offchannel TX either (CVE-2024-47738)
* kernel: wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() (CVE-2024-47713)
* kernel: vhost_vdpa: assign irq bypass producer token correctly (CVE-2024-47748)
* kernel: tpm: Clean up TPM space after command failure (CVE-2024-49851)
* kernel: mm: call the security_mmap_file() LSM hook in remap_file_pages() (CVE-2024-47745)
* kernel: bpf, lsm: Add check for BPF LSM return value (CVE-2024-47703)
* kernel: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (CVE-2024-47685)
* kernel: ext4: check stripe size compatibility on remount as well (CVE-2024-47700)
* kernel: nfsd: map the EBADMSG to nfserr_io to avoid warning (CVE-2024-49875)
* kernel: iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count (CVE-2024-49993)
* kernel: tipc: guard against string buffer overrun (CVE-2024-49995)
* kernel: exfat: fix memory leak in exfat_load_bitmap() (CVE-2024-50013)
* kernel: Bluetooth: L2CAP: Fix uaf in l2cap_connect (CVE-2024-49950)
* kernel: ext4: fix double brelse() the buffer of the extents path (CVE-2024-49882)
* kernel: cachefiles: fix dentry leak in cachefiles_open_file() (CVE-2024-49870)
* kernel: ppp: do not assume bh is held in ppp_channel_bridge_input() (CVE-2024-49946)
* kernel: ext4: filesystems without casefold feature cannot be mounted with siphash (CVE-2024-49968)
* kernel: net: napi: Prevent overflow of napi_defer_hard_irqs (CVE-2024-50018)
* kernel: ext4: fix access to uninitialised lock in fc replay path (CVE-2024-50014)
* kernel: mm, slub: avoid zeroing kmalloc redzone (CVE-2024-49885)
* kernel: drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer (CVE-2024-49991)
* kernel: platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug (CVE-2024-49886)
* kernel: drm/amdgpu: add list empty check to avoid null pointer issue (CVE-2024-49904)
* kernel: wifi: iwlwifi: mvm: avoid NULL pointer dereference (CVE-2024-49929)
* kernel: uprobes: fix kernel info leak via [uprobes] vma (CVE-2024-49975)
* kernel: ext4: aovid use-after-free in ext4_ext_insert_extent() (CVE-2024-49883)
* kernel: ext4: fix timer use-after-free on failed mount (CVE-2024-49960)
* kernel: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free (CVE-2024-49983)
* kernel: cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value (CVE-2024-50009)
* kernel: ext4: update orig_path in ext4_find_extent() (CVE-2024-49881)
* kernel: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit (CVE-2024-49938)
* kernel: wifi: cfg80211: Set correct chandef when starting CAC (CVE-2024-49937)
* kernel: ext4: avoid use-after-free in ext4_ext_show_leaf() (CVE-2024-49889)
* kernel: resource: fix region_intersects() vs add_memory_driver_managed() (CVE-2024-49878)
* kernel: wifi: ath11k: fix array out-of-bound access in SoC stats (CVE-2024-49930)
* kernel: ext4: dax: fix overflowing extents beyond inode size when partially writing (CVE-2024-50015)
* kernel: r8169: add tally counter fields added with RTL8125 (CVE-2024-49973)
* kernel: wifi: rtw89: avoid reading out of bounds when loading TX power FW elements (CVE-2024-49928)
* kernel: ext4: fix i_data_sem unlock order in ext4_ind_migrate() (CVE-2024-50006)
* kernel: static_call: Replace pointless WARN_ON() in static_call_module_notify() (CVE-2024-49954)
* kernel: fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name (CVE-2024-49934)
* kernel: ext4: no need to continue when the number of entries is 1 (CVE-2024-49967)
* kernel: jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error (CVE-2024-49959)
* kernel: net: add more sanity checks to qdisc_pkt_len_init() (CVE-2024-49948)
* kernel: block: fix integer overflow in BLKSECDISCARD (CVE-2024-49994)
* kernel: afs: Fix the setting of the server responding flag (CVE-2024-49999)
* kernel: ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package() (CVE-2024-49962)
* kernel: NFSD: Limit the number of concurrent async COPY operations (CVE-2024-49974)
* kernel: wifi: rtw89: avoid to add interface to list twice when SER (CVE-2024-49939)
* kernel: Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (CVE-2024-49951)
* kernel: drm/amd/display: Increase array size of dummy_boolean (CVE-2024-49971)
* kernel: ACPI: PAD: fix crash in exit_round_robin() (CVE-2024-49935)
* kernel: static_call: Handle module init failure correctly in static_call_del_module() (CVE-2024-50002)
* kernel: x86/ioapic: Handle allocation failures gracefully (CVE-2024-49927)
* kernel: ext4: fix slab-use-after-free in ext4_split_extent_at() (CVE-2024-49884)
* kernel: net: stmmac: Fix zero-division error when disabling tc cbs (CVE-2024-49977)
* kernel: wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext() (CVE-2024-50008)
* kernel: blk_iocost: fix more out of bound shifts (CVE-2024-49933)
* kernel: smb: client: fix UAF in async decryption (CVE-2024-50047)
* kernel: netfilter: xtables: avoid NFPROTO_UNSPEC where needed (CVE-2024-50038)
* kernel: slip: make slhc_remember() more robust against malicious packets (CVE-2024-50033)
* kernel: zram: free secondary algorithms names (CVE-2024-50064)
* kernel: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change (CVE-2024-50044)
* kernel: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (CVE-2024-50029)
* kernel: device-dax: correct pgoff align in dax_set_mapping() (CVE-2024-50022)
* kernel: usb: typec: tipd: Free IRQ only if it was requested before (CVE-2024-50057)
* kernel: NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies() (CVE-2024-50046)
* kernel: thermal: core: Reference count the zone in thermal_zone_get_by_id() (CVE-2024-50028)
* kernel: net: Fix an unsafe loop on the list (CVE-2024-50024)
* kernel: serial: protect uart_port_dtr_rts() in uart_shutdown() too (CVE-2024-50058)
* kernel: driver core: bus: Fix double free in driver API bus_register() (CVE-2024-50055)
* kernel: net/sched: accept TCA_STAB only for root qdisc (CVE-2024-50039)
* kernel: kthread: unpark only parked kthread (CVE-2024-50019)
* kernel: net: phy: Remove LED entry from LEDs list on unregister (CVE-2024-50023)
* kernel: thermal: core: Free tzp copy along with the thermal zone (CVE-2024-50027)
* kernel: ppp: fix ppp_async_encode() illegal access (CVE-2024-50035)
* kernel: xen-netfront: Fix NULL sring after live migration (CVE-2022-48969)
* kernel: net: tun: Fix use-after-free in tun_detach() (CVE-2022-49014)
* kernel: hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails (CVE-2022-49029)
* kernel: fscache: Fix oops due to race with cookie_lru and use_cookie (CVE-2022-48989)
* kernel: tracing: Free buffers when a used dynamic event is removed (CVE-2022-49006)
* kernel: uprobe: avoid out-of-bounds memory access of fetching args (CVE-2024-50067)
* kernel: Bluetooth: ISO: Fix multiple init when debugfs is disabled (CVE-2024-50077)
* kernel: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (CVE-2024-50082)
* kernel: parport: Proper fix for array out-of-bounds access (CVE-2024-50074)
* kernel: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux (CVE-2024-50073)
* kernel: blk-mq: setup queue ->tag_set before initializing hctx (CVE-2024-50081)
* kernel: xhci: tegra: fix checked USB2 port number (CVE-2024-50075)
* kernel: Bluetooth: Call iso_exit() on module unload (CVE-2024-50078)
* kernel: nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net (CVE-2024-50121)
* kernel: md/raid10: fix null ptr dereference in raid10_size() (CVE-2024-50109)
* kernel: net: wwan: fix global oob in wwan_rtnl_policy (CVE-2024-50128)
* kernel: net: sched: use RCU read-side critical section in taprio_dump() (CVE-2024-50126)
* kernel: net: sched: fix use-after-free in taprio_change() (CVE-2024-50127)
* kernel: x86: fix user address masking non-canonical speculation issue (CVE-2024-50102)
* kernel: drm/amd: Guard against bad data for ATIF ACPI method (CVE-2024-50117)
* kernel: smb: client: Handle kstrdup failures for passwords (CVE-2024-50120)
* kernel: platform/x86/intel/pmc: Fix pmc_core_iounmap to call iounmap for valid addresses (CVE-2024-50107)
* kernel: nfsd: fix race between laundromat and free_stateid (CVE-2024-50106)
* kernel: thermal: intel: int340x: processor: Fix warning during module unload (CVE-2024-50093)
* kernel: iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices (CVE-2024-50101)
* kernel: netfilter: bpf: must hold reference on net namespace (CVE-2024-50130)
* kernel: bpf: devmap: provide rxq after redirect (CVE-2024-50162)
* kernel: udf: fix uninit-value use in udf_get_fileshortad (CVE-2024-50143)
* kernel: scsi: target: core: Fix null-ptr-deref in target_alloc_device() (CVE-2024-50153)
* kernel: smb: client: fix OOBs when building SMB2_IOCTL request (CVE-2024-50151)
* kernel: bpf: Make sure internal and UAPI bpf_redirect flags don't overlap (CVE-2024-50163)
* kernel: vsock: Update rx_bytes on read_skb() (CVE-2024-50169)
* kernel: ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context (CVE-2024-50141)
* kernel: usb: typec: altmode should keep reference to parent (CVE-2024-50150)
* kernel: smb: client: fix possible double free in smb2_set_ea() (CVE-2024-50152)
* kernel: ext4: don't set SB_RDONLY after filesystem errors (CVE-2024-50191)
* kernel: maple_tree: correct tree corruption on spanning store (CVE-2024-50200)
* kernel: pinctrl: intel: platform: fix error path in device_for_each_child_node() (CVE-2024-50197)
* kernel: net: explicitly clear the sk pointer, when pf->create fails (CVE-2024-50186)
* kernel: HID: amd_sfh: Switch to device-managed dmam_alloc_coherent() (CVE-2024-50189)
* kernel: drm/radeon: Fix encoder->possible_clones (CVE-2024-50201)
* kernel: mm/swapfile: skip HugeTLB pages for unuse_vma (CVE-2024-50199)
* kernel: secretmem: disable memfd_secret() if arch cannot set direct map (CVE-2024-50182)
* kernel: wifi: ath10k: Fix memory leak in management tx (CVE-2024-50236)
* kernel: mm/page_alloc: let GFP_ATOMIC order-0 allocs access highatomic reserves (CVE-2024-50219)
* kernel: mm: shmem: fix data-race in shmem_getattr() (CVE-2024-50228)
* kernel: wifi: cfg80211: clear wdev->cqm_config pointer on free (CVE-2024-50235)
* kernel: nvmet-auth: assign dh_key to NULL after kfree_sensitive (CVE-2024-50215)
* kernel: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (CVE-2024-50256)
* kernel: wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower (CVE-2024-50237)
* kernel: xfs: fix finding a last resort AG in xfs_filestream_pick_ag (CVE-2024-50216)
* kernel: macsec: Fix use-after-free while sending the offloading packet (CVE-2024-50261)
* kernel: signal: restore the override_rlimit logic (CVE-2024-50271)
* kernel: dm cache: fix potential out-of-bounds access on the first resume (CVE-2024-50278)
* kernel: filemap: Fix bounds checking in filemap_read() (CVE-2024-50272)
* kernel: drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() (CVE-2024-50282)
* kernel: sctp: properly validate chunk size in sctp_sf_ootb() (CVE-2024-50299)
* kernel: usb: dwc3: fix fault at system suspend if device was already runtime suspended (CVE-2024-53070)
* kernel: drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported (CVE-2024-53060)
* kernel: virtio_net: Add hash_key_length check (CVE-2024-53082)
* kernel: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow() (CVE-2024-53042)
* kernel: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (CVE-2024-53057)
* kernel: wifi: iwlwifi: mvm: fix 6 GHz scan construction (CVE-2024-53055)
* kernel: tpm: Lock TPM chip in tpm_pm_suspend() first (CVE-2024-53085)
* kernel: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (CVE-2024-50304)
* kernel: drm/i915/hdcp: Add encoder check in hdcp2_get_capability (CVE-2024-53050)
* kernel: drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability (CVE-2024-53051)
* kernel: mptcp: init: protect sched with rcu_read_lock (CVE-2024-53047)
* kernel: platform/x86/amd/pmc: Detect when STB is not available (CVE-2024-53072)
* kernel: wifi: iwlwifi: mvm: don't leak a link on AP removal (CVE-2024-53074)
* kernel: net/sched: sch_api: fix xa_insert() error path in tcf_block_get_ext() (CVE-2024-53044)
* kernel: wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() (CVE-2024-53059)
* kernel: smb: client: Fix use-after-free of network namespace. (CVE-2024-53095)
* kernel: nvme-multipath: defer partition scanning (CVE-2024-53093)
* kernel: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx (CVE-2024-53091)
* kernel: mm: resolve faulty mmap_region() error path behaviour (CVE-2024-53096)
* kernel: mm: krealloc: Fix MTE false alarm in __do_krealloc (CVE-2024-53097)
* kernel: hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer (CVE-2024-53103)
* kernel: vsock: Fix sk_error_queue memory leak (CVE-2024-53118)
* kernel: mptcp: error out earlier on disconnect (CVE-2024-53123)
* kernel: net: fix data-races around sk->sk_forward_alloc (CVE-2024-53124)
* kernel: mm: page_alloc: move mlocked flag clearance into free_pages_prepare() (CVE-2024-53105)
* kernel: net/mlx5e: CT: Fix null-ptr-deref in add rule err flow (CVE-2024-53120)
* kernel: virtio/vsock: Improve MSG_ZEROCOPY error handling (CVE-2024-53117)
* kernel: net/mlx5: fs, lock FTE when checking if active (CVE-2024-53121)
* kernel: vp_vdpa: fix id_table array not null terminated error (CVE-2024-53110)
* kernel: mm: revert mm: shmem: fix data-race in shmem_getattr() (CVE-2024-53136)
* kernel: pmdomain: imx93-blk-ctrl: correct remove path (CVE-2024-53134)
* kernel: initramfs: avoid filename buffer overrun (CVE-2024-53142)
* kernel: NFSD: Prevent a potential integer overflow (CVE-2024-53146)
* kernel: PCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert() (CVE-2024-53152)
* kernel: wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() (CVE-2024-53156)
* kernel: EDAC/bluefield: Fix potential integer overflow (CVE-2024-53161)
* kernel: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu (CVE-2024-53160)
* kernel: net: sched: fix ordering of qlen adjustment (CVE-2024-53164)
* kernel: PCI: Fix use-after-free of slot->bus on hot remove (CVE-2024-53194)
* kernel: zram: fix NULL pointer in comp_algorithm_show() (CVE-2024-53222)
* kernel: block, bfq: fix bfqq uaf in bfq_limit_depth() (CVE-2024-53166)
* kernel: Bluetooth: fix use-after-free in device_for_each_child() (CVE-2024-53237)
* kernel: net: usb: lan78xx: Fix double free issue with interrupt buffer allocation (CVE-2024-53213)
* kernel: Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (CVE-2024-53208)
* kernel: NFSv4.0: Fix a use-after-free problem in the asynchronous open() (CVE-2024-53173)
* kernel: RDMA/mlx5: Move events notifier registration to be after device registration (CVE-2024-53224)
* kernel: wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures (CVE-2024-53190)
* kernel: usb: typec: fix potential array underflow in ucsi_ccg_sync_control() (CVE-2024-53203)
* kernel: SUNRPC: make sure cache entry active before cache_show (CVE-2024-53174)
* kernel: Bluetooth: hci_conn: Use disable_delayed_work_sync (CVE-2024-56591)
* kernel: i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs() (CVE-2024-56562)
* kernel: mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM (CVE-2024-56611)
* kernel: wifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg() (CVE-2024-56535)
* kernel: net: inet6: do not leave a dangling sk pointer in inet6_create() (CVE-2024-56600)
* kernel: scsi: qla2xxx: Fix use after free on unload (CVE-2024-56623)
* kernel: mm/slub: Avoid list corruption when removing a slab from the full list (CVE-2024-56566)
* kernel: ovl: Filter invalid inodes with missing lookup function (CVE-2024-56570)
* kernel: net: inet: do not leave a dangling sk pointer in inet_create() (CVE-2024-56601)
* kernel: drm/amdgpu: fix usage slab after free (CVE-2024-56551)
* kernel: drm/dp_mst: Fix MST sideband message body length check (CVE-2024-56616)
* kernel: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (CVE-2024-56590)
* kernel: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() (CVE-2024-56604)
* kernel: net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (CVE-2024-56602)
* kernel: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (CVE-2024-56605)
* kernel: scsi: sg: Fix slab-use-after-free read in sg_release() (CVE-2024-56631)
* kernel: Bluetooth: btmtk: avoid UAF in btmtk_process_coredump (CVE-2024-56653)
* kernel: wifi: n ...
Please note that the description has been truncated due to length. Please refer to vendor advisory for the full description.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?a7e51e86
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2278283
https://bugzilla.redhat.com/show_bug.cgi?id=2280464
https://bugzilla.redhat.com/show_bug.cgi?id=2281340
https://bugzilla.redhat.com/show_bug.cgi?id=2281687
https://bugzilla.redhat.com/show_bug.cgi?id=2281827
https://bugzilla.redhat.com/show_bug.cgi?id=2281829
https://bugzilla.redhat.com/show_bug.cgi?id=2281879
https://bugzilla.redhat.com/show_bug.cgi?id=2281905
https://bugzilla.redhat.com/show_bug.cgi?id=2281907
https://bugzilla.redhat.com/show_bug.cgi?id=2281909
https://bugzilla.redhat.com/show_bug.cgi?id=2281912
https://bugzilla.redhat.com/show_bug.cgi?id=2281914
https://bugzilla.redhat.com/show_bug.cgi?id=2282952
https://bugzilla.redhat.com/show_bug.cgi?id=2282955
https://bugzilla.redhat.com/show_bug.cgi?id=2282959
https://bugzilla.redhat.com/show_bug.cgi?id=2284280
https://bugzilla.redhat.com/show_bug.cgi?id=2292324
https://bugzilla.redhat.com/show_bug.cgi?id=2293458
https://bugzilla.redhat.com/show_bug.cgi?id=2297472
https://bugzilla.redhat.com/show_bug.cgi?id=2297540
https://bugzilla.redhat.com/show_bug.cgi?id=2298411
https://bugzilla.redhat.com/show_bug.cgi?id=2300437
https://bugzilla.redhat.com/show_bug.cgi?id=2301498
https://bugzilla.redhat.com/show_bug.cgi?id=2307840
https://bugzilla.redhat.com/show_bug.cgi?id=2307862
https://bugzilla.redhat.com/show_bug.cgi?id=2307871
https://bugzilla.redhat.com/show_bug.cgi?id=2307883
https://bugzilla.redhat.com/show_bug.cgi?id=2307887
https://bugzilla.redhat.com/show_bug.cgi?id=2307888
https://bugzilla.redhat.com/show_bug.cgi?id=2307889
https://bugzilla.redhat.com/show_bug.cgi?id=2307891
https://bugzilla.redhat.com/show_bug.cgi?id=2309783
https://bugzilla.redhat.com/show_bug.cgi?id=2309789
https://bugzilla.redhat.com/show_bug.cgi?id=2309795
https://bugzilla.redhat.com/show_bug.cgi?id=2309838
https://bugzilla.redhat.com/show_bug.cgi?id=2309850
https://bugzilla.redhat.com/show_bug.cgi?id=2309852
https://bugzilla.redhat.com/show_bug.cgi?id=2309863
https://bugzilla.redhat.com/show_bug.cgi?id=2311706
https://bugzilla.redhat.com/show_bug.cgi?id=2311707
https://bugzilla.redhat.com/show_bug.cgi?id=2311713
https://bugzilla.redhat.com/show_bug.cgi?id=2311719
https://bugzilla.redhat.com/show_bug.cgi?id=2312061
https://bugzilla.redhat.com/show_bug.cgi?id=2312063
https://bugzilla.redhat.com/show_bug.cgi?id=2312108
https://bugzilla.redhat.com/show_bug.cgi?id=2313053
https://bugzilla.redhat.com/show_bug.cgi?id=2313054
https://bugzilla.redhat.com/show_bug.cgi?id=2313055
https://bugzilla.redhat.com/show_bug.cgi?id=2313056
https://bugzilla.redhat.com/show_bug.cgi?id=2313091
https://bugzilla.redhat.com/show_bug.cgi?id=2313093
https://bugzilla.redhat.com/show_bug.cgi?id=2313095
https://bugzilla.redhat.com/show_bug.cgi?id=2313098
https://bugzilla.redhat.com/show_bug.cgi?id=2313102
https://bugzilla.redhat.com/show_bug.cgi?id=2313104
https://bugzilla.redhat.com/show_bug.cgi?id=2313106
https://bugzilla.redhat.com/show_bug.cgi?id=2313107
https://bugzilla.redhat.com/show_bug.cgi?id=2313109
https://bugzilla.redhat.com/show_bug.cgi?id=2313131
https://bugzilla.redhat.com/show_bug.cgi?id=2313134
https://bugzilla.redhat.com/show_bug.cgi?id=2313135
https://bugzilla.redhat.com/show_bug.cgi?id=2313148
https://bugzilla.redhat.com/show_bug.cgi?id=2315156
https://bugzilla.redhat.com/show_bug.cgi?id=2315157
https://bugzilla.redhat.com/show_bug.cgi?id=2315158
https://bugzilla.redhat.com/show_bug.cgi?id=2315171
https://bugzilla.redhat.com/show_bug.cgi?id=2315172
https://bugzilla.redhat.com/show_bug.cgi?id=2315174
https://bugzilla.redhat.com/show_bug.cgi?id=2315180
https://bugzilla.redhat.com/show_bug.cgi?id=2315187
https://bugzilla.redhat.com/show_bug.cgi?id=2315191
https://bugzilla.redhat.com/show_bug.cgi?id=2315205
https://bugzilla.redhat.com/show_bug.cgi?id=2315216
https://bugzilla.redhat.com/show_bug.cgi?id=2317581
https://bugzilla.redhat.com/show_bug.cgi?id=2317584
https://bugzilla.redhat.com/show_bug.cgi?id=2317601
https://bugzilla.redhat.com/show_bug.cgi?id=2320168
https://bugzilla.redhat.com/show_bug.cgi?id=2320169
https://bugzilla.redhat.com/show_bug.cgi?id=2320173
https://bugzilla.redhat.com/show_bug.cgi?id=2320187
https://bugzilla.redhat.com/show_bug.cgi?id=2320200
https://bugzilla.redhat.com/show_bug.cgi?id=2320209
https://bugzilla.redhat.com/show_bug.cgi?id=2320210
https://bugzilla.redhat.com/show_bug.cgi?id=2320212
https://bugzilla.redhat.com/show_bug.cgi?id=2320213
https://bugzilla.redhat.com/show_bug.cgi?id=2320214
https://bugzilla.redhat.com/show_bug.cgi?id=2320220
https://bugzilla.redhat.com/show_bug.cgi?id=2320225
https://bugzilla.redhat.com/show_bug.cgi?id=2320235
https://bugzilla.redhat.com/show_bug.cgi?id=2320238
https://bugzilla.redhat.com/show_bug.cgi?id=2320239
https://bugzilla.redhat.com/show_bug.cgi?id=2320240
https://bugzilla.redhat.com/show_bug.cgi?id=2320242
https://bugzilla.redhat.com/show_bug.cgi?id=2320245
https://bugzilla.redhat.com/show_bug.cgi?id=2320246
https://bugzilla.redhat.com/show_bug.cgi?id=2320248
https://bugzilla.redhat.com/show_bug.cgi?id=2320249
https://bugzilla.redhat.com/show_bug.cgi?id=2320268
https://bugzilla.redhat.com/show_bug.cgi?id=2320274
https://bugzilla.redhat.com/show_bug.cgi?id=2320425
https://bugzilla.redhat.com/show_bug.cgi?id=2320432
https://bugzilla.redhat.com/show_bug.cgi?id=2320443
https://bugzilla.redhat.com/show_bug.cgi?id=2320454
https://bugzilla.redhat.com/show_bug.cgi?id=2320459
https://bugzilla.redhat.com/show_bug.cgi?id=2320462
https://bugzilla.redhat.com/show_bug.cgi?id=2320468
https://bugzilla.redhat.com/show_bug.cgi?id=2320471
https://bugzilla.redhat.com/show_bug.cgi?id=2320475
https://bugzilla.redhat.com/show_bug.cgi?id=2320480
https://bugzilla.redhat.com/show_bug.cgi?id=2320481
https://bugzilla.redhat.com/show_bug.cgi?id=2320484
https://bugzilla.redhat.com/show_bug.cgi?id=2320486
https://bugzilla.redhat.com/show_bug.cgi?id=2320488
https://bugzilla.redhat.com/show_bug.cgi?id=2320489
https://bugzilla.redhat.com/show_bug.cgi?id=2320497
https://bugzilla.redhat.com/show_bug.cgi?id=2320500
https://bugzilla.redhat.com/show_bug.cgi?id=2320501
https://bugzilla.redhat.com/show_bug.cgi?id=2320502
https://bugzilla.redhat.com/show_bug.cgi?id=2320503
https://bugzilla.redhat.com/show_bug.cgi?id=2320506
https://bugzilla.redhat.com/show_bug.cgi?id=2320509
https://bugzilla.redhat.com/show_bug.cgi?id=2320510
https://bugzilla.redhat.com/show_bug.cgi?id=2320515
https://bugzilla.redhat.com/show_bug.cgi?id=2320520
https://bugzilla.redhat.com/show_bug.cgi?id=2320527
https://bugzilla.redhat.com/show_bug.cgi?id=2320529
https://bugzilla.redhat.com/show_bug.cgi?id=2320531
https://bugzilla.redhat.com/show_bug.cgi?id=2320541
https://bugzilla.redhat.com/show_bug.cgi?id=2320543
https://bugzilla.redhat.com/show_bug.cgi?id=2320544
https://bugzilla.redhat.com/show_bug.cgi?id=2320546
https://bugzilla.redhat.com/show_bug.cgi?id=2320547
https://bugzilla.redhat.com/show_bug.cgi?id=2320549
https://bugzilla.redhat.com/show_bug.cgi?id=2320550
https://bugzilla.redhat.com/show_bug.cgi?id=2320552
https://bugzilla.redhat.com/show_bug.cgi?id=2320554
https://bugzilla.redhat.com/show_bug.cgi?id=2320556
https://bugzilla.redhat.com/show_bug.cgi?id=2320557
https://bugzilla.redhat.com/show_bug.cgi?id=2320559
https://bugzilla.redhat.com/show_bug.cgi?id=2320562
https://bugzilla.redhat.com/show_bug.cgi?id=2320563
https://bugzilla.redhat.com/show_bug.cgi?id=2320565
https://bugzilla.redhat.com/show_bug.cgi?id=2320570
https://bugzilla.redhat.com/show_bug.cgi?id=2320571
https://bugzilla.redhat.com/show_bug.cgi?id=2320572
https://bugzilla.redhat.com/show_bug.cgi?id=2320573
https://bugzilla.redhat.com/show_bug.cgi?id=2320574
https://bugzilla.redhat.com/show_bug.cgi?id=2320576
https://bugzilla.redhat.com/show_bug.cgi?id=2320577
https://bugzilla.redhat.com/show_bug.cgi?id=2320586
https://bugzilla.redhat.com/show_bug.cgi?id=2320587
https://bugzilla.redhat.com/show_bug.cgi?id=2320589
https://bugzilla.redhat.com/show_bug.cgi?id=2320590
https://bugzilla.redhat.com/show_bug.cgi?id=2320594
https://bugzilla.redhat.com/show_bug.cgi?id=2320596
https://bugzilla.redhat.com/show_bug.cgi?id=2320598
https://bugzilla.redhat.com/show_bug.cgi?id=2320601
https://bugzilla.redhat.com/show_bug.cgi?id=2320602
https://bugzilla.redhat.com/show_bug.cgi?id=2320610
https://bugzilla.redhat.com/show_bug.cgi?id=2320611
https://bugzilla.redhat.com/show_bug.cgi?id=2320612
https://bugzilla.redhat.com/show_bug.cgi?id=2320615
https://bugzilla.redhat.com/show_bug.cgi?id=2320620
https://bugzilla.redhat.com/show_bug.cgi?id=2320625
https://bugzilla.redhat.com/show_bug.cgi?id=2320629
https://bugzilla.redhat.com/show_bug.cgi?id=2320635
https://bugzilla.redhat.com/show_bug.cgi?id=2320636
https://bugzilla.redhat.com/show_bug.cgi?id=2320658
https://bugzilla.redhat.com/show_bug.cgi?id=2320670
https://bugzilla.redhat.com/show_bug.cgi?id=2320693
https://bugzilla.redhat.com/show_bug.cgi?id=2320707
https://bugzilla.redhat.com/show_bug.cgi?id=2320781
https://bugzilla.redhat.com/show_bug.cgi?id=2322072
https://bugzilla.redhat.com/show_bug.cgi?id=2322303
https://bugzilla.redhat.com/show_bug.cgi?id=2322308
https://bugzilla.redhat.com/show_bug.cgi?id=2322310
https://bugzilla.redhat.com/show_bug.cgi?id=2322312
https://bugzilla.redhat.com/show_bug.cgi?id=2322316
https://bugzilla.redhat.com/show_bug.cgi?id=2322320
https://bugzilla.redhat.com/show_bug.cgi?id=2322323
https://bugzilla.redhat.com/show_bug.cgi?id=2323905
https://bugzilla.redhat.com/show_bug.cgi?id=2323909
https://bugzilla.redhat.com/show_bug.cgi?id=2323918
https://bugzilla.redhat.com/show_bug.cgi?id=2323924
https://bugzilla.redhat.com/show_bug.cgi?id=2323927
https://bugzilla.redhat.com/show_bug.cgi?id=2323929
https://bugzilla.redhat.com/show_bug.cgi?id=2323932
https://bugzilla.redhat.com/show_bug.cgi?id=2323933
https://bugzilla.redhat.com/show_bug.cgi?id=2323938
https://bugzilla.redhat.com/show_bug.cgi?id=2323945
https://bugzilla.redhat.com/show_bug.cgi?id=2323947
https://bugzilla.redhat.com/show_bug.cgi?id=2323950
https://bugzilla.redhat.com/show_bug.cgi?id=2323953
https://bugzilla.redhat.com/show_bug.cgi?id=2324317
https://bugzilla.redhat.com/show_bug.cgi?id=2324320
https://bugzilla.redhat.com/show_bug.cgi?id=2324321
https://bugzilla.redhat.com/show_bug.cgi?id=2324324
https://bugzilla.redhat.com/show_bug.cgi?id=2324325
https://bugzilla.redhat.com/show_bug.cgi?id=2324410
https://bugzilla.redhat.com/show_bug.cgi?id=2324413
https://bugzilla.redhat.com/show_bug.cgi?id=2324419
https://bugzilla.redhat.com/show_bug.cgi?id=2324423
https://bugzilla.redhat.com/show_bug.cgi?id=2324548
https://bugzilla.redhat.com/show_bug.cgi?id=2324566
https://bugzilla.redhat.com/show_bug.cgi?id=2324578
https://bugzilla.redhat.com/show_bug.cgi?id=2324599
https://bugzilla.redhat.com/show_bug.cgi?id=2324610
https://bugzilla.redhat.com/show_bug.cgi?id=2324617
https://bugzilla.redhat.com/show_bug.cgi?id=2324645
https://bugzilla.redhat.com/show_bug.cgi?id=2324650
https://bugzilla.redhat.com/show_bug.cgi?id=2324853
https://bugzilla.redhat.com/show_bug.cgi?id=2324865
https://bugzilla.redhat.com/show_bug.cgi?id=2324869
https://bugzilla.redhat.com/show_bug.cgi?id=2324874
https://bugzilla.redhat.com/show_bug.cgi?id=2324875
https://bugzilla.redhat.com/show_bug.cgi?id=2324889
https://bugzilla.redhat.com/show_bug.cgi?id=2324897
https://bugzilla.redhat.com/show_bug.cgi?id=2324899
https://bugzilla.redhat.com/show_bug.cgi?id=2324901
https://bugzilla.redhat.com/show_bug.cgi?id=2327174
https://bugzilla.redhat.com/show_bug.cgi?id=2327182
https://bugzilla.redhat.com/show_bug.cgi?id=2327189
https://bugzilla.redhat.com/show_bug.cgi?id=2327190
https://bugzilla.redhat.com/show_bug.cgi?id=2327194
https://bugzilla.redhat.com/show_bug.cgi?id=2327332
https://bugzilla.redhat.com/show_bug.cgi?id=2327335
https://bugzilla.redhat.com/show_bug.cgi?id=2327338
https://bugzilla.redhat.com/show_bug.cgi?id=2327343
https://bugzilla.redhat.com/show_bug.cgi?id=2327344
https://bugzilla.redhat.com/show_bug.cgi?id=2327349
https://bugzilla.redhat.com/show_bug.cgi?id=2327358
https://bugzilla.redhat.com/show_bug.cgi?id=2327361
https://bugzilla.redhat.com/show_bug.cgi?id=2327362
https://bugzilla.redhat.com/show_bug.cgi?id=2327365
https://bugzilla.redhat.com/show_bug.cgi?id=2327369
https://bugzilla.redhat.com/show_bug.cgi?id=2327370
https://bugzilla.redhat.com/show_bug.cgi?id=2327373
https://bugzilla.redhat.com/show_bug.cgi?id=2327381
https://bugzilla.redhat.com/show_bug.cgi?id=2327383
https://bugzilla.redhat.com/show_bug.cgi?id=2327888
https://bugzilla.redhat.com/show_bug.cgi?id=2327890
https://bugzilla.redhat.com/show_bug.cgi?id=2327893
https://bugzilla.redhat.com/show_bug.cgi?id=2328791
https://bugzilla.redhat.com/show_bug.cgi?id=2328792
https://bugzilla.redhat.com/show_bug.cgi?id=2329818
https://bugzilla.redhat.com/show_bug.cgi?id=2329919
https://bugzilla.redhat.com/show_bug.cgi?id=2329927
https://bugzilla.redhat.com/show_bug.cgi?id=2329928
https://bugzilla.redhat.com/show_bug.cgi?id=2329929
https://bugzilla.redhat.com/show_bug.cgi?id=2329930
https://bugzilla.redhat.com/show_bug.cgi?id=2329935
https://bugzilla.redhat.com/show_bug.cgi?id=2329936
https://bugzilla.redhat.com/show_bug.cgi?id=2329937
https://bugzilla.redhat.com/show_bug.cgi?id=2330346
https://bugzilla.redhat.com/show_bug.cgi?id=2330357
https://bugzilla.redhat.com/show_bug.cgi?id=2330765
https://bugzilla.redhat.com/show_bug.cgi?id=2333973
https://bugzilla.redhat.com/show_bug.cgi?id=2333974
https://bugzilla.redhat.com/show_bug.cgi?id=2333976
https://bugzilla.redhat.com/show_bug.cgi?id=2333977
https://bugzilla.redhat.com/show_bug.cgi?id=2333982
https://bugzilla.redhat.com/show_bug.cgi?id=2334350
https://bugzilla.redhat.com/show_bug.cgi?id=2334367
https://bugzilla.redhat.com/show_bug.cgi?id=2334373
https://bugzilla.redhat.com/show_bug.cgi?id=2334384
https://bugzilla.redhat.com/show_bug.cgi?id=2334386
https://bugzilla.redhat.com/show_bug.cgi?id=2334388
https://bugzilla.redhat.com/show_bug.cgi?id=2334392
https://bugzilla.redhat.com/show_bug.cgi?id=2334398
https://bugzilla.redhat.com/show_bug.cgi?id=2334399
https://bugzilla.redhat.com/show_bug.cgi?id=2334408
https://bugzilla.redhat.com/show_bug.cgi?id=2334409
https://bugzilla.redhat.com/show_bug.cgi?id=2334419
https://bugzilla.redhat.com/show_bug.cgi?id=2334426
https://bugzilla.redhat.com/show_bug.cgi?id=2334430
https://bugzilla.redhat.com/show_bug.cgi?id=2334432
https://bugzilla.redhat.com/show_bug.cgi?id=2334441
https://bugzilla.redhat.com/show_bug.cgi?id=2334458
https://bugzilla.redhat.com/show_bug.cgi?id=2334461
https://bugzilla.redhat.com/show_bug.cgi?id=2334463
https://bugzilla.redhat.com/show_bug.cgi?id=2334469
https://bugzilla.redhat.com/show_bug.cgi?id=2334472
https://bugzilla.redhat.com/show_bug.cgi?id=2334479
https://bugzilla.redhat.com/show_bug.cgi?id=2334483
https://bugzilla.redhat.com/show_bug.cgi?id=2334486
https://bugzilla.redhat.com/show_bug.cgi?id=2334495
https://bugzilla.redhat.com/show_bug.cgi?id=2334501
https://bugzilla.redhat.com/show_bug.cgi?id=2334503
https://bugzilla.redhat.com/show_bug.cgi?id=2334528
https://bugzilla.redhat.com/show_bug.cgi?id=2334538
https://bugzilla.redhat.com/show_bug.cgi?id=2334539
https://bugzilla.redhat.com/show_bug.cgi?id=2334542
https://bugzilla.redhat.com/show_bug.cgi?id=2334551
https://bugzilla.redhat.com/show_bug.cgi?id=2334561
https://bugzilla.redhat.com/show_bug.cgi?id=2334562
https://bugzilla.redhat.com/show_bug.cgi?id=2334563
https://bugzilla.redhat.com/show_bug.cgi?id=2334573
https://bugzilla.redhat.com/show_bug.cgi?id=2334575
https://bugzilla.redhat.com/show_bug.cgi?id=2334577
https://bugzilla.redhat.com/show_bug.cgi?id=2334667
https://bugzilla.redhat.com/show_bug.cgi?id=2334683
https://bugzilla.redhat.com/show_bug.cgi?id=2334809
https://bugzilla.redhat.com/show_bug.cgi?id=2335899
https://bugzilla.redhat.com/show_bug.cgi?id=2335906
https://bugzilla.redhat.com/show_bug.cgi?id=2336546
https://bugzilla.redhat.com/show_bug.cgi?id=2336550
https://bugzilla.redhat.com/show_bug.cgi?id=2337104
https://bugzilla.redhat.com/show_bug.cgi?id=2337113
https://bugzilla.redhat.com/show_bug.cgi?id=2337117
https://bugzilla.redhat.com/show_bug.cgi?id=2337118
https://bugzilla.redhat.com/show_bug.cgi?id=2337136
https://bugzilla.redhat.com/show_bug.cgi?id=2337148
https://bugzilla.redhat.com/show_bug.cgi?id=2337152
https://bugzilla.redhat.com/show_bug.cgi?id=2337328
https://bugzilla.redhat.com/show_bug.cgi?id=2337333
https://bugzilla.redhat.com/show_bug.cgi?id=2338195
https://bugzilla.redhat.com/show_bug.cgi?id=2338197
https://bugzilla.redhat.com/show_bug.cgi?id=2338199
https://bugzilla.redhat.com/show_bug.cgi?id=2338204
https://bugzilla.redhat.com/show_bug.cgi?id=2338208
https://bugzilla.redhat.com/show_bug.cgi?id=2338214
https://bugzilla.redhat.com/show_bug.cgi?id=2338830
https://bugzilla.redhat.com/show_bug.cgi?id=2338858
https://bugzilla.redhat.com/show_bug.cgi?id=2339126
https://bugzilla.redhat.com/show_bug.cgi?id=2339140
https://bugzilla.redhat.com/show_bug.cgi?id=2339143
https://bugzilla.redhat.com/show_bug.cgi?id=2343169
https://bugzilla.redhat.com/show_bug.cgi?id=2343173
https://bugzilla.redhat.com/show_bug.cgi?id=2343183
https://bugzilla.redhat.com/show_bug.cgi?id=2344683
https://bugzilla.redhat.com/show_bug.cgi?id=2345243
https://bugzilla.redhat.com/show_bug.cgi?id=2345615
https://bugzilla.redhat.com/show_bug.cgi?id=2362882
https://issues.redhat.com/browse/RHEL-12439
https://issues.redhat.com/browse/RHEL-28791
https://issues.redhat.com/browse/RHEL-58641
https://issues.redhat.com/browse/RHEL-60028
https://issues.redhat.com/browse/RHEL-61203
https://issues.redhat.com/browse/RHEL-62339
https://issues.redhat.com/browse/RHEL-67304
https://issues.redhat.com/browse/RHEL-71541
https://issues.redhat.com/browse/RHEL-8810
https://issues.redhat.com/browse/RHEL-9279
http://www.nessus.org/u?cd874625
https://access.redhat.com/errata/RHSA-2025:6966

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:6966.
Risk Factor
High
CVSS v3.0 Base Score
9.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
8.2 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
9.2
EPSS Score
0.0578
CVSS v2.0 Base Score
9.4 (CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-48969
CVE | CVE-2022-48989
CVE | CVE-2022-49006
CVE | CVE-2022-49014
CVE | CVE-2022-49029
CVE | CVE-2022-49778
CVE | CVE-2022-49804
CVE | CVE-2022-49815
CVE | CVE-2022-50112
CVE | CVE-2022-50159
CVE | CVE-2023-52672
CVE | CVE-2023-53066
CVE | CVE-2023-53117
CVE | CVE-2024-27008
CVE | CVE-2024-27398
CVE | CVE-2024-35891
CVE | CVE-2024-35933
CVE | CVE-2024-35934
CVE | CVE-2024-35963
CVE | CVE-2024-35964
CVE | CVE-2024-35965
CVE | CVE-2024-35966
CVE | CVE-2024-35967
CVE | CVE-2024-35978
CVE | CVE-2024-36011
CVE | CVE-2024-36012
CVE | CVE-2024-36013
CVE | CVE-2024-36880
CVE | CVE-2024-36968
CVE | CVE-2024-38541
CVE | CVE-2024-39500
CVE | CVE-2024-40956
CVE | CVE-2024-41010
CVE | CVE-2024-41062
CVE | CVE-2024-42094
CVE | CVE-2024-42133
CVE | CVE-2024-42253
CVE | CVE-2024-42265
CVE | CVE-2024-42278
CVE | CVE-2024-42291
CVE | CVE-2024-42294
CVE | CVE-2024-42302
CVE | CVE-2024-42304
CVE | CVE-2024-42305
CVE | CVE-2024-42312
CVE | CVE-2024-42315
CVE | CVE-2024-42316
CVE | CVE-2024-42321
CVE | CVE-2024-43820
CVE | CVE-2024-43821
CVE | CVE-2024-43823
CVE | CVE-2024-43828
CVE | CVE-2024-43834
CVE | CVE-2024-43846
CVE | CVE-2024-43853
CVE | CVE-2024-43871
CVE | CVE-2024-43873
CVE | CVE-2024-43882
CVE | CVE-2024-43884
CVE | CVE-2024-43889
CVE | CVE-2024-43910
CVE | CVE-2024-43914
CVE | CVE-2024-44931
CVE | CVE-2024-44932
CVE | CVE-2024-44934
CVE | CVE-2024-44958
CVE | CVE-2024-44964
CVE | CVE-2024-44975
CVE | CVE-2024-44987
CVE | CVE-2024-44989
CVE | CVE-2024-45000
CVE | CVE-2024-45009
CVE | CVE-2024-45010
CVE | CVE-2024-45016
CVE | CVE-2024-45022
CVE | CVE-2024-46673
CVE | CVE-2024-46675
CVE | CVE-2024-46711
CVE | CVE-2024-46722
CVE | CVE-2024-46723
CVE | CVE-2024-46724
CVE | CVE-2024-46725
CVE | CVE-2024-46743
CVE | CVE-2024-46745
CVE | CVE-2024-46747
CVE | CVE-2024-46750
CVE | CVE-2024-46754
CVE | CVE-2024-46759
CVE | CVE-2024-46761
CVE | CVE-2024-46783
CVE | CVE-2024-46786
CVE | CVE-2024-46787
CVE | CVE-2024-46800
CVE | CVE-2024-46805
CVE | CVE-2024-46806
CVE | CVE-2024-46807
CVE | CVE-2024-46819
CVE | CVE-2024-46820
CVE | CVE-2024-46822
CVE | CVE-2024-46828
CVE | CVE-2024-46835
CVE | CVE-2024-46853
CVE | CVE-2024-46864
CVE | CVE-2024-46871
CVE | CVE-2024-47141
CVE | CVE-2024-47660
CVE | CVE-2024-47668
CVE | CVE-2024-47678
CVE | CVE-2024-47685
CVE | CVE-2024-47687
CVE | CVE-2024-47692
CVE | CVE-2024-47700
CVE | CVE-2024-47703
CVE | CVE-2024-47705
CVE | CVE-2024-47706
CVE | CVE-2024-47710
CVE | CVE-2024-47713
CVE | CVE-2024-47715
CVE | CVE-2024-47718
CVE | CVE-2024-47719
CVE | CVE-2024-47737
CVE | CVE-2024-47738
CVE | CVE-2024-47739
CVE | CVE-2024-47745
CVE | CVE-2024-47748
CVE | CVE-2024-48873
CVE | CVE-2024-49569
CVE | CVE-2024-49851
CVE | CVE-2024-49856
CVE | CVE-2024-49860
CVE | CVE-2024-49862
CVE | CVE-2024-49870
CVE | CVE-2024-49875
CVE | CVE-2024-49878
CVE | CVE-2024-49881
CVE | CVE-2024-49882
CVE | CVE-2024-49883
CVE | CVE-2024-49884
CVE | CVE-2024-49885
CVE | CVE-2024-49886
CVE | CVE-2024-49889
CVE | CVE-2024-49904
CVE | CVE-2024-49927
CVE | CVE-2024-49928
CVE | CVE-2024-49929
CVE | CVE-2024-49930
CVE | CVE-2024-49933
CVE | CVE-2024-49934
CVE | CVE-2024-49935
CVE | CVE-2024-49937
CVE | CVE-2024-49938
CVE | CVE-2024-49939
CVE | CVE-2024-49946
CVE | CVE-2024-49948
CVE | CVE-2024-49950
CVE | CVE-2024-49951
CVE | CVE-2024-49954
CVE | CVE-2024-49959
CVE | CVE-2024-49960
CVE | CVE-2024-49962
CVE | CVE-2024-49968
CVE | CVE-2024-49971
CVE | CVE-2024-49973
CVE | CVE-2024-49974
CVE | CVE-2024-49975
CVE | CVE-2024-49977
CVE | CVE-2024-49983
CVE | CVE-2024-49991
CVE | CVE-2024-49994
CVE | CVE-2024-49999
CVE | CVE-2024-50002
CVE | CVE-2024-50006
CVE | CVE-2024-50008
CVE | CVE-2024-50009
CVE | CVE-2024-50013
CVE | CVE-2024-50014
CVE | CVE-2024-50015
CVE | CVE-2024-50019
CVE | CVE-2024-50022
CVE | CVE-2024-50023
CVE | CVE-2024-50024
CVE | CVE-2024-50027
CVE | CVE-2024-50028
CVE | CVE-2024-50029
CVE | CVE-2024-50033
CVE | CVE-2024-50035
CVE | CVE-2024-50038
CVE | CVE-2024-50039
CVE | CVE-2024-50044
CVE | CVE-2024-50046
CVE | CVE-2024-50047
CVE | CVE-2024-50055
CVE | CVE-2024-50057
CVE | CVE-2024-50058
CVE | CVE-2024-50064
CVE | CVE-2024-50067
CVE | CVE-2024-50073
CVE | CVE-2024-50074
CVE | CVE-2024-50075
CVE | CVE-2024-50077
CVE | CVE-2024-50078
CVE | CVE-2024-50081
CVE | CVE-2024-50082
CVE | CVE-2024-50093
CVE | CVE-2024-50101
CVE | CVE-2024-50102
CVE | CVE-2024-50106
CVE | CVE-2024-50107
CVE | CVE-2024-50109
CVE | CVE-2024-50117
CVE | CVE-2024-50120
CVE | CVE-2024-50121
CVE | CVE-2024-50126
CVE | CVE-2024-50127
CVE | CVE-2024-50128
CVE | CVE-2024-50130
CVE | CVE-2024-50141
CVE | CVE-2024-50143
CVE | CVE-2024-50150
CVE | CVE-2024-50151
CVE | CVE-2024-50152
CVE | CVE-2024-50153
CVE | CVE-2024-50162
CVE | CVE-2024-50163
CVE | CVE-2024-50169
CVE | CVE-2024-50182
CVE | CVE-2024-50186
CVE | CVE-2024-50189
CVE | CVE-2024-50191
CVE | CVE-2024-50197
CVE | CVE-2024-50199
CVE | CVE-2024-50200
CVE | CVE-2024-50201
CVE | CVE-2024-50215
CVE | CVE-2024-50216
CVE | CVE-2024-50235
CVE | CVE-2024-50236
CVE | CVE-2024-50237
CVE | CVE-2024-50256
CVE | CVE-2024-50261
CVE | CVE-2024-50271
CVE | CVE-2024-50272
CVE | CVE-2024-50278
CVE | CVE-2024-50282
CVE | CVE-2024-50299
CVE | CVE-2024-50304
CVE | CVE-2024-53042
CVE | CVE-2024-53044
CVE | CVE-2024-53047
CVE | CVE-2024-53050
CVE | CVE-2024-53051
CVE | CVE-2024-53055
CVE | CVE-2024-53057
CVE | CVE-2024-53059
CVE | CVE-2024-53060
CVE | CVE-2024-53070
CVE | CVE-2024-53072
CVE | CVE-2024-53074
CVE | CVE-2024-53082
CVE | CVE-2024-53085
CVE | CVE-2024-53091
CVE | CVE-2024-53093
CVE | CVE-2024-53095
CVE | CVE-2024-53096
CVE | CVE-2024-53097
CVE | CVE-2024-53103
CVE | CVE-2024-53105
CVE | CVE-2024-53110
CVE | CVE-2024-53117
CVE | CVE-2024-53118
CVE | CVE-2024-53120
CVE | CVE-2024-53121
CVE | CVE-2024-53123
CVE | CVE-2024-53124
CVE | CVE-2024-53134
CVE | CVE-2024-53136
CVE | CVE-2024-53141
CVE | CVE-2024-53142
CVE | CVE-2024-53146
CVE | CVE-2024-53152
CVE | CVE-2024-53156
CVE | CVE-2024-53160
CVE | CVE-2024-53161
CVE | CVE-2024-53164
CVE | CVE-2024-53166
CVE | CVE-2024-53173
CVE | CVE-2024-53174
CVE | CVE-2024-53190
CVE | CVE-2024-53194
CVE | CVE-2024-53203
CVE | CVE-2024-53208
CVE | CVE-2024-53213
CVE | CVE-2024-53222
CVE | CVE-2024-53224
CVE | CVE-2024-53232
CVE | CVE-2024-53237
CVE | CVE-2024-53681
CVE | CVE-2024-54460
CVE | CVE-2024-56535
CVE | CVE-2024-56544
CVE | CVE-2024-56551
CVE | CVE-2024-56558
CVE | CVE-2024-56562
CVE | CVE-2024-56566
CVE | CVE-2024-56570
CVE | CVE-2024-56590
CVE | CVE-2024-56591
CVE | CVE-2024-56600
CVE | CVE-2024-56601
CVE | CVE-2024-56602
CVE | CVE-2024-56604
CVE | CVE-2024-56605
CVE | CVE-2024-56611
CVE | CVE-2024-56614
CVE | CVE-2024-56616
CVE | CVE-2024-56623
CVE | CVE-2024-56631
CVE | CVE-2024-56642
CVE | CVE-2024-56644
CVE | CVE-2024-56647
CVE | CVE-2024-56653
CVE | CVE-2024-56654
CVE | CVE-2024-56663
CVE | CVE-2024-56664
CVE | CVE-2024-56667
CVE | CVE-2024-56688
CVE | CVE-2024-56693
CVE | CVE-2024-56729
CVE | CVE-2024-56757
CVE | CVE-2024-56760
CVE | CVE-2024-56779
CVE | CVE-2024-56783
CVE | CVE-2024-57798
CVE | CVE-2024-57809
CVE | CVE-2024-57843
CVE | CVE-2024-57852
CVE | CVE-2024-57879
CVE | CVE-2024-57884
CVE | CVE-2024-57885
CVE | CVE-2024-57888
CVE | CVE-2024-57890
CVE | CVE-2024-57898
CVE | CVE-2024-57903
CVE | CVE-2024-57929
CVE | CVE-2024-57931
CVE | CVE-2024-57940
CVE | CVE-2024-58009
CVE | CVE-2024-58064
CVE | CVE-2024-58099
CVE | CVE-2025-1272
CVE | CVE-2025-21646
CVE | CVE-2025-21663
CVE | CVE-2025-21666
CVE | CVE-2025-21668
CVE | CVE-2025-21669
CVE | CVE-2025-21689
CVE | CVE-2025-21694
CVE | CVE-2025-22087
XREF | RHSA:2025:6966
XREF | CWE:20
XREF | CWE:99
XREF | CWE:119
XREF | CWE:120
XREF | CWE:121
XREF | CWE:122
XREF | CWE:125
XREF | CWE:126
XREF | CWE:129
XREF | CWE:131
XREF | CWE:170
XREF | CWE:190
XREF | CWE:191
XREF | CWE:193
XREF | CWE:200
XREF | CWE:203
XREF | CWE:212
XREF | CWE:248
XREF | CWE:253
XREF | CWE:266
XREF | CWE:354
XREF | CWE:362
XREF | CWE:364
XREF | CWE:369
XREF | CWE:385
XREF | CWE:400
XREF | CWE:401
XREF | CWE:402
XREF | CWE:404
XREF | CWE:413
XREF | CWE:415
XREF | CWE:416
XREF | CWE:457
XREF | CWE:459
XREF | CWE:460
XREF | CWE:470
XREF | CWE:476
XREF | CWE:617
XREF | CWE:662
XREF | CWE:664
XREF | CWE:665
XREF | CWE:666
XREF | CWE:667
XREF | CWE:670
XREF | CWE:672
XREF | CWE:681
XREF | CWE:682
XREF | CWE:691
XREF | CWE:693
XREF | CWE:703
XREF | CWE:754
XREF | CWE:755
XREF | CWE:763
XREF | CWE:764
XREF | CWE:770
XREF | CWE:772
XREF | CWE:787
XREF | CWE:823
XREF | CWE:824
XREF | CWE:825
XREF | CWE:833
XREF | CWE:835
XREF | CWE:839
XREF | CWE:843
XREF | CWE:908
XREF | CWE:1050
XREF | CWE:1214

Plugin Information
Published: 2025/05/27, Modified: 2025/10/28
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.12.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.12.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.12.1.el9_6
Remote package installed : kernel-headers-5.14.0-503.11.1.el9_5
Should be : kernel-headers-5.14.0-570.12.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.12.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.12.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.12.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.12.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.12.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
210820 - RHEL 9 : krb5 (RHSA-2024:9474)
-
Synopsis
The remote Red Hat host is missing a security update for krb5.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:9474 advisory.
Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).
Security Fix(es):
* freeradius: forgery attack (CVE-2024-3596)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2263240
http://www.nessus.org/u?1389d31d
https://access.redhat.com/errata/RHSA-2024:9474

Solution
Update the RHEL krb5 package based on the guidance in RHSA-2024:9474.
Risk Factor
High
CVSS v4.0 Base Score
9.2 (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
9.0 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
7.3
EPSS Score
0.2241
CVSS v2.0 Base Score
7.6 (CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-3596
XREF | RHSA:2024:9474
XREF | CWE:924

Plugin Information
Published: 2024/11/12, Modified: 2025/01/06
Plugin Output

## tcp/0

Remote package installed : krb5-libs-1.21.1-3.el9
Should be : krb5-libs-1.21.1-4.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
252954 - RHEL 9 : libarchive (RHSA-2025:14130)
-
Synopsis
The remote Red Hat host is missing a security update for libarchive.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:14130 advisory.
The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.
Security Fix(es):
* libarchive: Double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c (CVE-2025-5914)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2370861
http://www.nessus.org/u?759347a1
https://access.redhat.com/errata/RHSA-2025:14130

Solution
Update the RHEL libarchive package based on the guidance in RHSA-2025:14130.
Risk Factor
Medium
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.8 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-5914
XREF | RHSA:2025:14130
XREF | CWE:415

Plugin Information
Published: 2025/08/20, Modified: 2025/08/20
Plugin Output

## tcp/0

Remote package installed : libarchive-3.5.3-4.el9
Should be : libarchive-3.5.3-6.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237336 - RHEL 9 : libsoup (RHSA-2025:7436)
-
Synopsis
The remote Red Hat host is missing one or more security updates for libsoup.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7436 advisory.
The libsoup packages provide an HTTP client and server library for GNOME.
Security Fix(es):
* libsoup: Integer overflow in append_param_quoted (CVE-2025-32050)
* libsoup: Heap buffer overflow in sniff_unknown() (CVE-2025-32052)
* libsoup: Heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space() (CVE-2025-32053)
* libsoup: Out of bounds reads in soup_headers_parse_request() (CVE-2025-32906)
* libsoup: Denial of service in server when client requests a large amount of overlapping ranges with Range header (CVE-2025-32907)
* libsoup: Double free on soup_message_headers_get_content_disposition() through soup-message- headers.c via params GHashTable value (CVE-2025-32911)
* libsoup: NULL pointer dereference in soup_message_headers_get_content_disposition when filename parameter is present, but has no value in Content-Disposition header (CVE-2025-32913)
* libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server (CVE-2025-46421)
* libsoup: Memory leak on soup_header_parse_quality_list() via soup-headers.c (CVE-2025-46420)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2357067
https://bugzilla.redhat.com/show_bug.cgi?id=2357069
https://bugzilla.redhat.com/show_bug.cgi?id=2357070
https://bugzilla.redhat.com/show_bug.cgi?id=2359341
https://bugzilla.redhat.com/show_bug.cgi?id=2359342
https://bugzilla.redhat.com/show_bug.cgi?id=2359355
https://bugzilla.redhat.com/show_bug.cgi?id=2359357
https://bugzilla.redhat.com/show_bug.cgi?id=2361962
https://bugzilla.redhat.com/show_bug.cgi?id=2361963
http://www.nessus.org/u?3aeda2e9
https://access.redhat.com/errata/RHSA-2025:7436

Solution
Update the RHEL libsoup package based on the guidance in RHSA-2025:7436.
Risk Factor
High
CVSS v3.0 Base Score
9.0 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
8.1
EPSS Score
0.0039
CVSS v2.0 Base Score
8.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
6.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-32050
CVE | CVE-2025-32052
CVE | CVE-2025-32053
CVE | CVE-2025-32906
CVE | CVE-2025-32907
CVE | CVE-2025-32911
CVE | CVE-2025-32913
CVE | CVE-2025-46420
CVE | CVE-2025-46421
XREF | RHSA:2025:7436
XREF | CWE:125
XREF | CWE:126
XREF | CWE:127
XREF | CWE:401
XREF | CWE:476
XREF | CWE:497
XREF | CWE:590
XREF | CWE:1050

Plugin Information
Published: 2025/05/27, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : libsoup-2.72.0-8.el9
Should be : libsoup-2.72.0-10.el9_6.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
211767 - RHEL 9 : libvpx (RHSA-2024:9827)
-
Synopsis
The remote Red Hat host is missing a security update for libvpx.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:9827 advisory.
The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.
Security Fix(es):
* libvpx: Integer overflow in vpx_img_alloc() (CVE-2024-5197)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2291198
http://www.nessus.org/u?de1c34fb
https://access.redhat.com/errata/RHSA-2024:9827

Solution
Update the RHEL libvpx package based on the guidance in RHSA-2024:9827.
Risk Factor
High
CVSS v4.0 Base Score
5.9 (CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:L/SA:N)
CVSS v3.0 Base Score
9.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
8.2 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0013
CVSS v2.0 Base Score
9.4 (CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-5197
XREF | RHSA:2024:9827
XREF | CWE:190

Plugin Information
Published: 2024/11/24, Modified: 2025/07/23
Plugin Output

## tcp/0

Remote package installed : libvpx-1.9.0-7.el9_2
Should be : libvpx-1.9.0-8.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
241658 - RHEL 9 : libxml2 (RHSA-2025:10699)
-
Synopsis
The remote Red Hat host is missing one or more security updates for libxml2.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10699 advisory.
The libxml2 library is a development toolbox providing the implementation of various XML standards.
Security Fix(es):
* libxml: Heap use after free (UAF) leads to Denial of service (DoS) (CVE-2025-49794)
* libxml: Type confusion leads to Denial of service (DoS) (CVE-2025-49796)
* libxml2: Integer Overflow in xmlBuildQName() Leads to Stack Buffer Overflow in libxml2 (CVE-2025-6021)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2372373
https://bugzilla.redhat.com/show_bug.cgi?id=2372385
https://bugzilla.redhat.com/show_bug.cgi?id=2372406
http://www.nessus.org/u?9726c751
https://access.redhat.com/errata/RHSA-2025:10699

Solution
Update the RHEL libxml2 package based on the guidance in RHSA-2025:10699.
Risk Factor
High
CVSS v3.0 Base Score
9.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
7.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0005
CVSS v2.0 Base Score
9.4 (CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
7.0 (CVSS2#E:U/RL:OF/RC:C)
STIG Severity
I
References

CVE | CVE-2025-6021
CVE | CVE-2025-49794
CVE | CVE-2025-49796
XREF | RHSA:2025:10699
XREF | IAVA:2025-A-0707
XREF | CWE:121
XREF | CWE:125
XREF | CWE:825

Plugin Information
Published: 2025/07/09, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : libxml2-2.9.13-6.el9_4
Should be : libxml2-2.9.13-10.el9_6
Remote package installed : libxml2-devel-2.9.13-6.el9_4
Should be : libxml2-devel-2.9.13-10.el9_6
Remote package installed : python3-libxml2-2.9.13-6.el9_4
Should be : python3-libxml2-2.9.13-10.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
216473 - RHEL 9 : mysql (RHSA-2025:1671)
-
Synopsis
The remote Red Hat host is missing one or more security updates for mysql.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:1671 advisory.
MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.
Security Fix(es):
* openssl: SSL_select_next_proto buffer overread (CVE-2024-5535)
* krb5: GSS message token handling (CVE-2024-37371)
* curl: libcurl: ASN.1 date parser overread (CVE-2024-7264)
* mysql: Thread Pooling unspecified vulnerability (CPU Oct 2024) (CVE-2024-21238)
* mysql: X Plugin unspecified vulnerability (CPU Oct 2024) (CVE-2024-21196)
* mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21241)
* mysql: Client programs unspecified vulnerability (CPU Oct 2024) (CVE-2024-21231)
* mysql: Information Schema unspecified vulnerability (CPU Oct 2024) (CVE-2024-21197)
* mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21218)
* mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21201)
* mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21236)
* mysql: Group Replication GCS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21237)
* mysql: FTS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21203)
* mysql: Health Monitor unspecified vulnerability (CPU Oct 2024) (CVE-2024-21212)
* mysql: DML unspecified vulnerability (CPU Oct 2024) (CVE-2024-21219)
* mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21230)
* mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21213)
* mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21194)
* mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21199)
* mysql: PS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21193)
* mysql: DDL unspecified vulnerability (CPU Oct 2024) (CVE-2024-21198)
* mysql: mysqldump unspecified vulnerability (CPU Oct 2024) (CVE-2024-21247)
* mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21239)
* curl: curl netrc password leak (CVE-2024-11053)
* mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21497)
* mysql: MySQL Server Options Vulnerability (CVE-2025-21520)
* mysql: High Privilege Denial of Service Vulnerability in MySQL Server (CVE-2025-21490)
* mysql: Information Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21529)
* mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21531)
* mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21504)
* mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21540)
* mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21555)
* mysql: Packaging unspecified vulnerability (CPU Jan 2025) (CVE-2025-21543)
* mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21491)
* mysql: DDL unspecified vulnerability (CPU Jan 2025) (CVE-2025-21525)
* mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21536)
* mysql: Thread Pooling unspecified vulnerability (CPU Jan 2025) (CVE-2025-21521)
* mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21501)
* mysql: Performance Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21534)
* mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21494)
* mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21519)
* mysql: Parser unspecified vulnerability (CPU Jan 2025) (CVE-2025-21522)
* mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21503)
* mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21518)
* mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21559)
* mysql: Privilege Misuse in MySQL Server Security Component (CVE-2025-21546)
* mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21500)
* mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21523)
* mysql: Components Services unspecified vulnerability (CPU Jan 2025) (CVE-2025-21505)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2294581
https://bugzilla.redhat.com/show_bug.cgi?id=2294676
https://bugzilla.redhat.com/show_bug.cgi?id=2301888
https://bugzilla.redhat.com/show_bug.cgi?id=2318857
https://bugzilla.redhat.com/show_bug.cgi?id=2318858
https://bugzilla.redhat.com/show_bug.cgi?id=2318870
https://bugzilla.redhat.com/show_bug.cgi?id=2318873
https://bugzilla.redhat.com/show_bug.cgi?id=2318874
https://bugzilla.redhat.com/show_bug.cgi?id=2318876
https://bugzilla.redhat.com/show_bug.cgi?id=2318882
https://bugzilla.redhat.com/show_bug.cgi?id=2318883
https://bugzilla.redhat.com/show_bug.cgi?id=2318884
https://bugzilla.redhat.com/show_bug.cgi?id=2318885
https://bugzilla.redhat.com/show_bug.cgi?id=2318886
https://bugzilla.redhat.com/show_bug.cgi?id=2318897
https://bugzilla.redhat.com/show_bug.cgi?id=2318900
https://bugzilla.redhat.com/show_bug.cgi?id=2318905
https://bugzilla.redhat.com/show_bug.cgi?id=2318914
https://bugzilla.redhat.com/show_bug.cgi?id=2318922
https://bugzilla.redhat.com/show_bug.cgi?id=2318923
https://bugzilla.redhat.com/show_bug.cgi?id=2318925
https://bugzilla.redhat.com/show_bug.cgi?id=2318926
https://bugzilla.redhat.com/show_bug.cgi?id=2318927
https://bugzilla.redhat.com/show_bug.cgi?id=2331191
https://bugzilla.redhat.com/show_bug.cgi?id=2339218
https://bugzilla.redhat.com/show_bug.cgi?id=2339220
https://bugzilla.redhat.com/show_bug.cgi?id=2339221
https://bugzilla.redhat.com/show_bug.cgi?id=2339226
https://bugzilla.redhat.com/show_bug.cgi?id=2339231
https://bugzilla.redhat.com/show_bug.cgi?id=2339236
https://bugzilla.redhat.com/show_bug.cgi?id=2339238
https://bugzilla.redhat.com/show_bug.cgi?id=2339243
https://bugzilla.redhat.com/show_bug.cgi?id=2339247
https://bugzilla.redhat.com/show_bug.cgi?id=2339252
https://bugzilla.redhat.com/show_bug.cgi?id=2339259
https://bugzilla.redhat.com/show_bug.cgi?id=2339266
https://bugzilla.redhat.com/show_bug.cgi?id=2339270
https://bugzilla.redhat.com/show_bug.cgi?id=2339271
https://bugzilla.redhat.com/show_bug.cgi?id=2339275
https://bugzilla.redhat.com/show_bug.cgi?id=2339277
https://bugzilla.redhat.com/show_bug.cgi?id=2339281
https://bugzilla.redhat.com/show_bug.cgi?id=2339284
https://bugzilla.redhat.com/show_bug.cgi?id=2339291
https://bugzilla.redhat.com/show_bug.cgi?id=2339293
https://bugzilla.redhat.com/show_bug.cgi?id=2339295
https://bugzilla.redhat.com/show_bug.cgi?id=2339299
https://bugzilla.redhat.com/show_bug.cgi?id=2339300
https://bugzilla.redhat.com/show_bug.cgi?id=2339304
https://bugzilla.redhat.com/show_bug.cgi?id=2339305
https://issues.redhat.com/browse/RHEL-40867
https://issues.redhat.com/browse/RHEL-5470
http://www.nessus.org/u?3c4218c9
https://access.redhat.com/errata/RHSA-2025:1671

Solution
Update the RHEL mysql package based on the guidance in RHSA-2025:1671.
Risk Factor
High
CVSS v3.0 Base Score
9.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
8.2 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0462
CVSS v2.0 Base Score
9.4 (CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:POC/RL:OF/RC:C)
STIG Severity
I
References

CVE | CVE-2024-5535
CVE | CVE-2024-7264
CVE | CVE-2024-11053
CVE | CVE-2024-21193
CVE | CVE-2024-21194
CVE | CVE-2024-21196
CVE | CVE-2024-21197
CVE | CVE-2024-21198
CVE | CVE-2024-21199
CVE | CVE-2024-21201
CVE | CVE-2024-21203
CVE | CVE-2024-21212
CVE | CVE-2024-21213
CVE | CVE-2024-21218
CVE | CVE-2024-21219
CVE | CVE-2024-21230
CVE | CVE-2024-21231
CVE | CVE-2024-21236
CVE | CVE-2024-21237
CVE | CVE-2024-21238
CVE | CVE-2024-21239
CVE | CVE-2024-21241
CVE | CVE-2024-21247
CVE | CVE-2024-37371
CVE | CVE-2025-21490
CVE | CVE-2025-21491
CVE | CVE-2025-21494
CVE | CVE-2025-21497
CVE | CVE-2025-21500
CVE | CVE-2025-21501
CVE | CVE-2025-21503
CVE | CVE-2025-21504
CVE | CVE-2025-21505
CVE | CVE-2025-21518
CVE | CVE-2025-21519
CVE | CVE-2025-21520
CVE | CVE-2025-21521
CVE | CVE-2025-21522
CVE | CVE-2025-21523
CVE | CVE-2025-21525
CVE | CVE-2025-21529
CVE | CVE-2025-21531
CVE | CVE-2025-21534
CVE | CVE-2025-21536
CVE | CVE-2025-21540
CVE | CVE-2025-21543
CVE | CVE-2025-21546
CVE | CVE-2025-21555
CVE | CVE-2025-21559
XREF | RHSA:2025:1671
XREF | IAVA:2025-A-0272
XREF | CWE:125
XREF | CWE:200
XREF | CWE:269
XREF | CWE:285
XREF | CWE:404

Plugin Information
Published: 2025/02/19, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : mysql-common-8.0.36-1.el9_3
Should be : mysql-common-8.0.41-2.el9_5
Remote package installed : mysql-errmsg-8.0.36-1.el9_3
Should be : mysql-errmsg-8.0.41-2.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
240088 - RHEL 9 : podman (RHSA-2025:9144)
-
Synopsis
The remote Red Hat host is missing a security update for podman.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9144 advisory.
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.
Security Fix(es):
* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2358493
http://www.nessus.org/u?632d0265
https://access.redhat.com/errata/RHSA-2025:9144

Solution
Update the RHEL podman package based on the guidance in RHSA-2025:9144.
Risk Factor
High
CVSS v3.0 Base Score
9.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
7.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
9.4 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N)
CVSS v2.0 Temporal Score
7.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-22871
XREF | RHSA:2025:9144
XREF | CWE:444

Plugin Information
Published: 2025/06/17, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : podman-5.2.2-1.el9
Should be : podman-5.4.0-10.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
241144 - RHEL 9 : python3.9 (RHSA-2025:10136)
-
Synopsis
The remote Red Hat host is missing one or more security updates for python3.9.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10136 advisory.
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435)
* cpython: Bypass extraction filter to modify file metadata outside extraction directory (CVE-2024-12718)
* cpython: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330)
* python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517)
* cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVE-2025-4138)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2370010
https://bugzilla.redhat.com/show_bug.cgi?id=2370013
https://bugzilla.redhat.com/show_bug.cgi?id=2370014
https://bugzilla.redhat.com/show_bug.cgi?id=2370016
https://bugzilla.redhat.com/show_bug.cgi?id=2372426
http://www.nessus.org/u?0b252441
https://access.redhat.com/errata/RHSA-2025:10136

Solution
Update the RHEL python3.9 package based on the guidance in RHSA-2025:10136.
Risk Factor
High
CVSS v4.0 Base Score
10.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
CVSS v3.0 Base Score
9.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L)
CVSS v3.0 Temporal Score
8.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.3
EPSS Score
0.0009
CVSS v2.0 Base Score
9.7 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:P)
CVSS v2.0 Temporal Score
7.2 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-12718
CVE | CVE-2025-4138
CVE | CVE-2025-4330
CVE | CVE-2025-4435
CVE | CVE-2025-4517
XREF | RHSA:2025:10136
XREF | CWE:22
XREF | CWE:706

Plugin Information
Published: 2025/07/02, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : python-unversioned-command-3.9.19-8.el9
Should be : python-unversioned-command-3.9.21-2.el9_6.1
Remote package installed : python3-3.9.19-8.el9
Should be : python3-3.9.21-2.el9_6.1
Remote package installed : python3-libs-3.9.19-8.el9
Should be : python3-libs-3.9.21-2.el9_6.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
242957 - RHEL 9 : sqlite (RHSA-2025:11992)
-
Synopsis
The remote Red Hat host is missing a security update for sqlite.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:11992 advisory.
SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use.
Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server.
Security Fix(es):
* sqlite: Integer Truncation in SQLite (CVE-2025-6965)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2380149
http://www.nessus.org/u?dab4f83f
https://access.redhat.com/errata/RHSA-2025:11992

Solution
Update the RHEL sqlite package based on the guidance in RHSA-2025:11992.
Risk Factor
Critical
CVSS v4.0 Base Score
7.2 (CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L)
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
9.2
EPSS Score
0.0004
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-6965
XREF | RHSA:2025:11992
XREF | CWE:197

Plugin Information
Published: 2025/07/29, Modified: 2025/08/04
Plugin Output

## tcp/0

Remote package installed : sqlite-libs-3.34.1-7.el9_3
Should be : sqlite-libs-3.34.1-8.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
274798 - RHEL 9 : sqlite (RHSA-2025:20936)
-
Synopsis
The remote Red Hat host is missing a security update for sqlite.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:20936 advisory.
SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use.
Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server.
Security Fix(es):
* sqlite: Integer Truncation in SQLite (CVE-2025-6965)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2380149
https://issues.redhat.com/browse/RHEL-89962
http://www.nessus.org/u?f5349cc4
https://access.redhat.com/errata/RHSA-2025:20936

Solution
Update the RHEL sqlite package based on the guidance in RHSA-2025:20936.
Risk Factor
Critical
CVSS v4.0 Base Score
7.2 (CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L)
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
9.2
EPSS Score
0.0004
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-6965
XREF | RHSA:2025:20936
XREF | CWE:197

Plugin Information
Published: 2025/11/11, Modified: 2025/11/11
Plugin Output

## tcp/0

Remote package installed : sqlite-libs-3.34.1-7.el9_3
Should be : sqlite-libs-3.34.1-9.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
209157 - RHEL 9 : webkit2gtk3 (RHSA-2024:8180)
-
Synopsis
The remote Red Hat host is missing one or more security updates for webkit2gtk3.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8180 advisory.
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkit: malicious website may exfiltrate audio data cross-origin (CVE-2024-23254)
* webkit: processing malicious web content prevents Content Security Policy from being enforced (CVE-2024-23263)
* webkit: maliciously crafted webpage may be able to fingerprint the user (CVE-2024-23280)
* webkit: processing maliciously crafted web content prevents Content Security Policy from being enforced (CVE-2024-23284)
* chromium-browser: Use after free in ANGLE (CVE-2024-4558)
* webkitgtk: webkit2gtk: Use after free may lead to Remote Code Execution (CVE-2024-40776)
* webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-40789)
* webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking (CVE-2024-40780)
* webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking (CVE-2024-40779)
* webkitgtk: webkit2gtk: Use-after-free was addressed with improved memory management (CVE-2024-40782)
* webkitgtk: Visiting a malicious website may lead to address bar spoofing (CVE-2024-40866)
* webkitgtk: Processing web content may lead to arbitrary code execution (CVE-2024-27820)
* webkitgtk: A maliciously crafted webpage may be able to fingerprint the user (CVE-2024-27838)
* webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2024-27851)
* webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2024-44187)
* webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-44185)
* webkit: Processing maliciously crafted web content may lead to memory corruption (CVE-2024-54534)
* webkitgtk: Processing a file may lead to unexpected app termination or arbitrary code execution (CVE-2024-27856)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2270289
https://bugzilla.redhat.com/show_bug.cgi?id=2270290
https://bugzilla.redhat.com/show_bug.cgi?id=2270291
https://bugzilla.redhat.com/show_bug.cgi?id=2270292
https://bugzilla.redhat.com/show_bug.cgi?id=2279689
https://bugzilla.redhat.com/show_bug.cgi?id=2301841
https://bugzilla.redhat.com/show_bug.cgi?id=2302067
https://bugzilla.redhat.com/show_bug.cgi?id=2302069
https://bugzilla.redhat.com/show_bug.cgi?id=2302070
https://bugzilla.redhat.com/show_bug.cgi?id=2302071
https://bugzilla.redhat.com/show_bug.cgi?id=2312724
https://bugzilla.redhat.com/show_bug.cgi?id=2314698
https://bugzilla.redhat.com/show_bug.cgi?id=2314702
https://bugzilla.redhat.com/show_bug.cgi?id=2314704
https://bugzilla.redhat.com/show_bug.cgi?id=2314706
https://bugzilla.redhat.com/show_bug.cgi?id=2323263
https://bugzilla.redhat.com/show_bug.cgi?id=2333846
https://bugzilla.redhat.com/show_bug.cgi?id=2344618
http://www.nessus.org/u?19be4377
https://access.redhat.com/errata/RHSA-2024:8180

Solution
Update the RHEL webkit2gtk3 package based on the guidance in RHSA-2024:8180.
Risk Factor
Critical
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.8 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
7.3
EPSS Score
0.0278
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.8 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-23254
CVE | CVE-2024-23263
CVE | CVE-2024-23280
CVE | CVE-2024-23284
CVE | CVE-2024-27820
CVE | CVE-2024-27838
CVE | CVE-2024-27851
CVE | CVE-2024-27856
CVE | CVE-2024-40776
CVE | CVE-2024-40779
CVE | CVE-2024-40780
CVE | CVE-2024-40782
CVE | CVE-2024-40789
CVE | CVE-2024-40866
CVE | CVE-2024-44185
CVE | CVE-2024-44187
CVE | CVE-2024-4558
CVE | CVE-2024-54534
XREF | RHSA:2024:8180
XREF | CWE:119
XREF | CWE:125
XREF | CWE:200
XREF | CWE:416
XREF | CWE:787
XREF | CWE:788
XREF | CWE:94

Plugin Information
Published: 2024/10/16, Modified: 2025/03/22
Plugin Output

## tcp/0

Remote package installed : webkit2gtk3-2.44.3-2.el9
Should be : webkit2gtk3-2.46.1-2.el9_4
Remote package installed : webkit2gtk3-jsc-2.44.3-2.el9
Should be : webkit2gtk3-jsc-2.46.1-2.el9_4
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
232750 - RHEL 9 : webkit2gtk3 (RHSA-2024:9553)
-
Synopsis
The remote Red Hat host is missing one or more security updates for webkit2gtk3.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:9553 advisory.
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Visiting a malicious website may lead to address bar spoofing (CVE-2024-40866)
* webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2024-44187)
* webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-44185)
* webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-44244)
* webkit: Processing maliciously crafted web content may lead to memory corruption (CVE-2024-54534)
* webkitgtk: Processing a file may lead to unexpected app termination or arbitrary code execution (CVE-2024-27856)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2312724
https://bugzilla.redhat.com/show_bug.cgi?id=2314706
https://bugzilla.redhat.com/show_bug.cgi?id=2323263
https://bugzilla.redhat.com/show_bug.cgi?id=2323278
https://bugzilla.redhat.com/show_bug.cgi?id=2333846
https://bugzilla.redhat.com/show_bug.cgi?id=2344618
http://www.nessus.org/u?2813e872
https://access.redhat.com/errata/RHSA-2024:9553

Solution
Update the RHEL webkit2gtk3 package based on the guidance in RHSA-2024:9553.
Risk Factor
Critical
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0022
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-27856
CVE | CVE-2024-40866
CVE | CVE-2024-44185
CVE | CVE-2024-44187
CVE | CVE-2024-44244
CVE | CVE-2024-54534
XREF | RHSA:2024:9553
XREF | CWE:787
XREF | CWE:788
XREF | CWE:94

Plugin Information
Published: 2025/03/14, Modified: 2025/04/05
Plugin Output

## tcp/0

Remote package installed : webkit2gtk3-2.44.3-2.el9
Should be : webkit2gtk3-2.46.3-1.el9_5
Remote package installed : webkit2gtk3-jsc-2.44.3-2.el9
Should be : webkit2gtk3-jsc-2.46.3-1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
270564 - RHEL 9 : webkit2gtk3 (RHSA-2025:18097)
-
Synopsis
The remote Red Hat host is missing one or more security updates for webkit2gtk3.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:18097 advisory.
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43272)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43342)
* webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43368)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43343)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2397626
https://bugzilla.redhat.com/show_bug.cgi?id=2397627
https://bugzilla.redhat.com/show_bug.cgi?id=2397628
https://bugzilla.redhat.com/show_bug.cgi?id=2397630
https://bugzilla.redhat.com/show_bug.cgi?id=2403598
http://www.nessus.org/u?dc4a5c95
https://access.redhat.com/errata/RHSA-2025:18097

Solution
Update the RHEL webkit2gtk3 package based on the guidance in RHSA-2025:18097.
Risk Factor
Critical
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-43272
CVE | CVE-2025-43342
CVE | CVE-2025-43343
CVE | CVE-2025-43356
CVE | CVE-2025-43368
XREF | RHSA:2025:18097
XREF | CWE:20
XREF | CWE:119
XREF | CWE:200
XREF | CWE:416

Plugin Information
Published: 2025/10/15, Modified: 2025/10/15
Plugin Output

## tcp/0

Remote package installed : webkit2gtk3-2.44.3-2.el9
Should be : webkit2gtk3-2.50.1-0.el9_6
Remote package installed : webkit2gtk3-jsc-2.44.3-2.el9
Should be : webkit2gtk3-jsc-2.50.1-0.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
274761 - RHEL 9 : webkit2gtk3 (RHSA-2025:20922)
-
Synopsis
The remote Red Hat host is missing one or more security updates for webkit2gtk3.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:20922 advisory.
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43272)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43342)
* webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43368)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43343)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2397626
https://bugzilla.redhat.com/show_bug.cgi?id=2397627
https://bugzilla.redhat.com/show_bug.cgi?id=2397628
https://bugzilla.redhat.com/show_bug.cgi?id=2397630
https://bugzilla.redhat.com/show_bug.cgi?id=2403598
http://www.nessus.org/u?9f2ba592
https://access.redhat.com/errata/RHSA-2025:20922

Solution
Update the RHEL webkit2gtk3 package based on the guidance in RHSA-2025:20922.
Risk Factor
Critical
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-43272
CVE | CVE-2025-43342
CVE | CVE-2025-43343
CVE | CVE-2025-43356
CVE | CVE-2025-43368
XREF | RHSA:2025:20922
XREF | CWE:20
XREF | CWE:119
XREF | CWE:200
XREF | CWE:416

Plugin Information
Published: 2025/11/11, Modified: 2025/11/11
Plugin Output

## tcp/0

Remote package installed : webkit2gtk3-2.44.3-2.el9
Should be : webkit2gtk3-2.50.1-1.el9_7
Remote package installed : webkit2gtk3-jsc-2.44.3-2.el9
Should be : webkit2gtk3-jsc-2.50.1-1.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.

##

100634 - Redis Server Unprotected by Password Authentication
-
Synopsis
A Redis server is not protected by password authentication.
Description
The Redis server running on the remote host is not protected by password authentication. A remote attacker can exploit this to gain unauthorized access to the server.
See Also

https://redis.io/commands/auth

Solution
Enable the 'requirepass' directive in the redis.conf configuration file.
Risk Factor
High
CVSS v3.0 Base Score
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
Plugin Information
Published: 2017/06/06, Modified: 2022/04/11
Plugin Output

## tcp/6379/redis_server

An unauthenticated INFO request to the Redis Server returned the following:
# Server
redis_version:6.2.17
redis_git_sha1:00000000
redis_git_dirty:0
redis_build_id:5e7d2a5c1d1fb236
redis_mode:standalone
os:Linux 5.14.0-503.11.1.el9_5.x86_64 x86_64
arch_bits:64
monotonic_clock:POSIX clock_gettime
multiplexing_api:epoll
atomicvar_api:c11-builtin
gcc_version:11.5.0
process_id:82163
process_supervised:no
run_id:ec0bc200a80573f605756d66e68e3026ca741e4b
tcp_port:6379
server_time_usec:1769335014374466
uptime_in_seconds:113809
uptime_in_days:1
hz:10
configured_hz:10
lru_clock:7727334
executable:/home/odin/manager/Bin/redis-server/./redis-server
config_file:/home/odin/manager/Bin/redis-server/./redis.conf
io_threads_active:0
# Clients
connected_clients:4
cluster_connections:0
maxclients:10000
client_recent_max_input_buffer:40
client_recent_max_output_buffer:0
blocked_clients:0
tracking_clients:0
clients_in_timeout_table:0
# Memory
used_memory:11165576
used_memory_human:10.65M
used_memory_rss:24854528
used_memory_rss_human:23.70M
used_memory_peak:11328584
used_memory_peak_human:10.80M
used_memory_peak_perc:98.56%
used_memory_overhead:1943304
used_memory_startup:812320
used_memory_dataset:9222272
used_memory_dataset_perc:89.08%
allocator_allocated:11158544
allocator_active:11517952
allocator_resident:15081472
total_system_memory:66887000064
total_system_memory_human:62.29G
used_memory_lua:33792
used_memory_lua_human:33.00K
used_memory_scripts:264
used_memory_scripts_human:264B
number_of_cached_scripts:1
maxmemory:0
maxmemory_human:0B
maxmemory_policy:noeviction
allocator_frag_ratio:1.03
allocator_frag_bytes:359408
allocator_rss_ratio:1.31
allocator_rss_bytes:3563520
rss_overhead_ratio:1.65
rss_overhead_bytes:9773056
mem_fragmentation_ratio:2.24
mem_fragmentation_bytes:13752680
mem_not_counted_for_evict:0
mem_replication_backlog:1048576
mem_clients_slaves:20512
mem_clients_normal:61520
mem_aof_buffer:0
mem_allocator:jemalloc-5.1.0
active_defrag_running:0
lazyfree_pending_objects:0
lazyfreed_objects:0
# Persistence
loading:0
current_cow_size:0
current_cow_size_age:0
current_fork_perc:0.00
current_save_keys_processed:0
current_save_keys_total:0
rdb_changes_since_last_save:0
rdb_bgsave_in_progress:0
rdb_last_save_time:1769245134
rdb_last_bgsave_status:ok
rdb_last_bgsave_time_sec:0
rdb_current_bgsave_time_sec:-1
rdb_last_cow_size:528384
aof_enabled:0
aof_rewrite_in_progress:0
aof_rewrite_scheduled:0
aof_last_rewrite_time_sec:-1
aof_current_rewrite_time_sec:-1
aof_last_bgrewrite_status:ok
aof_last_write_status:ok
aof_last_cow_size:0
module_fork_in_progress:0
module_fork_last_cow_size:0
# Stats
total_connections_received:103
total_commands_processed:186697
instantaneous_ops_per_sec:1
total_net_input_bytes:16643451
total_net_output_bytes:4411101
instantaneous_input_kbps:0.05
instantaneous_output_kbps:0.00
rejected_connections:0
sync_full:1
sync_partial_ok:0
sync_partial_err:0
expired_keys:0
expired_stale_perc:0.00
expired_time_cap_reached_count:0
expire_cycle_cpu_milliseconds:1167
evicted_keys:0
keyspace_hits:0
keyspace_misses:3
pubsub_channels:0
pubsub_patterns:0
latest_fork_usec:369
total_forks:36
migrate_cached_sockets:0
slave_expires_tracked_keys:0
active_defrag_hits:0
active_defrag_misses:0
active_defrag_key_hits:0
active_defrag_key_misses:0
tracking_total_keys:0
tracking_total_items:0
tracking_total_prefixes:0
unexpected_error_replies:0
total_error_replies:22
dump_payload_sanitizations:0
total_reads_processed:172261
total_writes_processed:73765
io_threaded_reads_processed:0
io_threaded_writes_processed:0
# Replication
role:master
connected_slaves:1
slave0:ip=10.20.50.55,port=6380,state=online,offset=679010,lag=0
master_failover_state:no-failover
master_replid:8521ed0381dc420df06841d1e02603362fce3e95
master_replid2:0000000000000000000000000000000000000000
master_repl_offset:679010
second_repl_offset:-1
repl_backlog_active:1
repl_backlog_size:1048576
repl_backlog_first_byte_offset:1
repl_backlog_histlen:679010
# CPU
used_cpu_sys:31.369984
used_cpu_user:50.172280
used_cpu_sys_children:0.085830
used_cpu_user_children:0.784624
used_cpu_sys_main_thread:30.185604
used_cpu_user_main_thread:49.152543
# Modules
# Errorstats
errorstat_ERR:count=22
# Cluster
cluster_enabled:0
# Keyspace
db0:keys=2,expires=0,avg_ttl=0

##

217022 - Linux Distros Unpatched Vulnerability : CVE-2005-2541
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Tar does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges. (CVE-2005-2541)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2005-2541
https://security-tracker.debian.org/tracker/CVE-2005-2541

Solution
There is no known solution at this time.
Risk Factor
Critical
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0254
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2005-2541

Plugin Information
Published: 2025/03/03, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- tar
218405 - Linux Distros Unpatched Vulnerability : CVE-2015-1197
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive. (CVE-2015-1197)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2015-1197

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0347
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.5 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2015-1197

Plugin Information
Published: 2025/03/04, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- cpio
219302 - Linux Distros Unpatched Vulnerability : CVE-2016-2568
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer. (CVE-2016-2568)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2016-2568
https://security-tracker.debian.org/tracker/CVE-2016-2568
https://ubuntu.com/security/CVE-2016-2568

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.5
EPSS Score
0.0015
CVSS v2.0 Base Score
4.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2016-2568

Plugin Information
Published: 2025/03/04, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- polkit
- polkit-libs
220737 - Linux Distros Unpatched Vulnerability : CVE-2017-13712
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NULL Pointer Dereference in the id3v2AddAudioDuration function in libmp3lame/id3tag.c in LAME 3.99.5 allows attackers to perform Denial of Service by triggering a NULL first argument. (CVE-2017-13712)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2017-13712

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0043
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2017-13712

Plugin Information
Published: 2025/03/04, Modified: 2025/09/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- lame-libs
220766 - Linux Distros Unpatched Vulnerability : CVE-2017-15019
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- LAME 3.99.5 has a NULL Pointer Dereference in the hip_decode_init function within libmp3lame/mpglib_interface.c via a malformed mpg file, because of an incorrect calloc call.
(CVE-2017-15019)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2017-15019

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0029
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2017-15019

Plugin Information
Published: 2025/03/04, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- lame-libs
220912 - Linux Distros Unpatched Vulnerability : CVE-2017-16232
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue (CVE-2017-16232)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2017-16232
https://security-tracker.debian.org/tracker/CVE-2017-16232
https://ubuntu.com/security/CVE-2017-16232

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0221
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2017-16232

Plugin Information
Published: 2025/03/04, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libtiff
- libtiff-devel
220899 - Linux Distros Unpatched Vulnerability : CVE-2017-17513
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- TeX Live through 20170524 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, related to linked_scripts/context/stubs/unix/mtxrun, texmf- dist/scripts/context/stubs/mswin/mtxrun.lua, and texmf-dist/tex/luatex/lualibs/lualibs-os.lua.
(CVE-2017-17513)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2017-17513
https://security-tracker.debian.org/tracker/CVE-2017-17513
https://ubuntu.com/security/CVE-2017-17513

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0054
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2017-17513

Plugin Information
Published: 2025/03/04, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- texlive-lib
221044 - Linux Distros Unpatched Vulnerability : CVE-2017-17973
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE:
there is a third-party report of inability to reproduce this issue (CVE-2017-17973)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2017-17973
https://ubuntu.com/security/CVE-2017-17973

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.9 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0073
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2017-17973

Plugin Information
Published: 2025/03/04, Modified: 2025/09/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libtiff
- libtiff-devel
221522 - Linux Distros Unpatched Vulnerability : CVE-2017-8419
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- LAME through 3.99.5 relies on the signed integer data type for values in a WAV or AIFF header, which allows remote attackers to cause a denial of service (stack-based buffer overflow or heap-based buffer overflow) or possibly have unspecified other impact via a crafted file, as demonstrated by mishandling of num_channels. (CVE-2017-8419)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2017-8419

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0096
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2017-8419

Plugin Information
Published: 2025/03/04, Modified: 2025/09/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- lame-libs
222942 - Linux Distros Unpatched Vulnerability : CVE-2019-25059
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839. (CVE-2019-25059)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2019-25059

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0022
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2019-25059

Plugin Information
Published: 2025/03/04, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- ghostscript
- ghostscript-tools-fonts
- ghostscript-tools-printing
- libgs
223364 - Linux Distros Unpatched Vulnerability : CVE-2020-18771
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Exiv2 0.27.99.0 has a global buffer over-read in Exiv2::Internal::Nikon1MakerNote::print0x0088 in nikonmn_int.cpp which can result in an information leak. (CVE-2020-18771)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-18771
https://ubuntu.com/security/CVE-2020-18771

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
8.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
7.3 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0013
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2020-18771

Plugin Information
Published: 2025/03/04, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- exiv2
- exiv2-libs
229923 - Linux Distros Unpatched Vulnerability : CVE-2020-23922
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in giflib through 5.1.4. DumpScreen2RGB in gif2rgb.c has a heap-based buffer over- read. (CVE-2020-23922)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-23922
https://security-tracker.debian.org/tracker/CVE-2020-23922

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0138
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2020-23922

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- giflib
229907 - Linux Distros Unpatched Vulnerability : CVE-2020-25275
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts. (CVE-2020-25275)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-25275

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0336
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2020-25275

Plugin Information
Published: 2025/03/05, Modified: 2025/09/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- dovecot
229904 - Linux Distros Unpatched Vulnerability : CVE-2020-25697
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw allows an attacker to take control of an X application by impersonating the server it is expecting to connect to. (CVE-2020-25697)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-25697
https://ubuntu.com/security/CVE-2020-25697

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0008
CVSS v2.0 Base Score
4.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2020-25697

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- xorg-x11-server-Xorg
- xorg-x11-server-common
223505 - Linux Distros Unpatched Vulnerability : CVE-2020-26556
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, able to conduct a successful brute-force attack on an insufficiently random AuthValue before the provisioning procedure times out, to complete authentication by leveraging Malleable Commitment. (CVE-2020-26556)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-26556
https://ubuntu.com/security/CVE-2020-26556

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.025
CVSS v2.0 Base Score
2.9 (CVSS2#AV:A/AC:M/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
2.5 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2020-26556

Plugin Information
Published: 2025/03/04, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bluez
- bluez-libs
- bluez-obexd
223483 - Linux Distros Unpatched Vulnerability : CVE-2020-26557
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (without possession of the AuthValue used in the provisioning protocol) to determine the AuthValue via a brute- force attack (unless the AuthValue is sufficiently random and changed each time). (CVE-2020-26557)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-26557
https://ubuntu.com/security/CVE-2020-26557

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0192
CVSS v2.0 Base Score
2.9 (CVSS2#AV:A/AC:M/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
2.5 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2020-26557

Plugin Information
Published: 2025/03/04, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bluez
- bluez-libs
- bluez-obexd
223508 - Linux Distros Unpatched Vulnerability : CVE-2020-26559
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (participating in the provisioning protocol) to identify the AuthValue used given the Provisioner's public key, and the confirmation number and nonce provided by the provisioning device. This could permit a device without the AuthValue to complete provisioning without brute-forcing the AuthValue. (CVE-2020-26559)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-26559
https://ubuntu.com/security/CVE-2020-26559

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0256
CVSS v2.0 Base Score
5.8 (CVSS2#AV:A/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2020-26559

Plugin Information
Published: 2025/03/04, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bluez
- bluez-libs
- bluez-obexd
223468 - Linux Distros Unpatched Vulnerability : CVE-2020-26560
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, reflecting the authentication evidence from a Provisioner, to complete authentication without possessing the AuthValue, and potentially acquire a NetKey and AppKey. (CVE-2020-26560)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-26560
https://ubuntu.com/security/CVE-2020-26560

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
8.1 (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
7.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0186
CVSS v2.0 Base Score
4.8 (CVSS2#AV:A/AC:L/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2020-26560

Plugin Information
Published: 2025/03/04, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bluez
- bluez-libs
- bluez-obexd
223773 - Linux Distros Unpatched Vulnerability : CVE-2021-29923
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR. (CVE-2021-29923)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-29923
https://security-tracker.debian.org/tracker/CVE-2021-29923
https://ubuntu.com/security/CVE-2021-29923

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0009
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2021-29923

Plugin Information
Published: 2025/03/04, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
223894 - Linux Distros Unpatched Vulnerability : CVE-2021-34866
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of user-supplied eBPF programs, which can result in a type confusion condition. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. Was ZDI-CAN-14689. (CVE-2021-34866)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-34866
https://ubuntu.com/security/CVE-2021-34866

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0012
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-34866

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
223847 - Linux Distros Unpatched Vulnerability : CVE-2021-35065
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression. (CVE-2021-35065)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-35065
https://security-tracker.debian.org/tracker/CVE-2021-35065
https://ubuntu.com/security/CVE-2021-35065

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0035
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2021-35065

Plugin Information
Published: 2025/03/05, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gjs
224116 - Linux Distros Unpatched Vulnerability : CVE-2021-37789
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- stb_image.h 2.27 has a heap-based buffer over in stbi__jpeg_load, leading to Information Disclosure or Denial of Service. (CVE-2021-37789)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-37789
https://security-tracker.debian.org/tracker/CVE-2021-37789
https://ubuntu.com/security/CVE-2021-37789

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
8.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0009
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2021-37789

Plugin Information
Published: 2025/03/05, Modified: 2025/10/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- cogl
224109 - Linux Distros Unpatched Vulnerability : CVE-2021-38561
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack. (CVE-2021-38561)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-38561
https://security-tracker.debian.org/tracker/CVE-2021-38561
https://ubuntu.com/security/CVE-2021-38561

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-38561

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- podman
223960 - Linux Distros Unpatched Vulnerability : CVE-2021-38593
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke). (CVE-2021-38593)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-38593
https://ubuntu.com/security/CVE-2021-38593

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0084
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-38593

Plugin Information
Published: 2025/03/05, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- qt5-srpm-macros
224091 - Linux Distros Unpatched Vulnerability : CVE-2021-3927
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vim is vulnerable to Heap-based Buffer Overflow (CVE-2021-3927)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-3927
https://security-tracker.debian.org/tracker/CVE-2021-3927

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0016
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2021-3927

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224062 - Linux Distros Unpatched Vulnerability : CVE-2021-3928
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vim is vulnerable to Use of Uninitialized Variable (CVE-2021-3928)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-3928
https://security-tracker.debian.org/tracker/CVE-2021-3928

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2021-3928

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224085 - Linux Distros Unpatched Vulnerability : CVE-2021-3968
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vim is vulnerable to Heap-based Buffer Overflow (CVE-2021-3968)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-3968
https://security-tracker.debian.org/tracker/CVE-2021-3968

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
8.0 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.2 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0034
CVSS v2.0 Base Score
8.5 (CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.7 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2021-3968

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224049 - Linux Distros Unpatched Vulnerability : CVE-2021-3973
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vim is vulnerable to Heap-based Buffer Overflow (CVE-2021-3973)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-3973
https://security-tracker.debian.org/tracker/CVE-2021-3973

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0024
CVSS v2.0 Base Score
9.3 (CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2021-3973

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224117 - Linux Distros Unpatched Vulnerability : CVE-2021-3974
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vim is vulnerable to Use After Free (CVE-2021-3974)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-3974
https://security-tracker.debian.org/tracker/CVE-2021-3974

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2021-3974

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224279 - Linux Distros Unpatched Vulnerability : CVE-2021-4136
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vim is vulnerable to Heap-based Buffer Overflow (CVE-2021-4136)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-4136
https://security-tracker.debian.org/tracker/CVE-2021-4136

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0019
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2021-4136

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224235 - Linux Distros Unpatched Vulnerability : CVE-2021-4166
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vim is vulnerable to Out-of-bounds Read (CVE-2021-4166)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-4166
https://security-tracker.debian.org/tracker/CVE-2021-4166
https://ubuntu.com/security/CVE-2021-4166

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0026
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2021-4166

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224248 - Linux Distros Unpatched Vulnerability : CVE-2021-4173
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vim is vulnerable to Use After Free (CVE-2021-4173)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-4173

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0014
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2021-4173

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224282 - Linux Distros Unpatched Vulnerability : CVE-2021-4187
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vim is vulnerable to Use After Free (CVE-2021-4187)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-4187

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0024
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2021-4187

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224129 - Linux Distros Unpatched Vulnerability : CVE-2021-4202
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A use-after-free flaw was found in nci_request in net/nfc/nci/core.c in NFC Controller Interface (NCI) in the Linux kernel. This flaw could allow a local attacker with user privileges to cause a data race problem while the device is getting removed, leading to a privilege escalation problem. (CVE-2021-4202)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-4202
https://ubuntu.com/security/CVE-2021-4202

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.6 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.2 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2021-4202

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224200 - Linux Distros Unpatched Vulnerability : CVE-2021-4204
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An out-of-bounds (OOB) memory access flaw was found in the Linux kernel's eBPF due to an Improper Input Validation. This flaw allows a local attacker with a special privilege to crash the system or leak internal information. (CVE-2021-4204)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-4204
https://security-tracker.debian.org/tracker/CVE-2021-4204
https://ubuntu.com/security/CVE-2021-4204

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.2
EPSS Score
0.0077
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-4204

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224150 - Linux Distros Unpatched Vulnerability : CVE-2021-43138
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution. (CVE-2021-43138)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-43138

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0083
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2021-43138

Plugin Information
Published: 2025/03/05, Modified: 2025/08/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gjs
224355 - Linux Distros Unpatched Vulnerability : CVE-2021-45078
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out- of-bounds write. NOTE: this issue exists because of an incorrect fix for CVE-2018-12699. (CVE-2021-45078)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-45078
https://security-tracker.debian.org/tracker/CVE-2021-45078
https://ubuntu.com/security/CVE-2021-45078

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0018
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2021-45078

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
249709 - Linux Distros Unpatched Vulnerability : CVE-2021-46984
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: kyber: fix out of bounds access when preempted __blk_mq_sched_bio_merge() gets the ctx and hctx for the current CPU and passes the hctx to
->bio_merge(). kyber_bio_merge() then gets the ctx for the current CPU again and uses that to get the corresponding Kyber context in the passed hctx. However, the thread may be preempted between the two calls to blk_mq_get_ctx(), and the ctx returned the second time may no longer correspond to the passed hctx.
This works accidentally most of the time, but it can cause us to read garbage if the second ctx came from an hctx with more ctx's than the first one (i.e., if ctx->index_hw[hctx->type] > hctx->nr_ctx). This manifested as this UBSAN array index out of bounds error reported by Jakub: UBSAN: array-index-out-of- bounds in ../kernel/locking/qspinlock.c:130:9 index 13106 is out of range for type 'long unsigned int [128]' Call Trace: dump_stack+0xa4/0xe5 ubsan_epilogue+0x5/0x40
__ubsan_handle_out_of_bounds.cold.13+0x2a/0x34 queued_spin_lock_slowpath+0x476/0x480 do_raw_spin_lock+0x1c2/0x1d0 kyber_bio_merge+0x112/0x180 blk_mq_submit_bio+0x1f5/0x1100 submit_bio_noacct+0x7b0/0x870 submit_bio+0xc2/0x3a0 btrfs_map_bio+0x4f0/0x9d0 btrfs_submit_data_bio+0x24e/0x310 submit_one_bio+0x7f/0xb0 submit_extent_page+0xc4/0x440
__extent_writepage_io+0x2b8/0x5e0 __extent_writepage+0x28d/0x6e0 extent_write_cache_pages+0x4d7/0x7a0 extent_writepages+0xa2/0x110 do_writepages+0x8f/0x180 __writeback_single_inode+0x99/0x7f0 writeback_sb_inodes+0x34e/0x790 __writeback_inodes_wb+0x9e/0x120 wb_writeback+0x4d2/0x660 wb_workfn+0x64d/0xa10 process_one_work+0x53a/0xa80 worker_thread+0x69/0x5b0 kthread+0x20b/0x240 ret_from_fork+0x1f/0x30 Only Kyber uses the hctx, so fix it by passing the request_queue to ->bio_merge() instead. BFQ and mq-deadline just use that, and Kyber can map the queues itself to avoid the mismatch.
(CVE-2021-46984)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-46984
https://ubuntu.com/security/CVE-2021-46984

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0009
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-46984

Plugin Information
Published: 2025/08/15, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230133 - Linux Distros Unpatched Vulnerability : CVE-2021-46999
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: sctp: do asoc update earlier in sctp_sf_do_dupcook_a There's a panic that occurs in a few of envs, the call trace is as below: [] general protection fault, ... 0x29acd70f1000a: 0000 [#1] SMP PTI [] RIP:
0010:sctp_ulpevent_notify_peer_addr_change+0x4b/0x1fa [sctp] [] sctp_assoc_control_transport+0x1b9/0x210 [sctp] [] sctp_do_8_2_transport_strike.isra.16+0x15c/0x220 [sctp] [] sctp_cmd_interpreter.isra.21+0x1231/0x1a10 [sctp] [] sctp_do_sm+0xc3/0x2a0 [sctp] [] sctp_generate_timeout_event+0x81/0xf0 [sctp] This is caused by a transport use-after-free issue. When processing a duplicate COOKIE-ECHO chunk in sctp_sf_do_dupcook_a(), both COOKIE-ACK and SHUTDOWN chunks are allocated with the transort from the new asoc. However, later in the sideeffect machine, the old asoc is used to send them out and old asoc's shutdown_last_sent_to is set to the transport that SHUTDOWN chunk attached to in sctp_cmd_setup_t2(), which actually belongs to the new asoc. After the new_asoc is freed and the old asoc T2 timeout, the old asoc's shutdown_last_sent_to that is already freed would be accessed in sctp_sf_t2_timer_expire(). Thanks Alexander and Jere for helping dig into this issue. To fix it, this patch is to do the asoc update first, then allocate the COOKIE-ACK and SHUTDOWN chunks with the 'updated'
old asoc. This would make more sense, as a chunk from an asoc shouldn't be sent out with another asoc. We had fixed quite a few issues caused by this. (CVE-2021-46999)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-46999
https://ubuntu.com/security/CVE-2021-46999

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-46999

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229820 - Linux Distros Unpatched Vulnerability : CVE-2021-47014
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/sched: act_ct: fix wild memory access when clearing fragments while testing re-assembly/re- fragmentation using act_ct, it's possible to observe a crash like the following one: KASAN: maybe wild- memory-access in range [0x0001000000000448-0x000100000000044f] CPU: 50 PID: 0 Comm: swapper/50 Tainted: G S 5.12.0-rc7+ #424 Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.4.3 01/17/2017 RIP:
0010:inet_frag_rbtree_purge+0x50/0xc0 Code: 00 fc ff df 48 89 c3 31 ed 48 89 df e8 a9 7a 38 ff 4c 89 fe 48 89 df 49 89 c6 e8 5b 3a 38 ff 48 8d 7b 40 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 75 59 48 8d bb d0 00 00 00 4c 8b 6b 40 48 89 f8 48 RSP: 0018:ffff888c31449db8 EFLAGS: 00010203 RAX: 0000200000000089 RBX:
000100000000040e RCX: ffffffff989eb960 RDX: 0000000000000140 RSI: ffffffff97cfb977 RDI: 000100000000044e RBP: 0000000000000900 R08: 0000000000000000 R09: ffffed1186289350 R10: 0000000000000003 R11:
ffffed1186289350 R12: dffffc0000000000 R13: 000100000000040e R14: 0000000000000000 R15: ffff888155e02160 FS: 0000000000000000(0000) GS:ffff888c31440000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005600cb70a5b8 CR3: 0000000a2c014005 CR4: 00000000003706e0 DR0:
0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> inet_frag_destroy+0xa9/0x150 call_timer_fn+0x2d/0x180 run_timer_softirq+0x4fe/0xe70 __do_softirq+0x197/0x5a0 irq_exit_rcu+0x1de/0x200 sysvec_apic_timer_interrupt+0x6b/0x80 </IRQ> when act_ct temporarily stores an IP fragment, restoring the skb qdisc cb results in putting random data in FRAG_CB(), and this causes those wild memory accesses later, when the rbtree is purged. Never overwrite the skb cb in case tcf_ct_handle_fragments() returns
-EINPROGRESS. (CVE-2021-47014)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47014
https://security-tracker.debian.org/tracker/CVE-2021-47014
https://ubuntu.com/security/CVE-2021-47014

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47014

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248963 - Linux Distros Unpatched Vulnerability : CVE-2021-47017
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ath10k: Fix a use after free in ath10k_htc_send_bundle In ath10k_htc_send_bundle, the bundle_skb could be freed by dev_kfree_skb_any(bundle_skb). But the bundle_skb is used later by bundle_skb->len. As skb_len = bundle_skb->len, my patch replaces bundle_skb->len to skb_len after the bundle_skb was freed.
(CVE-2021-47017)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47017
https://ubuntu.com/security/CVE-2021-47017

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0005
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47017

Plugin Information
Published: 2025/08/12, Modified: 2025/09/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224402 - Linux Distros Unpatched Vulnerability : CVE-2021-47097
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: Input: elantech - fix stack out of bound access in elantech_change_report_id() The array param[] in elantech_change_report_id() must be at least 3 bytes, because elantech_read_reg_params() is calling ps2_command() with PSMOUSE_CMD_GETINFO, that is going to access 3 bytes from param[], but it's defined in the stack as an array of 2 bytes, therefore we have a potential stack out-of-bounds access here, also confirmed by KASAN: [ 6.512374] BUG: KASAN:
stack-out-of-bounds in __ps2_command+0x372/0x7e0 [ 6.512397] Read of size 1 at addr ffff8881024d77c2 by task kworker/2:1/118 [ 6.512416] CPU: 2 PID: 118 Comm: kworker/2:1 Not tainted 5.13.0-22-generic #22+arighi20211110 [ 6.512428] Hardware name: LENOVO 20T8000QGE/20T8000QGE, BIOS R1AET32W (1.08 ) 08/14/2020 [ 6.512436] Workqueue: events_long serio_handle_event [ 6.512453] Call Trace: [ 6.512462] show_stack+0x52/0x58 [ 6.512474] dump_stack+0xa1/0xd3 [ 6.512487] print_address_description.constprop.0+0x1d/0x140 [ 6.512502] ? __ps2_command+0x372/0x7e0 [ 6.512516]
__kasan_report.cold+0x7d/0x112 [ 6.512527] ? _raw_write_lock_irq+0x20/0xd0 [ 6.512539] ?
__ps2_command+0x372/0x7e0 [ 6.512552] kasan_report+0x3c/0x50 [ 6.512564] __asan_load1+0x6a/0x70 [ 6.512575] __ps2_command+0x372/0x7e0 [ 6.512589] ? ps2_drain+0x240/0x240 [ 6.512601] ? dev_printk_emit+0xa2/0xd3 [ 6.512612] ? dev_vprintk_emit+0xc5/0xc5 [ 6.512621] ?
__kasan_check_write+0x14/0x20 [ 6.512634] ? mutex_lock+0x8f/0xe0 [ 6.512643] ?
__mutex_lock_slowpath+0x20/0x20 [ 6.512655] ps2_command+0x52/0x90 [ 6.512670] elantech_ps2_command+0x4f/0xc0 [psmouse] [ 6.512734] elantech_change_report_id+0x1e6/0x256 [psmouse] [ 6.512799] ? elantech_report_trackpoint.constprop.0.cold+0xd/0xd [psmouse] [ 6.512863] ? ps2_command+0x7f/0x90 [ 6.512877] elantech_query_info.cold+0x6bd/0x9ed [psmouse] [ 6.512943] ? elantech_setup_ps2+0x460/0x460 [psmouse] [ 6.513005] ? psmouse_reset+0x69/0xb0 [psmouse] [ 6.513064] ? psmouse_attr_set_helper+0x2a0/0x2a0 [psmouse] [ 6.513122] ? phys_pmd_init+0x30e/0x521 [ 6.513137] elantech_init+0x8a/0x200 [psmouse] [ 6.513200] ? elantech_init_ps2+0xf0/0xf0 [psmouse] [ 6.513249] ? elantech_query_info+0x440/0x440 [psmouse] [ 6.513296] ? synaptics_send_cmd+0x60/0x60 [psmouse] [ 6.513342] ? elantech_query_info+0x440/0x440 [psmouse] [ 6.513388] ? psmouse_try_protocol+0x11e/0x170 [psmouse] [ 6.513432] psmouse_extensions+0x65d/0x6e0 [psmouse] [ 6.513476] ? psmouse_try_protocol+0x170/0x170 [psmouse] [ 6.513519] ? mutex_unlock+0x22/0x40 [ 6.513526] ? ps2_command+0x7f/0x90 [ 6.513536] ? psmouse_probe+0xa3/0xf0 [psmouse] [ 6.513580] psmouse_switch_protocol+0x27d/0x2e0 [psmouse] [ 6.513624] psmouse_connect+0x272/0x530 [psmouse] [ 6.513669] serio_driver_probe+0x55/0x70 [ 6.513679] really_probe+0x190/0x720 [ 6.513689] driver_probe_device+0x160/0x1f0 [ 6.513697] device_driver_attach+0x119/0x130 [ 6.513705] ? device_driver_attach+0x130/0x130 [ 6.513713]
__driver_attach+0xe7/0x1a0 [ 6.513720] ? device_driver_attach+0x130/0x130 [ 6.513728] bus_for_each_dev+0xfb/0x150 [ 6.513738] ? subsys_dev_iter_exit+0x10/0x10 [ 6.513748] ?
_raw_write_unlock_bh+0x30/0x30 [ 6.513757] driver_attach+0x2d/0x40 [ 6.513764] serio_handle_event+0x199/0x3d0 [ 6.513775] process_one_work+0x471/0x740 [ 6.513785] worker_thread+0x2d2/0x790 [ 6.513794] ? process_one_work+0x740/0x740 [ 6.513802] kthread+0x1b4/0x1e0 [ 6.513809] ? set_kthread_struct+0x80/0x80 [ 6.513816] ret_from_fork+0x22/0x30 [ 6.513832] The buggy address belongs to the page: [ 6.513838] page:00000000bc35e189 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1024d7 [ 6.513847] flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff) [ 6.513860] raw: 0 ---truncated--- (CVE-2021-47097)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47097
https://ubuntu.com/security/CVE-2021-47097

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0006
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2021-47097

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224305 - Linux Distros Unpatched Vulnerability : CVE-2021-47191
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() The following warning was observed running syzkaller: [ 3813.830724] sg_write: data in/out 65466/242 bytes for SCSI command 0x9e-- guessing data in;
[ 3813.830724] program syz-executor not setting count and/or reply_len properly [ 3813.836956] ================================================================== [ 3813.839465] BUG: KASAN: stack-out- of-bounds in sg_copy_buffer+0x157/0x1e0 [ 3813.841773] Read of size 4096 at addr ffff8883cf80f540 by task syz-executor/1549 [ 3813.846612] Call Trace: [ 3813.846995] dump_stack+0x108/0x15f [ 3813.847524] print_address_description+0xa5/0x372 [ 3813.848243] kasan_report.cold+0x236/0x2a8 [ 3813.849439] check_memory_region+0x240/0x270 [ 3813.850094] memcpy+0x30/0x80 [ 3813.850553] sg_copy_buffer+0x157/0x1e0 [ 3813.853032] sg_copy_from_buffer+0x13/0x20 [ 3813.853660] fill_from_dev_buffer+0x135/0x370 [ 3813.854329] resp_readcap16+0x1ac/0x280 [ 3813.856917] schedule_resp+0x41f/0x1630 [ 3813.858203] scsi_debug_queuecommand+0xb32/0x17e0 [ 3813.862699] scsi_dispatch_cmd+0x330/0x950 [ 3813.863329] scsi_request_fn+0xd8e/0x1710 [ 3813.863946] __blk_run_queue+0x10b/0x230 [ 3813.864544] blk_execute_rq_nowait+0x1d8/0x400 [ 3813.865220] sg_common_write.isra.0+0xe61/0x2420 [ 3813.871637] sg_write+0x6c8/0xef0 [ 3813.878853] __vfs_write+0xe4/0x800 [ 3813.883487] vfs_write+0x17b/0x530 [ 3813.884008] ksys_write+0x103/0x270 [ 3813.886268] __x64_sys_write+0x77/0xc0 [ 3813.886841] do_syscall_64+0x106/0x360 [ 3813.887415] entry_SYSCALL_64_after_hwframe+0x44/0xa9 This issue can be reproduced with the following syzkaller log: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd/3\x00') open_by_handle_at(r1, &(0x7f00000003c0)=ANY=[@ANYRESHEX], 0x602000) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40782) write$binfmt_aout(r2, &(0x7f0000000340)=ANY=[@ANYBLOB=00 000000deff000000000000000000000000000000000000000000000000000047f007af9e107a41ec395f1bded7be24277a1501ff61 96a83366f4e6362bc0ff2b247f68a972989b094b2da4fb3607fcf611a22dd04310d28c75039d], 0x126) In resp_readcap16() we get int alloc_len value -1104926854, and then pass the huge arr_len to fill_from_dev_buffer(), but arr is only 32 bytes. This leads to OOB in sg_copy_buffer(). To solve this issue, define alloc_len as u32.
(CVE-2021-47191)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47191
https://ubuntu.com/security/CVE-2021-47191

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0006
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47191

Plugin Information
Published: 2025/03/05, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224345 - Linux Distros Unpatched Vulnerability : CVE-2021-47196
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Set send and receive CQ before forwarding to the driver Preset both receive and send CQ pointers prior to call to the drivers and overwrite it later again till the mlx4 is going to be changed do not overwrite ibqp properties. This change is needed for mlx5, because in case of QP creation failure, it will go to the path of QP destroy which relies on proper CQ pointers. BUG: KASAN: use-after-free in create_qp.cold+0x164/0x16e [mlx5_ib] Write of size 8 at addr ffff8880064c55c0 by task a.out/246 CPU: 0 PID: 246 Comm: a.out Not tainted 5.15.0+ #291 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x45/0x59 print_address_description.constprop.0+0x1f/0x140 kasan_report.cold+0x83/0xdf create_qp.cold+0x164/0x16e [mlx5_ib] mlx5_ib_create_qp+0x358/0x28a0 [mlx5_ib] create_qp.part.0+0x45b/0x6a0 [ib_core] ib_create_qp_user+0x97/0x150 [ib_core] ib_uverbs_handler_UVERBS_METHOD_QP_CREATE+0x92c/0x1250 [ib_uverbs] ib_uverbs_cmd_verbs+0x1c38/0x3150 [ib_uverbs] ib_uverbs_ioctl+0x169/0x260 [ib_uverbs] __x64_sys_ioctl+0x866/0x14d0 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae Allocated by task 246: kasan_save_stack+0x1b/0x40
__kasan_kmalloc+0xa4/0xd0 create_qp.part.0+0x92/0x6a0 [ib_core] ib_create_qp_user+0x97/0x150 [ib_core] ib_uverbs_handler_UVERBS_METHOD_QP_CREATE+0x92c/0x1250 [ib_uverbs] ib_uverbs_cmd_verbs+0x1c38/0x3150 [ib_uverbs] ib_uverbs_ioctl+0x169/0x260 [ib_uverbs] __x64_sys_ioctl+0x866/0x14d0 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae Freed by task 246: kasan_save_stack+0x1b/0x40 kasan_set_track+0x1c/0x30 kasan_set_free_info+0x20/0x30 __kasan_slab_free+0x10c/0x150 slab_free_freelist_hook+0xb4/0x1b0 kfree+0xe7/0x2a0 create_qp.part.0+0x52b/0x6a0 [ib_core] ib_create_qp_user+0x97/0x150 [ib_core] ib_uverbs_handler_UVERBS_METHOD_QP_CREATE+0x92c/0x1250 [ib_uverbs] ib_uverbs_cmd_verbs+0x1c38/0x3150 [ib_uverbs] ib_uverbs_ioctl+0x169/0x260 [ib_uverbs]
__x64_sys_ioctl+0x866/0x14d0 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae (CVE-2021-47196)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47196
https://ubuntu.com/security/CVE-2021-47196

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.2
EPSS Score
0.0006
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47196

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229864 - Linux Distros Unpatched Vulnerability : CVE-2021-47222
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix vlan tunnel dst refcnt when egressing The egress tunnel code uses dst_clone() and directly sets the result which is wrong because the entry might have 0 refcnt or be already deleted, causing number of problems. It also triggers the WARN_ON() in dst_hold()[1] when a refcnt couldn't be taken. Fix it by using dst_hold_safe() and checking if a reference was actually taken before setting the dst. [1] dmesg WARN_ON log and following refcnt errors WARNING: CPU: 5 PID: 38 at include/net/dst.h:230 br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge] Modules linked in: 8021q garp mrp bridge stp llc bonding ipv6 virtio_net CPU: 5 PID: 38 Comm:
ksoftirqd/5 Kdump: loaded Tainted: G W 5.13.0-rc3+ #360 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 RIP: 0010:br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge] Code: e8 85 bc 01 e1 45 84 f6 74 90 45 31 f6 85 db 48 c7 c7 a0 02 19 a0 41 0f 94 c6 31 c9 31 d2 44 89 f6 e8 64 bc 01 e1 85 db 75 02 <0f> 0b 31 c9 31 d2 44 89 f6 48 c7 c7 70 02 19 a0 e8 4b bc 01 e1 49 RSP:
0018:ffff8881003d39e8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffa01902a0 RBP: ffff8881040c6700 R08:
0000000000000000 R09: 0000000000000001 R10: 2ce93d0054fe0d00 R11: 54fe0d00000e0000 R12: ffff888109515000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000401 FS: 0000000000000000(0000) GS:ffff88822bf40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
00007f42ba70f030 CR3: 0000000109926000 CR4: 00000000000006e0 Call Trace: br_handle_vlan+0xbc/0xca [bridge]
__br_forward+0x23/0x164 [bridge] deliver_clone+0x41/0x48 [bridge] br_handle_frame_finish+0x36f/0x3aa [bridge] ? skb_dst+0x2e/0x38 [bridge] ? br_handle_ingress_vlan_tunnel+0x3e/0x1c8 [bridge] ? br_handle_frame_finish+0x3aa/0x3aa [bridge] br_handle_frame+0x2c3/0x377 [bridge] ? __skb_pull+0x33/0x51 ? vlan_do_receive+0x4f/0x36a ? br_handle_frame_finish+0x3aa/0x3aa [bridge]
__netif_receive_skb_core+0x539/0x7c6 ? __list_del_entry_valid+0x16e/0x1c2
__netif_receive_skb_list_core+0x6d/0xd6 netif_receive_skb_list_internal+0x1d9/0x1fa gro_normal_list+0x22/0x3e dev_gro_receive+0x55b/0x600 ? detach_buf_split+0x58/0x140 napi_gro_receive+0x94/0x12e virtnet_poll+0x15d/0x315 [virtio_net] __napi_poll+0x2c/0x1c9 net_rx_action+0xe6/0x1fb __do_softirq+0x115/0x2d8 run_ksoftirqd+0x18/0x20 smpboot_thread_fn+0x183/0x19c ? smpboot_unregister_percpu_thread+0x66/0x66 kthread+0x10a/0x10f ? kthread_mod_delayed_work+0xb6/0xb6 ret_from_fork+0x22/0x30 ---[ end trace 49f61b07f775fd2b ]--- dst_release: dst:00000000c02d677a refcnt:-1 dst_release underflow (CVE-2021-47222)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47222
https://ubuntu.com/security/CVE-2021-47222

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0011
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47222

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229762 - Linux Distros Unpatched Vulnerability : CVE-2021-47226
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer Both Intel and AMD consider it to be architecturally valid for XRSTOR to fail with #PF but nonetheless change the register state. The actual conditions under which this might occur are unclear [1], but it seems plausible that this might be triggered if one sibling thread unmaps a page and invalidates the shared TLB while another sibling thread is executing XRSTOR on the page in question. __fpu__restore_sig() can execute XRSTOR while the hardware registers are preserved on behalf of a different victim task (using the fpu_fpregs_owner_ctx mechanism), and, in theory, XRSTOR could fail but modify the registers. If this happens, then there is a window in which __fpu__restore_sig() could schedule out and the victim task could schedule back in without reloading its own FPU registers. This would result in part of the FPU state that __fpu__restore_sig() was attempting to load leaking into the victim task's user-visible state. Invalidate preserved FPU registers on XRSTOR failure to prevent this situation from corrupting any state. [1] Frequent readers of the errata lists might imagine complex microarchitectural conditions. (CVE-2021-47226)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47226
https://ubuntu.com/security/CVE-2021-47226

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0006
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47226

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229792 - Linux Distros Unpatched Vulnerability : CVE-2021-47241
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ethtool: strset: fix message length calculation Outer nest for ETHTOOL_A_STRSET_STRINGSETS is not accounted for. This may result in ETHTOOL_MSG_STRSET_GET producing a warning like: calculated message payload length (684) not sufficient WARNING: CPU: 0 PID: 30967 at net/ethtool/netlink.c:369 ethnl_default_doit+0x87a/0xa20 and a splat. As usually with such warnings three conditions must be met for the warning to trigger: - there must be no skb size rounding up (e.g. reply_size of 684); - string set must be per-device (so that the header gets populated); - the device name must be at least 12 characters long. all in all with current user space it looks like reading priv flags is the only place this could potentially happen. Or with syzbot :) (CVE-2021-47241)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47241
https://ubuntu.com/security/CVE-2021-47241

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0026
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47241

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224460 - Linux Distros Unpatched Vulnerability : CVE-2021-47261
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix initializing CQ fragments buffer The function init_cq_frag_buf() can be called to initialize the current CQ fragments buffer cq->buf, or the temporary cq->resize_buf that is filled during CQ resize operation. However, the offending commit started to use function get_cqe() for getting the CQEs, the issue with this change is that get_cqe() always returns CQEs from cq->buf, which leads us to initialize the wrong buffer, and in case of enlarging the CQ we try to access elements beyond the size of the current cq->buf and eventually hit a kernel panic. [exception RIP: init_cq_frag_buf+103] [ffff9f799ddcbcd8] mlx5_ib_resize_cq at ffffffffc0835d60 [mlx5_ib] [ffff9f799ddcbdb0] ib_resize_cq at ffffffffc05270df [ib_core] [ffff9f799ddcbdc0] llt_rdma_setup_qp at ffffffffc0a6a712 [llt] [ffff9f799ddcbe10] llt_rdma_cc_event_action at ffffffffc0a6b411 [llt] [ffff9f799ddcbe98] llt_rdma_client_conn_thread at ffffffffc0a6bb75 [llt] [ffff9f799ddcbec8] kthread at ffffffffa66c5da1 [ffff9f799ddcbf50] ret_from_fork_nospec_begin at ffffffffa6d95ddd Fix it by getting the needed CQE by calling mlx5_frag_buf_get_wqe() that takes the correct source buffer as a parameter. (CVE-2021-47261)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47261
https://ubuntu.com/security/CVE-2021-47261

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0008
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47261

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230193 - Linux Distros Unpatched Vulnerability : CVE-2021-47313
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cpufreq: CPPC: Fix potential memleak in cppc_cpufreq_cpu_init It's a classic example of memleak, we allocate something, we fail and never free the resources. Make sure we free all resources on policy ->init() failures. (CVE-2021-47313)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47313
https://ubuntu.com/security/CVE-2021-47313

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
8.4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.3 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47313

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230195 - Linux Distros Unpatched Vulnerability : CVE-2021-47327
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- iommu/arm-smmu: Fix arm_smmu_device refcount leak when arm_smmu_rpm_get fails arm_smmu_rpm_get() invokes pm_runtime_get_sync(), which increases the refcount of the smmu even though the return value is less than 0. The reference counting issue happens in some error handling paths of arm_smmu_rpm_get() in its caller functions. When arm_smmu_rpm_get() fails, the caller functions forget to decrease the refcount of smmu increased by arm_smmu_rpm_get(), causing a refcount leak. Fix this issue by calling pm_runtime_resume_and_get() instead of pm_runtime_get_sync() in arm_smmu_rpm_get(), which can keep the refcount balanced in case of failure. (CVE-2021-47327)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47327
https://ubuntu.com/security/CVE-2021-47327

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0005
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47327

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229844 - Linux Distros Unpatched Vulnerability : CVE-2021-47398
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Fix kernel pointer leak Pointers should be printed with %p or %px rather than cast to 'unsigned long long' and printed with %llx.
Change %llx to %p to print the secured pointer. (CVE-2021-47398)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47398
https://ubuntu.com/security/CVE-2021-47398

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47398

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224310 - Linux Distros Unpatched Vulnerability : CVE-2021-47404
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- HID: betop: fix slab-out-of-bounds Write in betop_probe Syzbot reported slab-out-of-bounds Write bug in hid-betopff driver. The problem is the driver assumes the device must have an input report but some malicious devices violate this assumption. So this patch checks hid_device's input is non empty before it's been used. (CVE-2021-47404)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47404
https://ubuntu.com/security/CVE-2021-47404

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47404

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230147 - Linux Distros Unpatched Vulnerability : CVE-2021-47444
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/edid: In connector_bad_edid() cap num_of_ext by num_blocks read In commit e11f5bd8228f (drm: Add support for DP 1.4 Compliance edid corruption test) the function connector_bad_edid() started assuming that the memory for the EDID passed to it was big enough to hold `edid[0x7e] + 1` blocks of data (1 extra for the base block). It completely ignored the fact that the function was passed `num_blocks` which indicated how much memory had been allocated for the EDID. Let's fix this by adding a bounds check. This is important for handling the case where there's an error in the first block of the EDID. In that case we will call connector_bad_edid() without having re-allocated memory based on `edid[0x7e]`. (CVE-2021-47444)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47444
https://ubuntu.com/security/CVE-2021-47444

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47444

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230127 - Linux Distros Unpatched Vulnerability : CVE-2021-47449
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ice: fix locking for Tx timestamp tracking flush Commit 4dd0d5c33c3e (ice: add lock around Tx timestamp tracker flush) added a lock around the Tx timestamp tracker flow which is used to cleanup any left over SKBs and prepare for device removal.
This lock is problematic because it is being held around a call to ice_clear_phy_tstamp. The clear function takes a mutex to send a PHY write command to firmware. This could lead to a deadlock if the mutex actually sleeps, and causes the following warning on a kernel with preemption debugging enabled: [ 715.419426] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:573 [ 715.427900] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 3100, name: rmmod [ 715.435652] INFO: lockdep is turned off. [ 715.439591] Preemption disabled at: [ 715.439594] [<0000000000000000>] 0x0 [ 715.446678] CPU: 52 PID: 3100 Comm: rmmod Tainted: G W OE 5.15.0-rc4+ #42 bdd7ec3018e725f159ca0d372ce8c2c0e784891c [ 715.458058] Hardware name: Intel Corporation S2600STQ/S2600STQ, BIOS SE5C620.86B.02.01.0010.010620200716 01/06/2020 [ 715.468483] Call Trace: [ 715.470940] dump_stack_lvl+0x6a/0x9a [ 715.474613]
___might_sleep.cold+0x224/0x26a [ 715.478895] __mutex_lock+0xb3/0x1440 [ 715.482569] ? stack_depot_save+0x378/0x500 [ 715.486763] ? ice_sq_send_cmd+0x78/0x14c0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.494979] ? kfree+0xc1/0x520 [ 715.498128] ? mutex_lock_io_nested+0x12a0/0x12a0 [ 715.502837] ? kasan_set_free_info+0x20/0x30 [ 715.507110] ?
__kasan_slab_free+0x10b/0x140 [ 715.511385] ? slab_free_freelist_hook+0xc7/0x220 [ 715.516092] ? kfree+0xc1/0x520 [ 715.519235] ? ice_deinit_lag+0x16c/0x220 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.527359] ? ice_remove+0x1cf/0x6a0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.535133] ? pci_device_remove+0xab/0x1d0 [ 715.539318] ? __device_release_driver+0x35b/0x690 [ 715.544110] ? driver_detach+0x214/0x2f0 [ 715.548035] ? bus_remove_driver+0x11d/0x2f0 [ 715.552309] ? pci_unregister_driver+0x26/0x250 [ 715.556840] ? ice_module_exit+0xc/0x2f [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.564799] ? __do_sys_delete_module.constprop.0+0x2d8/0x4e0 [ 715.570554] ? do_syscall_64+0x3b/0x90 [ 715.574303] ? entry_SYSCALL_64_after_hwframe+0x44/0xae [ 715.579529] ? start_flush_work+0x542/0x8f0 [ 715.583719] ? ice_sq_send_cmd+0x78/0x14c0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.591923] ice_sq_send_cmd+0x78/0x14c0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.599960] ? wait_for_completion_io+0x250/0x250 [ 715.604662] ? lock_acquire+0x196/0x200 [ 715.608504] ? do_raw_spin_trylock+0xa5/0x160 [ 715.612864] ice_sbq_rw_reg+0x1e6/0x2f0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.620813] ? ice_reset+0x130/0x130 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.628497] ?
__debug_check_no_obj_freed+0x1e8/0x3c0 [ 715.633550] ? trace_hardirqs_on+0x1c/0x130 [ 715.637748] ice_write_phy_reg_e810+0x70/0xf0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.646220] ? do_raw_spin_trylock+0xa5/0x160 [ 715.650581] ? ice_ptp_release+0x910/0x910 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.658797] ? ice_ptp_release+0x255/0x910 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.667013] ice_clear_phy_tstamp+0x2c/0x110 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.675403] ice_ptp_release+0x408/0x910 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.683440] ice_remove+0x560/0x6a0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.691037] ? _raw_spin_unlock_irqrestore+0x46/0x73 [ 715.696005] pci_device_remove+0xab/0x1d0 [ 715.700018] __device_release_driver+0x35b/0x690 [ 715.704637] driver_detach+0x214/0x2f0 [ 715.708389] bus_remove_driver+0x11d/0x2f0 [ 715.712489] pci_unregister_driver+0x26/0x250 [ 71 ---truncated--- (CVE-2021-47449)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47449
https://ubuntu.com/security/CVE-2021-47449

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0004
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47449

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230138 - Linux Distros Unpatched Vulnerability : CVE-2021-47483
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: regmap: Fix possible double-free in regcache_rbtree_exit() In regcache_rbtree_insert_to_block(), when 'present' realloc failed, the 'blk'
which is supposed to assign to 'rbnode->block' will be freed, so 'rbnode->block' points a freed memory, in the error handling path of regcache_rbtree_init(), 'rbnode->block' will be freed again in regcache_rbtree_exit(), KASAN will report double-free as follows: BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390 Call Trace: slab_free_freelist_hook+0x10d/0x240 kfree+0xce/0x390 regcache_rbtree_exit+0x15d/0x1a0 regcache_rbtree_init+0x224/0x2c0 regcache_init+0x88d/0x1310
__regmap_init+0x3151/0x4a80 __devm_regmap_init+0x7d/0x100 madera_spi_probe+0x10f/0x333 [madera_spi] spi_probe+0x183/0x210 really_probe+0x285/0xc30 To fix this, moving up the assignment of rbnode->block to immediately after the reallocation has succeeded so that the data structure stays valid even if the second reallocation fails. (CVE-2021-47483)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47483
https://ubuntu.com/security/CVE-2021-47483

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0005
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47483

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230154 - Linux Distros Unpatched Vulnerability : CVE-2021-47517
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ethtool: do not perform operations on net devices being unregistered There is a short period between a net device starts to be unregistered and when it is actually gone. In that time frame ethtool operations could still be performed, which might end up in unwanted or undefined behaviours[1]. Do not allow ethtool operations after a net device starts its unregistration. This patch targets the netlink part as the ioctl one isn't affected: the reference to the net device is taken and the operation is executed within an rtnl lock section and the net device won't be found after unregister. [1] For example adding Tx queues after unregister ends up in NULL pointer exceptions and UaFs, such as: BUG: KASAN: use-after-free in kobject_get+0x14/0x90 Read of size 1 at addr ffff88801961248c by task ethtool/755 CPU: 0 PID: 755 Comm: ethtool Not tainted 5.15.0-rc6+ #778 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/014 Call Trace:
dump_stack_lvl+0x57/0x72 print_address_description.constprop.0+0x1f/0x140 kasan_report.cold+0x7f/0x11b kobject_get+0x14/0x90 kobject_add_internal+0x3d1/0x450 kobject_init_and_add+0xba/0xf0 netdev_queue_update_kobjects+0xcf/0x200 netif_set_real_num_tx_queues+0xb4/0x310 veth_set_channels+0x1c3/0x550 ethnl_set_channels+0x524/0x610 (CVE-2021-47517)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47517
https://ubuntu.com/security/CVE-2021-47517

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0005
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47517

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229748 - Linux Distros Unpatched Vulnerability : CVE-2021-47536
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/smc: fix wrong list_del in smc_lgr_cleanup_early smc_lgr_cleanup_early() meant to delete the link group from the link group list, but it deleted the list head by mistake. This may cause memory corruption since we didn't remove the real link group from the list and later memseted the link group structure. We got a list corruption panic when testing: [ 231.277259] list_del corruption. prev->next should be ffff8881398a8000, but was 0000000000000000 [ 231.278222] ------------[ cut here ]------------ [ 231.278726] kernel BUG at lib/list_debug.c:53! [ 231.279326] invalid opcode: 0000 [#1] SMP NOPTI [ 231.279803] CPU: 0 PID: 5 Comm:
kworker/0:0 Not tainted 5.10.46+ #435 [ 231.280466] Hardware name: Alibaba Cloud ECS, BIOS 8c24b4c 04/01/2014 [ 231.281248] Workqueue: events smc_link_down_work [ 231.281732] RIP:
0010:__list_del_entry_valid+0x70/0x90 [ 231.282258] Code: 4c 60 82 e8 7d cc 6a 00 0f 0b 48 89 fe 48 c7 c7 88 4c 60 82 e8 6c cc 6a 00 0f 0b 48 89 fe 48 c7 c7 c0 4c 60 82 e8 5b cc 6a 00 <0f> 0b 48 89 fe 48 c7 c7 00 4d 60 82 e8 4a cc 6a 00 0f 0b cc cc cc [ 231.284146] RSP: 0018:ffffc90000033d58 EFLAGS: 00010292 [ 231.284685] RAX: 0000000000000054 RBX: ffff8881398a8000 RCX: 0000000000000000 [ 231.285415] RDX:
0000000000000001 RSI: ffff88813bc18040 RDI: ffff88813bc18040 [ 231.286141] RBP: ffffffff8305ad40 R08:
0000000000000003 R09: 0000000000000001 [ 231.286873] R10: ffffffff82803da0 R11: ffffc90000033b90 R12:
0000000000000001 [ 231.287606] R13: 0000000000000000 R14: ffff8881398a8000 R15: 0000000000000003 [ 231.288337] FS: 0000000000000000(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 [ 231.289160] CS:
0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 231.289754] CR2: 0000000000e72058 CR3: 000000010fa96006 CR4: 00000000003706f0 [ 231.290485] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 231.291211] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 231.291940] Call Trace: [ 231.292211] smc_lgr_terminate_sched+0x53/0xa0 [ 231.292677] smc_switch_conns+0x75/0x6b0 [ 231.293085] ? update_load_avg+0x1a6/0x590 [ 231.293517] ? ttwu_do_wakeup+0x17/0x150 [ 231.293907] ? update_load_avg+0x1a6/0x590 [ 231.294317] ? newidle_balance+0xca/0x3d0 [ 231.294716] smcr_link_down+0x50/0x1a0 [ 231.295090] ? __wake_up_common_lock+0x77/0x90 [ 231.295534] smc_link_down_work+0x46/0x60 [ 231.295933] process_one_work+0x18b/0x350 (CVE-2021-47536)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47536
https://ubuntu.com/security/CVE-2021-47536

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.001
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47536

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230150 - Linux Distros Unpatched Vulnerability : CVE-2021-47539
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() Need to call rxrpc_put_peer() for bundle candidate before kfree() as it holds a ref to rxrpc_peer. [DH: v2: Changed to abstract out the bundle freeing code into a function] (CVE-2021-47539)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47539
https://ubuntu.com/security/CVE-2021-47539

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47539

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229819 - Linux Distros Unpatched Vulnerability : CVE-2021-47561
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: i2c: virtio: disable timeout handling If a timeout is hit, it can result is incorrect data on the I2C bus and/or memory corruptions in the guest since the device can still be operating on the buffers it was given while the guest has freed them. Here is, for example, the start of a slub_debug splat which was triggered on the next transfer after one transfer was forced to timeout by setting a breakpoint in the backend (rust-vmm/vhost-device): BUG kmalloc-1k (Not tainted): Poison overwritten First byte 0x1 instead of 0x6b Allocated in virtio_i2c_xfer+0x65/0x35c age=350 cpu=0 pid=29 __kmalloc+0xc2/0x1c9 virtio_i2c_xfer+0x65/0x35c
__i2c_transfer+0x429/0x57d i2c_transfer+0x115/0x134 i2cdev_ioctl_rdwr+0x16a/0x1de i2cdev_ioctl+0x247/0x2ed vfs_ioctl+0x21/0x30 sys_ioctl+0xb18/0xb41 Freed in virtio_i2c_xfer+0x32e/0x35c age=244 cpu=0 pid=29 kfree+0x1bd/0x1cc virtio_i2c_xfer+0x32e/0x35c __i2c_transfer+0x429/0x57d i2c_transfer+0x115/0x134 i2cdev_ioctl_rdwr+0x16a/0x1de i2cdev_ioctl+0x247/0x2ed vfs_ioctl+0x21/0x30 sys_ioctl+0xb18/0xb41 There is no simple fix for this (the driver would have to always create bounce buffers and hold on to them until the device eventually returns the buffers), so just disable the timeout support for now. (CVE-2021-47561)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47561
https://ubuntu.com/security/CVE-2021-47561

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0012
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47561

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229747 - Linux Distros Unpatched Vulnerability : CVE-2021-47576
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() In resp_mode_select() sanity check the block descriptor len to avoid UAF. BUG: KASAN: use-after-free in resp_mode_select+0xa4c/0xb40 drivers/scsi/scsi_debug.c:2509 Read of size 1 at addr ffff888026670f50 by task scsicmd/15032 CPU: 1 PID:
15032 Comm: scsicmd Not tainted 5.15.0-01d0625 #15 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Call Trace: <TASK> dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:107 print_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:257 kasan_report.cold.14+0x7d/0x117 mm/kasan/report.c:443 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report_generic.c:306 resp_mode_select+0xa4c/0xb40 drivers/scsi/scsi_debug.c:2509 schedule_resp+0x4af/0x1a10 drivers/scsi/scsi_debug.c:5483 scsi_debug_queuecommand+0x8c9/0x1e70 drivers/scsi/scsi_debug.c:7537 scsi_queue_rq+0x16b4/0x2d10 drivers/scsi/scsi_lib.c:1521 blk_mq_dispatch_rq_list+0xb9b/0x2700 block/blk- mq.c:1640 __blk_mq_sched_dispatch_requests+0x28f/0x590 block/blk-mq-sched.c:325 blk_mq_sched_dispatch_requests+0x105/0x190 block/blk-mq-sched.c:358 __blk_mq_run_hw_queue+0xe5/0x150 block/blk-mq.c:1762 __blk_mq_delay_run_hw_queue+0x4f8/0x5c0 block/blk-mq.c:1839 blk_mq_run_hw_queue+0x18d/0x350 block/blk-mq.c:1891 blk_mq_sched_insert_request+0x3db/0x4e0 block/blk-mq- sched.c:474 blk_execute_rq_nowait+0x16b/0x1c0 block/blk-exec.c:63 sg_common_write.isra.18+0xeb3/0x2000 drivers/scsi/sg.c:837 sg_new_write.isra.19+0x570/0x8c0 drivers/scsi/sg.c:775 sg_ioctl_common+0x14d6/0x2710 drivers/scsi/sg.c:941 sg_ioctl+0xa2/0x180 drivers/scsi/sg.c:1166 __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:52 do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:50 entry_SYSCALL_64_after_hwframe+0x44/0xae arch/x86/entry/entry_64.S:113 (CVE-2021-47576)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47576
https://ubuntu.com/security/CVE-2021-47576

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47576

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229823 - Linux Distros Unpatched Vulnerability : CVE-2021-47609
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: Fix string overflow in SCPI genpd driver Without the bound checks for scpi_pd->name, it could result in the buffer overflow when copying the SCPI device name from the corresponding device tree node as the name string is set at maximum size of 30. Let us fix it by using devm_kasprintf so that the string buffer is allocated dynamically. (CVE-2021-47609)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47609
https://ubuntu.com/security/CVE-2021-47609

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47609

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224325 - Linux Distros Unpatched Vulnerability : CVE-2021-47613
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: i2c: virtio: fix completion handling The driver currently assumes that the notify callback is only received when the device is done with all the queued buffers. However, this is not true, since the notify callback could be called without any of the queued buffers being completed (for example, with virtio-pci and shared interrupts) or with only some of the buffers being completed (since the driver makes them available to the device in multiple separate virtqueue_add_sgs() calls). This can lead to incorrect data on the I2C bus or memory corruption in the guest if the device operates on buffers which are have been freed by the driver. (The WARN_ON in the driver is also triggered.) BUG kmalloc-128 (Tainted: G W ): Poison overwritten First byte 0x0 instead of 0x6b Allocated in i2cdev_ioctl_rdwr+0x9d/0x1de age=243 cpu=0 pid=28 memdup_user+0x2e/0xbd i2cdev_ioctl_rdwr+0x9d/0x1de i2cdev_ioctl+0x247/0x2ed vfs_ioctl+0x21/0x30 sys_ioctl+0xb18/0xb41 Freed in i2cdev_ioctl_rdwr+0x1bb/0x1de age=68 cpu=0 pid=28 kfree+0x1bd/0x1cc i2cdev_ioctl_rdwr+0x1bb/0x1de i2cdev_ioctl+0x247/0x2ed vfs_ioctl+0x21/0x30 sys_ioctl+0xb18/0xb41 Fix this by calling virtio_get_buf() from the notify handler like other virtio drivers and by actually waiting for all the buffers to be completed. (CVE-2021-47613)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47613
https://ubuntu.com/security/CVE-2021-47613

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47613

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230205 - Linux Distros Unpatched Vulnerability : CVE-2021-47616
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA: Fix use-after-free in rxe_queue_cleanup On error handling path in rxe_qp_from_init() qp->sq.queue is freed and then rxe_create_qp() will drop last reference to this object. qp clean up function will try to free this queue one time and it causes UAF bug. Fix it by zeroing queue pointer after freeing queue in rxe_qp_from_init().
(CVE-2021-47616)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47616
https://ubuntu.com/security/CVE-2021-47616

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0006
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47616

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224395 - Linux Distros Unpatched Vulnerability : CVE-2021-47634
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl Hulk Robot reported a KASAN report about use-after-free:
================================================================== BUG: KASAN: use-after-free in
__list_del_entry_valid+0x13d/0x160 Read of size 8 at addr ffff888035e37d98 by task ubiattach/1385 [...] Call Trace: klist_dec_and_del+0xa7/0x4a0 klist_put+0xc7/0x1a0 device_del+0x4d4/0xed0 cdev_device_del+0x1a/0x80 ubi_attach_mtd_dev+0x2951/0x34b0 [ubi] ctrl_cdev_ioctl+0x286/0x2f0 [ubi] Allocated by task 1414: device_add+0x60a/0x18b0 cdev_device_add+0x103/0x170 ubi_create_volume+0x1118/0x1a10 [ubi] ubi_cdev_ioctl+0xb7f/0x1ba0 [ubi] Freed by task 1385:
cdev_device_del+0x1a/0x80 ubi_remove_volume+0x438/0x6c0 [ubi] ubi_cdev_ioctl+0xbf4/0x1ba0 [ubi] [...] ================================================================== The lock held by ctrl_cdev_ioctl is ubi_devices_mutex, but the lock held by ubi_cdev_ioctl is ubi->device_mutex. Therefore, the two locks can be concurrent. ctrl_cdev_ioctl contains two operations: ubi_attach and ubi_detach. ubi_detach is bug-free because it uses reference counting to prevent concurrency. However, uif_init and uif_close in ubi_attach may race with ubi_cdev_ioctl. uif_init will race with ubi_cdev_ioctl as in the following stack. cpu1 cpu2 cpu3 _______________________|________________________|______________________ ctrl_cdev_ioctl ubi_attach_mtd_dev uif_init ubi_cdev_ioctl ubi_create_volume cdev_device_add ubi_add_volume // sysfs exist kill_volumes ubi_cdev_ioctl ubi_remove_volume cdev_device_del // first free ubi_free_volume cdev_del // double free cdev_device_del And uif_close will race with ubi_cdev_ioctl as in the following stack. cpu1 cpu2 cpu3 _______________________|________________________|______________________ ctrl_cdev_ioctl ubi_attach_mtd_dev uif_init ubi_cdev_ioctl ubi_create_volume cdev_device_add ubi_debugfs_init_dev //error goto out_uif; uif_close kill_volumes ubi_cdev_ioctl ubi_remove_volume cdev_device_del // first free ubi_free_volume // double free The cause of this problem is that commit 714fb87e8bc0 make device available before it becomes accessible via sysfs. Therefore, we roll back the modification. We will fix the race condition between ubi device creation and udev by removing ubi_get_device in vol_attribute_show and dev_attribute_show.This avoids accessing uninitialized ubi_devices[ubi_num]. ubi_get_device is used to prevent devices from being deleted during sysfs execution. However, now kernfs ensures that devices will not be deleted before all reference counting are released. The key process is shown in the following stack. device_del device_remove_attrs device_remove_groups sysfs_remove_groups sysfs_remove_group remove_files kernfs_remove_by_name kernfs_remove_by_name_ns __kernfs_remove kernfs_drain (CVE-2021-47634)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47634
https://ubuntu.com/security/CVE-2021-47634

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47634

Plugin Information
Published: 2025/03/05, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230042 - Linux Distros Unpatched Vulnerability : CVE-2022-0351
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.
(CVE-2022-0351)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-0351

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-0351

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
229723 - Linux Distros Unpatched Vulnerability : CVE-2022-0500
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in the Linux kernel's BPF subsystem due to the way a user loads BTF. This flaw allows a local user to crash or escalate their privileges on the system. (CVE-2022-0500)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-0500
https://security-tracker.debian.org/tracker/CVE-2022-0500
https://ubuntu.com/security/CVE-2022-0500

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-0500

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229707 - Linux Distros Unpatched Vulnerability : CVE-2022-1616
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution (CVE-2022-1616)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-1616

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0022
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-1616

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
230004 - Linux Distros Unpatched Vulnerability : CVE-2022-1619
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899.
This vulnerabilities are capable of crashing software, modify memory, and possible remote execution (CVE-2022-1619)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-1619
https://security-tracker.debian.org/tracker/CVE-2022-1619

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0065
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-1619

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
230084 - Linux Distros Unpatched Vulnerability : CVE-2022-1620
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 allows attackers to cause a denial of service (application crash) via a crafted input. (CVE-2022-1620)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-1620
https://security-tracker.debian.org/tracker/CVE-2022-1620

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0011
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-1620

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
229969 - Linux Distros Unpatched Vulnerability : CVE-2022-1708
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability. (CVE-2022-1708)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-1708

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0021
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-1708

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- conmon
229620 - Linux Distros Unpatched Vulnerability : CVE-2022-1720
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Buffer Over-read in function grab_file_name in GitHub repository vim/vim prior to 8.2.4956. This vulnerability is capable of crashing the software, memory modification, and possible remote execution.
(CVE-2022-1720)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-1720
https://security-tracker.debian.org/tracker/CVE-2022-1720
https://ubuntu.com/security/CVE-2022-1720

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0038
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-1720

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
229635 - Linux Distros Unpatched Vulnerability : CVE-2022-1920
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a heap overwrite while parsing matroska files. Potential for arbitrary code execution through heap overwrite. (CVE-2022-1920)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-1920

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.4 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0007
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.8 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2022-1920

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gstreamer1-plugins-good
- gstreamer1-plugins-good-gtk
229715 - Linux Distros Unpatched Vulnerability : CVE-2022-1921
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while parsing avi files. Potential for arbitrary code execution through heap overwrite. (CVE-2022-1921)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-1921

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.4 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.8 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2022-1921

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gstreamer1-plugins-good
- gstreamer1-plugins-good-gtk
230038 - Linux Distros Unpatched Vulnerability : CVE-2022-1922
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux element in gst_matroska_decompress_data function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite. (CVE-2022-1922)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-1922

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.4 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.8 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2022-1922

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gstreamer1-plugins-good
- gstreamer1-plugins-good-gtk
229661 - Linux Distros Unpatched Vulnerability : CVE-2022-1923
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite. (CVE-2022-1923)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-1923

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.4 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.8 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2022-1923

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gstreamer1-plugins-good
- gstreamer1-plugins-good-gtk
230085 - Linux Distros Unpatched Vulnerability : CVE-2022-1924
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux element in lzo decompression function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite. (CVE-2022-1924)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-1924

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.4 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.8 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2022-1924

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gstreamer1-plugins-good
- gstreamer1-plugins-good-gtk
229626 - Linux Distros Unpatched Vulnerability : CVE-2022-1925
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the matroskaparse element has no size checks. (CVE-2022-1925)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-1925

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.4 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.8 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2022-1925

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gstreamer1-plugins-good
- gstreamer1-plugins-good-gtk
229676 - Linux Distros Unpatched Vulnerability : CVE-2022-2042
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Use After Free in GitHub repository vim/vim prior to 8.2. (CVE-2022-2042)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2042
https://security-tracker.debian.org/tracker/CVE-2022-2042

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0008
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2042

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
230039 - Linux Distros Unpatched Vulnerability : CVE-2022-2122
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in qtdemux_inflate function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. (CVE-2022-2122)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2122
https://ubuntu.com/security/CVE-2022-2122

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.4 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2022-2122

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gstreamer1-plugins-good
- gstreamer1-plugins-good-gtk
230080 - Linux Distros Unpatched Vulnerability : CVE-2022-2124
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Buffer Over-read in GitHub repository vim/vim prior to 8.2. (CVE-2022-2124)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2124
https://security-tracker.debian.org/tracker/CVE-2022-2124

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0008
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2124

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
229650 - Linux Distros Unpatched Vulnerability : CVE-2022-2125
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. (CVE-2022-2125)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2125
https://security-tracker.debian.org/tracker/CVE-2022-2125

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0007
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2125

Plugin Information
Published: 2025/03/05, Modified: 2025/10/08
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
230007 - Linux Distros Unpatched Vulnerability : CVE-2022-2126
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. (CVE-2022-2126)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2126
https://security-tracker.debian.org/tracker/CVE-2022-2126

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0008
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2126

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
229740 - Linux Distros Unpatched Vulnerability : CVE-2022-2129
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. (CVE-2022-2129)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2129

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0007
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2129

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
229678 - Linux Distros Unpatched Vulnerability : CVE-2022-2175
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Buffer Over-read in GitHub repository vim/vim prior to 8.2. (CVE-2022-2175)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2175
https://security-tracker.debian.org/tracker/CVE-2022-2175

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0009
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2175

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
229675 - Linux Distros Unpatched Vulnerability : CVE-2022-2182
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. (CVE-2022-2182)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2182
https://security-tracker.debian.org/tracker/CVE-2022-2182

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0105
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2182

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
230074 - Linux Distros Unpatched Vulnerability : CVE-2022-2183
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. (CVE-2022-2183)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2183
https://security-tracker.debian.org/tracker/CVE-2022-2183

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0083
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2183

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
229654 - Linux Distros Unpatched Vulnerability : CVE-2022-2206
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. (CVE-2022-2206)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2206
https://security-tracker.debian.org/tracker/CVE-2022-2206

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0008
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2206

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
229646 - Linux Distros Unpatched Vulnerability : CVE-2022-2207
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. (CVE-2022-2207)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2207
https://security-tracker.debian.org/tracker/CVE-2022-2207

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0009
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2207

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
229973 - Linux Distros Unpatched Vulnerability : CVE-2022-2210
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. (CVE-2022-2210)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2210
https://security-tracker.debian.org/tracker/CVE-2022-2210

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0008
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2210

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
229697 - Linux Distros Unpatched Vulnerability : CVE-2022-2257
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. (CVE-2022-2257)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2257
https://security-tracker.debian.org/tracker/CVE-2022-2257

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0008
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2257

Plugin Information
Published: 2025/03/05, Modified: 2025/09/06
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
229992 - Linux Distros Unpatched Vulnerability : CVE-2022-2284
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. (CVE-2022-2284)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2284
https://security-tracker.debian.org/tracker/CVE-2022-2284

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0012
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2284

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
229695 - Linux Distros Unpatched Vulnerability : CVE-2022-2285
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0. (CVE-2022-2285)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2285
https://security-tracker.debian.org/tracker/CVE-2022-2285

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0013
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2285

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
230067 - Linux Distros Unpatched Vulnerability : CVE-2022-2286
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. (CVE-2022-2286)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2286
https://security-tracker.debian.org/tracker/CVE-2022-2286

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0012
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2286

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
229971 - Linux Distros Unpatched Vulnerability : CVE-2022-2287
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. (CVE-2022-2287)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2287
https://security-tracker.debian.org/tracker/CVE-2022-2287

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0004
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2287

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
230047 - Linux Distros Unpatched Vulnerability : CVE-2022-2304
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. (CVE-2022-2304)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2304

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0005
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2304

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
229667 - Linux Distros Unpatched Vulnerability : CVE-2022-2309
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.
(CVE-2022-2309)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2309
https://security-tracker.debian.org/tracker/CVE-2022-2309
https://ubuntu.com/security/CVE-2022-2309

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0048
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2022-2309

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- python3-lxml
230063 - Linux Distros Unpatched Vulnerability : CVE-2022-23222
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of the availability of pointer arithmetic via certain *_OR_NULL pointer types. (CVE-2022-23222)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-23222
https://ubuntu.com/security/CVE-2022-23222

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.2 (CVSS:3.0/E:F/RL:O/RC:C)
VPR Score
7.4
EPSS Score
0.0027
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.0 (CVSS2#E:F/RL:OF/RC:C)
References

CVE | CVE-2022-23222

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229984 - Linux Distros Unpatched Vulnerability : CVE-2022-2343
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044. (CVE-2022-2343)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2343
https://security-tracker.debian.org/tracker/CVE-2022-2343

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0011
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2343

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
229986 - Linux Distros Unpatched Vulnerability : CVE-2022-2344
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0045. (CVE-2022-2344)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2344
https://security-tracker.debian.org/tracker/CVE-2022-2344

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2344

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
229999 - Linux Distros Unpatched Vulnerability : CVE-2022-2345
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Use After Free in GitHub repository vim/vim prior to 9.0.0046. (CVE-2022-2345)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2345
https://security-tracker.debian.org/tracker/CVE-2022-2345

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2345

Plugin Information
Published: 2025/03/05, Modified: 2025/10/08
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224499 - Linux Distros Unpatched Vulnerability : CVE-2022-24795
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version 1.4.2. As a workaround, avoid passing large inputs to YAJL. (CVE-2022-24795)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-24795
https://security-tracker.debian.org/tracker/CVE-2022-24795
https://ubuntu.com/security/CVE-2022-24795

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0075
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2022-24795

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- yajl
224513 - Linux Distros Unpatched Vulnerability : CVE-2022-2522
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061. (CVE-2022-2522)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2522
https://security-tracker.debian.org/tracker/CVE-2022-2522
https://ubuntu.com/security/CVE-2022-2522

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2522

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224506 - Linux Distros Unpatched Vulnerability : CVE-2022-25265
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 (e.g., with GCC 3.2.2 and Linux kernel 2.4.20). This can cause execution of bytes located in supposedly non-executable regions of a file. (CVE-2022-25265)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-25265
https://security-tracker.debian.org/tracker/CVE-2022-25265
https://ubuntu.com/security/CVE-2022-25265

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.4 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0018
CVSS v2.0 Base Score
4.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2022-25265

Plugin Information
Published: 2025/03/05, Modified: 2025/12/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224557 - Linux Distros Unpatched Vulnerability : CVE-2022-25881
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library. (CVE-2022-25881)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-25881

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0012
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-25881

Plugin Information
Published: 2025/03/05, Modified: 2025/08/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- dotnet-host
- netstandard-targeting-pack-2.1
224549 - Linux Distros Unpatched Vulnerability : CVE-2022-26981
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Liblouis through 3.21.0 has a buffer overflow in compilePassOpcode in compileTranslationTable.c (called, indirectly, by tools/lou_checktable.c). (CVE-2022-26981)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-26981
https://security-tracker.debian.org/tracker/CVE-2022-26981
https://ubuntu.com/security/CVE-2022-26981

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0014
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-26981

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- liblouis
- python3-louis
224590 - Linux Distros Unpatched Vulnerability : CVE-2022-27239
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges. (CVE-2022-27239)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-27239

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0007
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-27239

Plugin Information
Published: 2025/03/05, Modified: 2025/09/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- cifs-utils
224552 - Linux Distros Unpatched Vulnerability : CVE-2022-27664
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. (CVE-2022-27664)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-27664
https://security-tracker.debian.org/tracker/CVE-2022-27664
https://ubuntu.com/security/CVE-2022-27664

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0009
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-27664

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- containernetworking-plugins
- podman
224624 - Linux Distros Unpatched Vulnerability : CVE-2022-28131
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document. (CVE-2022-28131)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-28131
https://security-tracker.debian.org/tracker/CVE-2022-28131

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-28131

Plugin Information
Published: 2025/03/05, Modified: 2025/08/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- podman
224645 - Linux Distros Unpatched Vulnerability : CVE-2022-2817
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Use After Free in GitHub repository vim/vim prior to 9.0.0213. (CVE-2022-2817)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2817
https://security-tracker.debian.org/tracker/CVE-2022-2817

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2817

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224634 - Linux Distros Unpatched Vulnerability : CVE-2022-2819
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0211. (CVE-2022-2819)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2819
https://security-tracker.debian.org/tracker/CVE-2022-2819

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2819

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224633 - Linux Distros Unpatched Vulnerability : CVE-2022-2845
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Improper Validation of Specified Quantity in Input in GitHub repository vim/vim prior to 9.0.0218.
(CVE-2022-2845)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2845
https://security-tracker.debian.org/tracker/CVE-2022-2845
https://ubuntu.com/security/CVE-2022-2845

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0053
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2845

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224660 - Linux Distros Unpatched Vulnerability : CVE-2022-2849
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0220. (CVE-2022-2849)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2849
https://security-tracker.debian.org/tracker/CVE-2022-2849
https://ubuntu.com/security/CVE-2022-2849

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2849

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224653 - Linux Distros Unpatched Vulnerability : CVE-2022-2862
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Use After Free in GitHub repository vim/vim prior to 9.0.0221. (CVE-2022-2862)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2862
https://security-tracker.debian.org/tracker/CVE-2022-2862

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0008
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2862

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224681 - Linux Distros Unpatched Vulnerability : CVE-2022-2879
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics.
After fix, Reader.Read limits the maximum size of header blocks to 1 MiB. (CVE-2022-2879)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2879
https://security-tracker.debian.org/tracker/CVE-2022-2879
https://ubuntu.com/security/CVE-2022-2879

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-2879

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- podman
224706 - Linux Distros Unpatched Vulnerability : CVE-2022-2880
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged. (CVE-2022-2880)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2880
https://security-tracker.debian.org/tracker/CVE-2022-2880
https://ubuntu.com/security/CVE-2022-2880

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2880

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- podman
224637 - Linux Distros Unpatched Vulnerability : CVE-2022-2889
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Use After Free in GitHub repository vim/vim prior to 9.0.0225. (CVE-2022-2889)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2889
https://security-tracker.debian.org/tracker/CVE-2022-2889

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2889

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224702 - Linux Distros Unpatched Vulnerability : CVE-2022-29167
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`. (CVE-2022-29167)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-29167

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0007
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-29167

Plugin Information
Published: 2025/03/05, Modified: 2025/08/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
- gjs
224701 - Linux Distros Unpatched Vulnerability : CVE-2022-2946
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Use After Free in GitHub repository vim/vim prior to 9.0.0246. (CVE-2022-2946)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2946
https://security-tracker.debian.org/tracker/CVE-2022-2946
https://ubuntu.com/security/CVE-2022-2946

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2946

Plugin Information
Published: 2025/03/05, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224650 - Linux Distros Unpatched Vulnerability : CVE-2022-2982
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Use After Free in GitHub repository vim/vim prior to 9.0.0260. (CVE-2022-2982)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2982
https://security-tracker.debian.org/tracker/CVE-2022-2982

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2982

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224620 - Linux Distros Unpatched Vulnerability : CVE-2022-3016
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Use After Free in GitHub repository vim/vim prior to 9.0.0286. (CVE-2022-3016)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-3016
https://security-tracker.debian.org/tracker/CVE-2022-3016
https://ubuntu.com/security/CVE-2022-3016

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-3016

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224677 - Linux Distros Unpatched Vulnerability : CVE-2022-3037
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Use After Free in GitHub repository vim/vim prior to 9.0.0322. (CVE-2022-3037)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-3037
https://security-tracker.debian.org/tracker/CVE-2022-3037
https://ubuntu.com/security/CVE-2022-3037

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-3037

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224676 - Linux Distros Unpatched Vulnerability : CVE-2022-30630
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.
(CVE-2022-30630)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-30630

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-30630

Plugin Information
Published: 2025/03/05, Modified: 2025/09/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- containernetworking-plugins
- podman
224712 - Linux Distros Unpatched Vulnerability : CVE-2022-30631
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files. (CVE-2022-30631)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-30631
https://security-tracker.debian.org/tracker/CVE-2022-30631

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-30631

Plugin Information
Published: 2025/03/05, Modified: 2025/08/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- containernetworking-plugins
- podman
224612 - Linux Distros Unpatched Vulnerability : CVE-2022-30632
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.
(CVE-2022-30632)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-30632
https://security-tracker.debian.org/tracker/CVE-2022-30632

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0007
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-30632

Plugin Information
Published: 2025/03/05, Modified: 2025/08/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- containernetworking-plugins
- podman
224651 - Linux Distros Unpatched Vulnerability : CVE-2022-30633
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag. (CVE-2022-30633)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-30633
https://security-tracker.debian.org/tracker/CVE-2022-30633

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0007
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-30633

Plugin Information
Published: 2025/03/05, Modified: 2025/08/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- podman
224698 - Linux Distros Unpatched Vulnerability : CVE-2022-30635
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.
(CVE-2022-30635)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-30635
https://security-tracker.debian.org/tracker/CVE-2022-30635

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0013
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-30635

Plugin Information
Published: 2025/03/05, Modified: 2025/08/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- containernetworking-plugins
224662 - Linux Distros Unpatched Vulnerability : CVE-2022-3099
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Use After Free in GitHub repository vim/vim prior to 9.0.0360. (CVE-2022-3099)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-3099

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-3099

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224781 - Linux Distros Unpatched Vulnerability : CVE-2022-3134
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Use After Free in GitHub repository vim/vim prior to 9.0.0389. (CVE-2022-3134)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-3134
https://ubuntu.com/security/CVE-2022-3134

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-3134

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224734 - Linux Distros Unpatched Vulnerability : CVE-2022-32149
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse. (CVE-2022-32149)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-32149
https://security-tracker.debian.org/tracker/CVE-2022-32149
https://ubuntu.com/security/CVE-2022-32149

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-32149

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- podman
224721 - Linux Distros Unpatched Vulnerability : CVE-2022-32189
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service. (CVE-2022-32189)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-32189
https://security-tracker.debian.org/tracker/CVE-2022-32189
https://ubuntu.com/security/CVE-2022-32189

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0009
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-32189

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- containernetworking-plugins
- podman
224745 - Linux Distros Unpatched Vulnerability : CVE-2022-3234
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483. (CVE-2022-3234)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-3234
https://security-tracker.debian.org/tracker/CVE-2022-3234

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-3234

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224733 - Linux Distros Unpatched Vulnerability : CVE-2022-3235
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Use After Free in GitHub repository vim/vim prior to 9.0.0490. (CVE-2022-3235)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-3235
https://security-tracker.debian.org/tracker/CVE-2022-3235
https://ubuntu.com/security/CVE-2022-3235

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-3235

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224792 - Linux Distros Unpatched Vulnerability : CVE-2022-3256
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Use After Free in GitHub repository vim/vim prior to 9.0.0530. (CVE-2022-3256)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-3256
https://security-tracker.debian.org/tracker/CVE-2022-3256

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-3256

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224747 - Linux Distros Unpatched Vulnerability : CVE-2022-3296
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577. (CVE-2022-3296)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-3296
https://security-tracker.debian.org/tracker/CVE-2022-3296
https://ubuntu.com/security/CVE-2022-3296

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-3296

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224725 - Linux Distros Unpatched Vulnerability : CVE-2022-3297
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Use After Free in GitHub repository vim/vim prior to 9.0.0579. (CVE-2022-3297)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-3297
https://security-tracker.debian.org/tracker/CVE-2022-3297
https://ubuntu.com/security/CVE-2022-3297

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-3297

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224744 - Linux Distros Unpatched Vulnerability : CVE-2022-3324
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598. (CVE-2022-3324)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-3324

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-3324

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224724 - Linux Distros Unpatched Vulnerability : CVE-2022-3352
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Use After Free in GitHub repository vim/vim prior to 9.0.0614. (CVE-2022-3352)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-3352
https://security-tracker.debian.org/tracker/CVE-2022-3352

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-3352

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224838 - Linux Distros Unpatched Vulnerability : CVE-2022-3517
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service. (CVE-2022-3517)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-3517

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0046
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-3517

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gjs
224853 - Linux Distros Unpatched Vulnerability : CVE-2022-3534
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability classified as critical has been found in Linux Kernel. Affected is the function btf_dump_name_dups of the file tools/lib/bpf/btf_dump.c of the component libbpf. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211032. (CVE-2022-3534)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-3534
https://ubuntu.com/security/CVE-2022-3534

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
8.0 (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-3534

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224837 - Linux Distros Unpatched Vulnerability : CVE-2022-3705
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was found in vim and classified as problematic. Affected by this issue is the function qf_update_buffer of the file quickfix.c of the component autocmd Handler. The manipulation leads to use after free. The attack may be launched remotely. Upgrading to version 9.0.0805 is able to address this issue. The name of the patch is d0fab10ed2a86698937e3c3fed2f10bd9bb5e731. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-212324. (CVE-2022-3705)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-3705
https://security-tracker.debian.org/tracker/CVE-2022-3705
https://ubuntu.com/security/CVE-2022-3705

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0018
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-3705

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
250386 - Linux Distros Unpatched Vulnerability : CVE-2022-37603
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
(CVE-2022-37603)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-37603
https://ubuntu.com/security/CVE-2022-37603

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0085
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2022-37603

Plugin Information
Published: 2025/08/18, Modified: 2025/10/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gjs
224856 - Linux Distros Unpatched Vulnerability : CVE-2022-38784
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2022-38171 in Xpdf. (CVE-2022-38784)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-38784
https://ubuntu.com/security/CVE-2022-38784

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.4 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0005
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2022-38784

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- poppler
- poppler-cpp
- poppler-glib
- poppler-utils
225014 - Linux Distros Unpatched Vulnerability : CVE-2022-39176
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len. (CVE-2022-39176)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-39176
https://ubuntu.com/security/CVE-2022-39176

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0007
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-39176

Plugin Information
Published: 2025/03/05, Modified: 2025/09/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bluez
- bluez-libs
- bluez-obexd
224929 - Linux Distros Unpatched Vulnerability : CVE-2022-39177
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be processed in profiles/audio/avdtp.c. (CVE-2022-39177)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-39177
https://ubuntu.com/security/CVE-2022-39177

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0004
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-39177

Plugin Information
Published: 2025/03/05, Modified: 2025/09/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bluez
- bluez-libs
- bluez-obexd
225001 - Linux Distros Unpatched Vulnerability : CVE-2022-40674
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. (CVE-2022-40674)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-40674
https://security-tracker.debian.org/tracker/CVE-2022-40674
https://ubuntu.com/security/CVE-2022-40674

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
8.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0059
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-40674

Plugin Information
Published: 2025/03/05, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
224923 - Linux Distros Unpatched Vulnerability : CVE-2022-41409
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input. (CVE-2022-41409)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-41409
https://security-tracker.debian.org/tracker/CVE-2022-41409
https://ubuntu.com/security/CVE-2022-41409

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-41409

Plugin Information
Published: 2025/03/05, Modified: 2025/09/06
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- pcre2
- pcre2-devel
- pcre2-syntax
- pcre2-utf16
- pcre2-utf32
224960 - Linux Distros Unpatched Vulnerability : CVE-2022-4141
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command. (CVE-2022-4141)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-4141
https://ubuntu.com/security/CVE-2022-4141

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-4141

Plugin Information
Published: 2025/03/05, Modified: 2025/10/08
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224933 - Linux Distros Unpatched Vulnerability : CVE-2022-41715
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected. (CVE-2022-41715)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-41715
https://security-tracker.debian.org/tracker/CVE-2022-41715
https://ubuntu.com/security/CVE-2022-41715

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-41715

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- containernetworking-plugins
- podman
224963 - Linux Distros Unpatched Vulnerability : CVE-2022-4292
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Use After Free in GitHub repository vim/vim prior to 9.0.0882. (CVE-2022-4292)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-4292
https://security-tracker.debian.org/tracker/CVE-2022-4292

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0035
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-4292

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
225037 - Linux Distros Unpatched Vulnerability : CVE-2022-43680
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. (CVE-2022-43680)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-43680
https://security-tracker.debian.org/tracker/CVE-2022-43680
https://ubuntu.com/security/CVE-2022-43680

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0024
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2022-43680

Plugin Information
Published: 2025/03/05, Modified: 2025/10/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
225056 - Linux Distros Unpatched Vulnerability : CVE-2022-4450
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the name (e.g.
CERTIFICATE), any header data and the payload data. If the function succeeds then the name_out, header and data arguments are populated with pointers to buffers containing the relevant decoded data.
The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue. (CVE-2022-4450)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-4450
https://ubuntu.com/security/CVE-2022-4450

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0012
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-4450

Plugin Information
Published: 2025/03/05, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- compat-openssl11
225083 - Linux Distros Unpatched Vulnerability : CVE-2022-44840
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Heap buffer overflow vulnerability in binutils readelf before 2.40 via function find_section_in_set in file readelf.c. (CVE-2022-44840)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-44840
https://security-tracker.debian.org/tracker/CVE-2022-44840

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-44840

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-12-binutils
- gcc-toolset-12-binutils-devel
- gcc-toolset-12-binutils-gold
- gcc-toolset-13-binutils
- gcc-toolset-13-binutils-devel
- gcc-toolset-13-binutils-gold
225104 - Linux Distros Unpatched Vulnerability : CVE-2022-46175
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named `__proto__`, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by `JSON5.parse` and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from `JSON5.parse`. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. `JSON5.parse` should restrict parsing of `__proto__` keys when parsing JSON strings to objects. As a point of reference, the `JSON.parse` method included in JavaScript ignores `__proto__` keys. Simply changing `JSON5.parse` to `JSON.parse` in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later. (CVE-2022-46175)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-46175

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.3 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.3679
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.8 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2022-46175

Plugin Information
Published: 2025/03/05, Modified: 2025/11/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gjs
225231 - Linux Distros Unpatched Vulnerability : CVE-2022-48643
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix nft_counters_enabled underflow at nf_tables_addchain() syzbot is reporting underflow of nft_counters_enabled counter at nf_tables_addchain() [1], for commit 43eb8949cfdffa76 (netfilter:
nf_tables: do not leave chain stats enabled on error) missed that nf_tables_chain_destroy() after nft_basechain_init() in the error path of nf_tables_addchain() decrements the counter because nft_basechain_init() makes nft_is_base_chain() return true by setting NFT_CHAIN_BASE flag. Increment the counter immediately after returning from nft_basechain_init(). (CVE-2022-48643)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48643
https://ubuntu.com/security/CVE-2022-48643

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0012
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48643

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225321 - Linux Distros Unpatched Vulnerability : CVE-2022-48652
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ice: Fix crash by keep old cfg when update TCs more than queues There are problems if allocated queues less than Traffic Classes. Commit a632b2a4c920 (ice: ethtool: Prohibit improper channel config for DCB) already disallow setting less queues than TCs. Another case is if we first set less queues, and later update more TCs config due to LLDP, ice_vsi_cfg_tc() will failed but left dirty num_txq/rxq and tc_cfg in vsi, that will cause invalid pointer access. [ 95.968089] ice 0000:3b:00.1: More TCs defined than queues/rings allocated. [ 95.968092] ice 0000:3b:00.1: Trying to use more Rx queues (8), than were allocated (1)! [ 95.968093] ice 0000:3b:00.1: Failed to config TC for VSI index: 0 [ 95.969621] general protection fault: 0000 [#1] SMP NOPTI [ 95.969705] CPU: 1 PID: 58405 Comm: lldpad Kdump: loaded Tainted: G U W O --------- -t - 4.18.0 #1 [ 95.969867] Hardware name: O.E.M/BC11SPSCB10, BIOS 8.23 12/30/2021 [ 95.969992] RIP:
0010:devm_kmalloc+0xa/0x60 [ 95.970052] Code: 5c ff ff ff 31 c0 5b 5d 41 5c c3 b8 f4 ff ff ff eb f4 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 89 d1 <8b> 97 60 02 00 00 48 8d 7e 18 48 39 f7 72 3f 55 89 ce 53 48 8b 4c [ 95.970344] RSP: 0018:ffffc9003f553888 EFLAGS: 00010206 [ 95.970425] RAX:
dead000000000200 RBX: ffffea003c425b00 RCX: 00000000006080c0 [ 95.970536] RDX: 00000000006080c0 RSI:
0000000000000200 RDI: dead000000000200 [ 95.970648] RBP: dead000000000200 R08: 00000000000463c0 R09:
ffff888ffa900000 [ 95.970760] R10: 0000000000000000 R11: 0000000000000002 R12: ffff888ff6b40100 [ 95.970870] R13: ffff888ff6a55018 R14: 0000000000000000 R15: ffff888ff6a55460 [ 95.970981] FS:
00007f51b7d24700(0000) GS:ffff88903ee80000(0000) knlGS:0000000000000000 [ 95.971108] CS: 0010 DS: 0000 ES:
0000 CR0: 0000000080050033 [ 95.971197] CR2: 00007fac5410d710 CR3: 0000000f2c1de002 CR4: 00000000007606e0 [ 95.971309] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 95.971419] DR3:
0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 95.971530] PKRU: 55555554 [ 95.971573] Call Trace: [ 95.971622] ice_setup_rx_ring+0x39/0x110 [ice] [ 95.971695] ice_vsi_setup_rx_rings+0x54/0x90 [ice] [ 95.971774] ice_vsi_open+0x25/0x120 [ice] [ 95.971843] ice_open_internal+0xb8/0x1f0 [ice] [ 95.971919] ice_ena_vsi+0x4f/0xd0 [ice] [ 95.971987] ice_dcb_ena_dis_vsi.constprop.5+0x29/0x90 [ice] [ 95.972082] ice_pf_dcb_cfg+0x29a/0x380 [ice] [ 95.972154] ice_dcbnl_setets+0x174/0x1b0 [ice] [ 95.972220] dcbnl_ieee_set+0x89/0x230 [ 95.972279] ? dcbnl_ieee_del+0x150/0x150 [ 95.972341] dcb_doit+0x124/0x1b0 [ 95.972392] rtnetlink_rcv_msg+0x243/0x2f0 [ 95.972457] ? dcb_doit+0x14d/0x1b0 [ 95.972510] ?
__kmalloc_node_track_caller+0x1d3/0x280 [ 95.972591] ? rtnl_calcit.isra.31+0x100/0x100 [ 95.972661] netlink_rcv_skb+0xcf/0xf0 [ 95.972720] netlink_unicast+0x16d/0x220 [ 95.972781] netlink_sendmsg+0x2ba/0x3a0 [ 95.975891] sock_sendmsg+0x4c/0x50 [ 95.979032] ___sys_sendmsg+0x2e4/0x300 [ 95.982147] ? kmem_cache_alloc+0x13e/0x190 [ 95.985242] ? __wake_up_common_lock+0x79/0x90 [ 95.988338] ?
__check_object_size+0xac/0x1b0 [ 95.991440] ? _copy_to_user+0x22/0x30 [ 95.994539] ? move_addr_to_user+0xbb/0xd0 [ 95.997619] ? __sys_sendmsg+0x53/0x80 [ 96.000664] __sys_sendmsg+0x53/0x80 [ 96.003747] do_syscall_64+0x5b/0x1d0 [ 96.006862] entry_SYSCALL_64_after_hwframe+0x65/0xca Only update num_txq/rxq when passed check, and restore tc_cfg if setup queue map failed. (CVE-2022-48652)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48652
https://ubuntu.com/security/CVE-2022-48652

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.7 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0012
CVSS v2.0 Base Score
7.6 (CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48652

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225672 - Linux Distros Unpatched Vulnerability : CVE-2022-48657
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: arm64: topology: fix possible overflow in amu_fie_setup() cpufreq_get_hw_max_freq() returns max frequency in kHz as *unsigned int*, while freq_inv_set_max_ratio() gets passed this frequency in Hz as 'u64'. Multiplying max frequency by 1000 can potentially result in overflow -- multiplying by 1000ULL instead should avoid that... Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. (CVE-2022-48657)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48657
https://ubuntu.com/security/CVE-2022-48657

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.0011
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48657

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225583 - Linux Distros Unpatched Vulnerability : CVE-2022-48658
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mm: slub: fix flush_cpu_slab()/__free_slab() invocations in task context. Commit 5a836bf6b09f (mm: slub: move flush_cpu_slab() invocations __free_slab() invocations out of IRQ context) moved all flush_cpu_slab() invocations to the global workqueue to avoid a problem related with deactivate_slab()/__free_slab() being called from an IRQ context on PREEMPT_RT kernels. When the flush_all_cpu_locked() function is called from a task context it may happen that a workqueue with WQ_MEM_RECLAIM bit set ends up flushing the global workqueue, this will cause a dependency issue. workqueue: WQ_MEM_RECLAIM nvme-delete- wq:nvme_delete_ctrl_work [nvme_core] is flushing !WQ_MEM_RECLAIM events:flush_cpu_slab WARNING: CPU: 37 PID: 410 at kernel/workqueue.c:2637 check_flush_dependency+0x10a/0x120 Workqueue: nvme-delete-wq nvme_delete_ctrl_work [nvme_core] RIP: 0010:check_flush_dependency+0x10a/0x120[ 453.262125] Call Trace:
__flush_work.isra.0+0xbf/0x220 ? __queue_work+0x1dc/0x420 flush_all_cpus_locked+0xfb/0x120
__kmem_cache_shutdown+0x2b/0x320 kmem_cache_destroy+0x49/0x100 bioset_exit+0x143/0x190 blk_release_queue+0xb9/0x100 kobject_cleanup+0x37/0x130 nvme_fc_ctrl_free+0xc6/0x150 [nvme_fc] nvme_free_ctrl+0x1ac/0x2b0 [nvme_core] Fix this bug by creating a workqueue for the flush operation with the WQ_MEM_RECLAIM bit set. (CVE-2022-48658)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48658
https://ubuntu.com/security/CVE-2022-48658

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0007
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48658

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225457 - Linux Distros Unpatched Vulnerability : CVE-2022-48662
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Really move i915_gem_context.link under ref protection i915_perf assumes that it can use the i915_gem_context reference to protect its i915->gem.contexts.list iteration. However, this requires that we do not remove the context from the list until after we drop the final reference and release the struct. If, as currently, we remove the context from the list during context_close(), the link.next pointer may be poisoned while we are holding the context reference and cause a GPF: [ 4070.573157] i915 0000:00:02.0:
[drm:i915_perf_open_ioctl [i915]] filtering on ctx_id=0x1fffff ctx_id_mask=0x1fffff [ 4070.574881] general protection fault, probably for non-canonical address 0xdead000000000100: 0000 [#1] PREEMPT SMP [ 4070.574897] CPU: 1 PID: 284392 Comm: amd_performance Tainted: G E 5.17.9 #180 [ 4070.574903] Hardware name: Intel Corporation NUC7i5BNK/NUC7i5BNB, BIOS BNKBL357.86A.0052.2017.0918.1346 09/18/2017 [ 4070.574907] RIP: 0010:oa_configure_all_contexts.isra.0+0x222/0x350 [i915] [ 4070.574982] Code: 08 e8 32 6e 10 e1 4d 8b 6d 50 b8 ff ff ff ff 49 83 ed 50 f0 41 0f c1 04 24 83 f8 01 0f 84 e3 00 00 00 85 c0 0f 8e fa 00 00 00 <49> 8b 45 50 48 8d 70 b0 49 8d 45 50 48 39 44 24 10 0f 85 34 fe ff [ 4070.574990] RSP:
0018:ffffc90002077b78 EFLAGS: 00010202 [ 4070.574995] RAX: 0000000000000002 RBX: 0000000000000002 RCX:
0000000000000000 [ 4070.575000] RDX: 0000000000000001 RSI: ffffc90002077b20 RDI: ffff88810ddc7c68 [ 4070.575004] RBP: 0000000000000001 R08: ffff888103242648 R09: fffffffffffffffc [ 4070.575008] R10:
ffffffff82c50bc0 R11: 0000000000025c80 R12: ffff888101bf1860 [ 4070.575012] R13: dead0000000000b0 R14:
ffffc90002077c04 R15: ffff88810be5cabc [ 4070.575016] FS: 00007f1ed50c0780(0000) GS:ffff88885ec80000(0000) knlGS:0000000000000000 [ 4070.575021] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4070.575025] CR2:
00007f1ed5590280 CR3: 000000010ef6f005 CR4: 00000000003706e0 [ 4070.575029] Call Trace: [ 4070.575033] <TASK> [ 4070.575037] lrc_configure_all_contexts+0x13e/0x150 [i915] [ 4070.575103] gen8_enable_metric_set+0x4d/0x90 [i915] [ 4070.575164] i915_perf_open_ioctl+0xbc0/0x1500 [i915] [ 4070.575224] ? asm_common_interrupt+0x1e/0x40 [ 4070.575232] ? i915_oa_init_reg_state+0x110/0x110 [i915] [ 4070.575290] drm_ioctl_kernel+0x85/0x110 [ 4070.575296] ? update_load_avg+0x5f/0x5e0 [ 4070.575302] drm_ioctl+0x1d3/0x370 [ 4070.575307] ? i915_oa_init_reg_state+0x110/0x110 [i915] [ 4070.575382] ? gen8_gt_irq_handler+0x46/0x130 [i915] [ 4070.575445] __x64_sys_ioctl+0x3c4/0x8d0 [ 4070.575451] ?
__do_softirq+0xaa/0x1d2 [ 4070.575456] do_syscall_64+0x35/0x80 [ 4070.575461] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 4070.575467] RIP: 0033:0x7f1ed5c10397 [ 4070.575471] Code: 3c 1c e8 1c ff ff ff 85 c0 79 87 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a9 da 0d 00 f7 d8 64 89 01 48 [ 4070.575478] RSP:
002b:00007ffd65c8d7a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 4070.575484] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007f1ed5c10397 [ 4070.575488] RDX: 00007ffd65c8d7c0 RSI: 0000000040106476 RDI: 0000000000000006 [ 4070.575492] RBP: 00005620972f9c60 R08: 000000000000000a R09: 0000000000000005 [ 4070.575496] R10: 000000000000000d R11: 0000000000000246 R12: 000000000000000a [ 4070.575500] R13:
000000000000000d R14: 0000000000000000 R15: 00007ffd65c8d7c0 [ 4070.575505] </TASK> [ 4070.575507] Modules linked in: nls_ascii(E) nls_cp437(E) vfat(E) fat(E) i915(E) x86_pkg_temp_thermal(E) intel_powerclamp(E) crct10dif_pclmul(E) crc32_pclmul(E) crc32c_intel(E) aesni_intel(E) crypto_simd(E) intel_gtt(E) cryptd(E) ttm(E) rapl(E) intel_cstate(E) drm_kms_helper(E) cfbfillrect(E) syscopyarea(E) cfbimgblt(E) intel_uncore(E) sysfillrect(E) mei_me(E) sysimgblt(E) i2c_i801(E) fb_sys_fops(E) mei(E) intel_pch_thermal(E) i2c_smbus ---truncated--- (CVE-2022-48662)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48662
https://ubuntu.com/security/CVE-2022-48662

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0007
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48662

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225530 - Linux Distros Unpatched Vulnerability : CVE-2022-48689
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tcp: TX zerocopy should not sense pfmemalloc status We got a recent syzbot report [1] showing a possible misuse of pfmemalloc page status in TCP zerocopy paths. Indeed, for pages coming from user space or other layers, using page_is_pfmemalloc() is moot, and possibly could give false positives. There has been attempts to make page_is_pfmemalloc() more robust, but not using it in the first place in this context is probably better, removing cpu cycles.
Note to stable teams : You need to backport 84ce071e38a6 (net: introduce __skb_fill_page_desc_noacc) as a prereq. Race is more probable after commit c07aea3ef4d4 (mm: add a signature in struct page) because page_is_pfmemalloc() is now using low order bit from page->lru.next, which can change more often than page->index. Low order bit should never be set for lru.next (when used as an anchor in LRU list), so KCSAN report is mostly a false positive. Backporting to older kernel versions seems not necessary. [1] BUG:
KCSAN: data-race in lru_add_fn / tcp_build_frag write to 0xffffea0004a1d2c8 of 8 bytes by task 18600 on cpu 0: __list_add include/linux/list.h:73 [inline] list_add include/linux/list.h:88 [inline] lruvec_add_folio include/linux/mm_inline.h:105 [inline] lru_add_fn+0x440/0x520 mm/swap.c:228 folio_batch_move_lru+0x1e1/0x2a0 mm/swap.c:246 folio_batch_add_and_move mm/swap.c:263 [inline] folio_add_lru+0xf1/0x140 mm/swap.c:490 filemap_add_folio+0xf8/0x150 mm/filemap.c:948
__filemap_get_folio+0x510/0x6d0 mm/filemap.c:1981 pagecache_get_page+0x26/0x190 mm/folio-compat.c:104 grab_cache_page_write_begin+0x2a/0x30 mm/folio-compat.c:116 ext4_da_write_begin+0x2dd/0x5f0 fs/ext4/inode.c:2988 generic_perform_write+0x1d4/0x3f0 mm/filemap.c:3738 ext4_buffered_write_iter+0x235/0x3e0 fs/ext4/file.c:270 ext4_file_write_iter+0x2e3/0x1210 call_write_iter include/linux/fs.h:2187 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x468/0x760 fs/read_write.c:578 ksys_write+0xe8/0x1a0 fs/read_write.c:631 __do_sys_write fs/read_write.c:643 [inline]
__se_sys_write fs/read_write.c:640 [inline] __x64_sys_write+0x3e/0x50 fs/read_write.c:640 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffffea0004a1d2c8 of 8 bytes by task 18611 on cpu 1:
page_is_pfmemalloc include/linux/mm.h:1740 [inline] __skb_fill_page_desc include/linux/skbuff.h:2422 [inline] skb_fill_page_desc include/linux/skbuff.h:2443 [inline] tcp_build_frag+0x613/0xb20 net/ipv4/tcp.c:1018 do_tcp_sendpages+0x3e8/0xaf0 net/ipv4/tcp.c:1075 tcp_sendpage_locked net/ipv4/tcp.c:1140 [inline] tcp_sendpage+0x89/0xb0 net/ipv4/tcp.c:1150 inet_sendpage+0x7f/0xc0 net/ipv4/af_inet.c:833 kernel_sendpage+0x184/0x300 net/socket.c:3561 sock_sendpage+0x5a/0x70 net/socket.c:1054 pipe_to_sendpage+0x128/0x160 fs/splice.c:361 splice_from_pipe_feed fs/splice.c:415 [inline] __splice_from_pipe+0x222/0x4d0 fs/splice.c:559 splice_from_pipe fs/splice.c:594 [inline] generic_splice_sendpage+0x89/0xc0 fs/splice.c:743 do_splice_from fs/splice.c:764 [inline] direct_splice_actor+0x80/0xa0 fs/splice.c:931 splice_direct_to_actor+0x305/0x620 fs/splice.c:886 do_splice_direct+0xfb/0x180 fs/splice.c:974 do_sendfile+0x3bf/0x910 fs/read_write.c:1249
__do_sys_sendfile64 fs/read_write.c:1317 [inline] __se_sys_sendfile64 fs/read_write.c:1303 [inline]
__x64_sys_sendfile64+0x10c/0x150 fs/read_write.c:1303 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed:
0x0000000000000000 -> 0xffffea0004a1d288 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 18611 Comm: syz-executor.4 Not tainted 6.0.0-rc2-syzkaller-00248-ge022620b5d05-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 (CVE-2022-48689)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48689
https://ubuntu.com/security/CVE-2022-48689

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0005
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48689

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225404 - Linux Distros Unpatched Vulnerability : CVE-2022-48690
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ice: Fix DMA mappings leak Fix leak, when user changes ring parameters. During reallocation of RX buffers, new DMA mappings are created for those buffers. New buffers with different RX ring count should substitute older ones, but those buffers were freed in ice_vsi_cfg_rxq and reallocated again with ice_alloc_rx_buf. kfree on rx_buf caused leak of already mapped DMA. Reallocate ZC with xdp_buf struct, when BPF program loads. Reallocate back to rx_buf, when BPF program unloads. If BPF program is loaded/unloaded and XSK pools are created, reallocate RX queues accordingly in XDP_SETUP_XSK_POOL handler. Steps for reproduction: while : do for ((i=0; i<=8160;
i=i+32)) do ethtool -G enp130s0f0 rx $i tx $i sleep 0.5 ethtool -g enp130s0f0 done done (CVE-2022-48690)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48690
https://ubuntu.com/security/CVE-2022-48690

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48690

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243656 - Linux Distros Unpatched Vulnerability : CVE-2022-48694
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix drain SQ hang with no completion SW generated completions for outstanding WRs posted on SQ after QP is in error target the wrong CQ. This causes the ib_drain_sq to hang with no completion. Fix this to generate completions on the right CQ. [ 863.969340] INFO: task kworker/u52:2:671 blocked for more than 122 seconds. [ 863.979224] Not tainted 5.14.0-130.el9.x86_64 #1 [ 863.986588] echo 0 > /proc/sys/kernel/hung_task_timeout_secs disables this message. [ 863.996997] task:kworker/u52:2 state:D stack: 0 pid: 671 ppid: 2 flags:0x00004000 [ 864.007272] Workqueue: xprtiod xprt_autoclose [sunrpc] [ 864.014056] Call Trace: [ 864.017575]
__schedule+0x206/0x580 [ 864.022296] schedule+0x43/0xa0 [ 864.026736] schedule_timeout+0x115/0x150 [ 864.032185] __wait_for_common+0x93/0x1d0 [ 864.037717] ? usleep_range_state+0x90/0x90 [ 864.043368]
__ib_drain_sq+0xf6/0x170 [ib_core] [ 864.049371] ? __rdma_block_iter_next+0x80/0x80 [ib_core] [ 864.056240] ib_drain_sq+0x66/0x70 [ib_core] [ 864.062003] rpcrdma_xprt_disconnect+0x82/0x3b0 [rpcrdma] [ 864.069365] ? xprt_prepare_transmit+0x5d/0xc0 [sunrpc] [ 864.076386] xprt_rdma_close+0xe/0x30 [rpcrdma] [ 864.082593] xprt_autoclose+0x52/0x100 [sunrpc] [ 864.088718] process_one_work+0x1e8/0x3c0 [ 864.094170] worker_thread+0x50/0x3b0 [ 864.099109] ? rescuer_thread+0x370/0x370 [ 864.104473] kthread+0x149/0x170 [ 864.109022] ? set_kthread_struct+0x40/0x40 [ 864.114713] ret_from_fork+0x22/0x30 (CVE-2022-48694)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48694
https://ubuntu.com/security/CVE-2022-48694

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48694

Plugin Information
Published: 2025/08/05, Modified: 2025/09/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225531 - Linux Distros Unpatched Vulnerability : CVE-2022-48702
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() The voice allocator sometimes begins allocating from near the end of the array and then wraps around, however snd_emu10k1_pcm_channel_alloc() accesses the newly allocated voices as if it never wrapped around. This results in out of bounds access if the first voice has a high enough index so that first_voice + requested_voice_count > NUM_G (64). The more voices are requested, the more likely it is for this to occur. This was initially discovered using PipeWire, however it can be reproduced by calling aplay multiple times with 16 channels: aplay -r 48000 -D plughw:CARD=Live,DEV=3 -c 16 /dev/zero UBSAN: array- index-out-of-bounds in sound/pci/emu10k1/emupcm.c:127:40 index 65 is out of range for type 'snd_emu10k1_voice [64]' CPU: 1 PID: 31977 Comm: aplay Tainted: G W IOE 6.0.0-rc2-emu10k1+ #7 Hardware name: ASUSTEK COMPUTER INC P5W DH Deluxe/P5W DH Deluxe, BIOS 3002 07/22/2010 Call Trace: <TASK>
dump_stack_lvl+0x49/0x63 dump_stack+0x10/0x16 ubsan_epilogue+0x9/0x3f
__ubsan_handle_out_of_bounds.cold+0x44/0x49 snd_emu10k1_playback_hw_params+0x3bc/0x420 [snd_emu10k1] snd_pcm_hw_params+0x29f/0x600 [snd_pcm] snd_pcm_common_ioctl+0x188/0x1410 [snd_pcm] ? exit_to_user_mode_prepare+0x35/0x170 ? do_syscall_64+0x69/0x90 ? syscall_exit_to_user_mode+0x26/0x50 ? do_syscall_64+0x69/0x90 ? exit_to_user_mode_prepare+0x35/0x170 snd_pcm_ioctl+0x27/0x40 [snd_pcm]
__x64_sys_ioctl+0x95/0xd0 do_syscall_64+0x5c/0x90 ? do_syscall_64+0x69/0x90 ? do_syscall_64+0x69/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd (CVE-2022-48702)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48702
https://ubuntu.com/security/CVE-2022-48702

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0005
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48702

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225394 - Linux Distros Unpatched Vulnerability : CVE-2022-48712
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: fix error handling in ext4_fc_record_modified_inode() Current code does not fully takes care of krealloc() error case, which could lead to silent memory corruption or a kernel bug. This patch fixes that. Also it cleans up some duplicated error handling logic from various functions in fast_commit.c file.
(CVE-2022-48712)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48712
https://ubuntu.com/security/CVE-2022-48712

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0007
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48712

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225185 - Linux Distros Unpatched Vulnerability : CVE-2022-48714
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf: Use VM_MAP instead of VM_ALLOC for ringbuf After commit 2fd3fb0be1d1 (kasan, vmalloc: unpoison VM_ALLOC pages after mapping), non- VM_ALLOC mappings will be marked as accessible in __get_vm_area_node() when KASAN is enabled. But now the flag for ringbuf area is VM_ALLOC, so KASAN will complain out-of-bound access after vmap() returns.
Because the ringbuf area is created by mapping allocated pages, so use VM_MAP instead. After the change, info in /proc/vmallocinfo also changes from [start]-[end] 24576 ringbuf_map_alloc+0x171/0x290 vmalloc user to [start]-[end] 24576 ringbuf_map_alloc+0x171/0x290 vmap user (CVE-2022-48714)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48714
https://ubuntu.com/security/CVE-2022-48714

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.2
EPSS Score
0.0006
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48714

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225526 - Linux Distros Unpatched Vulnerability : CVE-2022-48732
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix off by one in BIOS boundary checking Bounds checking when parsing init scripts embedded in the BIOS reject access to the last byte. This causes driver initialization to fail on Apple eMac's with GeForce 2 MX GPUs, leaving the system with no working console. This is probably only seen on OpenFirmware machines like PowerPC Macs because the BIOS image provided by OF is only the used parts of the ROM, not a power-of-two blocks read from PCI directly so PCs always have empty bytes at the end that are never accessed. (CVE-2022-48732)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48732
https://ubuntu.com/security/CVE-2022-48732

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0005
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48732

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225653 - Linux Distros Unpatched Vulnerability : CVE-2022-48744
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mlx5e: Avoid field-overflowing memcpy() In preparation for FORTIFY_SOURCE performing compile-time and run-time field bounds checking for memcpy(), memmove(), and memset(), avoid intentionally writing across neighboring fields. Use flexible arrays instead of zero-element arrays (which look like they are always overflowing) and split the cross-field memcpy() into two halves that can be appropriately bounds-checked by the compiler. We were doing: #define ETH_HLEN 14 #define VLAN_HLEN 4 ... #define MLX5E_XDP_MIN_INLINE (ETH_HLEN + VLAN_HLEN) ... struct mlx5e_tx_wqe *wqe = mlx5_wq_cyc_get_wqe(wq, pi); ... struct mlx5_wqe_eth_seg *eseg = &wqe->eth; struct mlx5_wqe_data_seg *dseg = wqe->data; ...
memcpy(eseg->inline_hdr.start, xdptxd->data, MLX5E_XDP_MIN_INLINE); target is wqe->eth.inline_hdr.start (which the compiler sees as being 2 bytes in size), but copying 18, intending to write across start (really vlan_tci, 2 bytes). The remaining 16 bytes get written into wqe->data[0], covering byte_count (4 bytes), lkey (4 bytes), and addr (8 bytes). struct mlx5e_tx_wqe { struct mlx5_wqe_ctrl_seg ctrl; /* 0 16
*/ struct mlx5_wqe_eth_seg eth; /* 16 16 */ struct mlx5_wqe_data_seg data[]; /* 32 0 */ /* size: 32, cachelines: 1, members: 3 */ /* last cacheline: 32 bytes */ }; struct mlx5_wqe_eth_seg { u8 swp_outer_l4_offset; /* 0 1 */ u8 swp_outer_l3_offset; /* 1 1 */ u8 swp_inner_l4_offset; /* 2 1 */ u8 swp_inner_l3_offset; /* 3 1 */ u8 cs_flags; /* 4 1 */ u8 swp_flags; /* 5 1 */ __be16 mss; /* 6 2 */ __be32 flow_table_metadata; /* 8 4 */ union { struct { __be16 sz; /* 12 2 */ u8 start[2]; /* 14 2 */ } inline_hdr; /* 12 4 */ struct { __be16 type; /* 12 2 */ __be16 vlan_tci; /* 14 2 */ } insert; /* 12 4 */
__be32 trailer; /* 12 4 */ }; /* 12 4 */ /* size: 16, cachelines: 1, members: 9 */ /* last cacheline: 16 bytes */ }; struct mlx5_wqe_data_seg { __be32 byte_count; /* 0 4 */ __be32 lkey; /* 4 4 */ __be64 addr; /* 8 8 */ /* size: 16, cachelines: 1, members: 3 */ /* last cacheline: 16 bytes */ }; So, split the memcpy() so the compiler can reason about the buffer sizes. pahole shows no size nor member offset changes to struct mlx5e_tx_wqe nor struct mlx5e_umr_wqe. objdump -d shows no meaningful object code changes (i.e.
only source line number induced differences and optimizations). (CVE-2022-48744)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48744
https://security-tracker.debian.org/tracker/CVE-2022-48744
https://ubuntu.com/security/CVE-2022-48744

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0005
CVSS v2.0 Base Score
4.3 (CVSS2#AV:L/AC:L/Au:S/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48744

Plugin Information
Published: 2025/03/05, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225596 - Linux Distros Unpatched Vulnerability : CVE-2022-48748
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: bridge: vlan: fix memory leak in
__allowed_ingress When using per-vlan state, if vlan snooping and stats are disabled, untagged or priority-tagged ingress frame will go to check pvid state. If the port state is forwarding and the pvid state is not learning/forwarding, untagged or priority-tagged frame will be dropped but skb memory is not freed. Should free skb when __allowed_ingress returns false. (CVE-2022-48748)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48748
https://ubuntu.com/security/CVE-2022-48748

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0017
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48748

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225501 - Linux Distros Unpatched Vulnerability : CVE-2022-48754
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: phylib: fix potential use-after-free Commit bafbdd527d56 (phylib: Add device reset GPIO support) added call to phy_device_reset(phydev) after the put_device() call in phy_detach(). The comment before the put_device() call says that the phydev might go away with put_device(). Fix potential use-after-free by calling phy_device_reset() before put_device().
(CVE-2022-48754)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48754
https://ubuntu.com/security/CVE-2022-48754

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
8.4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0005
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48754

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
253741 - Linux Distros Unpatched Vulnerability : CVE-2022-48757
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: fix information leakage in /proc/net/ptype In one net namespace, after creating a packet socket without binding it to a device, users in other net namespaces can observe the new `packet_type` added by this packet socket by reading `/proc/net/ptype` file. This is minor information leakage as packet socket is namespace aware. Add a net pointer in `packet_type` to keep the net namespace of of corresponding packet socket. In `ptype_seq_show`, this net pointer must be checked when it is not NULL. (CVE-2022-48757)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48757
https://ubuntu.com/security/CVE-2022-48757

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0019
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48757

Plugin Information
Published: 2025/08/24, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260501 - Linux Distros Unpatched Vulnerability : CVE-2022-48760
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- USB: core: Fix hang in usb_kill_urb by adding memory barriers The syzbot fuzzer has identified a bug in which processes hang waiting for usb_kill_urb() to return. It turns out the issue is not unlinking the URB; that works just fine. Rather, the problem arises when the wakeup notification that the URB has completed is not received. The reason is memory-access ordering on SMP systems. In outline form, usb_kill_urb() and __usb_hcd_giveback_urb() operating concurrently on different CPUs perform the following actions: CPU 0 CPU 1 ---------------------------- --------------------------------- usb_kill_urb():
__usb_hcd_giveback_urb(): ... ... atomic_inc(&urb->reject); atomic_dec(&urb->use_count); ... ...
wait_event(usb_kill_urb_queue, atomic_read(&urb->use_count) == 0); if (atomic_read(&urb->reject)) wake_up(&usb_kill_urb_queue); Confining your attention to urb->reject and urb->use_count, you can see that the overall pattern of accesses on CPU 0 is: write urb->reject, then read urb->use_count; whereas the overall pattern of accesses on CPU 1 is: write urb->use_count, then read urb->reject. This pattern is referred to in memory-model circles as SB (for Store Buffering), and it is well known that without suitable enforcement of the desired order of accesses -- in the form of memory barriers -- it is entirely possible for one or both CPUs to execute their reads ahead of their writes. The end result will be that sometimes CPU 0 sees the old un-decremented value of urb->use_count while CPU 1 sees the old un- incremented value of urb->reject. Consequently CPU 0 ends up on the wait queue and never gets woken up, leading to the observed hang in usb_kill_urb(). The same pattern of accesses occurs in usb_poison_urb() and the failure pathway of usb_hcd_submit_urb(). The problem is fixed by adding suitable memory barriers.
To provide proper memory-access ordering in the SB pattern, a full barrier is required on both CPUs. The atomic_inc() and atomic_dec() accesses themselves don't provide any memory ordering, but since they are present, we can use the optimized smp_mb__after_atomic() memory barrier in the various routines to obtain the desired effect. This patch adds the necessary memory barriers. (CVE-2022-48760)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48760
https://ubuntu.com/security/CVE-2022-48760

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0016
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48760

Plugin Information
Published: 2025/09/02, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225454 - Linux Distros Unpatched Vulnerability : CVE-2022-48778
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: gpmi: don't leak PM reference in error path If gpmi_nfc_apply_timings() fails, the PM runtime usage counter must be dropped.
(CVE-2022-48778)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48778
https://ubuntu.com/security/CVE-2022-48778

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0003
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48778

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225680 - Linux Distros Unpatched Vulnerability : CVE-2022-48780
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/smc: Avoid overwriting the copies of clcsock callback functions The callback functions of clcsock will be saved and replaced during the fallback. But if the fallback happens more than once, then the copies of these callback functions will be overwritten incorrectly, resulting in a loop call issue: clcsk->sk_error_report |- smc_fback_error_report() <------------------------------| |- smc_fback_forward_wakeup() | (loop) |- clcsock_callback() (incorrectly overwritten) | |- smc->clcsk_error_report() ------------------| So this patch fixes the issue by saving these function pointers only once in the fallback and avoiding overwriting. (CVE-2022-48780)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48780
https://ubuntu.com/security/CVE-2022-48780

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48780

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225365 - Linux Distros Unpatched Vulnerability : CVE-2022-48783
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: dsa: lantiq_gswip: fix use after free in gswip_remove() of_node_put(priv->ds->slave_mii_bus->dev.of_node) should be done before mdiobus_free(priv->ds->slave_mii_bus). (CVE-2022-48783)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48783
https://ubuntu.com/security/CVE-2022-48783

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48783

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225686 - Linux Distros Unpatched Vulnerability : CVE-2022-48785
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() Some time ago 8965779d2c0e (ipv6,mcast: always hold idev->lock before mca_lock) switched ipv6_get_lladdr() to __ipv6_get_lladdr(), which is rcu-unsafe version. That was OK, because idev->lock was held for these codepaths. In 88e2ca308094 (mld: convert ifmcaddr6 to RCU) these external locks were removed, so we probably need to restore the original rcu-safe call. Otherwise, we occasionally get a machine crashed/stalled with the following in dmesg: [ 3405.966610][T230589] general protection fault, probably for non-canonical address 0xdead00000000008c: 0000 [#1] SMP NOPTI [ 3405.982083][T230589] CPU: 44 PID: 230589 Comm: kworker/44:3 Tainted: G O 5.15.19-cloudflare-2022.2.1 #1 [ 3405.998061][T230589] Hardware name: SUPA-COOL-SERV [ 3406.009552][T230589] Workqueue: mld mld_ifc_work [ 3406.017224][T230589] RIP: 0010:__ipv6_get_lladdr+0x34/0x60 [ 3406.025780][T230589] Code: 57 10 48 83 c7 08 48 89 e5 48 39 d7 74 3e 48 8d 82 38 ff ff ff eb 13 48 8b 90 d0 00 00 00 48 8d 82 38 ff ff ff 48 39 d7 74 22 <66> 83 78 32 20 77 1b 75 e4 89 ca 23 50 2c 75 dd 48 8b 50 08 48 8b [ 3406.055748][T230589] RSP: 0018:ffff94e4b3fc3d10 EFLAGS:
00010202 [ 3406.065617][T230589] RAX: dead00000000005a RBX: ffff94e4b3fc3d30 RCX: 0000000000000040 [ 3406.077477][T230589] RDX: dead000000000122 RSI: ffff94e4b3fc3d30 RDI: ffff8c3a31431008 [ 3406.089389][T230589] RBP: ffff94e4b3fc3d10 R08: 0000000000000000 R09: 0000000000000000 [ 3406.101445][T230589] R10: ffff8c3a31430000 R11: 000000000000000b R12: ffff8c2c37887100 [ 3406.113553][T230589] R13: ffff8c3a39537000 R14: 00000000000005dc R15: ffff8c3a31431000 [ 3406.125730][T230589] FS: 0000000000000000(0000) GS:ffff8c3b9fc80000(0000) knlGS:0000000000000000 [ 3406.138992][T230589] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3406.149895][T230589] CR2:
00007f0dfea1db60 CR3: 000000387b5f2000 CR4: 0000000000350ee0 [ 3406.162421][T230589] Call Trace: [ 3406.170235][T230589] <TASK> [ 3406.177736][T230589] mld_newpack+0xfe/0x1a0 [ 3406.186686][T230589] add_grhead+0x87/0xa0 [ 3406.195498][T230589] add_grec+0x485/0x4e0 [ 3406.204310][T230589] ? newidle_balance+0x126/0x3f0 [ 3406.214024][T230589] mld_ifc_work+0x15d/0x450 [ 3406.223279][T230589] process_one_work+0x1e6/0x380 [ 3406.232982][T230589] worker_thread+0x50/0x3a0 [ 3406.242371][T230589] ? rescuer_thread+0x360/0x360 [ 3406.252175][T230589] kthread+0x127/0x150 [ 3406.261197][T230589] ? set_kthread_struct+0x40/0x40 [ 3406.271287][T230589] ret_from_fork+0x22/0x30 [ 3406.280812][T230589] </TASK> [ 3406.288937][T230589] Modules linked in: ... [last unloaded: kheaders] [ 3406.476714][T230589]
---[ end trace 3525a7655f2f3b9e ]--- (CVE-2022-48785)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48785
https://ubuntu.com/security/CVE-2022-48785

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48785

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225664 - Linux Distros Unpatched Vulnerability : CVE-2022-48787
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: iwlwifi: fix use-after-free If no firmware was present at all (or, presumably, all of the firmware files failed to parse), we end up unbinding by calling device_release_driver(), which calls remove(), which then in iwlwifi calls iwl_drv_stop(), freeing the 'drv' struct. However the new code I added will still erroneously access it after it was freed. Set 'failure=false' in this case to avoid the access, all data was already freed anyway. (CVE-2022-48787)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48787
https://ubuntu.com/security/CVE-2022-48787

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48787

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225674 - Linux Distros Unpatched Vulnerability : CVE-2022-48801
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Fix file related error handling in IIO_BUFFER_GET_FD_IOCTL If we fail to copy the just created file descriptor to userland, we try to clean up by putting back 'fd' and freeing 'ib'. The code uses put_unused_fd() for the former which is wrong, as the file descriptor was already published by fd_install() which gets called internally by anon_inode_getfd(). This makes the error handling code leaving a half cleaned up file descriptor table around and a partially destructed 'file' object, allowing userland to play use-after-free tricks on us, by abusing the still usable fd and making the code operate on a dangling 'file->private_data' pointer.
Instead of leaving the kernel in a partially corrupted state, don't attempt to explicitly clean up and leave this to the process exit path that'll release any still valid fds, including the one created by the previous call to anon_inode_getfd(). Simply return -EFAULT to indicate the error. (CVE-2022-48801)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48801
https://ubuntu.com/security/CVE-2022-48801

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48801

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225228 - Linux Distros Unpatched Vulnerability : CVE-2022-48831
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ima: fix reference leak in asymmetric_verify() Don't leak a reference to the key if its algorithm is unknown. (CVE-2022-48831)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48831
https://ubuntu.com/security/CVE-2022-48831

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48831

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225229 - Linux Distros Unpatched Vulnerability : CVE-2022-48834
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: Fix bug in pipe direction for control transfers The syzbot fuzzer reported a minor bug in the usbtmc driver: usb 5-1: BOGUS control dir, pipe 80001e80 doesn't match bRequestType 0 WARNING: CPU: 0 PID: 3813 at drivers/usb/core/urb.c:412 usb_submit_urb+0x13a5/0x1970 drivers/usb/core/urb.c:410 Modules linked in: CPU: 0 PID: 3813 Comm: syz- executor122 Not tainted 5.17.0-rc5-syzkaller-00306-g2293be58d6a1 #0 ... Call Trace: <TASK>
usb_start_wait_urb+0x113/0x530 drivers/usb/core/message.c:58 usb_internal_control_msg drivers/usb/core/message.c:102 [inline] usb_control_msg+0x2a5/0x4b0 drivers/usb/core/message.c:153 usbtmc_ioctl_request drivers/usb/class/usbtmc.c:1947 [inline] The problem is that usbtmc_ioctl_request() uses usb_rcvctrlpipe() for all of its transfers, whether they are in or out. It's easy to fix.
(CVE-2022-48834)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48834
https://ubuntu.com/security/CVE-2022-48834

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0005
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48834

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225211 - Linux Distros Unpatched Vulnerability : CVE-2022-48837
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: usb: gadget: rndis: prevent integer overflow in rndis_set_response() If BufOffset is very large the BufOffset + 8 operation can have an integer overflow. (CVE-2022-48837)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48837
https://ubuntu.com/security/CVE-2022-48837

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48837

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225224 - Linux Distros Unpatched Vulnerability : CVE-2022-48848
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Do not unregister events twice Nicolas reported that using: # trace-cmd record -e all -M 10 -p osnoise --poll Resulted in the following kernel warning: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1217 at kernel/tracepoint.c:404 tracepoint_probe_unregister+0x280/0x370 [...] CPU: 0 PID: 1217 Comm: trace-cmd Not tainted 5.17.0-rc6-next-20220307-nico+ #19 RIP: 0010:tracepoint_probe_unregister+0x280/0x370 [...] CR2:
00007ff919b29497 CR3: 0000000109da4005 CR4: 0000000000170ef0 Call Trace: <TASK>
osnoise_workload_stop+0x36/0x90 tracing_set_tracer+0x108/0x260 tracing_set_trace_write+0x94/0xd0 ?
__check_object_size.part.0+0x10a/0x150 ? selinux_file_permission+0x104/0x150 vfs_write+0xb5/0x290 ksys_write+0x5f/0xe0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP:
0033:0x7ff919a18127 [...] ---[ end trace 0000000000000000 ]--- The warning complains about an attempt to unregister an unregistered tracepoint. This happens on trace-cmd because it first stops tracing, and then switches the tracer to nop. Which is equivalent to: # cd /sys/kernel/tracing/ # echo osnoise >
current_tracer # echo 0 > tracing_on # echo nop > current_tracer The osnoise tracer stops the workload when no trace instance is actually collecting data. This can be caused both by disabling tracing or disabling the tracer itself. To avoid unregistering events twice, use the existing trace_osnoise_callback_enabled variable to check if the events (and the workload) are actually active before trying to deactivate them. (CVE-2022-48848)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48848
https://ubuntu.com/security/CVE-2022-48848

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48848

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225408 - Linux Distros Unpatched Vulnerability : CVE-2022-48858
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix a race on command flush flow Fix a refcount use after free warning due to a race on command entry. Such race occurs when one of the commands releases its last refcount and frees its index and entry while another process running command flush flow takes refcount to this command entry. The process which handles commands flush may see this command as needed to be flushed if the other process released its refcount but didn't release the index yet. Fix it by adding the needed spin lock. It fixes the following warning trace: refcount_t:
addition on 0; use-after-free. WARNING: CPU: 11 PID: 540311 at lib/refcount.c:25 refcount_warn_saturate+0x80/0xe0 ... RIP: 0010:refcount_warn_saturate+0x80/0xe0 ... Call Trace: <TASK>
mlx5_cmd_trigger_completions+0x293/0x340 [mlx5_core] mlx5_cmd_flush+0x3a/0xf0 [mlx5_core] enter_error_state+0x44/0x80 [mlx5_core] mlx5_fw_fatal_reporter_err_work+0x37/0xe0 [mlx5_core] process_one_work+0x1be/0x390 worker_thread+0x4d/0x3d0 ? rescuer_thread+0x350/0x350 kthread+0x141/0x160 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x1f/0x30 </TASK> (CVE-2022-48858)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48858
https://ubuntu.com/security/CVE-2022-48858

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48858

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225213 - Linux Distros Unpatched Vulnerability : CVE-2022-48913
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: blktrace: fix use after free for struct blk_trace When tracing the whole disk, 'dropped' and 'msg' will be created under 'q->debugfs_dir'
and 'bt->dir' is NULL, thus blk_trace_free() won't remove those files. What's worse, the following UAF can be triggered because of accessing stale 'dropped' and 'msg':
================================================================== BUG: KASAN: use-after-free in blk_dropped_read+0x89/0x100 Read of size 4 at addr ffff88816912f3d8 by task blktrace/1188 CPU: 27 PID:
1188 Comm: blktrace Not tainted 5.17.0-rc4-next-20220217+ #469 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-4 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_address_description.constprop.0.cold+0xab/0x381 ? blk_dropped_read+0x89/0x100 ? blk_dropped_read+0x89/0x100 kasan_report.cold+0x83/0xdf ? blk_dropped_read+0x89/0x100 kasan_check_range+0x140/0x1b0 blk_dropped_read+0x89/0x100 ? blk_create_buf_file_callback+0x20/0x20 ? kmem_cache_free+0xa1/0x500 ? do_sys_openat2+0x258/0x460 full_proxy_read+0x8f/0xc0 vfs_read+0xc6/0x260 ksys_read+0xb9/0x150 ? vfs_write+0x3d0/0x3d0 ? fpregs_assert_state_consistent+0x55/0x60 ? exit_to_user_mode_prepare+0x39/0x1e0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP:
0033:0x7fbc080d92fd Code: ce 20 00 00 75 10 b8 00 00 00 00 0f 05 48 3d 01 f0 ff ff 73 31 c3 48 83 1 RSP:
002b:00007fbb95ff9cb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX:
00007fbb95ff9dc0 RCX: 00007fbc080d92fd RDX: 0000000000000100 RSI: 00007fbb95ff9cc0 RDI: 0000000000000045 RBP: 0000000000000045 R08: 0000000000406299 R09: 00000000fffffffd R10: 000000000153afa0 R11:
0000000000000293 R12: 00007fbb780008c0 R13: 00007fbb78000938 R14: 0000000000608b30 R15: 00007fbb780029c8 </TASK> Allocated by task 1050: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x81/0xa0 do_blk_trace_setup+0xcb/0x410 __blk_trace_setup+0xac/0x130 blk_trace_ioctl+0xe9/0x1c0 blkdev_ioctl+0xf1/0x390 __x64_sys_ioctl+0xa5/0xe0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Freed by task 1050: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_set_free_info+0x20/0x30 __kasan_slab_free+0x103/0x180 kfree+0x9a/0x4c0
__blk_trace_remove+0x53/0x70 blk_trace_ioctl+0x199/0x1c0 blkdev_common_ioctl+0x5e9/0xb30 blkdev_ioctl+0x1a5/0x390 __x64_sys_ioctl+0xa5/0xe0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae The buggy address belongs to the object at ffff88816912f380 which belongs to the cache kmalloc-96 of size 96 The buggy address is located 88 bytes inside of 96-byte region [ffff88816912f380, ffff88816912f3e0) The buggy address belongs to the page: page:000000009a1b4e7c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0f flags:
0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) raw: 0017ffffc0000200 ffffea00044f1100 dead000000000002 ffff88810004c780 raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88816912f280:
fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff88816912f300: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc >ffff88816912f380: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff88816912f400: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff88816912f480: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ================================================================== (CVE-2022-48913)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48913
https://ubuntu.com/security/CVE-2022-48913

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48913

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225177 - Linux Distros Unpatched Vulnerability : CVE-2022-48950
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- perf: Fix perf_pending_task() UaF Per syzbot it is possible for perf_pending_task() to run after the event is free()'d. There are two related but distinct cases: - the task_work was already queued before destroying the event; - destroying the event itself queues the task_work. The first cannot be solved using task_work_cancel() since perf_release() itself might be called from a task_work (____fput), which means the current->task_works list is already empty and task_work_cancel() won't be able to find the perf_pending_task() entry. The simplest alternative is extending the perf_event lifetime to cover the task_work. The second is just silly, queueing a task_work while you know the event is going away makes no sense and is easily avoided by re-arranging how the event is marked STATE_DEAD and ensuring it goes through STATE_OFF on the way down. (CVE-2022-48950)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48950
https://ubuntu.com/security/CVE-2022-48950

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48950

Plugin Information
Published: 2025/03/05, Modified: 2025/12/23
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225319 - Linux Distros Unpatched Vulnerability : CVE-2022-48951
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() The bounds checks in snd_soc_put_volsw_sx() are only being applied to the first channel, meaning it is possible to write out of bounds values to the second channel in stereo controls. Add appropriate checks. (CVE-2022-48951)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48951
https://ubuntu.com/security/CVE-2022-48951

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:C/I:P/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48951

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225498 - Linux Distros Unpatched Vulnerability : CVE-2022-48981
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove errant put in error path drm_gem_shmem_mmap() doesn't own this reference, resulting in the GEM object getting prematurely freed leading to a later use-after-free. (CVE-2022-48981)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48981
https://ubuntu.com/security/CVE-2022-48981

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48981

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225513 - Linux Distros Unpatched Vulnerability : CVE-2022-48990
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/amdgpu: fix use-after-free during gpu recovery [Why] [ 754.862560] refcount_t: underflow; use-after- free. [ 754.862898] Call Trace: [ 754.862903] <TASK> [ 754.862913] amdgpu_job_free_cb+0xc2/0xe1 [amdgpu] [ 754.863543] drm_sched_main.cold+0x34/0x39 [amd_sched] [How] The fw_fence may be not init, check whether dma_fence_init is performed before job free (CVE-2022-48990)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48990
https://ubuntu.com/security/CVE-2022-48990

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48990

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225575 - Linux Distros Unpatched Vulnerability : CVE-2022-49015
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: hsr: Fix potential use-after-free The skb is delivered to netif_rx() which may free it, after calling this, dereferencing skb may trigger use-after-free. (CVE-2022-49015)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49015
https://ubuntu.com/security/CVE-2022-49015

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49015

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225693 - Linux Distros Unpatched Vulnerability : CVE-2022-49017
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tipc: re-fetch skb cb after tipc_msg_validate As the call trace shows, the original skb was freed in tipc_msg_validate(), and dereferencing the old skb cb would cause an use-after-free crash. BUG: KASAN: use-after-free in tipc_crypto_rcv_complete+0x1835/0x2240 [tipc] Call Trace: <IRQ> tipc_crypto_rcv_complete+0x1835/0x2240 [tipc] tipc_crypto_rcv+0xd32/0x1ec0 [tipc] tipc_rcv+0x744/0x1150 [tipc] ... Allocated by task 47078:
kmem_cache_alloc_node+0x158/0x4d0 __alloc_skb+0x1c1/0x270 tipc_buf_acquire+0x1e/0xe0 [tipc] tipc_msg_create+0x33/0x1c0 [tipc] tipc_link_build_proto_msg+0x38a/0x2100 [tipc] tipc_link_timeout+0x8b8/0xef0 [tipc] tipc_node_timeout+0x2a1/0x960 [tipc] call_timer_fn+0x2d/0x1c0 ...
Freed by task 47078: tipc_msg_validate+0x7b/0x440 [tipc] tipc_crypto_rcv_complete+0x4b5/0x2240 [tipc] tipc_crypto_rcv+0xd32/0x1ec0 [tipc] tipc_rcv+0x744/0x1150 [tipc] This patch fixes it by re-fetching the skb cb from the new allocated skb after calling tipc_msg_validate(). (CVE-2022-49017)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49017
https://ubuntu.com/security/CVE-2022-49017

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49017

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225449 - Linux Distros Unpatched Vulnerability : CVE-2022-49053
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: target: tcmu: Fix possible page UAF tcmu_try_get_data_page() looks up pages under cmdr_lock, but it does not take refcount properly and just returns page pointer. When tcmu_try_get_data_page() returns, the returned page may have been freed by tcmu_blocks_release(). We need to get_page() under cmdr_lock to avoid concurrent tcmu_blocks_release(). (CVE-2022-49053)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49053
https://ubuntu.com/security/CVE-2022-49053

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49053

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225708 - Linux Distros Unpatched Vulnerability : CVE-2022-49062
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix KASAN slab-out-of- bounds in cachefiles_set_volume_xattr Use the actual length of volume coherency data when setting the xattr to avoid the following KASAN report. BUG: KASAN: slab-out-of-bounds in cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles] Write of size 4 at addr ffff888101e02af4 by task kworker/6:0/1347 CPU: 6 PID: 1347 Comm: kworker/6:0 Kdump: loaded Not tainted 5.18.0-rc1-nfs-fscache- netfs+ #13 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-4.fc34 04/01/2014 Workqueue:
events fscache_create_volume_work [fscache] Call Trace: <TASK> dump_stack_lvl+0x45/0x5a print_report.cold+0x5e/0x5db ? __lock_text_start+0x8/0x8 ? cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles] kasan_report+0xab/0x120 ? cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles] kasan_check_range+0xf5/0x1d0 memcpy+0x39/0x60 cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles] cachefiles_acquire_volume+0x2be/0x500 [cachefiles] ? __cachefiles_free_volume+0x90/0x90 [cachefiles] fscache_create_volume_work+0x68/0x160 [fscache] process_one_work+0x3b7/0x6a0 worker_thread+0x2c4/0x650 ? process_one_work+0x6a0/0x6a0 kthread+0x16c/0x1a0 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 </TASK> Allocated by task 1347: kasan_save_stack+0x1e/0x40
__kasan_kmalloc+0x81/0xa0 cachefiles_set_volume_xattr+0x76/0x350 [cachefiles] cachefiles_acquire_volume+0x2be/0x500 [cachefiles] fscache_create_volume_work+0x68/0x160 [fscache] process_one_work+0x3b7/0x6a0 worker_thread+0x2c4/0x650 kthread+0x16c/0x1a0 ret_from_fork+0x22/0x30 The buggy address belongs to the object at ffff888101e02af0 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 4 bytes inside of 8-byte region [ffff888101e02af0, ffff888101e02af8) The buggy address belongs to the physical page: page:00000000a2292d70 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101e02 flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) raw:
0017ffffc0000200 0000000000000000 dead000000000001 ffff888100042280 raw: 0000000000000000 0000000080660066 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888101e02980: fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc ffff888101e02a00: 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00 >ffff888101e02a80: fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc 04 fc ^ ffff888101e02b00: fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc ffff888101e02b80: fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc ================================================================== (CVE-2022-49062)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49062
https://ubuntu.com/security/CVE-2022-49062

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49062

Plugin Information
Published: 2025/03/05, Modified: 2025/10/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243864 - Linux Distros Unpatched Vulnerability : CVE-2022-49064
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cachefiles: unmark inode in use in error path Unmark inode in use if error encountered. If the in-use flag leakage occurs in cachefiles_open_file(), Cachefiles will complain Inode already in use when later another cookie with the same index key is looked up. If the in-use flag leakage occurs in cachefiles_create_tmpfile(), though the Inode already in use warning won't be triggered, fix the leakage anyway. (CVE-2022-49064)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49064
https://ubuntu.com/security/CVE-2022-49064

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49064

Plugin Information
Published: 2025/08/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225173 - Linux Distros Unpatched Vulnerability : CVE-2022-49076
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Fix use-after-free bug for mm struct Under certain conditions, such as MPI_Abort, the hfi1 cleanup code may represent the last reference held on the task mm. hfi1_mmu_rb_unregister() then drops the last reference and the mm is freed before the final use in hfi1_release_user_pages(). A new task may allocate the mm structure while it is still being used, resulting in problems. One manifestation is corruption of the mmap_sem counter leading to a hang in down_write(). Another is corruption of an mm struct that is in use by another task.
(CVE-2022-49076)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49076
https://ubuntu.com/security/CVE-2022-49076

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49076

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225767 - Linux Distros Unpatched Vulnerability : CVE-2022-49082
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: mpt3sas: Fix use after free in _scsih_expander_node_remove() The function mpt3sas_transport_port_remove() called in _scsih_expander_node_remove() frees the port field of the sas_expander structure, leading to the following use-after-free splat from KASAN when the ioc_info() call following that function is executed (e.g. when doing rmmod of the driver module): [ 3479.371167] ================================================================== [ 3479.378496] BUG: KASAN: use-after- free in _scsih_expander_node_remove+0x710/0x750 [mpt3sas] [ 3479.386936] Read of size 1 at addr ffff8881c037691c by task rmmod/1531 [ 3479.393524] [ 3479.395035] CPU: 18 PID: 1531 Comm: rmmod Not tainted 5.17.0-rc8+ #1436 [ 3479.401712] Hardware name: Supermicro Super Server/H12SSL-NT, BIOS 2.1 06/02/2021 [ 3479.409263] Call Trace: [ 3479.411743] <TASK> [ 3479.413875] dump_stack_lvl+0x45/0x59 [ 3479.417582] print_address_description.constprop.0+0x1f/0x120 [ 3479.423389] ?
_scsih_expander_node_remove+0x710/0x750 [mpt3sas] [ 3479.429469] kasan_report.cold+0x83/0xdf [ 3479.433438] ? _scsih_expander_node_remove+0x710/0x750 [mpt3sas] [ 3479.439514]
_scsih_expander_node_remove+0x710/0x750 [mpt3sas] [ 3479.445411] ? _raw_spin_unlock_irqrestore+0x2d/0x40 [ 3479.452032] scsih_remove+0x525/0xc90 [mpt3sas] [ 3479.458212] ? mpt3sas_expander_remove+0x1d0/0x1d0 [mpt3sas] [ 3479.465529] ? down_write+0xde/0x150 [ 3479.470746] ? up_write+0x14d/0x460 [ 3479.475840] ? kernfs_find_ns+0x137/0x310 [ 3479.481438] pci_device_remove+0x65/0x110 [ 3479.487013]
__device_release_driver+0x316/0x680 [ 3479.493180] driver_detach+0x1ec/0x2d0 [ 3479.498499] bus_remove_driver+0xe7/0x2d0 [ 3479.504081] pci_unregister_driver+0x26/0x250 [ 3479.510033]
_mpt3sas_exit+0x2b/0x6cf [mpt3sas] [ 3479.516144] __x64_sys_delete_module+0x2fd/0x510 [ 3479.522315] ? free_module+0xaa0/0xaa0 [ 3479.527593] ? __cond_resched+0x1c/0x90 [ 3479.532951] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 3479.539607] ? syscall_enter_from_user_mode+0x21/0x70 [ 3479.546161] ? trace_hardirqs_on+0x1c/0x110 [ 3479.551828] do_syscall_64+0x35/0x80 [ 3479.556884] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3479.563402] RIP: 0033:0x7f1fc482483b ... [ 3479.943087] ================================================================== Fix this by introducing the local variable port_id to store the port ID value before executing mpt3sas_transport_port_remove(). This local variable is then used in the call to ioc_info() instead of dereferencing the freed port structure.
(CVE-2022-49082)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49082
https://ubuntu.com/security/CVE-2022-49082

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49082

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225684 - Linux Distros Unpatched Vulnerability : CVE-2022-49094
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/tls: fix slab-out-of-bounds bug in decrypt_internal The memory size of tls_ctx->rx.iv for AES128-CCM is 12 setting in tls_set_sw_offload().
The return value of crypto_aead_ivsize() for ccm(aes) is 16. So memcpy() require 16 bytes from 12 bytes memory space will trigger slab-out-of-bounds bug as following:
================================================================== BUG: KASAN: slab-out-of-bounds in decrypt_internal+0x385/0xc40 [tls] Read of size 16 at addr ffff888114e84e60 by task tls/10911 Call Trace:
<TASK> dump_stack_lvl+0x34/0x44 print_report.cold+0x5e/0x5db ? decrypt_internal+0x385/0xc40 [tls] kasan_report+0xab/0x120 ? decrypt_internal+0x385/0xc40 [tls] kasan_check_range+0xf9/0x1e0 memcpy+0x20/0x60 decrypt_internal+0x385/0xc40 [tls] ? tls_get_rec+0x2e0/0x2e0 [tls] ? process_rx_list+0x1a5/0x420 [tls] ? tls_setup_from_iter.constprop.0+0x2e0/0x2e0 [tls] decrypt_skb_update+0x9d/0x400 [tls] tls_sw_recvmsg+0x3c8/0xb50 [tls] Allocated by task 10911: kasan_save_stack+0x1e/0x40
__kasan_kmalloc+0x81/0xa0 tls_set_sw_offload+0x2eb/0xa20 [tls] tls_setsockopt+0x68c/0x700 [tls]
__sys_setsockopt+0xfe/0x1b0 Replace the crypto_aead_ivsize() with prot->iv_size + prot->salt_size when memcpy() iv value in TLS_1_3_VERSION scenario. (CVE-2022-49094)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49094
https://ubuntu.com/security/CVE-2022-49094

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0004
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49094

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225584 - Linux Distros Unpatched Vulnerability : CVE-2022-49127
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ref_tracker: implement use-after-free detection Whenever ref_tracker_dir_init() is called, mark the struct ref_tracker_dir as dead. Test the dead status from ref_tracker_alloc() and ref_tracker_free() This should detect buggy dev_put()/dev_hold() happening too late in netdevice dismantle process. (CVE-2022-49127)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49127
https://ubuntu.com/security/CVE-2022-49127

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49127

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225264 - Linux Distros Unpatched Vulnerability : CVE-2022-49157
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: qla2xxx: Fix premature hw access after PCI error After a recoverable PCI error has been detected and recovered, qla driver needs to check to see if the error condition still persist and/or wait for the OS to give the resume signal. Sep 8 22:26:03 localhost kernel: WARNING: CPU: 9 PID: 124606 at qla_tmpl.c:440 qla27xx_fwdt_entry_t266+0x55/0x60 [qla2xxx] Sep 8 22:26:03 localhost kernel: RIP:
0010:qla27xx_fwdt_entry_t266+0x55/0x60 [qla2xxx] Sep 8 22:26:03 localhost kernel: Call Trace: Sep 8 22:26:03 localhost kernel: ? qla27xx_walk_template+0xb1/0x1b0 [qla2xxx] Sep 8 22:26:03 localhost kernel: ? qla27xx_execute_fwdt_template+0x12a/0x160 [qla2xxx] Sep 8 22:26:03 localhost kernel: ? qla27xx_fwdump+0xa0/0x1c0 [qla2xxx] Sep 8 22:26:03 localhost kernel: ? qla2xxx_pci_mmio_enabled+0xfb/0x120 [qla2xxx] Sep 8 22:26:03 localhost kernel: ? report_mmio_enabled+0x44/0x80 Sep 8 22:26:03 localhost kernel: ? report_slot_reset+0x80/0x80 Sep 8 22:26:03 localhost kernel: ? pci_walk_bus+0x70/0x90 Sep 8 22:26:03 localhost kernel: ? aer_dev_correctable_show+0xc0/0xc0 Sep 8 22:26:03 localhost kernel: ? pcie_do_recovery+0x1bb/0x240 Sep 8 22:26:03 localhost kernel: ? aer_recover_work_func+0xaa/0xd0 Sep 8 22:26:03 localhost kernel: ? process_one_work+0x1a7/0x360 .. Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-8041:22: detected PCI disconnect. Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-107ff:22: qla27xx_fwdt_entry_t262: dump ram MB failed. Area 5h start 198013h end 198013h Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-107ff:22: Unable to capture FW dump Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-1015:22: cmd=0x0, waited 5221 msecs Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-680d:22: mmio enabled returning. Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-d04c:22: MBX Command timeout for cmd 0, iocontrol=ffffffff jiffies=10140f2e5 mb[0-3]=[0xffff 0xffff 0xffff 0xffff] (CVE-2022-49157)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49157
https://security-tracker.debian.org/tracker/CVE-2022-49157
https://ubuntu.com/security/CVE-2022-49157

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49157

Plugin Information
Published: 2025/03/05, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225446 - Linux Distros Unpatched Vulnerability : CVE-2022-49176
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bfq: fix use-after-free in bfq_dispatch_request KASAN reports a use-after-free report when doing normal scsi-mq test [69832.239032] ================================================================== [69832.241810] BUG: KASAN: use-after- free in bfq_dispatch_request+0x1045/0x44b0 [69832.243267] Read of size 8 at addr ffff88802622ba88 by task kworker/3:1H/155 [69832.244656] [69832.245007] CPU: 3 PID: 155 Comm: kworker/3:1H Not tainted 5.10.0-10295-g576c6382529e #8 [69832.246626] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [69832.249069] Workqueue: kblockd blk_mq_run_work_fn [69832.250022] Call Trace: [69832.250541] dump_stack+0x9b/0xce [69832.251232] ? bfq_dispatch_request+0x1045/0x44b0 [69832.252243] print_address_description.constprop.6+0x3e/0x60 [69832.253381] ? __cpuidle_text_end+0x5/0x5 [69832.254211] ? vprintk_func+0x6b/0x120 [69832.254994] ? bfq_dispatch_request+0x1045/0x44b0 [69832.255952] ? bfq_dispatch_request+0x1045/0x44b0 [69832.256914] kasan_report.cold.9+0x22/0x3a [69832.257753] ? bfq_dispatch_request+0x1045/0x44b0 [69832.258755] check_memory_region+0x1c1/0x1e0 [69832.260248] bfq_dispatch_request+0x1045/0x44b0 [69832.261181] ? bfq_bfqq_expire+0x2440/0x2440 [69832.262032] ? blk_mq_delay_run_hw_queues+0xf9/0x170 [69832.263022]
__blk_mq_do_dispatch_sched+0x52f/0x830 [69832.264011] ? blk_mq_sched_request_inserted+0x100/0x100 [69832.265101] __blk_mq_sched_dispatch_requests+0x398/0x4f0 [69832.266206] ? blk_mq_do_dispatch_ctx+0x570/0x570 [69832.267147] ? __switch_to+0x5f4/0xee0 [69832.267898] blk_mq_sched_dispatch_requests+0xdf/0x140 [69832.268946] __blk_mq_run_hw_queue+0xc0/0x270 [69832.269840] blk_mq_run_work_fn+0x51/0x60 [69832.278170] process_one_work+0x6d4/0xfe0 [69832.278984] worker_thread+0x91/0xc80 [69832.279726] ? __kthread_parkme+0xb0/0x110 [69832.280554] ? process_one_work+0xfe0/0xfe0 [69832.281414] kthread+0x32d/0x3f0 [69832.282082] ? kthread_park+0x170/0x170 [69832.282849] ret_from_fork+0x1f/0x30 [69832.283573] [69832.283886] Allocated by task 7725:
[69832.284599] kasan_save_stack+0x19/0x40 [69832.285385] __kasan_kmalloc.constprop.2+0xc1/0xd0 [69832.286350] kmem_cache_alloc_node+0x13f/0x460 [69832.287237] bfq_get_queue+0x3d4/0x1140 [69832.287993] bfq_get_bfqq_handle_split+0x103/0x510 [69832.289015] bfq_init_rq+0x337/0x2d50 [69832.289749] bfq_insert_requests+0x304/0x4e10 [69832.290634] blk_mq_sched_insert_requests+0x13e/0x390 [69832.291629] blk_mq_flush_plug_list+0x4b4/0x760 [69832.292538] blk_flush_plug_list+0x2c5/0x480 [69832.293392] io_schedule_prepare+0xb2/0xd0 [69832.294209] io_schedule_timeout+0x13/0x80 [69832.295014] wait_for_common_io.constprop.1+0x13c/0x270 [69832.296137] submit_bio_wait+0x103/0x1a0 [69832.296932] blkdev_issue_discard+0xe6/0x160 [69832.297794] blk_ioctl_discard+0x219/0x290 [69832.298614] blkdev_common_ioctl+0x50a/0x1750 [69832.304715] blkdev_ioctl+0x470/0x600 [69832.305474] block_ioctl+0xde/0x120 [69832.306232] vfs_ioctl+0x6c/0xc0 [69832.306877] __se_sys_ioctl+0x90/0xa0 [69832.307629] do_syscall_64+0x2d/0x40 [69832.308362] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [69832.309382] [69832.309701] Freed by task 155: [69832.310328] kasan_save_stack+0x19/0x40 [69832.311121] kasan_set_track+0x1c/0x30 [69832.311868] kasan_set_free_info+0x1b/0x30 [69832.312699]
__kasan_slab_free+0x111/0x160 [69832.313524] kmem_cache_free+0x94/0x460 [69832.314367] bfq_put_queue+0x582/0x940 [69832.315112] __bfq_bfqd_reset_in_service+0x166/0x1d0 [69832.317275] bfq_bfqq_expire+0xb27/0x2440 [69832.318084] bfq_dispatch_request+0x697/0x44b0 [69832.318991]
__blk_mq_do_dispatch_sched+0x52f/0x830 [69832.319984] __blk_mq_sched_dispatch_requests+0x398/0x4f0 [69832.321087] blk_mq_sched_dispatch_requests+0xdf/0x140 [69832.322225] __blk_mq_run_hw_queue+0xc0/0x270 [69832.323114] blk_mq_run_work_fn+0x51/0x6 ---truncated--- (CVE-2022-49176)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49176
https://ubuntu.com/security/CVE-2022-49176

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49176

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225147 - Linux Distros Unpatched Vulnerability : CVE-2022-49182
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: hns3: add vlan list lock to protect vlan list When adding port base VLAN, vf VLAN need to remove from HW and modify the vlan state in vf VLAN list as false. If the periodicity task is freeing the same node, it may cause use after free error. This patch adds a vlan list lock to protect the vlan list.
(CVE-2022-49182)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49182
https://security-tracker.debian.org/tracker/CVE-2022-49182
https://ubuntu.com/security/CVE-2022-49182

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49182

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225603 - Linux Distros Unpatched Vulnerability : CVE-2022-49196
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- powerpc/pseries: Fix use after free in remove_phb_dynamic() In remove_phb_dynamic() we use &phb->io_resource, after we've called device_unregister(&host_bridge->dev). But the unregister may have freed phb, because pcibios_free_controller_deferred() is the release function for the host_bridge. If there are no outstanding references when we call device_unregister() then phb will be freed out from under us. This has gone mainly unnoticed, but with slub_debug and page_poison enabled it can lead to a crash:
PID: 7574 TASK: c0000000d492cb80 CPU: 13 COMMAND: drmgr #0 [c0000000e4f075a0] crash_kexec at c00000000027d7dc #1 [c0000000e4f075d0] oops_end at c000000000029608 #2 [c0000000e4f07650] __bad_page_fault at c0000000000904b4 #3 [c0000000e4f076c0] do_bad_slb_fault at c00000000009a5a8 #4 [c0000000e4f076f0] data_access_slb_common_virt at c000000000008b30 Data SLB Access [380] exception frame: R0:
c000000000167250 R1: c0000000e4f07a00 R2: c000000002a46100 R3: c000000002b39ce8 R4: 00000000000000c0 R5:
00000000000000a9 R6: 3894674d000000c0 R7: 0000000000000000 R8: 00000000000000ff R9: 0000000000000100 R10:
6b6b6b6b6b6b6b6b R11: 0000000000008000 R12: c00000000023da80 R13: c0000009ffd38b00 R14: 0000000000000000 R15: 000000011c87f0f0 R16: 0000000000000006 R17: 0000000000000003 R18: 0000000000000002 R19:
0000000000000004 R20: 0000000000000005 R21: 000000011c87ede8 R22: 000000011c87c5a8 R23: 000000011c87d3a0 R24: 0000000000000000 R25: 0000000000000001 R26: c0000000e4f07cc8 R27: c00000004d1cc400 R28:
c0080000031d00e8 R29: c00000004d23d800 R30: c00000004d1d2400 R31: c00000004d1d2540 NIP: c000000000167258 MSR: 8000000000009033 OR3: c000000000e9f474 CTR: 0000000000000000 LR: c000000000167250 XER:
0000000020040003 CCR: 0000000024088420 MQ: 0000000000000000 DAR: 6b6b6b6b6b6b6ba3 DSISR: c0000000e4f07920 Syscall Result: fffffffffffffff2 [NIP : release_resource+56] [LR : release_resource+48] #5 [c0000000e4f07a00] release_resource at c000000000167258 (unreliable) #6 [c0000000e4f07a30] remove_phb_dynamic at c000000000105648 #7 [c0000000e4f07ab0] dlpar_remove_slot at c0080000031a09e8 [rpadlpar_io] #8 [c0000000e4f07b50] remove_slot_store at c0080000031a0b9c [rpadlpar_io] #9 [c0000000e4f07be0] kobj_attr_store at c000000000817d8c #10 [c0000000e4f07c00] sysfs_kf_write at c00000000063e504 #11 [c0000000e4f07c20] kernfs_fop_write_iter at c00000000063d868 #12 [c0000000e4f07c70] new_sync_write at c00000000054339c #13 [c0000000e4f07d10] vfs_write at c000000000546624 #14 [c0000000e4f07d60] ksys_write at c0000000005469f4 #15 [c0000000e4f07db0] system_call_exception at c000000000030840 #16 [c0000000e4f07e10] system_call_vectored_common at c00000000000c168 To avoid it, we can take a reference to the host_bridge->dev until we're done using phb. Then when we drop the reference the phb will be freed. (CVE-2022-49196)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49196
https://security-tracker.debian.org/tracker/CVE-2022-49196
https://ubuntu.com/security/CVE-2022-49196

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49196

Plugin Information
Published: 2025/03/05, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225124 - Linux Distros Unpatched Vulnerability : CVE-2022-49377
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx blk_mq_run_hw_queues() could be run when there isn't queued request and after queue is cleaned up, at that time tagset is freed, because tagset lifetime is covered by driver, and often freed after blk_cleanup_queue() returns. So don't touch ->tagset for figuring out current default hctx by the mapping built in request queue, so use-after-free on tagset can be avoided. Meantime this way should be fast than retrieving mapping from tagset. (CVE-2022-49377)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49377
https://ubuntu.com/security/CVE-2022-49377

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49377

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225668 - Linux Distros Unpatched Vulnerability : CVE-2022-49384
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: md: fix double free of io_acct_set bioset Now io_acct_set is alloc and free in personality. Remove the codes that free io_acct_set in md_free and md_stop. (CVE-2022-49384)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49384
https://ubuntu.com/security/CVE-2022-49384

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49384

Plugin Information
Published: 2025/03/05, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225451 - Linux Distros Unpatched Vulnerability : CVE-2022-49385
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- driver: base: fix UAF when driver_attach failed When driver_attach(drv); failed, the driver_private will be freed. But it has been added to the bus, which caused a UAF. To fix it, we need to delete it from the bus when failed. (CVE-2022-49385)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49385
https://ubuntu.com/security/CVE-2022-49385

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49385

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225377 - Linux Distros Unpatched Vulnerability : CVE-2022-49388
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ubi: ubi_create_volume: Fix use-after- free when volume creation failed There is an use-after-free problem for 'eba_tbl' in ubi_create_volume()'s error handling path: ubi_eba_replace_table(vol, eba_tbl) vol->eba_tbl = tbl out_mapping:
ubi_eba_destroy_table(eba_tbl) // Free 'eba_tbl' out_unlock: put_device(&vol->dev) vol_release kfree(tbl->entries) // UAF Fix it by removing redundant 'eba_tbl' releasing. Fetch a reproducer in [Link].
(CVE-2022-49388)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49388
https://ubuntu.com/security/CVE-2022-49388

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49388

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225410 - Linux Distros Unpatched Vulnerability : CVE-2022-49390
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- macsec: fix UAF bug for real_dev Create a new macsec device but not get reference to real_dev. That can not ensure that real_dev is freed after macsec. That will trigger the UAF bug for real_dev as following:
================================================================== BUG: KASAN: use-after-free in macsec_get_iflink+0x5f/0x70 drivers/net/macsec.c:3662 Call Trace: ... macsec_get_iflink+0x5f/0x70 drivers/net/macsec.c:3662 dev_get_iflink+0x73/0xe0 net/core/dev.c:637 default_operstate net/core/link_watch.c:42 [inline] rfc2863_policy+0x233/0x2d0 net/core/link_watch.c:54 linkwatch_do_dev+0x2a/0x150 net/core/link_watch.c:161 Allocated by task 22209: ...
alloc_netdev_mqs+0x98/0x1100 net/core/dev.c:10549 rtnl_create_link+0x9d7/0xc00 net/core/rtnetlink.c:3235 veth_newlink+0x20e/0xa90 drivers/net/veth.c:1748 Freed by task 8: ... kfree+0xd6/0x4d0 mm/slub.c:4552 kvfree+0x42/0x50 mm/util.c:615 device_release+0x9f/0x240 drivers/base/core.c:2229 kobject_cleanup lib/kobject.c:673 [inline] kobject_release lib/kobject.c:704 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1c8/0x540 lib/kobject.c:721 netdev_run_todo+0x72e/0x10b0 net/core/dev.c:10327 After commit faab39f63c1f (net: allow out-of-order netdev unregistration) and commit e5f80fcf869a (ipv6: give an IPv6 dev to blackhole_netdev), we can add dev_hold_track() in macsec_dev_init() and dev_put_track() in macsec_free_netdev() to fix the problem. (CVE-2022-49390)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49390
https://security-tracker.debian.org/tracker/CVE-2022-49390
https://ubuntu.com/security/CVE-2022-49390

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49390

Plugin Information
Published: 2025/03/05, Modified: 2025/12/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225588 - Linux Distros Unpatched Vulnerability : CVE-2022-49395
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- um: Fix out-of-bounds read in LDT setup syscall_stub_data() expects the data_count parameter to be the number of longs, not bytes. ================================================================== BUG: KASAN:
stack-out-of-bounds in syscall_stub_data+0x70/0xe0 Read of size 128 at addr 000000006411f6f0 by task swapper/1 CPU: 0 PID: 1 Comm: swapper Not tainted 5.18.0+ #18 Call Trace: show_stack.cold+0x166/0x2a7
__dump_stack+0x3a/0x43 dump_stack_lvl+0x1f/0x27 print_report.cold+0xdb/0xf81 kasan_report+0x119/0x1f0 kasan_check_range+0x3a3/0x440 memcpy+0x52/0x140 syscall_stub_data+0x70/0xe0 write_ldt_entry+0xac/0x190 init_new_ldt+0x515/0x960 init_new_context+0x2c4/0x4d0 mm_init.constprop.0+0x5ed/0x760 mm_alloc+0x118/0x170 0x60033f48 do_one_initcall+0x1d7/0x860 0x60003e7b kernel_init+0x6e/0x3d4 new_thread_handler+0x1e7/0x2c0 The buggy address belongs to stack of task swapper/1 and is located at offset 64 in frame:
init_new_ldt+0x0/0x960 This frame has 2 objects: [32, 40) 'addr' [64, 80) 'desc'
================================================================== (CVE-2022-49395)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49395
https://ubuntu.com/security/CVE-2022-49395

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0006
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49395

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225720 - Linux Distros Unpatched Vulnerability : CVE-2022-49402
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ftrace: Clean up hash direct_functions on register failures We see the following GPF when register_ftrace_direct fails: [ ] general protection fault, probably for non-canonical address \ 0x200000000000010: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI [...] [ ] RIP: 0010:ftrace_find_rec_direct+0x53/0x70 [ ] Code: 48 c1 e0 03 48 03 42 08 48 8b 10 31 c0 48 85 d2 74 [...] [ ] RSP: 0018:ffffc9000138bc10 EFLAGS: 00010206 [ ] RAX: 0000000000000000 RBX:
ffffffff813e0df0 RCX: 000000000000003b [ ] RDX: 0200000000000000 RSI: 000000000000000c RDI:
ffffffff813e0df0 [ ] RBP: ffffffffa00a3000 R08: ffffffff81180ce0 R09: 0000000000000001 [ ] R10:
ffffc9000138bc18 R11: 0000000000000001 R12: ffffffff813e0df0 [ ] R13: ffffffff813e0df0 R14:
ffff888171b56400 R15: 0000000000000000 [ ] FS: 00007fa9420c7780(0000) GS:ffff888ff6a00000(0000) knlGS:000000000 [ ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ ] CR2: 000000000770d000 CR3:
0000000107d50003 CR4: 0000000000370ee0 [ ] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000 [ ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ ] Call Trace: [ ] <TASK> [ ] register_ftrace_direct+0x54/0x290 [ ] ? render_sigset_t+0xa0/0xa0 [ ] bpf_trampoline_update+0x3f5/0x4a0 [ ] ? 0xffffffffa00a3000 [ ] bpf_trampoline_link_prog+0xa9/0x140 [ ] bpf_tracing_prog_attach+0x1dc/0x450 [ ] bpf_raw_tracepoint_open+0x9a/0x1e0 [ ] ? find_held_lock+0x2d/0x90 [ ] ? lock_release+0x150/0x430 [ ] __sys_bpf+0xbd6/0x2700 [ ] ? lock_is_held_type+0xd8/0x130 [ ]
__x64_sys_bpf+0x1c/0x20 [ ] do_syscall_64+0x3a/0x80 [ ] entry_SYSCALL_64_after_hwframe+0x44/0xae [ ] RIP:
0033:0x7fa9421defa9 [ ] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 9 f8 [...] [ ] RSP:
002b:00007ffed743bd78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ ] RAX: ffffffffffffffda RBX:
00000000069d2480 RCX: 00007fa9421defa9 [ ] RDX: 0000000000000078 RSI: 00007ffed743bd80 RDI:
0000000000000011 [ ] RBP: 00007ffed743be00 R08: 0000000000bb7270 R09: 0000000000000000 [ ] R10:
00000000069da210 R11: 0000000000000246 R12: 0000000000000001 [ ] R13: 00007ffed743c4b0 R14:
00000000069d2480 R15: 0000000000000001 [ ] </TASK> [ ] Modules linked in: klp_vm(OK) [ ] ---[ end trace 0000000000000000 ]--- One way to trigger this is: 1. load a livepatch that patches kernel function xxx; 2.
run bpftrace -e 'kfunc:xxx {}', this will fail (expected for now); 3. repeat #2 => gpf. This is because the entry is added to direct_functions, but not removed. Fix this by remove the entry from direct_functions when register_ftrace_direct fails. Also remove the last trailing space from ftrace.c, so we don't have to worry about it anymore. (CVE-2022-49402)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49402
https://ubuntu.com/security/CVE-2022-49402

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0008
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49402

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225559 - Linux Distros Unpatched Vulnerability : CVE-2022-49407
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dlm: fix plock invalid read This patch fixes an invalid read showed by KASAN. A unlock will allocate a struct plock_op and a followed send_op() will append it to a global send_list data structure. In some cases a followed dev_read() moves it to recv_list and dev_write() will cast it to struct plock_xop and access fields which are only available in those structures. At this point an invalid read happens by accessing those fields. To fix this issue the callback field is moved to struct plock_op to indicate that a cast to plock_xop is allowed and does the additional plock_xop handling if set. Example of the KASAN output which showed the invalid read: [ 2064.296453] ================================================================== [ 2064.304852] BUG: KASAN: slab-out-of- bounds in dev_write+0x52b/0x5a0 [dlm] [ 2064.306491] Read of size 8 at addr ffff88800ef227d8 by task dlm_controld/7484 [ 2064.308168] [ 2064.308575] CPU: 0 PID: 7484 Comm: dlm_controld Kdump: loaded Not tainted 5.14.0+ #9 [ 2064.310292] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 2064.311618] Call Trace: [ 2064.312218] dump_stack_lvl+0x56/0x7b [ 2064.313150] print_address_description.constprop.8+0x21/0x150 [ 2064.314578] ? dev_write+0x52b/0x5a0 [dlm] [ 2064.315610] ? dev_write+0x52b/0x5a0 [dlm] [ 2064.316595] kasan_report.cold.14+0x7f/0x11b [ 2064.317674] ? dev_write+0x52b/0x5a0 [dlm] [ 2064.318687] dev_write+0x52b/0x5a0 [dlm] [ 2064.319629] ? dev_read+0x4a0/0x4a0 [dlm] [ 2064.320713] ? bpf_lsm_kernfs_init_security+0x10/0x10 [ 2064.321926] vfs_write+0x17e/0x930 [ 2064.322769] ? __fget_light+0x1aa/0x220 [ 2064.323753] ksys_write+0xf1/0x1c0 [ 2064.324548] ? __ia32_sys_read+0xb0/0xb0 [ 2064.325464] do_syscall_64+0x3a/0x80 [ 2064.326387] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2064.327606] RIP: 0033:0x7f807e4ba96f [ 2064.328470] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 39 87 f8 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 7c 87 f8 ff 48 [ 2064.332902] RSP:
002b:00007ffd50cfe6e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 2064.334658] RAX: ffffffffffffffda RBX: 000055cc3886eb30 RCX: 00007f807e4ba96f [ 2064.336275] RDX: 0000000000000040 RSI: 00007ffd50cfe7e0 RDI: 0000000000000010 [ 2064.337980] RBP: 00007ffd50cfe7e0 R08: 0000000000000000 R09: 0000000000000001 [ 2064.339560] R10: 000055cc3886eb30 R11: 0000000000000293 R12: 000055cc3886eb80 [ 2064.341237] R13:
000055cc3886eb00 R14: 000055cc3886f590 R15: 0000000000000001 [ 2064.342857] [ 2064.343226] Allocated by task 12438: [ 2064.344057] kasan_save_stack+0x1c/0x40 [ 2064.345079] __kasan_kmalloc+0x84/0xa0 [ 2064.345933] kmem_cache_alloc_trace+0x13b/0x220 [ 2064.346953] dlm_posix_unlock+0xec/0x720 [dlm] [ 2064.348811] do_lock_file_wait.part.32+0xca/0x1d0 [ 2064.351070] fcntl_setlk+0x281/0xbc0 [ 2064.352879] do_fcntl+0x5e4/0xfe0 [ 2064.354657] __x64_sys_fcntl+0x11f/0x170 [ 2064.356550] do_syscall_64+0x3a/0x80 [ 2064.358259] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2064.360745] [ 2064.361511] Last potentially related work creation: [ 2064.363957] kasan_save_stack+0x1c/0x40 [ 2064.365811]
__kasan_record_aux_stack+0xaf/0xc0 [ 2064.368100] call_rcu+0x11b/0xf70 [ 2064.369785] dlm_process_incoming_buffer+0x47d/0xfd0 [dlm] [ 2064.372404] receive_from_sock+0x290/0x770 [dlm] [ 2064.374607] process_recv_sockets+0x32/0x40 [dlm] [ 2064.377290] process_one_work+0x9a8/0x16e0 [ 2064.379357] worker_thread+0x87/0xbf0 [ 2064.381188] kthread+0x3ac/0x490 [ 2064.383460] ret_from_fork+0x22/0x30 [ 2064.385588] [ 2064.386518] Second to last potentially related work creation: [ 2064.389219] kasan_save_stack+0x1c/0x40 [ 2064.391043] __kasan_record_aux_stack+0xaf/0xc0 [ 2064.393303] call_rcu+0x11b/0xf70 [ 2064.394885] dlm_process_incoming_buffer+0x47d/0xfd0 [dlm] [ 2064.397694] receive_from_sock+0x290/0x770 ---truncated--- (CVE-2022-49407)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49407
https://ubuntu.com/security/CVE-2022-49407

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0011
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49407

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225690 - Linux Distros Unpatched Vulnerability : CVE-2022-49410
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential double free in create_var_ref() In create_var_ref(), init_var_ref() is called to initialize the fields of variable ref_field, which is allocated in the previous function call to create_hist_field(). Function init_var_ref() allocates the corresponding fields such as ref_field->system, but frees these fields when the function encounters an error. The caller later calls destroy_hist_field() to conduct error handling, which frees the fields and the variable itself. This results in double free of the fields which are already freed in the previous function. Fix this by storing NULL to the corresponding fields when they are freed in init_var_ref(). (CVE-2022-49410)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49410
https://ubuntu.com/security/CVE-2022-49410

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49410

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225245 - Linux Distros Unpatched Vulnerability : CVE-2022-49411
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bfq: Make sure bfqg for which we are queueing requests is online Bios queued into BFQ IO scheduler can be associated with a cgroup that was already offlined. This may then cause insertion of this bfq_group into a service tree. But this bfq_group will get freed as soon as last bio associated with it is completed leading to use after free issues for service tree users. Fix the problem by making sure we always operate on online bfq_group. If the bfq_group associated with the bio is not online, we pick the first online parent. (CVE-2022-49411)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49411
https://ubuntu.com/security/CVE-2022-49411

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49411

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225599 - Linux Distros Unpatched Vulnerability : CVE-2022-49419
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: video: fbdev: vesafb: Fix a use-after- free due early fb_info cleanup Commit b3c9a924aab6 (fbdev: vesafb: Cleanup fb_info in .fb_destroy rather than .remove) fixed a use-after-free error due the vesafb driver freeing the fb_info in the .remove handler instead of doing it in .fb_destroy. This can happen if the .fb_destroy callback is executed after the .remove callback, since the former tries to access a pointer freed by the latter. But that change didn't take into account that another possible scenario is that .fb_destroy is called before the .remove callback. For example, if no process has the fbdev chardev opened by the time the driver is removed. If that's the case, fb_info will be freed when unregister_framebuffer() is called, making the fb_info pointer accessed in vesafb_remove() after that to no longer be valid. To prevent that, move the expression containing the info->par to happen before the unregister_framebuffer() function call. (CVE-2022-49419)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49419
https://ubuntu.com/security/CVE-2022-49419

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49419

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248823 - Linux Distros Unpatched Vulnerability : CVE-2022-49436
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: powerpc/papr_scm: Fix leaking nvdimm_events_map elements Right now 'char *' elements allocated for individual 'stat_id' in 'papr_scm_priv.nvdimm_events_map[]' during papr_scm_pmu_check_events(), get leaked in papr_scm_remove() and papr_scm_pmu_register(), papr_scm_pmu_check_events() error paths. Also individual 'stat_id' arent NULL terminated 'char *' instead they are fixed 8-byte sized identifiers. However papr_scm_pmu_register() assumes it to be a NULL terminated 'char *' and at other places it assumes it to be a 'papr_scm_perf_stat.stat_id' sized string which is 8-byes in size. Fix this by allocating the memory for papr_scm_priv.nvdimm_events_map to also include space for 'stat_id' entries. This is possible since number of available events/stat_ids are known upfront. This saves some memory and one extra level of indirection from 'nvdimm_events_map' to 'stat_id'. Also rest of the code can continue to call 'kfree(papr_scm_priv.nvdimm_events_map)' without needing to iterate over the array and free up individual elements. (CVE-2022-49436)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49436
https://ubuntu.com/security/CVE-2022-49436

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49436

Plugin Information
Published: 2025/08/12, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225634 - Linux Distros Unpatched Vulnerability : CVE-2022-49444
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- module: fix [e_shstrndx].sh_size=0 OOB access It is trivial to craft a module to trigger OOB access in this line: if (info->secstrings[strhdr->sh_size - 1] != '\0') { BUG: unable to handle page fault for address: ffffc90000aa0fff PGD 100000067 P4D 100000067 PUD 100066067 PMD 10436f067 PTE 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 7 PID: 1215 Comm: insmod Not tainted 5.18.0-rc5-00007-g9bf578647087-dirty #10 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014 RIP:
0010:load_module+0x19b/0x2391 [rebased patch onto modules-next] (CVE-2022-49444)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49444
https://security-tracker.debian.org/tracker/CVE-2022-49444
https://ubuntu.com/security/CVE-2022-49444

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49444

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225702 - Linux Distros Unpatched Vulnerability : CVE-2022-49455
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: misc: ocxl: fix possible double free in ocxl_file_register_afu info_release() will be called in device_unregister() when info->dev's reference count is 0. So there is no need to call ocxl_afu_put() and kfree() again. Fix this by adding free_minor() and return to err_unregister error path. (CVE-2022-49455)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49455
https://ubuntu.com/security/CVE-2022-49455

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49455

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227185 - Linux Distros Unpatched Vulnerability : CVE-2022-49474
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout Connecting the same socket twice consecutively in sco_sock_connect() could lead to a race condition where two sco_conn objects are created but only one is associated with the socket. If the socket is closed before the SCO connection is established, the timer associated with the dangling sco_conn object won't be canceled. As the sock object is being freed, the use-after-free problem happens when the timer callback function sco_sock_timeout() accesses the socket. Here's the call trace:
dump_stack+0x107/0x163 ? refcount_inc+0x1c/ print_address_description.constprop.0+0x1c/0x47e ? refcount_inc+0x1c/0x7b kasan_report+0x13a/0x173 ? refcount_inc+0x1c/0x7b check_memory_region+0x132/0x139 refcount_inc+0x1c/0x7b sco_sock_timeout+0xb2/0x1ba process_one_work+0x739/0xbd1 ? cancel_delayed_work+0x13f/0x13f ? __raw_spin_lock_init+0xf0/0xf0 ? to_kthread+0x59/0x85 worker_thread+0x593/0x70e kthread+0x346/0x35a ? drain_workqueue+0x31a/0x31a ? kthread_bind+0x4b/0x4b ret_from_fork+0x1f/0x30 (CVE-2022-49474)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49474
https://ubuntu.com/security/CVE-2022-49474

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
5.9 (CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
4.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49474

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226775 - Linux Distros Unpatched Vulnerability : CVE-2022-49479
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mt76: fix tx status related use-after- free race on station removal There is a small race window where ongoing tx activity can lead to a skb getting added to the status tracking idr after that idr has already been cleaned up, which will keep the wcid linked in the status poll list. Fix this by only adding status skbs if the wcid pointer is still assigned in dev->wcid, which gets cleared early by mt76_sta_pre_rcu_remove (CVE-2022-49479)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49479
https://ubuntu.com/security/CVE-2022-49479

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49479

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226404 - Linux Distros Unpatched Vulnerability : CVE-2022-49493
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ASoC: rt5645: Fix errorenous cleanup order There is a logic error when removing rt5645 device as the function rt5645_i2c_remove() first cancel the &rt5645->jack_detect_work and delete the &rt5645->btn_check_timer latter. However, since the timer handler rt5645_btn_check_callback() will re- queue the jack_detect_work, this cleanup order is buggy. That is, once the del_timer_sync in rt5645_i2c_remove is concurrently run with the rt5645_btn_check_callback, the canceled jack_detect_work will be rescheduled again, leading to possible use-after-free. This patch fix the issue by placing the del_timer_sync function before the cancel_delayed_work_sync. (CVE-2022-49493)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49493
https://ubuntu.com/security/CVE-2022-49493

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49493

Plugin Information
Published: 2025/03/05, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227202 - Linux Distros Unpatched Vulnerability : CVE-2022-49501
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usbnet: Run unregister_netdev() before unbind() again Commit 2c9d6c2b871d (usbnet: run unbind() before unregister_netdev()) sought to fix a use-after-free on disconnect of USB Ethernet adapters. It turns out that a different fix is necessary to address the issue:
https://lore.kernel.org/netdev/18b3541e5372bc9b9fc733d422f4e698c089077c.1650177997.git.lukas@wunner.de/ So the commit was not necessary. The commit made binding and unbinding of USB Ethernet asymmetrical: Before, usbnet_probe() first invoked the ->bind() callback and then register_netdev(). usbnet_disconnect() mirrored that by first invoking unregister_netdev() and then ->unbind(). Since the commit, the order in usbnet_disconnect() is reversed and no longer mirrors usbnet_probe(). One consequence is that a PHY disconnected (and stopped) in ->unbind() is afterwards stopped once more by unregister_netdev() as it closes the netdev before unregistering. That necessitates a contortion in ->stop() because the PHY may only be stopped if it hasn't already been disconnected. Reverting the commit allows making the call to phy_stop() unconditional in ->stop(). (CVE-2022-49501)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49501
https://ubuntu.com/security/CVE-2022-49501

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49501

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226140 - Linux Distros Unpatched Vulnerability : CVE-2022-49503
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix The rxstatus->rs_keyix eventually gets passed to test_bit() so we need to ensure that it is within the bitmap.
drivers/net/wireless/ath/ath9k/common.c:46 ath9k_cmn_rx_accept() error: passing untrusted data 'rx_stats->rs_keyix' to 'test_bit()' (CVE-2022-49503)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49503
https://ubuntu.com/security/CVE-2022-49503

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0006
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49503

Plugin Information
Published: 2025/03/05, Modified: 2025/12/12
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226779 - Linux Distros Unpatched Vulnerability : CVE-2022-49508
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: HID: elan: Fix potential double free in elan_input_configured 'input' is a managed resource allocated with devm_input_allocate_device(), so there is no need to call input_free_device() explicitly or there will be a double free. According to the doc of devm_input_allocate_device(): * Managed input devices do not need to be explicitly unregistered or
* freed as it will be done automatically when owner device unbinds from * its driver (or binding fails).
(CVE-2022-49508)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49508
https://ubuntu.com/security/CVE-2022-49508

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49508

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225922 - Linux Distros Unpatched Vulnerability : CVE-2022-49518
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ASoC: SOF: ipc3-topology: Correct get_control_data for non bytes payload It is possible to craft a topology where sof_get_control_data() would do out of bounds access because it expects that it is only called when the payload is bytes type. Confusingly it also handles other types of controls, but the payload parsing implementation is only valid for bytes. Fix the code to count the non bytes controls and instead of storing a pointer to sof_abi_hdr in sof_widget_data (which is only valid for bytes), store the pointer to the data itself and add a new member to save the size of the data. In case of non bytes controls we store the pointer to the chanv itself, which is just an array of values at the end. In case of bytes control, drop the wrong cdata->data (wdata[i].pdata) check against NULL since it is incorrect and invalid in this context. The data is pointing to the end of cdata struct, so it should never be null.
(CVE-2022-49518)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49518
https://ubuntu.com/security/CVE-2022-49518

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49518

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226594 - Linux Distros Unpatched Vulnerability : CVE-2022-49535
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI If lpfc_issue_els_flogi() fails and returns non-zero status, the node reference count is decremented to trigger the release of the nodelist structure. However, if there is a prior registration or dev-loss-evt work pending, the node may be released prematurely. When dev-loss-evt completes, the released node is referenced causing a use-after- free null pointer dereference. Similarly, when processing non-zero ELS PLOGI completion status in lpfc_cmpl_els_plogi(), the ndlp flags are checked for a transport registration before triggering node removal. If dev-loss-evt work is pending, the node may be released prematurely and a subsequent call to lpfc_dev_loss_tmo_handler() results in a use after free ndlp dereference. Add test for pending dev-loss before decrementing the node reference count for FLOGI, PLOGI, PRLI, and ADISC handling. (CVE-2022-49535)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49535
https://ubuntu.com/security/CVE-2022-49535

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49535

Plugin Information
Published: 2025/03/05, Modified: 2025/12/23
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226414 - Linux Distros Unpatched Vulnerability : CVE-2022-49556
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak For some sev ioctl interfaces, the length parameter that is passed maybe less than or equal to SEV_FW_BLOB_MAX_SIZE, but larger than the data that PSP firmware returns. In this case, kmalloc will allocate memory that is the size of the input rather than the size of the data.
Since PSP firmware doesn't fully overwrite the allocated buffer, these sev ioctl interface may return uninitialized kernel slab memory. (CVE-2022-49556)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49556
https://ubuntu.com/security/CVE-2022-49556

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.2
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49556

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227000 - Linux Distros Unpatched Vulnerability : CVE-2022-49581
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- be2net: Fix buffer overflow in be_get_module_eeprom be_cmd_read_port_transceiver_data assumes that it is given a buffer that is at least PAGE_DATA_LEN long, or twice that if the module supports SFF 8472.
However, this is not always the case. Fix this by passing the desired offset and length to be_cmd_read_port_transceiver_data so that we only copy the bytes once. (CVE-2022-49581)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49581
https://ubuntu.com/security/CVE-2022-49581

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49581

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226311 - Linux Distros Unpatched Vulnerability : CVE-2022-49667
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: bonding: fix use-after-free after 802.3ad slave unbind commit 0622cab0341c (bonding: fix 802.3ad aggregator reselection), resolve case, when there is several aggregation groups in the same bond.
bond_3ad_unbind_slave will invalidate (clear) aggregator when __agg_active_ports return zero. So, ad_clear_agg can be executed even, when num_of_ports!=0. Than bond_3ad_unbind_slave can be executed again for, previously cleared aggregator. NOTE: at this time bond_3ad_unbind_slave will not update slave ports list, because lag_ports==NULL. So, here we got slave ports, pointing to freed aggregator memory. Fix with checking actual number of ports in group (as was before commit 0622cab0341c (bonding: fix 802.3ad aggregator reselection) ), before ad_clear_agg(). The KASAN logs are as follows: [ 767.617392] ================================================================== [ 767.630776] BUG: KASAN: use-after- free in bond_3ad_state_machine_handler+0x13dc/0x1470 [ 767.638764] Read of size 2 at addr ffff00011ba9d430 by task kworker/u8:7/767 [ 767.647361] CPU: 3 PID: 767 Comm: kworker/u8:7 Tainted: G O 5.15.11 #15 [ 767.655329] Hardware name: DNI AmazonGo1 A7040 board (DT) [ 767.660760] Workqueue: lacp_1 bond_3ad_state_machine_handler [ 767.666468] Call trace: [ 767.668930] dump_backtrace+0x0/0x2d0 [ 767.672625] show_stack+0x24/0x30 [ 767.675965] dump_stack_lvl+0x68/0x84 [ 767.679659] print_address_description.constprop.0+0x74/0x2b8 [ 767.685451] kasan_report+0x1f0/0x260 [ 767.689148]
__asan_load2+0x94/0xd0 [ 767.692667] bond_3ad_state_machine_handler+0x13dc/0x1470 (CVE-2022-49667)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49667
https://ubuntu.com/security/CVE-2022-49667

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49667

Plugin Information
Published: 2025/03/05, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226007 - Linux Distros Unpatched Vulnerability : CVE-2022-49694
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: block: disable the elevator int del_gendisk The elevator is only used for file system requests, which are stopped in del_gendisk. Move disabling the elevator and freeing the scheduler tags to the end of del_gendisk instead of doing that work in disk_release and blk_cleanup_queue to avoid a use after free on q->tag_set from disk_release as the tag_set might not be alive at that point. Move the blk_qos_exit call as well, as it just depends on the elevator exit and would be the only reason to keep the not exactly cheap queue freeze in disk_release.
(CVE-2022-49694)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49694
https://ubuntu.com/security/CVE-2022-49694

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49694

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227381 - Linux Distros Unpatched Vulnerability : CVE-2022-49696
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tipc: fix use-after-free Read in tipc_named_reinit syzbot found the following issue on:
================================================================== BUG: KASAN: use-after-free in tipc_named_reinit+0x94f/0x9b0 net/tipc/name_distr.c:413 Read of size 8 at addr ffff88805299a000 by task kworker/1:9/23764 CPU: 1 PID: 23764 Comm: kworker/1:9 Not tainted 5.18.0-rc4-syzkaller-00878-g17d49e6e8012 #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events tipc_net_finalize_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313 print_report mm/kasan/report.c:429 [inline] kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491 tipc_named_reinit+0x94f/0x9b0 net/tipc/name_distr.c:413 tipc_net_finalize+0x234/0x3d0 net/tipc/net.c:138 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 </TASK> [...] ================================================================== In the commit d966ddcc3821 (tipc: fix a deadlock when flushing scheduled work), the cancel_work_sync() function just to make sure ONLY the work tipc_net_finalize_work() is executing/pending on any CPU completed before tipc namespace is destroyed through tipc_exit_net(). But this function is not guaranteed the work is the last queued. So, the destroyed instance may be accessed in the work which will try to enqueue later. In order to completely fix, we re-order the calling of cancel_work_sync() to make sure the work tipc_net_finalize_work() was last queued and it must be completed by calling cancel_work_sync(). (CVE-2022-49696)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49696
https://ubuntu.com/security/CVE-2022-49696

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49696

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226953 - Linux Distros Unpatched Vulnerability : CVE-2022-49720
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- block: Fix handling of offline queues in blk_mq_alloc_request_hctx() This patch prevents that test nvme/004 triggers the following: UBSAN: array-index-out-of-bounds in block/blk-mq.h:135:9 index 512 is out of range for type 'long unsigned int [512]' Call Trace: show_stack+0x52/0x58 dump_stack_lvl+0x49/0x5e dump_stack+0x10/0x12 ubsan_epilogue+0x9/0x3b __ubsan_handle_out_of_bounds.cold+0x44/0x49 blk_mq_alloc_request_hctx+0x304/0x310 __nvme_submit_sync_cmd+0x70/0x200 [nvme_core] nvmf_connect_io_queue+0x23e/0x2a0 [nvme_fabrics] nvme_loop_connect_io_queues+0x8d/0xb0 [nvme_loop] nvme_loop_create_ctrl+0x58e/0x7d0 [nvme_loop] nvmf_create_ctrl+0x1d7/0x4d0 [nvme_fabrics] nvmf_dev_write+0xae/0x111 [nvme_fabrics] vfs_write+0x144/0x560 ksys_write+0xb7/0x140
__x64_sys_write+0x42/0x50 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae (CVE-2022-49720)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49720
https://ubuntu.com/security/CVE-2022-49720

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49720

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245547 - Linux Distros Unpatched Vulnerability : CVE-2022-49740
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads This patch fixes slab-out-of-bounds reads in brcmfmac that occur in brcmf_construct_chaninfo() and brcmf_enable_bw40_2g() when the count value of channel specifications provided by the device is greater than the length of 'list->element[]', decided by the size of the 'list' allocated with kzalloc(). The patch adds checks that make the functions free the buffer and return -EINVAL if that is the case. Note that the negative return is handled by the caller, brcmf_setup_wiphybands() or brcmf_cfg80211_attach(). Found by a modified version of syzkaller. Crash Report from brcmf_construct_chaninfo():
================================================================== BUG: KASAN: slab-out-of-bounds in brcmf_setup_wiphybands+0x1238/0x1430 Read of size 4 at addr ffff888115f24600 by task kworker/0:2/1896 CPU:
0 PID: 1896 Comm: kworker/0:2 Tainted: G W O 5.14.0+ #132 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 Workqueue: usb_hub_wq hub_event Call Trace: dump_stack_lvl+0x57/0x7d print_address_description.constprop.0.cold+0x93/0x334 kasan_report.cold+0x83/0xdf brcmf_setup_wiphybands+0x1238/0x1430 brcmf_cfg80211_attach+0x2118/0x3fd0 brcmf_attach+0x389/0xd40 brcmf_usb_probe+0x12de/0x1690 usb_probe_interface+0x25f/0x710 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_set_configuration+0x984/0x1770 usb_generic_driver_probe+0x69/0x90 usb_probe_device+0x9c/0x220 really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_new_device.cold+0x463/0xf66 hub_event+0x10d5/0x3330 process_one_work+0x873/0x13e0 worker_thread+0x8b/0xd10 kthread+0x379/0x450 ret_from_fork+0x1f/0x30 Allocated by task 1896: kasan_save_stack+0x1b/0x40 __kasan_kmalloc+0x7c/0x90 kmem_cache_alloc_trace+0x19e/0x330 brcmf_setup_wiphybands+0x290/0x1430 brcmf_cfg80211_attach+0x2118/0x3fd0 brcmf_attach+0x389/0xd40 brcmf_usb_probe+0x12de/0x1690 usb_probe_interface+0x25f/0x710 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120
__device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_set_configuration+0x984/0x1770 usb_generic_driver_probe+0x69/0x90 usb_probe_device+0x9c/0x220 really_probe+0x1be/0xa90
__driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_new_device.cold+0x463/0xf66 hub_event+0x10d5/0x3330 process_one_work+0x873/0x13e0 worker_thread+0x8b/0xd10 kthread+0x379/0x450 ret_from_fork+0x1f/0x30 The buggy address belongs to the object at ffff888115f24000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1536 bytes inside of 2048-byte region [ffff888115f24000, ffff888115f24800) Memory state around the buggy address: ffff888115f24500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888115f24580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888115f24600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff888115f24680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888115f24700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== Crash Report from brcmf_enable_bw40_2g(): ========== ---truncated--- (CVE-2022-49740)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49740
https://ubuntu.com/security/CVE-2022-49740

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
3.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
3.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49740

Plugin Information
Published: 2025/08/07, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244911 - Linux Distros Unpatched Vulnerability : CVE-2022-49743
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ovl: Use buf flexible array for memcpy() destination The buf flexible array needs to be the memcpy() destination to avoid false positive run-time warning from the recent FORTIFY_SOURCE hardening: memcpy:
detected field-spanning write (size 93) of single field &fh->fb at fs/overlayfs/export.c:799 (size 21) (CVE-2022-49743)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49743
https://security-tracker.debian.org/tracker/CVE-2022-49743
https://ubuntu.com/security/CVE-2022-49743

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49743

Plugin Information
Published: 2025/08/07, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250155 - Linux Distros Unpatched Vulnerability : CVE-2022-49766
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netlink: Bounds-check struct nlmsgerr creation In preparation for FORTIFY_SOURCE doing bounds-check on memcpy(), switch from __nlmsg_put to nlmsg_put(), and explain the bounds check for dealing with the memcpy() across a composite flexible array struct. Avoids this future run-time warning: memcpy: detected field-spanning write (size 32) of single field &errmsg->msg at net/netlink/af_netlink.c:2447 (size 16) (CVE-2022-49766)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49766
https://security-tracker.debian.org/tracker/CVE-2022-49766
https://ubuntu.com/security/CVE-2022-49766

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49766

Plugin Information
Published: 2025/08/15, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246794 - Linux Distros Unpatched Vulnerability : CVE-2022-49771
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dm ioctl: fix misbehavior if list_versions races with module loading __list_versions will first estimate the required space using the dm_target_iterate(list_version_get_needed, &needed) call and then will fill the space using the dm_target_iterate(list_version_get_info, &iter_info) call. Each of these calls locks the targets using the down_read(&_lock) and up_read(&_lock) calls, however between the first and second dm_target_iterate there is no lock held and the target modules can be loaded at this point, so the second dm_target_iterate call may need more space than what was the first dm_target_iterate returned. The code tries to handle this overflow (see the beginning of list_version_get_info), however this handling is incorrect. The code sets param->data_size = param->data_start + needed and iter_info.end = (char *)vers+len - needed is the size returned by the first dm_target_iterate call;
len is the size of the buffer allocated by userspace. len may be greater than needed; in this case, the code will write up to len bytes into the buffer, however param->data_size is set to needed, so it may write data past the param->data_size value. The ioctl interface copies only up to param->data_size into userspace, thus part of the result will be truncated. Fix this bug by setting iter_info.end = (char
*)vers + needed; - this guarantees that the second dm_target_iterate call will write only up to the needed buffer and it will exit with DM_BUFFER_FULL_FLAG if it overflows the needed space - in this case, userspace will allocate a larger buffer and retry. Note that there is also a bug in list_version_get_needed - we need to add strlen(tt->name) + 1 to the needed size, not strlen(tt->name). (CVE-2022-49771)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49771
https://ubuntu.com/security/CVE-2022-49771

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49771

Plugin Information
Published: 2025/08/09, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246554 - Linux Distros Unpatched Vulnerability : CVE-2022-49776
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: macvlan: enforce a consistent minimal mtu macvlan should enforce a minimal mtu of 68, even at link creation. This patch avoids the current behavior (which could lead to crashes in ipv6 stack if the link is brought up) $ ip link add macvlan1 link eno1 mtu 8 type macvlan # This should fail ! $ ip link sh dev macvlan1 5: macvlan1@eno1:
<BROADCAST,MULTICAST> mtu 8 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether 02:47:6c:24:74:82 brd ff:ff:ff:ff:ff:ff $ ip link set macvlan1 mtu 67 Error: mtu less than device minimum.
$ ip link set macvlan1 mtu 68 $ ip link set macvlan1 mtu 8 Error: mtu less than device minimum.
(CVE-2022-49776)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49776
https://ubuntu.com/security/CVE-2022-49776

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49776

Plugin Information
Published: 2025/08/09, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247502 - Linux Distros Unpatched Vulnerability : CVE-2022-49780
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() If device_register() fails in tcm_loop_setup_hba_bus(), the name allocated by dev_set_name() need be freed. As comment of device_register() says, it should use put_device() to give up the reference in the error path. So fix this by calling put_device(), then the name can be freed in kobject_cleanup(). The 'tl_hba' will be freed in tcm_loop_release_adapter(), so it don't need goto error label in this case. (CVE-2022-49780)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49780
https://ubuntu.com/security/CVE-2022-49780

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49780

Plugin Information
Published: 2025/08/10, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244655 - Linux Distros Unpatched Vulnerability : CVE-2022-49786
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: properly pin the parent in blkcg_css_online blkcg_css_online is supposed to pin the blkcg of the parent, but 397c9f46ee4d refactored things and along the way, changed it to pin the css instead. This results in extra pins, and we end up leaking blkcgs and cgroups. (CVE-2022-49786)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49786
https://ubuntu.com/security/CVE-2022-49786

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49786

Plugin Information
Published: 2025/08/07, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246666 - Linux Distros Unpatched Vulnerability : CVE-2022-49791
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: io_uring: fix multishot accept request leaks Having REQ_F_POLLED set doesn't guarantee that the request is executed as a multishot from the polling path. Fortunately for us, if the code thinks it's multishot issue when it's not, it can only ask to skip completion so leaking the request. Use issue_flags to mark multipoll issues. (CVE-2022-49791)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49791
https://ubuntu.com/security/CVE-2022-49791

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49791

Plugin Information
Published: 2025/08/09, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246559 - Linux Distros Unpatched Vulnerability : CVE-2022-49829
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/scheduler: fix fence ref counting We leaked dependency fences when processes were beeing killed.
Additional to that grab a reference to the last scheduled fence. (CVE-2022-49829)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49829
https://security-tracker.debian.org/tracker/CVE-2022-49829
https://ubuntu.com/security/CVE-2022-49829

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49829

Plugin Information
Published: 2025/08/09, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246890 - Linux Distros Unpatched Vulnerability : CVE-2022-49840
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() We got a syzkaller problem because of aarch64 alignment fault if KFENCE enabled. When the size from user bpf program is an odd number, like 399, 407, etc, it will cause the struct skb_shared_info's unaligned access. As seen below: BUG: KFENCE: use-after-free read in
__skb_clone+0x23c/0x2a0 net/core/skbuff.c:1032 Use-after-free read at 0xffff6254fffac077 (in kfence-#213):
__lse_atomic_add arch/arm64/include/asm/atomic_lse.h:26 [inline] arch_atomic_add arch/arm64/include/asm/atomic.h:28 [inline] arch_atomic_inc include/linux/atomic-arch-fallback.h:270 [inline] atomic_inc include/asm-generic/atomic-instrumented.h:241 [inline] __skb_clone+0x23c/0x2a0 net/core/skbuff.c:1032 skb_clone+0xf4/0x214 net/core/skbuff.c:1481 ____bpf_clone_redirect net/core/filter.c:2433 [inline] bpf_clone_redirect+0x78/0x1c0 net/core/filter.c:2420 bpf_prog_d3839dd9068ceb51+0x80/0x330 bpf_dispatcher_nop_func include/linux/bpf.h:728 [inline] bpf_test_run+0x3c0/0x6c0 net/bpf/test_run.c:53 bpf_prog_test_run_skb+0x638/0xa7c net/bpf/test_run.c:594 bpf_prog_test_run kernel/bpf/syscall.c:3148 [inline] __do_sys_bpf kernel/bpf/syscall.c:4441 [inline]
__se_sys_bpf+0xad0/0x1634 kernel/bpf/syscall.c:4381 kfence-#213: 0xffff6254fffac000-0xffff6254fffac196, size=407, cache=kmalloc-512 allocated by task 15074 on cpu 0 at 1342.585390s: kmalloc include/linux/slab.h:568 [inline] kzalloc include/linux/slab.h:675 [inline] bpf_test_init.isra.0+0xac/0x290 net/bpf/test_run.c:191 bpf_prog_test_run_skb+0x11c/0xa7c net/bpf/test_run.c:512 bpf_prog_test_run kernel/bpf/syscall.c:3148 [inline] __do_sys_bpf kernel/bpf/syscall.c:4441 [inline] __se_sys_bpf+0xad0/0x1634 kernel/bpf/syscall.c:4381
__arm64_sys_bpf+0x50/0x60 kernel/bpf/syscall.c:4381 To fix the problem, we adjust @size so that (@size + @hearoom) is a multiple of SMP_CACHE_BYTES. So we make sure the struct skb_shared_info is aligned to a cache line. (CVE-2022-49840)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49840
https://ubuntu.com/security/CVE-2022-49840

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49840

Plugin Information
Published: 2025/08/09, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247760 - Linux Distros Unpatched Vulnerability : CVE-2022-49844
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: can: dev: fix skb drop check In commit a6d190f8c767 (can: skb: drop tx skb if in listen only mode) the priv->ctrlmode element is read even on virtual CAN interfaces that do not create the struct can_priv at startup. This out-of-bounds read may lead to CAN frame drops for virtual CAN interfaces like vcan and vxcan. This patch mainly reverts the original commit and adds a new helper for CAN interface drivers that provide the required information in struct can_priv. [mkl: patch pch_can, too] (CVE-2022-49844)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49844
https://ubuntu.com/security/CVE-2022-49844

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49844

Plugin Information
Published: 2025/08/10, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246786 - Linux Distros Unpatched Vulnerability : CVE-2022-49870
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- capabilities: fix undefined behavior in bit shift for CAP_TO_MASK Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN:
shift-out-of-bounds in security/commoncap.c:1252:2 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace: <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e
__ubsan_handle_shift_out_of_bounds+0x1e7/0x20c cap_task_prctl+0x561/0x6f0 security_task_prctl+0x5a/0xb0
__x64_sys_prctl+0x61/0x8f0 do_syscall_64+0x58/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK>
(CVE-2022-49870)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49870
https://ubuntu.com/security/CVE-2022-49870

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49870

Plugin Information
Published: 2025/08/09, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245476 - Linux Distros Unpatched Vulnerability : CVE-2022-49877
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues When running `test_sockmap` selftests, the following warning appears: WARNING: CPU: 2 PID: 197 at net/core/stream.c:205 sk_stream_kill_queues+0xd3/0xf0 Call Trace: <TASK> inet_csk_destroy_sock+0x55/0x110 tcp_rcv_state_process+0xd28/0x1380 ? tcp_v4_do_rcv+0x77/0x2c0 tcp_v4_do_rcv+0x77/0x2c0 __release_sock+0x106/0x130 __tcp_close+0x1a7/0x4e0 tcp_close+0x20/0x70 inet_release+0x3c/0x80 __sock_release+0x3a/0xb0 sock_close+0x14/0x20 __fput+0xa3/0x260 task_work_run+0x59/0xb0 exit_to_user_mode_prepare+0x1b3/0x1c0 syscall_exit_to_user_mode+0x19/0x50 do_syscall_64+0x48/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae The root case is in commit 84472b436e76 (bpf, sockmap: Fix more uncharged while msg has more_data), where I used msg->sg.size to replace the tosend, causing breakage: if (msg->apply_bytes && msg->apply_bytes < tosend) tosend = psock->apply_bytes;
(CVE-2022-49877)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49877
https://ubuntu.com/security/CVE-2022-49877

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49877

Plugin Information
Published: 2025/08/07, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245648 - Linux Distros Unpatched Vulnerability : CVE-2022-49883
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: KVM: x86: smm: number of GPRs in the SMRAM image depends on the image format On 64 bit host, if the guest doesn't have X86_FEATURE_LM, KVM will access 16 gprs to 32-bit smram image, causing out-ouf-bound ram access. On 32 bit host, the rsm_load_state_64/enter_smm_save_state_64 is compiled out, thus access overflow can't happen.
(CVE-2022-49883)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49883
https://ubuntu.com/security/CVE-2022-49883

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49883

Plugin Information
Published: 2025/08/08, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249908 - Linux Distros Unpatched Vulnerability : CVE-2022-49888
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: arm64: entry: avoid kprobe recursion The cortex_a76_erratum_1463225_debug_handler() function is called when handling debug exceptions (and synchronous exceptions from BRK instructions), and so is called when a probed function executes. If the compiler does not inline cortex_a76_erratum_1463225_debug_handler(), it can be probed. If cortex_a76_erratum_1463225_debug_handler() is probed, any debug exception or software breakpoint exception will result in recursive exceptions leading to a stack overflow. This can be triggered with the ftrace multiple_probes selftest, and as per the example splat below. This is a regression caused by commit:
6459b8469753e9fe (arm64: entry: consolidate Cortex-A76 erratum 1463225 workaround) ... which removed the NOKPROBE_SYMBOL() annotation associated with the function. My intent was that cortex_a76_erratum_1463225_debug_handler() would be inlined into its caller, el1_dbg(), which is marked noinstr and cannot be probed. Mark cortex_a76_erratum_1463225_debug_handler() as __always_inline to ensure this. Example splat prior to this patch (with recursive entries elided): | # echo p cortex_a76_erratum_1463225_debug_handler > /sys/kernel/debug/tracing/kprobe_events | # echo p do_el0_svc >> /sys/kernel/debug/tracing/kprobe_events | # echo 1 > /sys/kernel/debug/tracing/events/kprobes/enable | Insufficient stack space to handle exception! | ESR: 0x0000000096000047 -- DABT (current EL) | FAR:
0xffff800009cefff0 | Task stack: [0xffff800009cf0000..0xffff800009cf4000] | IRQ stack:
[0xffff800008000000..0xffff800008004000] | Overflow stack: [0xffff00007fbc00f0..0xffff00007fbc10f0] | CPU:
0 PID: 145 Comm: sh Not tainted 6.0.0 #2 | Hardware name: linux,dummy-virt (DT) | pstate: 604003c5 (nZCv DAIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : arm64_enter_el1_dbg+0x4/0x20 | lr : el1_dbg+0x24/0x5c | sp : ffff800009cf0000 | x29: ffff800009cf0000 x28: ffff000002c74740 x27: 0000000000000000 | x26:
0000000000000000 x25: 0000000000000000 x24: 0000000000000000 | x23: 00000000604003c5 x22: ffff80000801745c x21: 0000aaaac95ac068 | x20: 00000000f2000004 x19: ffff800009cf0040 x18: 0000000000000000 | x17:
0000000000000000 x16: 0000000000000000 x15: 0000000000000000 | x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 | x11: 0000000000000010 x10: ffff800008c87190 x9 : ffff800008ca00d0 | x8 :
000000000000003c x7 : 0000000000000000 x6 : 0000000000000000 | x5 : 0000000000000000 x4 : 0000000000000000 x3 : 00000000000043a4 | x2 : 00000000f2000004 x1 : 00000000f2000004 x0 : ffff800009cf0040 | Kernel panic - not syncing: kernel stack overflow | CPU: 0 PID: 145 Comm: sh Not tainted 6.0.0 #2 | Hardware name:
linux,dummy-virt (DT) | Call trace: | dump_backtrace+0xe4/0x104 | show_stack+0x18/0x4c | dump_stack_lvl+0x64/0x7c | dump_stack+0x18/0x38 | panic+0x14c/0x338 | test_taint+0x0/0x2c | panic_bad_stack+0x104/0x118 | handle_bad_stack+0x34/0x48 | __bad_stack+0x78/0x7c | arm64_enter_el1_dbg+0x4/0x20 | el1h_64_sync_handler+0x40/0x98 | el1h_64_sync+0x64/0x68 | cortex_a76_erratum_1463225_debug_handler+0x0/0x34 ... | el1h_64_sync_handler+0x40/0x98 | el1h_64_sync+0x64/0x68 | cortex_a76_erratum_1463225_debug_handler+0x0/0x34 ... | el1h_64_sync_handler+0x40/0x98 | el1h_64_sync+0x64/0x68 | cortex_a76_erratum_1463225_debug_handler+0x0/0x34 | el1h_64_sync_handler+0x40/0x98 | el1h_64_sync+0x64/0x68 | do_el0_svc+0x0/0x28 | el0t_64_sync_handler+0x84/0xf0 | el0t_64_sync+0x18c/0x190 | Kernel Offset: disabled | CPU features: 0x0080,00005021,19001080 | Memory Limit: none | ---[ end Kernel panic - not syncing: kernel stack overflow ]--- With this patch, cortex_a76_erratum_1463225_debug_handler() is inlined into el1_dbg(), and el1_dbg() cannot be probed: | # echo p cortex_a76_erratum_1463225_debug_handler > /sys/kernel/debug/tracing/kprobe_events | sh: write error: No such file or directory | # grep -w cortex_a76_errat ---truncated--- (CVE-2022-49888)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49888
https://ubuntu.com/security/CVE-2022-49888

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49888

Plugin Information
Published: 2025/08/15, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246693 - Linux Distros Unpatched Vulnerability : CVE-2022-49892
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ftrace: Fix use-after-free for dynamic ftrace_ops KASAN reported a use-after-free with ftrace ops [1]. It was found from vmcore that perf had registered two ops with the same content successively, both dynamic.
After unregistering the second ops, a use-after-free occurred. In ftrace_shutdown(), when the second ops is unregistered, the FTRACE_UPDATE_CALLS command is not set because there is another enabled ops with the same content. Also, both ops are dynamic and the ftrace callback function is ftrace_ops_list_func, so the FTRACE_UPDATE_TRACE_FUNC command will not be set. Eventually the value of 'command' will be 0 and ftrace_shutdown() will skip the rcu synchronization. However, ftrace may be activated. When the ops is released, another CPU may be accessing the ops. Add the missing synchronization to fix this problem. [1] BUG: KASAN: use-after-free in __ftrace_ops_list_func kernel/trace/ftrace.c:7020 [inline] BUG: KASAN: use- after-free in ftrace_ops_list_func+0x2b0/0x31c kernel/trace/ftrace.c:7049 Read of size 8 at addr ffff56551965bbc8 by task syz-executor.2/14468 CPU: 1 PID: 14468 Comm: syz-executor.2 Not tainted 5.10.0 #7 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x40c arch/arm64/kernel/stacktrace.c:132 show_stack+0x30/0x40 arch/arm64/kernel/stacktrace.c:196 __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1b4/0x248 lib/dump_stack.c:118 print_address_description.constprop.0+0x28/0x48c mm/kasan/report.c:387 __kasan_report mm/kasan/report.c:547 [inline] kasan_report+0x118/0x210 mm/kasan/report.c:564 check_memory_region_inline mm/kasan/generic.c:187 [inline] __asan_load8+0x98/0xc0 mm/kasan/generic.c:253 __ftrace_ops_list_func kernel/trace/ftrace.c:7020 [inline] ftrace_ops_list_func+0x2b0/0x31c kernel/trace/ftrace.c:7049 ftrace_graph_call+0x0/0x4 __might_sleep+0x8/0x100 include/linux/perf_event.h:1170 __might_fault mm/memory.c:5183 [inline] __might_fault+0x58/0x70 mm/memory.c:5171 do_strncpy_from_user lib/strncpy_from_user.c:41 [inline] strncpy_from_user+0x1f4/0x4b0 lib/strncpy_from_user.c:139 getname_flags+0xb0/0x31c fs/namei.c:149 getname+0x2c/0x40 fs/namei.c:209 [...] Allocated by task 14445:
kasan_save_stack+0x24/0x50 mm/kasan/common.c:48 kasan_set_track mm/kasan/common.c:56 [inline]
__kasan_kmalloc mm/kasan/common.c:479 [inline] __kasan_kmalloc.constprop.0+0x110/0x13c mm/kasan/common.c:449 kasan_kmalloc+0xc/0x14 mm/kasan/common.c:493 kmem_cache_alloc_trace+0x440/0x924 mm/slub.c:2950 kmalloc include/linux/slab.h:563 [inline] kzalloc include/linux/slab.h:675 [inline] perf_event_alloc.part.0+0xb4/0x1350 kernel/events/core.c:11230 perf_event_alloc kernel/events/core.c:11733 [inline] __do_sys_perf_event_open kernel/events/core.c:11831 [inline]
__se_sys_perf_event_open+0x550/0x15f4 kernel/events/core.c:11723 __arm64_sys_perf_event_open+0x6c/0x80 kernel/events/core.c:11723 [...] Freed by task 14445: kasan_save_stack+0x24/0x50 mm/kasan/common.c:48 kasan_set_track+0x24/0x34 mm/kasan/common.c:56 kasan_set_free_info+0x20/0x40 mm/kasan/generic.c:358
__kasan_slab_free.part.0+0x11c/0x1b0 mm/kasan/common.c:437 __kasan_slab_free mm/kasan/common.c:445 [inline] kasan_slab_free+0x2c/0x40 mm/kasan/common.c:446 slab_free_hook mm/slub.c:1569 [inline] slab_free_freelist_hook mm/slub.c:1608 [inline] slab_free mm/slub.c:3179 [inline] kfree+0x12c/0xc10 mm/slub.c:4176 perf_event_alloc.part.0+0xa0c/0x1350 kernel/events/core.c:11434 perf_event_alloc kernel/events/core.c:11733 [inline] __do_sys_perf_event_open kernel/events/core.c:11831 [inline]
__se_sys_perf_event_open+0x550/0x15f4 kernel/events/core.c:11723 [...] (CVE-2022-49892)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49892
https://ubuntu.com/security/CVE-2022-49892

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49892

Plugin Information
Published: 2025/08/09, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244307 - Linux Distros Unpatched Vulnerability : CVE-2022-49907
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: mdio: fix undefined behavior in bit shift for __mdiobus_register Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN:
shift-out-of-bounds in drivers/net/phy/mdio_bus.c:586:27 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace: <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c __mdiobus_register+0x49d/0x4e0 fixed_mdio_bus_init+0xd8/0x12d do_one_initcall+0x76/0x430 kernel_init_freeable+0x3b3/0x422 kernel_init+0x24/0x1e0 ret_from_fork+0x1f/0x30 </TASK> (CVE-2022-49907)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49907
https://ubuntu.com/security/CVE-2022-49907

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49907

Plugin Information
Published: 2025/08/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243365 - Linux Distros Unpatched Vulnerability : CVE-2022-49918
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipvs: fix WARNING in __ip_vs_cleanup_batch() During the initialization of ip_vs_conn_net_init(), if file ip_vs_conn or ip_vs_conn_sync fails to be created, the initialization is successful by default. Therefore, the ip_vs_conn or ip_vs_conn_sync file doesn't be found during the remove. The following is the stack information: name 'ip_vs_conn_sync' WARNING: CPU: 3 PID: 9 at fs/proc/generic.c:712 remove_proc_entry+0x389/0x460 Modules linked in: Workqueue: netns cleanup_net RIP:
0010:remove_proc_entry+0x389/0x460 Call Trace: <TASK> __ip_vs_cleanup_batch+0x7d/0x120 ops_exit_list+0x125/0x170 cleanup_net+0x4ea/0xb00 process_one_work+0x9bf/0x1710 worker_thread+0x665/0x1080 kthread+0x2e4/0x3a0 ret_from_fork+0x1f/0x30 </TASK> (CVE-2022-49918)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49918
https://ubuntu.com/security/CVE-2022-49918

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49918

Plugin Information
Published: 2025/08/04, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248928 - Linux Distros Unpatched Vulnerability : CVE-2022-49921
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: sched: Fix use after free in red_enqueue() We can't use skb again after passing it to qdisc_enqueue(). This is basically identical to commit 2f09707d0c97 (sch_sfb: Also store skb len before calling child enqueue). (CVE-2022-49921)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49921
https://ubuntu.com/security/CVE-2022-49921

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49921

Plugin Information
Published: 2025/08/12, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243903 - Linux Distros Unpatched Vulnerability : CVE-2022-49929
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix mr leak in RESPST_ERR_RNR rxe_recheck_mr() will increase mr's ref_cnt, so we should call rxe_put(mr) to drop mr's ref_cnt in RESPST_ERR_RNR to avoid below warning: WARNING: CPU: 0 PID: 4156 at drivers/infiniband/sw/rxe/rxe_pool.c:259 __rxe_cleanup+0x1df/0x240 [rdma_rxe] ... Call Trace:
rxe_dereg_mr+0x4c/0x60 [rdma_rxe] ib_dereg_mr_user+0xa8/0x200 [ib_core] ib_mr_pool_destroy+0x77/0xb0 [ib_core] nvme_rdma_destroy_queue_ib+0x89/0x240 [nvme_rdma] nvme_rdma_free_queue+0x40/0x50 [nvme_rdma] nvme_rdma_teardown_io_queues.part.0+0xc3/0x120 [nvme_rdma] nvme_rdma_error_recovery_work+0x4d/0xf0 [nvme_rdma] process_one_work+0x582/0xa40 ? pwq_dec_nr_in_flight+0x100/0x100 ? rwlock_bug.part.0+0x60/0x60 worker_thread+0x2a9/0x700 ? process_one_work+0xa40/0xa40 kthread+0x168/0x1a0 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 (CVE-2022-49929)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49929
https://ubuntu.com/security/CVE-2022-49929

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49929

Plugin Information
Published: 2025/08/05, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245055 - Linux Distros Unpatched Vulnerability : CVE-2022-49948
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vt: Clear selection before changing the font When changing the console font with ioctl(KDFONTOP) the new font size can be bigger than the previous font. A previous selection may thus now be outside of the new screen size and thus trigger out-of-bounds accesses to graphics memory if the selection is removed in vc_do_resize(). Prevent such out-of-memory accesses by dropping the selection before the various con_font_set() console handlers are called. (CVE-2022-49948)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49948
https://ubuntu.com/security/CVE-2022-49948

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49948

Plugin Information
Published: 2025/08/07, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260496 - Linux Distros Unpatched Vulnerability : CVE-2022-49955
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- powerpc/rtas: Fix RTAS MSR[HV] handling for Cell The semi-recent changes to MSR handling when entering RTAS (firmware) cause crashes on IBM Cell machines. An example trace: kernel tried to execute user page (2fff01a8) - exploit attempt? (uid: 0) BUG: Unable to handle kernel instruction fetch Faulting instruction address: 0x2fff01a8 Oops: Kernel access of bad area, sig: 11 [#1] BE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=4 NUMA Cell Modules linked in: CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 6.0.0-rc2-00433-gede0a8d3307a #207 NIP: 000000002fff01a8 LR: 0000000000032608 CTR: 0000000000000000 REGS: c0000000015236b0 TRAP: 0400 Tainted: G W (6.0.0-rc2-00433-gede0a8d3307a) MSR: 0000000008001002 <ME,RI> CR: 00000000 XER: 20000000 ...
NIP 0x2fff01a8 LR 0x32608 Call Trace: 0xc00000000143c5f8 (unreliable) .rtas_call+0x224/0x320 .rtas_get_boot_time+0x70/0x150 .read_persistent_clock64+0x114/0x140 .read_persistent_wall_and_boot_offset+0x24/0x80 .timekeeping_init+0x40/0x29c .start_kernel+0x674/0x8f0 start_here_common+0x1c/0x50 Unlike PAPR platforms where RTAS is only used in guests, on the IBM Cell machines Linux runs with MSR[HV] set but also uses RTAS, provided by SLOF. Fix it by copying the MSR[HV] bit from the MSR value we've just read using mfmsr into the value used for RTAS. It seems like we could also fix it using an #ifdef CELL to set MSR[HV], but that doesn't work because it's possible to build a single kernel image that runs on both Cell native and pseries. (CVE-2022-49955)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49955
https://ubuntu.com/security/CVE-2022-49955

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49955

Plugin Information
Published: 2025/09/02, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243357 - Linux Distros Unpatched Vulnerability : CVE-2022-49963
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/i915/ttm: fix CCS handling Crucible + recent Mesa seems to sometimes hit: GEM_BUG_ON(num_ccs_blks > NUM_CCS_BLKS_PER_XFER) And it looks like we can also trigger this with gem_lmem_swapping, if we modify the test to use slightly larger object sizes. Looking closer it looks like we have the following issues in migrate_copy(): - We are using plain integer in various places, which we can easily overflow with a large object. - We pass the entire object size (when the src is lmem) into emit_pte() and then try to copy it, which doesn't work, since we only have a few fixed sized windows in which to map the pages and perform the copy. With an object > 8M we therefore aren't properly copying the pages. And then with an object > 64M we trigger the GEM_BUG_ON(num_ccs_blks > NUM_CCS_BLKS_PER_XFER). So it looks like our copy handling for any object > 8M (which is our CHUNK_SZ) is currently broken on DG2. Testcase: igt@gem_lmem_swapping (cherry picked from commit 8676145eb2f53a9940ff70910caf0125bd8a4bc2) (CVE-2022-49963)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49963
https://ubuntu.com/security/CVE-2022-49963

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49963

Plugin Information
Published: 2025/08/04, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247628 - Linux Distros Unpatched Vulnerability : CVE-2022-49975
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Don't redirect packets with invalid pkt_len Syzbot found an issue [1]: fq_codel_drop() try to drop a flow whitout any skbs, that is, the flow->head is null. The root cause, as the [2] says, is because that bpf_prog_test_run_skb() run a bpf prog which redirects empty skbs. So we should determine whether the length of the packet modified by bpf prog or others like bpf_prog_test is valid before forwarding it directly. (CVE-2022-49975)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49975
https://ubuntu.com/security/CVE-2022-49975

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49975

Plugin Information
Published: 2025/08/10, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244129 - Linux Distros Unpatched Vulnerability : CVE-2022-49987
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: md: call __md_stop_writes in md_stop From the link [1], we can see raid1d was running even after the path raid_dtr -> md_stop -> __md_stop.
Let's stop write first in destructor to align with normal md-raid to fix the KASAN issue. [1].
https://lore.kernel.org/linux-raid/CAPhsuW5gc4AakdGNdF8ubpezAuDLFOYUO_sfMZcec6hQFm8nhg@mail.gmail.com/T/#m 7f12bf90481c02c6d2da68c64aeed4779b7df74a (CVE-2022-49987)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49987
https://ubuntu.com/security/CVE-2022-49987

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49987

Plugin Information
Published: 2025/08/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243320 - Linux Distros Unpatched Vulnerability : CVE-2022-50071
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mptcp: move subflow cleanup in mptcp_destroy_common() If the mptcp socket creation fails due to a CGROUP_INET_SOCK_CREATE eBPF program, the MPTCP protocol ends-up leaking all the subflows: the related cleanup happens in __mptcp_destroy_sock() that is not invoked in such code path. Address the issue moving the subflow sockets cleanup in the mptcp_destroy_common() helper, which is invoked in every msk cleanup path. Additionally get rid of the intermediate list_splice_init step, which is an unneeded relic from the past. The issue is present since before the reported root cause commit, but any attempt to backport the fix before that hash will require a complete rewrite. (CVE-2022-50071)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50071
https://ubuntu.com/security/CVE-2022-50071

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50071

Plugin Information
Published: 2025/08/04, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249949 - Linux Distros Unpatched Vulnerability : CVE-2022-50082
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: fix warning in ext4_iomap_begin as race between bmap and write We got issue as follows:
------------[ cut here ]------------ WARNING: CPU: 3 PID: 9310 at fs/ext4/inode.c:3441 ext4_iomap_begin+0x182/0x5d0 RIP: 0010:ext4_iomap_begin+0x182/0x5d0 RSP: 0018:ffff88812460fa08 EFLAGS:
00010293 RAX: ffff88811f168000 RBX: 0000000000000000 RCX: ffffffff97793c12 RDX: 0000000000000000 RSI:
0000000000000000 RDI: 0000000000000003 RBP: ffff88812c669160 R08: ffff88811f168000 R09: ffffed10258cd20f R10: ffff88812c669077 R11: ffffed10258cd20e R12: 0000000000000001 R13: 00000000000000a4 R14:
000000000000000c R15: ffff88812c6691ee FS: 00007fd0d6ff3740(0000) GS:ffff8883af180000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd0d6dda290 CR3:
0000000104a62000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: iomap_apply+0x119/0x570 iomap_bmap+0x124/0x150 ext4_bmap+0x14f/0x250 bmap+0x55/0x80 do_vfs_ioctl+0x952/0xbd0
__x64_sys_ioctl+0xc6/0x170 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Above issue may happen as follows: bmap write bmap ext4_bmap iomap_bmap ext4_iomap_begin ext4_file_write_iter ext4_buffered_write_iter generic_perform_write ext4_da_write_begin ext4_da_write_inline_data_begin ext4_prepare_inline_data ext4_create_inline_data ext4_set_inode_flag(inode, EXT4_INODE_INLINE_DATA); if (WARN_ON_ONCE(ext4_has_inline_data(inode))) ->trigger bug_on To solved above issue hold inode lock in ext4_bamp. (CVE-2022-50082)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50082
https://ubuntu.com/security/CVE-2022-50082

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50082

Plugin Information
Published: 2025/08/15, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244308 - Linux Distros Unpatched Vulnerability : CVE-2022-50084
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dm raid: fix address sanitizer warning in raid_status There is this warning when using a kernel with the address sanitizer and running this testsuite: https://gitlab.com/cki-project/kernel- tests/-/tree/main/storage/swraid/scsi_raid ================================================================== BUG: KASAN: slab-out-of-bounds in raid_status+0x1747/0x2820 [dm_raid] Read of size 4 at addr ffff888079d2c7e8 by task lvcreate/13319 CPU: 0 PID: 13319 Comm: lvcreate Not tainted 5.18.0-0.rc3.<snip> #1 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 Call Trace: <TASK> dump_stack_lvl+0x6a/0x9c print_address_description.constprop.0+0x1f/0x1e0 print_report.cold+0x55/0x244 kasan_report+0xc9/0x100 raid_status+0x1747/0x2820 [dm_raid] dm_ima_measure_on_table_load+0x4b8/0xca0 [dm_mod] table_load+0x35c/0x630 [dm_mod] ctl_ioctl+0x411/0x630 [dm_mod] dm_ctl_ioctl+0xa/0x10 [dm_mod] __x64_sys_ioctl+0x12a/0x1a0 do_syscall_64+0x5b/0x80 The warning is caused by reading conf->max_nr_stripes in raid_status. The code in raid_status reads mddev->private, casts it to struct r5conf and reads the entry max_nr_stripes. However, if we have different raid type than 4/5/6, mddev->private doesn't point to struct r5conf; it may point to struct r0conf, struct r1conf, struct r10conf or struct mpconf. If we cast a pointer to one of these structs to struct r5conf, we will be reading invalid memory and KASAN warns about it. Fix this bug by reading struct r5conf only if raid type is 4, 5 or 6. (CVE-2022-50084)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50084
https://ubuntu.com/security/CVE-2022-50084

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50084

Plugin Information
Published: 2025/08/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245321 - Linux Distros Unpatched Vulnerability : CVE-2022-50103
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed With cgroup v2, the cpuset's cpus_allowed mask can be empty indicating that the cpuset will just use the effective CPUs of its parent.
So cpuset_can_attach() can call task_can_attach() with an empty mask. This can lead to cpumask_any_and() returns nr_cpu_ids causing the call to dl_bw_of() to crash due to percpu value access of an out of bound CPU value. For example: [80468.182258] BUG: unable to handle page fault for address: ffffffff8b6648b0 :
[80468.191019] RIP: 0010:dl_cpu_busy+0x30/0x2b0 : [80468.207946] Call Trace: [80468.208947] cpuset_can_attach+0xa0/0x140 [80468.209953] cgroup_migrate_execute+0x8c/0x490 [80468.210931] cgroup_update_dfl_csses+0x254/0x270 [80468.211898] cgroup_subtree_control_write+0x322/0x400 [80468.212854] kernfs_fop_write_iter+0x11c/0x1b0 [80468.213777] new_sync_write+0x11f/0x1b0 [80468.214689] vfs_write+0x1eb/0x280 [80468.215592] ksys_write+0x5f/0xe0 [80468.216463] do_syscall_64+0x5c/0x80 [80468.224287] entry_SYSCALL_64_after_hwframe+0x44/0xae Fix that by using effective_cpus instead. For cgroup v1, effective_cpus is the same as cpus_allowed. For v2, effective_cpus is the real cpumask to be used by tasks within the cpuset anyway. Also update task_can_attach()'s 2nd argument name to cs_effective_cpus to reflect the change. In addition, a check is added to task_can_attach() to guard against the possibility that cpumask_any_and() may return a value >= nr_cpu_ids. (CVE-2022-50103)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50103
https://ubuntu.com/security/CVE-2022-50103

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50103

Plugin Information
Published: 2025/08/07, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244935 - Linux Distros Unpatched Vulnerability : CVE-2022-50104
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: powerpc/xive: Fix refcount leak in xive_get_max_prio of_find_node_by_path() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak. (CVE-2022-50104)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50104
https://ubuntu.com/security/CVE-2022-50104

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50104

Plugin Information
Published: 2025/08/07, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247401 - Linux Distros Unpatched Vulnerability : CVE-2022-50108
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mfd: max77620: Fix refcount leak in max77620_initialise_fps of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. (CVE-2022-50108)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50108
https://ubuntu.com/security/CVE-2022-50108

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50108

Plugin Information
Published: 2025/08/10, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248400 - Linux Distros Unpatched Vulnerability : CVE-2022-50113
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ASoc: audio-graph-card2: Fix refcount leak bug in __graph_get_type() We should call of_node_put() for the reference before its replacement as it returned by of_get_parent() which has increased the refcount. Besides, we should also call of_node_put() before return. (CVE-2022-50113)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50113
https://ubuntu.com/security/CVE-2022-50113

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-50113

Plugin Information
Published: 2025/08/11, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246256 - Linux Distros Unpatched Vulnerability : CVE-2022-50119
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: rpmsg: Fix possible refcount leak in rpmsg_register_device_override() rpmsg_register_device_override need to call put_device to free vch when driver_set_override fails. Fix this by adding a put_device() to the error path. (CVE-2022-50119)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50119
https://ubuntu.com/security/CVE-2022-50119

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-50119

Plugin Information
Published: 2025/08/08, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248919 - Linux Distros Unpatched Vulnerability : CVE-2022-50121
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init Every iteration of for_each_available_child_of_node() decrements the reference count of the previous node. When breaking early from a for_each_available_child_of_node() loop, we need to explicitly call of_node_put() on the child node. Add missing of_node_put() to avoid refcount leak.
(CVE-2022-50121)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50121
https://ubuntu.com/security/CVE-2022-50121

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50121

Plugin Information
Published: 2025/08/12, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245413 - Linux Distros Unpatched Vulnerability : CVE-2022-50122
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Fix refcount leak in some error paths. (CVE-2022-50122)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50122
https://ubuntu.com/security/CVE-2022-50122

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50122

Plugin Information
Published: 2025/08/07, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249716 - Linux Distros Unpatched Vulnerability : CVE-2022-50142
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: intel_th: msu: Fix vmalloced buffers After commit f5ff79fddf0e (dma-mapping: remove CONFIG_DMA_REMAP) there's a chance of DMA buffer getting allocated via vmalloc(), which messes up the mmapping code: > RIP: msc_mmap_fault [intel_th_msu] > Call Trace: > <TASK> > __do_fault > do_fault ... Fix this by accounting for vmalloc possibility.
(CVE-2022-50142)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50142
https://ubuntu.com/security/CVE-2022-50142

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50142

Plugin Information
Published: 2025/08/15, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246520 - Linux Distros Unpatched Vulnerability : CVE-2022-50167
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: fix potential 32-bit overflow when accessing ARRAY map element If BPF array map is bigger than 4GB, element pointer calculation can overflow because both index and elem_size are u32. Fix this everywhere by forcing 64-bit multiplication. Extract this formula into separate small helper and use it consistently in various places. Speculative-preventing formula utilizing index_mask trick is left as is, but explicit u64 casts are added in both places. (CVE-2022-50167)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50167
https://security-tracker.debian.org/tracker/CVE-2022-50167
https://ubuntu.com/security/CVE-2022-50167

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50167

Plugin Information
Published: 2025/08/09, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245438 - Linux Distros Unpatched Vulnerability : CVE-2022-50197
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cpufreq: zynq: Fix refcount leak in zynq_get_revision of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak. (CVE-2022-50197)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50197
https://ubuntu.com/security/CVE-2022-50197

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50197

Plugin Information
Published: 2025/08/07, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244730 - Linux Distros Unpatched Vulnerability : CVE-2022-50220
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usbnet: Fix linkwatch use-after-free on disconnect usbnet uses the work usbnet_deferred_kevent() to perform tasks which may sleep. On disconnect, completion of the work was originally awaited in
->ndo_stop(). But in 2003, that was moved to ->disconnect() by historic commit [PATCH] USB: usbnet, prevent exotic rtnl deadlock: https://git.kernel.org/tglx/history/c/0f138bbfd83c The change was made because back then, the kernel's workqueue implementation did not allow waiting for a single work. One had to wait for completion of *all* work by calling flush_scheduled_work(), and that could deadlock when waiting for usbnet_deferred_kevent() with rtnl_mutex held in ->ndo_stop(). The commit solved one problem but created another: It causes a use-after-free in USB Ethernet drivers aqc111.c, asix_devices.c, ax88179_178a.c, ch9200.c and smsc75xx.c: * If the drivers receive a link change interrupt immediately before disconnect, they raise EVENT_LINK_RESET in their (non-sleepable) ->status() callback and schedule usbnet_deferred_kevent(). * usbnet_deferred_kevent() invokes the driver's ->link_reset() callback, which calls netif_carrier_{on,off}(). * That in turn schedules the work linkwatch_event(). Because usbnet_deferred_kevent() is awaited after unregister_netdev(), netif_carrier_{on,off}() may operate on an unregistered netdev and linkwatch_event() may run after free_netdev(), causing a use-after-free. In 2010, usbnet was changed to only wait for a single instance of usbnet_deferred_kevent() instead of *all* work by commit 23f333a2bfaf (drivers/net: don't use flush_scheduled_work()). Unfortunately the commit neglected to move the wait back to ->ndo_stop(). Rectify that omission at long last. (CVE-2022-50220)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50220
https://ubuntu.com/security/CVE-2022-50220

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50220

Plugin Information
Published: 2025/08/07, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247549 - Linux Distros Unpatched Vulnerability : CVE-2022-50222
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tty: vt: initialize unicode screen buffer syzbot reports kernel infoleak at vcs_read() [1], for buffer can be read immediately after resize operation. Initialize buffer using kzalloc(). ---------- #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <linux/fb.h> int main(int argc, char
*argv[]) { struct fb_var_screeninfo var = { }; const int fb_fd = open(/dev/fb0, 3); ioctl(fb_fd, FBIOGET_VSCREENINFO, &var); var.yres = 0x21; ioctl(fb_fd, FBIOPUT_VSCREENINFO, &var); return read(open(/dev/vcsu, O_RDONLY), &var, sizeof(var)) == -1; } ---------- (CVE-2022-50222)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50222
https://ubuntu.com/security/CVE-2022-50222

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50222

Plugin Information
Published: 2025/08/10, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243859 - Linux Distros Unpatched Vulnerability : CVE-2022-50224
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- KVM: x86/mmu: Treat NX as a valid SPTE bit for NPT Treat the NX bit as valid when using NPT, as KVM will set the NX bit when the NX huge page mitigation is enabled (mindblowing) and trigger the WARN that fires on reserved SPTE bits being set. KVM has required NX support for SVM since commit b26a71a1a5b9 (KVM: SVM:
Refuse to load kvm_amd if NX support is not available) for exactly this reason, but apparently it never occurred to anyone to actually test NPT with the mitigation enabled. ------------[ cut here ]------------ spte = 0x800000018a600ee7, level = 2, rsvd bits = 0x800f0000001fe000 WARNING: CPU: 152 PID: 15966 at arch/x86/kvm/mmu/spte.c:215 make_spte+0x327/0x340 [kvm] Hardware name: Google, Inc.
Arcadia_IT_80/Arcadia_IT_80, BIOS 10.48.0 01/27/2022 RIP: 0010:make_spte+0x327/0x340 [kvm] Call Trace:
<TASK> tdp_mmu_map_handle_target_level+0xc3/0x230 [kvm] kvm_tdp_mmu_map+0x343/0x3b0 [kvm] direct_page_fault+0x1ae/0x2a0 [kvm] kvm_tdp_page_fault+0x7d/0x90 [kvm] kvm_mmu_page_fault+0xfb/0x2e0 [kvm] npf_interception+0x55/0x90 [kvm_amd] svm_invoke_exit_handler+0x31/0xf0 [kvm_amd] svm_handle_exit+0xf6/0x1d0 [kvm_amd] vcpu_enter_guest+0xb6d/0xee0 [kvm] ? kvm_pmu_trigger_event+0x6d/0x230 [kvm] vcpu_run+0x65/0x2c0 [kvm] kvm_arch_vcpu_ioctl_run+0x355/0x610 [kvm] kvm_vcpu_ioctl+0x551/0x610 [kvm]
__se_sys_ioctl+0x77/0xc0 __x64_sys_ioctl+0x1d/0x20 do_syscall_64+0x44/0xa0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK> ---[ end trace 0000000000000000 ]--- (CVE-2022-50224)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50224
https://security-tracker.debian.org/tracker/CVE-2022-50224
https://ubuntu.com/security/CVE-2022-50224

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.2 (CVSS2#AV:L/AC:H/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
4.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50224

Plugin Information
Published: 2025/08/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264941 - Linux Distros Unpatched Vulnerability : CVE-2022-50252
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- igb: Do not free q_vector unless new one was allocated Avoid potential use-after-free condition under memory pressure. If the kzalloc() fails, q_vector will be freed but left in the original adapter->q_vector[v_idx] array position. (CVE-2022-50252)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50252
https://ubuntu.com/security/CVE-2022-50252

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50252

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264955 - Linux Distros Unpatched Vulnerability : CVE-2022-50253
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: make sure skb->len != 0 when redirecting to a tunneling device syzkaller managed to trigger another case where skb->len == 0 when we enter __dev_queue_xmit: WARNING: CPU: 0 PID: 2470 at include/linux/skbuff.h:2576 skb_assert_len include/linux/skbuff.h:2576 [inline] WARNING: CPU: 0 PID: 2470 at include/linux/skbuff.h:2576 __dev_queue_xmit+0x2069/0x35e0 net/core/dev.c:4295 Call Trace:
dev_queue_xmit+0x17/0x20 net/core/dev.c:4406 __bpf_tx_skb net/core/filter.c:2115 [inline]
__bpf_redirect_no_mac net/core/filter.c:2140 [inline] __bpf_redirect+0x5fb/0xda0 net/core/filter.c:2163
____bpf_clone_redirect net/core/filter.c:2447 [inline] bpf_clone_redirect+0x247/0x390 net/core/filter.c:2419 bpf_prog_48159a89cb4a9a16+0x59/0x5e bpf_dispatcher_nop_func include/linux/bpf.h:897 [inline] __bpf_prog_run include/linux/filter.h:596 [inline] bpf_prog_run include/linux/filter.h:603 [inline] bpf_test_run+0x46c/0x890 net/bpf/test_run.c:402 bpf_prog_test_run_skb+0xbdc/0x14c0 net/bpf/test_run.c:1170 bpf_prog_test_run+0x345/0x3c0 kernel/bpf/syscall.c:3648 __sys_bpf+0x43a/0x6c0 kernel/bpf/syscall.c:5005 __do_sys_bpf kernel/bpf/syscall.c:5091 [inline] __se_sys_bpf kernel/bpf/syscall.c:5089 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5089 do_syscall_64+0x54/0x70 arch/x86/entry/common.c:48 entry_SYSCALL_64_after_hwframe+0x61/0xc6 The reproducer doesn't really reproduce outside of syzkaller environment, so I'm taking a guess here. It looks like we do generate correct ETH_HLEN-sized packet, but we redirect the packet to the tunneling device. Before we do so, we __skb_pull l2 header and arrive again at skb->len == 0. Doesn't seem like we can do anything better than having an explicit check after __skb_pull? (CVE-2022-50253)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50253
https://ubuntu.com/security/CVE-2022-50253

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50253

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265025 - Linux Distros Unpatched Vulnerability : CVE-2022-50259
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix race in sock_map_free() sock_map_free() calls release_sock(sk) without owning a reference on the socket. This can cause use-after-free as syzbot found [1] Jakub Sitnicki already took care of a similar issue in sock_hash_free() in commit 75e68e5bf2c7 (bpf, sockhash: Synchronize delete from bucket list on map free) [1] refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 0 PID: 3785 at lib/refcount.c:31 refcount_warn_saturate+0x17c/0x1a0 lib/refcount.c:31 Modules linked in: CPU: 0 PID: 3785 Comm:
kworker/u4:6 Not tainted 6.1.0-rc7-syzkaller-00103-gef4d3ea40565 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: events_unbound bpf_map_free_deferred RIP:
0010:refcount_warn_saturate+0x17c/0x1a0 lib/refcount.c:31 Code: 68 8b 31 c0 e8 75 71 15 fd 0f 0b e9 64 ff ff ff e8 d9 6e 4e fd c6 05 62 9c 3d 0a 01 48 c7 c7 80 bb 68 8b 31 c0 e8 54 71 15 fd <0f> 0b e9 43 ff ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c a2 fe ff RSP: 0018:ffffc9000456fb60 EFLAGS: 00010246 RAX:
eae59bab72dcd700 RBX: 0000000000000004 RCX: ffff8880207057c0 RDX: 0000000000000000 RSI: 0000000000000201 RDI: 0000000000000000 RBP: 0000000000000004 R08: ffffffff816fdabd R09: fffff520008adee5 R10:
fffff520008adee5 R11: 1ffff920008adee4 R12: 0000000000000004 R13: dffffc0000000000 R14: ffff88807b1c6c00 R15: 1ffff1100f638dcf FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b30c30000 CR3: 000000000d08e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6:
00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __refcount_dec include/linux/refcount.h:344 [inline] refcount_dec include/linux/refcount.h:359 [inline] __sock_put include/net/sock.h:779 [inline] tcp_release_cb+0x2d0/0x360 net/ipv4/tcp_output.c:1092 release_sock+0xaf/0x1c0 net/core/sock.c:3468 sock_map_free+0x219/0x2c0 net/core/sock_map.c:356 process_one_work+0x81c/0xd10 kernel/workqueue.c:2289 worker_thread+0xb14/0x1330 kernel/workqueue.c:2436 kthread+0x266/0x300 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 </TASK> (CVE-2022-50259)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50259
https://ubuntu.com/security/CVE-2022-50259

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50259

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264984 - Linux Distros Unpatched Vulnerability : CVE-2022-50305
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ASoC: sof_es8336: fix possible use- after-free in sof_es8336_remove() sof_es8336_remove() calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling cancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself. (CVE-2022-50305)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50305
https://ubuntu.com/security/CVE-2022-50305

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:C/I:P/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-50305

Plugin Information
Published: 2025/09/16, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264949 - Linux Distros Unpatched Vulnerability : CVE-2022-50307
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: s390/cio: fix out-of-bounds access on cio_ignore free The channel-subsystem-driver scans for newly available devices whenever device-IDs are removed from the cio_ignore list using a command such as: echo free >/proc/cio_ignore Since an I/O device scan might interfer with running I/Os, commit 172da89ed0ea (s390/cio: avoid excessive path-verification requests) introduced an optimization to exclude online devices from the scan. The newly added check for online devices incorrectly assumes that an I/O-subchannel's drvdata points to a struct io_subchannel_private. For devices that are bound to a non-default I/O subchannel driver, such as the vfio_ccw driver, this results in an out-of-bounds read access during each scan. Fix this by changing the scan logic to rely on a driver-independent online indication. For this we can use struct subchannel->config.ena, which is the driver's requested subchannel-enabled state. Since I/Os can only be started on enabled subchannels, this matches the intent of the original optimization of not scanning devices where I/O might be running. (CVE-2022-50307)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50307
https://ubuntu.com/security/CVE-2022-50307

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50307

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265002 - Linux Distros Unpatched Vulnerability : CVE-2022-50311
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cxl: Fix refcount leak in cxl_calc_capp_routing of_get_next_parent() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. This function only calls of_node_put() in normal path, missing it in the error path. Add missing of_node_put() to avoid refcount leak. (CVE-2022-50311)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50311
https://ubuntu.com/security/CVE-2022-50311

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50311

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265003 - Linux Distros Unpatched Vulnerability : CVE-2022-50314
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nbd: Fix hung when signal interrupts nbd_start_device_ioctl() syzbot reported hung task [1]. The following program is a simplified version of the reproducer: int main(void) { int sv[2], fd; if (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) < 0) return 1; if ((fd = open(/dev/nbd0, 0)) < 0) return 1; if (ioctl(fd, NBD_SET_SIZE_BLOCKS, 0x81) < 0) return 1; if (ioctl(fd, NBD_SET_SOCK, sv[0]) < 0) return 1; if (ioctl(fd, NBD_DO_IT) < 0) return 1; return 0; } When signal interrupt nbd_start_device_ioctl() waiting the condition atomic_read(&config->recv_threads) == 0, the task can hung because it waits the completion of the inflight IOs. This patch fixes the issue by clearing queue, not just shutdown, when signal interrupt nbd_start_device_ioctl(). (CVE-2022-50314)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50314
https://ubuntu.com/security/CVE-2022-50314

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50314

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264992 - Linux Distros Unpatched Vulnerability : CVE-2022-50315
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS UBSAN complains about array-index-out-of-bounds: [ 1.980703] kernel: UBSAN: array-index-out-of-bounds in /build/linux-9H675w/linux-5.15.0/drivers/ata/libahci.c:968:41 [ 1.980709] kernel: index 15 is out of range for type 'ahci_em_priv [8]' [ 1.980713] kernel: CPU: 0 PID: 209 Comm: scsi_eh_8 Not tainted 5.15.0-25-generic #25-Ubuntu [ 1.980716] kernel: Hardware name: System manufacturer System Product Name/P5Q3, BIOS 1102 06/11/2010 [ 1.980718] kernel: Call Trace: [ 1.980721] kernel: <TASK> [ 1.980723] kernel: show_stack+0x52/0x58 [ 1.980729] kernel: dump_stack_lvl+0x4a/0x5f [ 1.980734] kernel:
dump_stack+0x10/0x12 [ 1.980736] kernel: ubsan_epilogue+0x9/0x45 [ 1.980739] kernel:
__ubsan_handle_out_of_bounds.cold+0x44/0x49 [ 1.980742] kernel: ahci_qc_issue+0x166/0x170 [libahci] [ 1.980748] kernel: ata_qc_issue+0x135/0x240 [ 1.980752] kernel: ata_exec_internal_sg+0x2c4/0x580 [ 1.980754] kernel: ? vprintk_default+0x1d/0x20 [ 1.980759] kernel: ata_exec_internal+0x67/0xa0 [ 1.980762] kernel: sata_pmp_read+0x8d/0xc0 [ 1.980765] kernel: sata_pmp_read_gscr+0x3c/0x90 [ 1.980768] kernel:
sata_pmp_attach+0x8b/0x310 [ 1.980771] kernel: ata_eh_revalidate_and_attach+0x28c/0x4b0 [ 1.980775] kernel: ata_eh_recover+0x6b6/0xb30 [ 1.980778] kernel: ? ahci_do_hardreset+0x180/0x180 [libahci] [ 1.980783] kernel: ? ahci_stop_engine+0xb0/0xb0 [libahci] [ 1.980787] kernel: ? ahci_do_softreset+0x290/0x290 [libahci] [ 1.980792] kernel: ? trace_event_raw_event_ata_eh_link_autopsy_qc+0xe0/0xe0 [ 1.980795] kernel:
sata_pmp_eh_recover.isra.0+0x214/0x560 [ 1.980799] kernel: sata_pmp_error_handler+0x23/0x40 [ 1.980802] kernel: ahci_error_handler+0x43/0x80 [libahci] [ 1.980806] kernel: ata_scsi_port_error_handler+0x2b1/0x600 [ 1.980810] kernel: ata_scsi_error+0x9c/0xd0 [ 1.980813] kernel: scsi_error_handler+0xa1/0x180 [ 1.980817] kernel: ? scsi_unjam_host+0x1c0/0x1c0 [ 1.980820] kernel: kthread+0x12a/0x150 [ 1.980823] kernel: ? set_kthread_struct+0x50/0x50 [ 1.980826] kernel: ret_from_fork+0x22/0x30 [ 1.980831] kernel: </TASK> This happens because sata_pmp_init_links() initialize link->pmp up to SATA_PMP_MAX_PORTS while em_priv is declared as 8 elements array. I can't find the maximum Enclosure Management ports specified in AHCI spec v1.3.1, but 12.2.1 LED message type states that Port Multiplier Information can utilize 4 bits, which implies it can support up to 16 ports. Hence, use SATA_PMP_MAX_PORTS as EM_MAX_SLOTS to resolve the issue.
BugLink: https://bugs.launchpad.net/bugs/1970074 (CVE-2022-50315)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50315
https://ubuntu.com/security/CVE-2022-50315

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50315

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264912 - Linux Distros Unpatched Vulnerability : CVE-2022-50320
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ACPI: tables: FPDT: Don't call acpi_os_map_memory() on invalid phys address On a Packard Bell Dot SC (Intel Atom N2600 model) there is a FPDT table which contains invalid physical addresses, with high bits set which fall outside the range of the CPU-s supported physical address range. Calling acpi_os_map_memory() on such an invalid phys address leads to the below WARN_ON in ioremap triggering resulting in an oops/stacktrace. Add code to verify the physical address before calling acpi_os_map_memory() to fix / avoid the oops. [ 1.226900] ioremap: invalid physical address 3001000000000000 [ 1.226949] ------------[ cut here ]------------ [ 1.226962] WARNING: CPU: 1 PID: 1 at arch/x86/mm/ioremap.c:200 __ioremap_caller.cold+0x43/0x5f [ 1.226996] Modules linked in: [ 1.227016] CPU:
1 PID: 1 Comm: swapper/0 Not tainted 6.0.0-rc3+ #490 [ 1.227029] Hardware name: Packard Bell dot s/SJE01_CT, BIOS V1.10 07/23/2013 [ 1.227038] RIP: 0010:__ioremap_caller.cold+0x43/0x5f [ 1.227054] Code:
96 00 00 e9 f8 af 24 ff 89 c6 48 c7 c7 d8 0c 84 99 e8 6a 96 00 00 e9 76 af 24 ff 48 89 fe 48 c7 c7 a8 0c 84 99 e8 56 96 00 00 <0f> 0b e9 60 af 24 ff 48 8b 34 24 48 c7 c7 40 0d 84 99 e8 3f 96 00 [ 1.227067] RSP:
0000:ffffb18c40033d60 EFLAGS: 00010286 [ 1.227084] RAX: 0000000000000032 RBX: 3001000000000000 RCX:
0000000000000000 [ 1.227095] RDX: 0000000000000001 RSI: 00000000ffffdfff RDI: 00000000ffffffff [ 1.227105] RBP: 3001000000000000 R08: 0000000000000000 R09: ffffb18c40033c18 [ 1.227115] R10: 0000000000000003 R11:
ffffffff99d62fe8 R12: 0000000000000008 [ 1.227124] R13: 0003001000000000 R14: 0000000000001000 R15:
3001000000000000 [ 1.227135] FS: 0000000000000000(0000) GS:ffff913a3c080000(0000) knlGS:0000000000000000 [ 1.227146] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1.227156] CR2: 0000000000000000 CR3:
0000000018c26000 CR4: 00000000000006e0 [ 1.227167] Call Trace: [ 1.227176] <TASK> [ 1.227185] ? acpi_os_map_iomem+0x1c9/0x1e0 [ 1.227215] ? kmem_cache_alloc_trace+0x187/0x370 [ 1.227254] acpi_os_map_iomem+0x1c9/0x1e0 [ 1.227288] acpi_init_fpdt+0xa8/0x253 [ 1.227308] ? acpi_debugfs_init+0x1f/0x1f [ 1.227339] do_one_initcall+0x5a/0x300 [ 1.227406] ? rcu_read_lock_sched_held+0x3f/0x80 [ 1.227442] kernel_init_freeable+0x28b/0x2cc [ 1.227512] ? rest_init+0x170/0x170 [ 1.227538] kernel_init+0x16/0x140 [ 1.227552] ret_from_fork+0x1f/0x30 [ 1.227639] </TASK> [ 1.227647] irq event stamp: 186819 [ 1.227656] hardirqs last enabled at (186825):
[<ffffffff98184a6e>] __up_console_sem+0x5e/0x70 [ 1.227672] hardirqs last disabled at (186830):
[<ffffffff98184a53>] __up_console_sem+0x43/0x70 [ 1.227686] softirqs last enabled at (186576):
[<ffffffff980fbc9d>] __irq_exit_rcu+0xed/0x160 [ 1.227701] softirqs last disabled at (186569):
[<ffffffff980fbc9d>] __irq_exit_rcu+0xed/0x160 [ 1.227715] ---[ end trace 0000000000000000 ]--- (CVE-2022-50320)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50320
https://ubuntu.com/security/CVE-2022-50320

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50320

Plugin Information
Published: 2025/09/16, Modified: 2025/12/23
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265137 - Linux Distros Unpatched Vulnerability : CVE-2022-50323
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: do not sense pfmemalloc status in skb_append_pagefrags() skb_append_pagefrags() is used by af_unix and udp sendpage() implementation so far.
In commit 326140063946 (tcp: TX zerocopy should not sense pfmemalloc status) we explained why we should not sense pfmemalloc status for pages owned by user space. We should also use skb_fill_page_desc_noacc() in skb_append_pagefrags() to avoid following KCSAN report: BUG: KCSAN: data-race in lru_add_fn / skb_append_pagefrags write to 0xffffea00058fc1c8 of 8 bytes by task 17319 on cpu 0: __list_add include/linux/list.h:73 [inline] list_add include/linux/list.h:88 [inline] lruvec_add_folio include/linux/mm_inline.h:323 [inline] lru_add_fn+0x327/0x410 mm/swap.c:228 folio_batch_move_lru+0x1e1/0x2a0 mm/swap.c:246 lru_add_drain_cpu+0x73/0x250 mm/swap.c:669 lru_add_drain+0x21/0x60 mm/swap.c:773 free_pages_and_swap_cache+0x16/0x70 mm/swap_state.c:311 tlb_batch_pages_flush mm/mmu_gather.c:59 [inline] tlb_flush_mmu_free mm/mmu_gather.c:256 [inline] tlb_flush_mmu+0x5b2/0x640 mm/mmu_gather.c:263 tlb_finish_mmu+0x86/0x100 mm/mmu_gather.c:363 exit_mmap+0x190/0x4d0 mm/mmap.c:3098 __mmput+0x27/0x1b0 kernel/fork.c:1185 mmput+0x3d/0x50 kernel/fork.c:1207 copy_process+0x19fc/0x2100 kernel/fork.c:2518 kernel_clone+0x166/0x550 kernel/fork.c:2671 __do_sys_clone kernel/fork.c:2812 [inline] __se_sys_clone kernel/fork.c:2796 [inline]
__x64_sys_clone+0xc3/0xf0 kernel/fork.c:2796 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffffea00058fc1c8 of 8 bytes by task 17325 on cpu 1: page_is_pfmemalloc include/linux/mm.h:1817 [inline]
__skb_fill_page_desc include/linux/skbuff.h:2432 [inline] skb_fill_page_desc include/linux/skbuff.h:2453 [inline] skb_append_pagefrags+0x210/0x600 net/core/skbuff.c:3974 unix_stream_sendpage+0x45e/0x990 net/unix/af_unix.c:2338 kernel_sendpage+0x184/0x300 net/socket.c:3561 sock_sendpage+0x5a/0x70 net/socket.c:1054 pipe_to_sendpage+0x128/0x160 fs/splice.c:361 splice_from_pipe_feed fs/splice.c:415 [inline] __splice_from_pipe+0x222/0x4d0 fs/splice.c:559 splice_from_pipe fs/splice.c:594 [inline] generic_splice_sendpage+0x89/0xc0 fs/splice.c:743 do_splice_from fs/splice.c:764 [inline] direct_splice_actor+0x80/0xa0 fs/splice.c:931 splice_direct_to_actor+0x305/0x620 fs/splice.c:886 do_splice_direct+0xfb/0x180 fs/splice.c:974 do_sendfile+0x3bf/0x910 fs/read_write.c:1255
__do_sys_sendfile64 fs/read_write.c:1323 [inline] __se_sys_sendfile64 fs/read_write.c:1309 [inline]
__x64_sys_sendfile64+0x10c/0x150 fs/read_write.c:1309 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed:
0x0000000000000000 -> 0xffffea00058fc188 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 17325 Comm: syz-executor.0 Not tainted 6.1.0-rc1-syzkaller-00158-g440b7895c990-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 (CVE-2022-50323)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50323
https://ubuntu.com/security/CVE-2022-50323

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50323

Plugin Information
Published: 2025/09/17, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264936 - Linux Distros Unpatched Vulnerability : CVE-2022-50328
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- jbd2: fix potential use-after-free in jbd2_fc_wait_bufs In 'jbd2_fc_wait_bufs' use 'bh' after put buffer head reference count which may lead to use-after-free. So judge buffer if uptodate before put buffer head reference count. (CVE-2022-50328)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50328
https://ubuntu.com/security/CVE-2022-50328

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50328

Plugin Information
Published: 2025/09/16, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265012 - Linux Distros Unpatched Vulnerability : CVE-2022-50329
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq Commit 64dc8c732f5c (block, bfq: fix possible uaf for 'bfqq->bic') will access 'bic->bfqq' in bic_set_bfqq(), however, bfq_exit_icq_bfqq() can free bfqq first, and then call bic_set_bfqq(), which will cause uaf. Fix the problem by moving bfq_exit_bfqq() behind bic_set_bfqq().
(CVE-2022-50329)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50329
https://ubuntu.com/security/CVE-2022-50329

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-50329

Plugin Information
Published: 2025/09/16, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264967 - Linux Distros Unpatched Vulnerability : CVE-2022-50337
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ocxl: fix pci device refcount leak when calling get_function_0() get_function_0() calls pci_get_domain_bus_and_slot(), as comment says, it returns a pci device with refcount increment, so after using it, pci_dev_put() needs be called. Get the device reference when get_function_0() is not called, so pci_dev_put() can be called in the error path and callers unconditionally. And add comment above get_dvsec_vendor0() to tell callers to call pci_dev_put().
(CVE-2022-50337)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50337
https://ubuntu.com/security/CVE-2022-50337

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50337

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265279 - Linux Distros Unpatched Vulnerability : CVE-2022-50351
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cifs: Fix xid leak in cifs_create() If the cifs already shutdown, we should free the xid before return, otherwise, the xid will be leaked.
(CVE-2022-50351)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50351
https://ubuntu.com/security/CVE-2022-50351

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50351

Plugin Information
Published: 2025/09/17, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265594 - Linux Distros Unpatched Vulnerability : CVE-2022-50365
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: skbuff: Account for tail adjustment during pull operations Extending the tail can have some unexpected side effects if a program uses a helper like BPF_FUNC_skb_pull_data to read partial content beyond the head skb headlen when all the skbs in the gso frag_list are linear with no head_frag - kernel BUG at net/core/skbuff.c:4219! pc :
skb_segment+0xcf4/0xd2c lr : skb_segment+0x63c/0xd2c Call trace: skb_segment+0xcf4/0xd2c
__udp_gso_segment+0xa4/0x544 udp4_ufo_fragment+0x184/0x1c0 inet_gso_segment+0x16c/0x3a4 skb_mac_gso_segment+0xd4/0x1b0 __skb_gso_segment+0xcc/0x12c udp_rcv_segment+0x54/0x16c udp_queue_rcv_skb+0x78/0x144 udp_unicast_rcv_skb+0x8c/0xa4 __udp4_lib_rcv+0x490/0x68c udp_rcv+0x20/0x30 ip_protocol_deliver_rcu+0x1b0/0x33c ip_local_deliver+0xd8/0x1f0 ip_rcv+0x98/0x1a4 deliver_ptype_list_skb+0x98/0x1ec __netif_receive_skb_core+0x978/0xc60 Fix this by marking these skbs as GSO_DODGY so segmentation can handle the tail updates accordingly. (CVE-2022-50365)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50365
https://ubuntu.com/security/CVE-2022-50365

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50365

Plugin Information
Published: 2025/09/20, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265541 - Linux Distros Unpatched Vulnerability : CVE-2022-50386
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: L2CAP: Fix user-after-free This uses l2cap_chan_hold_unless_zero() after calling
__l2cap_get_chan_blah() to prevent the following trace: Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref *kref) Bluetooth: chan 0000000023c4974d Bluetooth: parent 00000000ae861c08 ================================================================== BUG: KASAN: use-after-free in
__mutex_waiter_is_first kernel/locking/mutex.c:191 [inline] BUG: KASAN: use-after-free in
__mutex_lock_common kernel/locking/mutex.c:671 [inline] BUG: KASAN: use-after-free in
__mutex_lock+0x278/0x400 kernel/locking/mutex.c:729 Read of size 8 at addr ffff888006a49b08 by task kworker/u3:2/389 (CVE-2022-50386)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50386
https://ubuntu.com/security/CVE-2022-50386

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.6 (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:A/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50386

Plugin Information
Published: 2025/09/19, Modified: 2025/12/09
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265540 - Linux Distros Unpatched Vulnerability : CVE-2022-50390
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below:
UBSAN: shift-out-of-bounds in ./include/drm/ttm/ttm_tt.h:122:26 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace: <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c ttm_bo_move_memcpy+0x3b4/0x460 [ttm] bo_driver_move+0x32/0x40 [drm_vram_helper] ttm_bo_handle_move_mem+0x118/0x200 [ttm] ttm_bo_validate+0xfa/0x220 [ttm] drm_gem_vram_pin_locked+0x70/0x1b0 [drm_vram_helper] drm_gem_vram_pin+0x48/0xb0 [drm_vram_helper] drm_gem_vram_plane_helper_prepare_fb+0x53/0xe0 [drm_vram_helper] drm_gem_vram_simple_display_pipe_prepare_fb+0x26/0x30 [drm_vram_helper] drm_simple_kms_plane_prepare_fb+0x4d/0xe0 [drm_kms_helper] drm_atomic_helper_prepare_planes+0xda/0x210 [drm_kms_helper] drm_atomic_helper_commit+0xc3/0x1e0 [drm_kms_helper] drm_atomic_commit+0x9c/0x160 [drm] drm_client_modeset_commit_atomic+0x33a/0x380 [drm] drm_client_modeset_commit_locked+0x77/0x220 [drm] drm_client_modeset_commit+0x31/0x60 [drm] __drm_fb_helper_restore_fbdev_mode_unlocked+0xa7/0x170 [drm_kms_helper] drm_fb_helper_set_par+0x51/0x90 [drm_kms_helper] fbcon_init+0x316/0x790 visual_init+0x113/0x1d0 do_bind_con_driver+0x2a3/0x5c0 do_take_over_console+0xa9/0x270 do_fbcon_takeover+0xa1/0x170 do_fb_registered+0x2a8/0x340 fbcon_fb_registered+0x47/0xe0 register_framebuffer+0x294/0x4a0 __drm_fb_helper_initial_config_and_unlock+0x43c/0x880 [drm_kms_helper] drm_fb_helper_initial_config+0x52/0x80 [drm_kms_helper] drm_fbdev_client_hotplug+0x156/0x1b0 [drm_kms_helper] drm_fbdev_generic_setup+0xfc/0x290 [drm_kms_helper] bochs_pci_probe+0x6ca/0x772 [bochs] local_pci_probe+0x4d/0xb0 pci_device_probe+0x119/0x320 really_probe+0x181/0x550
__driver_probe_device+0xc6/0x220 driver_probe_device+0x32/0x100 __driver_attach+0x195/0x200 bus_for_each_dev+0xbb/0x120 driver_attach+0x27/0x30 bus_add_driver+0x22e/0x2f0 driver_register+0xa9/0x190
__pci_register_driver+0x90/0xa0 bochs_pci_driver_init+0x52/0x1000 [bochs] do_one_initcall+0x76/0x430 do_init_module+0x61/0x28a load_module+0x1f82/0x2e50 __do_sys_finit_module+0xf8/0x190
__x64_sys_finit_module+0x23/0x30 do_syscall_64+0x58/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK>
(CVE-2022-50390)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50390
https://security-tracker.debian.org/tracker/CVE-2022-50390
https://ubuntu.com/security/CVE-2022-50390

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50390

Plugin Information
Published: 2025/09/19, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265575 - Linux Distros Unpatched Vulnerability : CVE-2022-50394
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- i2c: ismt: Fix an out-of-bounds bug in ismt_access() When the driver does not check the data from the user, the variable 'data->block[0]' may be very large to cause an out-of-bounds bug. The following log can reveal it: [ 33.995542] i2c i2c-1: ioctl, cmd=0x720, arg=0x7ffcb3dc3a20 [ 33.995978] ismt_smbus 0000:00:05.0: I2C_SMBUS_BLOCK_DATA: WRITE [ 33.996475] ================================================================== [ 33.996995] BUG: KASAN: out-of-bounds in ismt_access.cold+0x374/0x214b [ 33.997473] Read of size 18446744073709551615 at addr ffff88810efcfdb1 by task ismt_poc/485 [ 33.999450] Call Trace: [ 34.001849] memcpy+0x20/0x60 [ 34.002077] ismt_access.cold+0x374/0x214b [ 34.003382] __i2c_smbus_xfer+0x44f/0xfb0 [ 34.004007] i2c_smbus_xfer+0x10a/0x390 [ 34.004291] i2cdev_ioctl_smbus+0x2c8/0x710 [ 34.005196] i2cdev_ioctl+0x5ec/0x74c Fix this bug by checking the size of 'data->block[0]' first. (CVE-2022-50394)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50394
https://ubuntu.com/security/CVE-2022-50394

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50394

Plugin Information
Published: 2025/09/19, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265536 - Linux Distros Unpatched Vulnerability : CVE-2022-50401
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure On error situation `clp->cl_cb_conn.cb_xprt` should not be given a reference to the xprt otherwise both client cleanup and the error handling path of the caller call to put it. Better to delay handing over the reference to a later branch. [ 72.530665] refcount_t: underflow; use-after-free. [ 72.531933] WARNING: CPU: 0 PID: 173 at lib/refcount.c:28 refcount_warn_saturate+0xcf/0x120 [ 72.533075] Modules linked in: nfsd(OE) nfsv4(OE) nfsv3(OE) nfs(OE) lockd(OE) compat_nfs_ssc(OE) nfs_acl(OE) rpcsec_gss_krb5(OE) auth_rpcgss(OE) rpcrdma(OE) dns_resolver fscache netfs grace rdma_cm iw_cm ib_cm sunrpc(OE) mlx5_ib mlx5_core mlxfw pci_hyperv_intf ib_uverbs ib_core xt_MASQUERADE nf_conntrack_netlink nft_counter xt_addrtype nft_compat br_netfilter bridge stp llc nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set overlay nf_tables nfnetlink crct10dif_pclmul crc32_pclmul ghash_clmulni_intel xfs serio_raw virtio_net virtio_blk net_failover failover fuse [last unloaded: sunrpc] [ 72.540389] CPU: 0 PID: 173 Comm: kworker/u16:5 Tainted: G OE 5.15.82-dan #1 [ 72.541511] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-3.module+el8.7.0+1084+97b81f61 04/01/2014 [ 72.542717] Workqueue: nfsd4_callbacks nfsd4_run_cb_work [nfsd] [ 72.543575] RIP:
0010:refcount_warn_saturate+0xcf/0x120 [ 72.544299] Code: 55 00 0f 0b 5d e9 01 50 98 00 80 3d 75 9e 39 08 00 0f 85 74 ff ff ff 48 c7 c7 e8 d1 60 8e c6 05 61 9e 39 08 01 e8 f6 51 55 00 <0f> 0b 5d e9 d9 4f 98 00 80 3d 4b 9e 39 08 00 0f 85 4c ff ff ff 48 [ 72.546666] RSP: 0018:ffffb3f841157cf0 EFLAGS: 00010286 [ 72.547393] RAX: 0000000000000026 RBX: ffff89ac6231d478 RCX: 0000000000000000 [ 72.548324] RDX:
ffff89adb7c2c2c0 RSI: ffff89adb7c205c0 RDI: ffff89adb7c205c0 [ 72.549271] RBP: ffffb3f841157cf0 R08:
0000000000000000 R09: c0000000ffefffff [ 72.550209] R10: 0000000000000001 R11: ffffb3f841157ad0 R12:
ffff89ac6231d180 [ 72.551142] R13: ffff89ac6231d478 R14: ffff89ac40c06180 R15: ffff89ac6231d4b0 [ 72.552089] FS: 0000000000000000(0000) GS:ffff89adb7c00000(0000) knlGS:0000000000000000 [ 72.553175] CS:
0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 72.553934] CR2: 0000563a310506a8 CR3: 0000000109a66000 CR4:
0000000000350ef0 [ 72.554874] Call Trace: [ 72.555278] <TASK> [ 72.555614] svc_xprt_put+0xaf/0xe0 [sunrpc] [ 72.556276] nfsd4_process_cb_update.isra.11+0xb7/0x410 [nfsd] [ 72.557087] ? update_load_avg+0x82/0x610 [ 72.557652] ? cpuacct_charge+0x60/0x70 [ 72.558212] ? dequeue_entity+0xdb/0x3e0 [ 72.558765] ? queued_spin_unlock+0x9/0x20 [ 72.559358] nfsd4_run_cb_work+0xfc/0x270 [nfsd] [ 72.560031] process_one_work+0x1df/0x390 [ 72.560600] worker_thread+0x37/0x3b0 [ 72.561644] ? process_one_work+0x390/0x390 [ 72.562247] kthread+0x12f/0x150 [ 72.562710] ? set_kthread_struct+0x50/0x50 [ 72.563309] ret_from_fork+0x22/0x30 [ 72.563818] </TASK> [ 72.564189] ---[ end trace 031117b1c72ec616 ]--- [ 72.566019] list_add corruption. next->prev should be prev (ffff89ac4977e538), but was ffff89ac4763e018. (next=ffff89ac4763e018). [ 72.567647] ------------[ cut here ]------------ (CVE-2022-50401)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50401
https://ubuntu.com/security/CVE-2022-50401

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
4.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50401

Plugin Information
Published: 2025/09/19, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265491 - Linux Distros Unpatched Vulnerability : CVE-2022-50411
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ACPICA: Fix error code path in acpi_ds_call_control_method() A use-after-free in acpi_ps_parse_aml() after a failing invocaion of acpi_ds_call_control_method() is reported by KASAN [1] and code inspection reveals that next_walk_state pushed to the thread by acpi_ds_create_walk_state() is freed on errors, but it is not popped from the thread beforehand. Thus acpi_ds_get_current_walk_state() called by acpi_ps_parse_aml() subsequently returns it as the new walk state which is incorrect. To address this, make acpi_ds_call_control_method() call acpi_ds_pop_walk_state() to pop next_walk_state from the thread before returning an error. (CVE-2022-50411)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50411
https://ubuntu.com/security/CVE-2022-50411

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50411

Plugin Information
Published: 2025/09/19, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265508 - Linux Distros Unpatched Vulnerability : CVE-2022-50419
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times device_add shall not be called multiple times as stated in its documentation: 'Do not call this routine or device_register() more than once for any device structure' Syzkaller reports a bug as follows [1]: ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:33! invalid opcode: 0000 [#1] PREEMPT SMP KASAN [...] Call Trace: <TASK> __list_add include/linux/list.h:69 [inline] list_add_tail include/linux/list.h:102 [inline] kobj_kset_join lib/kobject.c:164 [inline] kobject_add_internal+0x18f/0x8f0 lib/kobject.c:214 kobject_add_varg lib/kobject.c:358 [inline] kobject_add+0x150/0x1c0 lib/kobject.c:410 device_add+0x368/0x1e90 drivers/base/core.c:3452 hci_conn_add_sysfs+0x9b/0x1b0 net/bluetooth/hci_sysfs.c:53 hci_le_cis_estabilished_evt+0x57c/0xae0 net/bluetooth/hci_event.c:6799 hci_le_meta_evt+0x2b8/0x510 net/bluetooth/hci_event.c:7110 hci_event_func net/bluetooth/hci_event.c:7440 [inline] hci_event_packet+0x63d/0xfd0 net/bluetooth/hci_event.c:7495 hci_rx_work+0xae7/0x1230 net/bluetooth/hci_core.c:4007 process_one_work+0x991/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e4/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 </TASK> (CVE-2022-50419)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50419
https://ubuntu.com/security/CVE-2022-50419

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.3 (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.1 (CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50419

Plugin Information
Published: 2025/09/19, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269552 - Linux Distros Unpatched Vulnerability : CVE-2022-50421
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Avoid double destroy of default endpoint The rpmsg_dev_remove() in rpmsg_core is the place for releasing this default endpoint. So need to avoid destroying the default endpoint in rpmsg_chrdev_eptdev_destroy(), this should be the same as rpmsg_eptdev_release(). Otherwise there will be double destroy issue that ept->refcount report warning:
refcount_t: underflow; use-after-free. Call trace: refcount_warn_saturate+0xf8/0x150 virtio_rpmsg_destroy_ept+0xd4/0xec rpmsg_dev_remove+0x60/0x70 The issue can be reproduced by stopping remoteproc before closing the /dev/rpmsgX. (CVE-2022-50421)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50421
https://ubuntu.com/security/CVE-2022-50421

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50421

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269543 - Linux Distros Unpatched Vulnerability : CVE-2022-50422
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() When executing SMP task failed, the smp_execute_task_sg() calls del_timer() to delete slow_task->timer. However, if the timer handler sas_task_internal_timedout() is running, the del_timer() in smp_execute_task_sg() will not stop it and a UAF will happen. The process is shown below: (thread 1) | (thread 2) smp_execute_task_sg() | sas_task_internal_timedout() ... | del_timer() | ... | ... sas_free_task(task) | kfree(task->slow_task) //FREE| | task->slow_task->... //USE Fix by calling del_timer_sync() in smp_execute_task_sg(), which makes sure the timer handler have finished before the task->slow_task is deallocated. (CVE-2022-50422)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50422
https://ubuntu.com/security/CVE-2022-50422

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50422

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269627 - Linux Distros Unpatched Vulnerability : CVE-2022-50423
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() There is an use-after-free reported by KASAN: BUG: KASAN: use-after-free in acpi_ut_remove_reference+0x3b/0x82 Read of size 1 at addr ffff888112afc460 by task modprobe/2111 CPU: 0 PID: 2111 Comm: modprobe Not tainted 6.1.0-rc7-dirty Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), Call Trace: <TASK> kasan_report+0xae/0xe0 acpi_ut_remove_reference+0x3b/0x82 acpi_ut_copy_iobject_to_iobject+0x3be/0x3d5 acpi_ds_store_object_to_local+0x15d/0x3a0 acpi_ex_store+0x78d/0x7fd acpi_ex_opcode_1A_1T_1R+0xbe4/0xf9b acpi_ps_parse_aml+0x217/0x8d5 ... </TASK> The root cause of the problem is that the acpi_operand_object is freed when acpi_ut_walk_package_tree() fails in acpi_ut_copy_ipackage_to_ipackage(), lead to repeated release in acpi_ut_copy_iobject_to_iobject(). The problem was introduced by 8aa5e56eeb61 commit, this commit is to fix memory leak in acpi_ut_copy_iobject_to_iobject(), repeatedly adding remove operation, lead to acpi_operand_object used after free. Fix it by removing acpi_ut_remove_reference() in acpi_ut_copy_ipackage_to_ipackage(). acpi_ut_copy_ipackage_to_ipackage() is called to copy an internal package object into another internal package object, when it fails, the memory of acpi_operand_object should be freed by the caller. (CVE-2022-50423)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50423
https://ubuntu.com/security/CVE-2022-50423

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50423

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269607 - Linux Distros Unpatched Vulnerability : CVE-2022-50429
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings() We should add the of_node_put() when breaking out of for_each_child_of_node() as it will automatically increase and decrease the refcount. (CVE-2022-50429)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50429
https://ubuntu.com/security/CVE-2022-50429

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50429

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269576 - Linux Distros Unpatched Vulnerability : CVE-2022-50432
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- kernfs: fix use-after-free in __kernfs_remove Syzkaller managed to trigger concurrent calls to kernfs_remove_by_name_ns() for the same file resulting in a KASAN detected use-after-free. The race occurs when the root node is freed during kernfs_drain(). To prevent this acquire an additional reference for the root of the tree that is removed before calling __kernfs_remove(). Found by syzkaller with the following reproducer (slab_nomerge is required): syz_mount_image$ext4(0x0, &(0x7f0000000100)='./file0\x00', 0x100000, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0) close(r0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x800) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0), 0x408, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@mmap}, {@loose}, {@loose}, {@mmap}], [{@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@fsmagic={'fsmagic', 0x3d, 0x10001}}, {@dont_hash}]}}) Sample report:
================================================================== BUG: KASAN: use-after-free in kernfs_type include/linux/kernfs.h:335 [inline] BUG: KASAN: use-after-free in kernfs_leftmost_descendant fs/kernfs/dir.c:1261 [inline] BUG: KASAN: use-after-free in __kernfs_remove.part.0+0x843/0x960 fs/kernfs/dir.c:1369 Read of size 2 at addr ffff8880088807f0 by task syz-executor.2/857 CPU: 0 PID: 857 Comm: syz-executor.2 Not tainted 6.0.0-rc3-00363-g7726d4c3e60b #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x6e/0x91 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x5e/0x5e5 mm/kasan/report.c:433 kasan_report+0xa3/0x130 mm/kasan/report.c:495 kernfs_type include/linux/kernfs.h:335 [inline] kernfs_leftmost_descendant fs/kernfs/dir.c:1261 [inline]
__kernfs_remove.part.0+0x843/0x960 fs/kernfs/dir.c:1369 __kernfs_remove fs/kernfs/dir.c:1356 [inline] kernfs_remove_by_name_ns+0x108/0x190 fs/kernfs/dir.c:1589 sysfs_slab_add+0x133/0x1e0 mm/slub.c:5943
__kmem_cache_create+0x3e0/0x550 mm/slub.c:4899 create_cache mm/slab_common.c:229 [inline] kmem_cache_create_usercopy+0x167/0x2a0 mm/slab_common.c:335 p9_client_create+0xd4d/0x1190 net/9p/client.c:993 v9fs_session_init+0x1e6/0x13c0 fs/9p/v9fs.c:408 v9fs_mount+0xb9/0xbd0 fs/9p/vfs_super.c:126 legacy_get_tree+0xf1/0x200 fs/fs_context.c:610 vfs_get_tree+0x85/0x2e0 fs/super.c:1530 do_new_mount fs/namespace.c:3040 [inline] path_mount+0x675/0x1d00 fs/namespace.c:3370 do_mount fs/namespace.c:3383 [inline] __do_sys_mount fs/namespace.c:3591 [inline] __se_sys_mount fs/namespace.c:3568 [inline] __x64_sys_mount+0x282/0x300 fs/namespace.c:3568 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f725f983aed Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f725f0f7028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f725faa3f80 RCX: 00007f725f983aed RDX:
00000000200000c0 RSI: 0000000020000040 RDI: 0000000000000000 RBP: 00007f725f9f419c R08: 0000000020000280 R09: 0000000000000000 R10: 0000000000000408 R11: 0000000000000246 R12: 0000000000000000 R13:
0000000000000006 R14: 00007f725faa3f80 R15: 00007f725f0d7000 </TASK> Allocated by task 855:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:437 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:470 kasan_slab_alloc include/linux/kasan.h:224 [inline] slab_post_alloc_hook mm/slab.h:7 ---truncated--- (CVE-2022-50432)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50432
https://ubuntu.com/security/CVE-2022-50432

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50432

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269547 - Linux Distros Unpatched Vulnerability : CVE-2022-50433
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: efi: ssdt: Don't free memory if ACPI table was loaded successfully Amadeusz reports KASAN use-after-free errors introduced by commit 3881ee0b1edc (efi: avoid efivars layer when loading SSDTs from variables). The problem appears to be that the memory that holds the new ACPI table is now freed unconditionally, instead of only when the ACPI core reported a failure to load the table. So let's fix this, by omitting the kfree() on success.
(CVE-2022-50433)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50433
https://ubuntu.com/security/CVE-2022-50433

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50433

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269585 - Linux Distros Unpatched Vulnerability : CVE-2022-50435
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: avoid crash when inline data creation follows DIO write When inode is created and written to using direct IO, there is nothing to clear the EXT4_STATE_MAY_INLINE_DATA flag. Thus when inode gets truncated later to say 1 byte and written using normal write, we will try to store the data as inline data. This confuses the code later because the inode now has both normal block and inline data allocated and the confusion manifests for example as: kernel BUG at fs/ext4/inode.c:2721! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 359 Comm: repro Not tainted 5.19.0-rc8-00001-g31ba1e3b8305-dirty #15 Hardware name:
QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014 RIP:
0010:ext4_writepages+0x363d/0x3660 RSP: 0018:ffffc90000ccf260 EFLAGS: 00010293 RAX: ffffffff81e1abcd RBX:
0000008000000000 RCX: ffff88810842a180 RDX: 0000000000000000 RSI: 0000008000000000 RDI: 0000000000000000 RBP: ffffc90000ccf650 R08: ffffffff81e17d58 R09: ffffed10222c680b R10: dfffe910222c680c R11:
1ffff110222c680a R12: ffff888111634128 R13: ffffc90000ccf880 R14: 0000008410000000 R15: 0000000000000001 FS: 00007f72635d2640(0000) GS:ffff88811b000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000565243379180 CR3: 000000010aa74000 CR4: 0000000000150eb0 Call Trace: <TASK>
do_writepages+0x397/0x640 filemap_fdatawrite_wbc+0x151/0x1b0 file_write_and_wait_range+0x1c9/0x2b0 ext4_sync_file+0x19e/0xa00 vfs_fsync_range+0x17b/0x190 ext4_buffered_write_iter+0x488/0x530 ext4_file_write_iter+0x449/0x1b90 vfs_write+0xbcd/0xf40 ksys_write+0x198/0x2c0 __x64_sys_write+0x7b/0x90 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> Fix the problem by clearing EXT4_STATE_MAY_INLINE_DATA when we are doing direct IO write to a file. (CVE-2022-50435)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50435
https://ubuntu.com/security/CVE-2022-50435

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50435

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269565 - Linux Distros Unpatched Vulnerability : CVE-2022-50439
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ASoC: mediatek: mt8173: Enable IRQ when pdata is ready If the device does not come straight from reset, we might receive an IRQ before we are ready to handle it. [ 2.334737] Unable to handle kernel read from unreadable memory at virtual address 00000000000001e4 [ 2.522601] Call trace: [ 2.525040] regmap_read+0x1c/0x80 [ 2.528434] mt8173_afe_irq_handler+0x40/0xf0 ... [ 2.598921] start_kernel+0x338/0x42c (CVE-2022-50439)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50439
https://ubuntu.com/security/CVE-2022-50439

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50439

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269499 - Linux Distros Unpatched Vulnerability : CVE-2022-50440
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/vmwgfx: Validate the box size for the snooped cursor Invalid userspace dma surface copies could potentially overflow the memcpy from the surface to the snooped image leading to crashes. To fix it the dimensions of the copybox have to be validated against the expected size of the snooped cursor.
(CVE-2022-50440)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50440
https://ubuntu.com/security/CVE-2022-50440

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50440

Plugin Information
Published: 2025/10/08, Modified: 2025/12/23
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269632 - Linux Distros Unpatched Vulnerability : CVE-2022-50444
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- clk: tegra20: Fix refcount leak in tegra20_clock_init of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. (CVE-2022-50444)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50444
https://ubuntu.com/security/CVE-2022-50444

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50444

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269528 - Linux Distros Unpatched Vulnerability : CVE-2022-50448
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mm/uffd: fix warning without PTE_MARKER_UFFD_WP compiled in When PTE_MARKER_UFFD_WP not configured, it's still possible to reach pte marker code and trigger an warning. Add a few CONFIG_PTE_MARKER_UFFD_WP ifdefs to make sure the code won't be reached when not compiled in. (CVE-2022-50448)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50448
https://ubuntu.com/security/CVE-2022-50448

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50448

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269620 - Linux Distros Unpatched Vulnerability : CVE-2022-50458
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: clk: tegra: Fix refcount leak in tegra210_clock_init of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.
(CVE-2022-50458)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50458
https://ubuntu.com/security/CVE-2022-50458

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50458

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269564 - Linux Distros Unpatched Vulnerability : CVE-2022-50460
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cifs: Fix xid leak in cifs_flock() If not flock, before return -ENOLCK, should free the xid, otherwise, the xid will be leaked. (CVE-2022-50460)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50460
https://ubuntu.com/security/CVE-2022-50460

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50460

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269555 - Linux Distros Unpatched Vulnerability : CVE-2022-50461
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: ethernet: ti: am65-cpsw: Fix PM runtime leakage in am65_cpsw_nuss_ndo_slave_open() Ensure pm_runtime_put() is issued in error path. (CVE-2022-50461)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50461
https://security-tracker.debian.org/tracker/CVE-2022-50461
https://ubuntu.com/security/CVE-2022-50461

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50461

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269613 - Linux Distros Unpatched Vulnerability : CVE-2022-50465
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ext4: fix leaking uninitialized memory in fast-commit journal When space at the end of fast-commit journal blocks is unused, make sure to zero it out so that uninitialized memory is not leaked to disk. (CVE-2022-50465)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50465
https://ubuntu.com/security/CVE-2022-50465

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50465

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269391 - Linux Distros Unpatched Vulnerability : CVE-2022-50476
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ntb_netdev: Use dev_kfree_skb_any() in interrupt context TX/RX callback handlers (ntb_netdev_tx_handler(), ntb_netdev_rx_handler()) can be called in interrupt context via the DMA framework when the respective DMA operations have completed. As such, any calls by these routines to free skb's, should use the interrupt context safe dev_kfree_skb_any() function. Previously, these callback handlers would call the interrupt unsafe version of dev_kfree_skb(). This has not presented an issue on Intel IOAT DMA engines as that driver utilizes tasklets rather than a hard interrupt handler, like the AMD PTDMA DMA driver. On AMD systems, a kernel WARNING message is encountered, which is being issued from skb_release_head_state() due to in_hardirq() being true. Besides the user visible WARNING from the kernel, the other symptom of this bug was that TCP/IP performance across the ntb_netdev interface was very poor, i.e. approximately an order of magnitude below what was expected. With the repair to use dev_kfree_skb_any(), kernel WARNINGs from skb_release_head_state() ceased and TCP/IP performance, as measured by iperf, was on par with expected results, approximately 20 Gb/s on AMD Milan based server. Note that this performance is comparable with Intel based servers. (CVE-2022-50476)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50476
https://ubuntu.com/security/CVE-2022-50476

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50476

Plugin Information
Published: 2025/10/08, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269394 - Linux Distros Unpatched Vulnerability : CVE-2022-50490
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf: Propagate error from htab_lock_bucket() to userspace In __htab_map_lookup_and_delete_batch() if htab_lock_bucket() returns
-EBUSY, it will go to next bucket. Going to next bucket may not only skip the elements in current bucket silently, but also incur out-of-bound memory access or expose kernel memory to userspace if current bucket_cnt is greater than bucket_size or zero. Fixing it by stopping batch operation and returning -EBUSY when htab_lock_bucket() fails, and the application can retry or skip the busy batch as needed.
(CVE-2022-50490)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50490
https://ubuntu.com/security/CVE-2022-50490

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50490

Plugin Information
Published: 2025/10/08, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269370 - Linux Distros Unpatched Vulnerability : CVE-2022-50497
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- binfmt_misc: fix shift-out-of-bounds in check_special_flags UBSAN reported a shift-out-of-bounds warning:
left shift of 1 by 31 places cannot be represented in type 'int' Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x8d/0xcf lib/dump_stack.c:106 ubsan_epilogue+0xa/0x44 lib/ubsan.c:151 __ubsan_handle_shift_out_of_bounds+0x1e7/0x208 lib/ubsan.c:322 check_special_flags fs/binfmt_misc.c:241 [inline] create_entry fs/binfmt_misc.c:456 [inline] bm_register_write+0x9d3/0xa20 fs/binfmt_misc.c:654 vfs_write+0x11e/0x580 fs/read_write.c:582 ksys_write+0xcf/0x120 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x34/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x4194e1 Since the type of Node's flags is unsigned long, we should define these macros with same type too. (CVE-2022-50497)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50497
https://ubuntu.com/security/CVE-2022-50497

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50497

Plugin Information
Published: 2025/10/08, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
270190 - Linux Distros Unpatched Vulnerability : CVE-2022-50531
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tipc: fix an information leak in tipc_topsrv_kern_subscr Use a 8-byte write to initialize sub.usr_handle in tipc_topsrv_kern_subscr(), otherwise four bytes remain uninitialized when issuing setsockopt(..., SOL_TIPC, ...). This resulted in an infoleak reported by KMSAN when the packet was received:
===================================================== BUG: KMSAN: kernel-infoleak in copyout+0xbc/0x100 lib/iov_iter.c:169 instrument_copy_to_user ./include/linux/instrumented.h:121 copyout+0xbc/0x100 lib/iov_iter.c:169 _copy_to_iter+0x5c0/0x20a0 lib/iov_iter.c:527 copy_to_iter ./include/linux/uio.h:176 simple_copy_to_iter+0x64/0xa0 net/core/datagram.c:513 __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:419 skb_copy_datagram_iter+0x58/0x200 net/core/datagram.c:527 skb_copy_datagram_msg ./include/linux/skbuff.h:3903 packet_recvmsg+0x521/0x1e70 net/packet/af_packet.c:3469
____sys_recvmsg+0x2c4/0x810 net/socket.c:? ___sys_recvmsg+0x217/0x840 net/socket.c:2743 __sys_recvmsg net/socket.c:2773 __do_sys_recvmsg net/socket.c:2783 __se_sys_recvmsg net/socket.c:2780
__x64_sys_recvmsg+0x364/0x540 net/socket.c:2780 do_syscall_x64 arch/x86/entry/common.c:50 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd arch/x86/entry/entry_64.S:120 ... Uninit was stored to memory at: tipc_sub_subscribe+0x42d/0xb50 net/tipc/subscr.c:156 tipc_conn_rcv_sub+0x246/0x620 net/tipc/topsrv.c:375 tipc_topsrv_kern_subscr+0x2e8/0x400 net/tipc/topsrv.c:579 tipc_group_create+0x4e7/0x7d0 net/tipc/group.c:190 tipc_sk_join+0x2a8/0x770 net/tipc/socket.c:3084 tipc_setsockopt+0xae5/0xe40 net/tipc/socket.c:3201 __sys_setsockopt+0x87f/0xdc0 net/socket.c:2252 __do_sys_setsockopt net/socket.c:2263 __se_sys_setsockopt net/socket.c:2260 __x64_sys_setsockopt+0xe0/0x160 net/socket.c:2260 do_syscall_x64 arch/x86/entry/common.c:50 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd arch/x86/entry/entry_64.S:120 Local variable sub created at:
tipc_topsrv_kern_subscr+0x57/0x400 net/tipc/topsrv.c:562 tipc_group_create+0x4e7/0x7d0 net/tipc/group.c:190 Bytes 84-87 of 88 are uninitialized Memory access of size 88 starts at ffff88801ed57cd0 Data copied to user address 0000000020000400 ...
===================================================== (CVE-2022-50531)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50531
https://ubuntu.com/security/CVE-2022-50531

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50531

Plugin Information
Published: 2025/10/13, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269265 - Linux Distros Unpatched Vulnerability : CVE-2022-50552
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- blk-mq: use quiesced elevator switch when reinitializing queues The hctx's run_work may be racing with the elevator switch when reinitializing hardware queues. The queue is merely frozen in this context, but that only prevents requests from allocating and doesn't stop the hctx work from running. The work may get an elevator pointer that's being torn down, and can result in use-after-free errors and kernel panics (example below). Use the quiesced elevator switch instead, and make the previous one static since it is now only used locally. nvme nvme0: resetting controller nvme nvme0: 32/0/0 default/read/poll queues BUG:
kernel NULL pointer dereference, address: 0000000000000008 #PF: supervisor read access in kernel mode #PF:
error_code(0x0000) - not-present page PGD 80000020c8861067 P4D 80000020c8861067 PUD 250f8c8067 PMD 0 Oops:
0000 [#1] SMP PTI Workqueue: kblockd blk_mq_run_work_fn RIP: 0010:kyber_has_work+0x29/0x70 ... Call Trace:
__blk_mq_do_dispatch_sched+0x83/0x2b0 __blk_mq_sched_dispatch_requests+0x12e/0x170 blk_mq_sched_dispatch_requests+0x30/0x60 __blk_mq_run_hw_queue+0x2b/0x50 process_one_work+0x1ef/0x380 worker_thread+0x2d/0x3e0 (CVE-2022-50552)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50552
https://security-tracker.debian.org/tracker/CVE-2022-50552
https://ubuntu.com/security/CVE-2022-50552

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50552

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
270202 - Linux Distros Unpatched Vulnerability : CVE-2022-50553
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx' When generate a synthetic event with many params and then create a trace action for it [1], kernel panic happened [2]. It is because that in trace_action_create() 'data->n_params' is up to SYNTH_FIELDS_MAX (current value is 64), and array 'data->var_ref_idx' keeps indices into array 'hist_data->var_refs' for each synthetic event param, but the length of 'data->var_ref_idx' is TRACING_MAP_VARS_MAX (current value is 16), so out-of-bound write happened when 'data->n_params' more than 16. In this case, 'data->match_data.event' is overwritten and eventually cause the panic. To solve the issue, adjust the length of 'data->var_ref_idx' to be SYNTH_FIELDS_MAX and add sanity checks to avoid out-of-bound write. [1] # cd /sys/kernel/tracing/ # echo my_synth_event int v1; int v2; int v3; int v4; int v5; int v6;\ int v7; int v8; int v9; int v10; int v11;
int v12; int v13; int v14;\ int v15; int v16; int v17; int v18; int v19; int v20; int v21; int v22;\ int v23; int v24; int v25; int v26; int v27; int v28; int v29; int v30;\ int v31; int v32; int v33; int v34;
int v35; int v36; int v37; int v38;\ int v39; int v40; int v41; int v42; int v43; int v44; int v45; int v46;\ int v47; int v48; int v49; int v50; int v51; int v52; int v53; int v54;\ int v55; int v56; int v57;
int v58; int v59; int v60; int v61; int v62;\ int v63 >> synthetic_events # echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm==bash' >> \ events/sched/sched_waking/trigger # echo hist:keys=next_pid:onmatch(sched.sched_waking).my_synth_event(\ pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,\ pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,\ pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,pid,\ pid,pid,pid,pid,pid,pid,pid,pid,pid) >> events/sched/sched_switch/trigger [2] BUG: unable to handle page fault for address: ffff91c900000000 PGD 61001067 P4D 61001067 PUD 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU:
2 PID: 322 Comm: bash Tainted: G W 6.1.0-rc8+ #229 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:strcmp+0xc/0x30 Code: 75 f7 31 d2 44 0f b6 04 16 44 88 04 11 48 83 c2 01 45 84 c0 75 ee c3 cc cc cc cc 0f 1f 00 31 c0 eb 08 48 83 c0 01 84 d2 74 13 <0f> b6 14 07 3a 14 06 74 ef 19 c0 83 c8 01 c3 cc cc cc cc 31 c3 RSP: 0018:ffff9b3b00f53c48 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffffffffba958a68 RCX: 0000000000000000 RDX: 0000000000000010 RSI: ffff91c943d33a90 RDI: ffff91c900000000 RBP: ffff91c900000000 R08: 00000018d604b529 R09:
0000000000000000 R10: ffff91c9483eddb1 R11: ffff91ca483eddab R12: ffff91c946171580 R13: ffff91c9479f0538 R14: ffff91c9457c2848 R15: ffff91c9479f0538 FS: 00007f1d1cfbe740(0000) GS:ffff91c9bdc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff91c900000000 CR3:
0000000006316000 CR4: 00000000000006e0 Call Trace: <TASK> __find_event_file+0x55/0x90 action_create+0x76c/0x1060 event_hist_trigger_parse+0x146d/0x2060 ? event_trigger_write+0x31/0xd0 trigger_process_regex+0xbb/0x110 event_trigger_write+0x6b/0xd0 vfs_write+0xc8/0x3e0 ? alloc_fd+0xc0/0x160 ? preempt_count_add+0x4d/0xa0 ? preempt_count_add+0x70/0xa0 ksys_write+0x5f/0xe0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f1d1d0cf077 Code: 64 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 RSP: 002b:00007ffcebb0e568 EFLAGS: 00000246 ORIG_RAX:
0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000143 RCX: 00007f1d1d0cf077 RDX: 0000000000000143 RSI: 00005639265aa7e0 RDI: 0000000000000001 RBP: 00005639265aa7e0 R08: 000000000000000a R09:
0000000000000142 R ---truncated--- (CVE-2022-50553)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50553
https://ubuntu.com/security/CVE-2022-50553

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:P)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50553

Plugin Information
Published: 2025/10/13, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271608 - Linux Distros Unpatched Vulnerability : CVE-2022-50579
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: arm64: ftrace: fix module PLTs with mcount Li Huafei reports that mcount-based ftrace with module PLTs was broken by commit: a6253579977e4c6f (arm64: ftrace: consistently handle PLTs.) When a module PLTs are used and a module is loaded sufficiently far away from the kernel, we'll create PLTs for any branches which are out-of-range. These are separate from the special ftrace trampoline PLTs, which the module PLT code doesn't directly manipulate. When mcount is in use this is a problem, as each mcount callsite in a module will be initialized to point to a module PLT, but since commit a6253579977e4c6f ftrace_make_nop() will assume that the callsite has been initialized to point to the special ftrace trampoline PLT, and ftrace_find_callable_addr() rejects other cases. This means that when ftrace tries to initialize a callsite via ftrace_make_nop(), the call to ftrace_find_callable_addr() will find that the `_mcount` stub is out-of-range and is not handled by the ftrace PLT, resulting in a splat: | ftrace_test: loading out-of- tree module taints kernel. | ftrace: no module PLT for _mcount | ------------[ ftrace bug ]------------ | ftrace failed to modify | [<ffff800029180014>] 0xffff800029180014 | actual: 44:00:00:94 | Initializing ftrace call sites | ftrace record flags: 2000000 | (0) | expected tramp: ffff80000802eb3c | ------------[ cut here ]------------ | WARNING: CPU: 3 PID: 157 at kernel/trace/ftrace.c:2120 ftrace_bug+0x94/0x270 | Modules linked in: | CPU: 3 PID: 157 Comm: insmod Tainted: G O 6.0.0-rc6-00151-gcd722513a189-dirty #22 | Hardware name: linux,dummy-virt (DT) | pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : ftrace_bug+0x94/0x270 | lr : ftrace_bug+0x21c/0x270 | sp : ffff80000b2bbaf0 | x29: ffff80000b2bbaf0 x28: 0000000000000000 x27: ffff0000c4d38000 | x26: 0000000000000001 x25: ffff800009d7e000 x24:
ffff0000c4d86e00 | x23: 0000000002000000 x22: ffff80000a62b000 x21: ffff8000098ebea8 | x20:
ffff0000c4d38000 x19: ffff80000aa24158 x18: ffffffffffffffff | x17: 0000000000000000 x16: 0a0d2d2d2d2d2d2d x15: ffff800009aa9118 | x14: 0000000000000000 x13: 6333626532303830 x12: 3030303866666666 | x11:
203a706d61727420 x10: 6465746365707865 x9 : 3362653230383030 | x8 : c0000000ffffefff x7 : 0000000000017fe8 x6 : 000000000000bff4 | x5 : 0000000000057fa8 x4 : 0000000000000000 x3 : 0000000000000001 | x2 :
ad2cb14bb5438900 x1 : 0000000000000000 x0 : 0000000000000022 | Call trace: | ftrace_bug+0x94/0x270 | ftrace_process_locs+0x308/0x430 | ftrace_module_init+0x44/0x60 | load_module+0x15b4/0x1ce8 |
__do_sys_init_module+0x1ec/0x238 | __arm64_sys_init_module+0x24/0x30 | invoke_syscall+0x54/0x118 | el0_svc_common.constprop.4+0x84/0x100 | do_el0_svc+0x3c/0xd0 | el0_svc+0x1c/0x50 | el0t_64_sync_handler+0x90/0xb8 | el0t_64_sync+0x15c/0x160 | ---[ end trace 0000000000000000 ]--- |
---------test_init----------- Fix this by reverting to the old behaviour of ignoring the old instruction when initialising an mcount callsite in a module, which was the behaviour prior to commit a6253579977e4c6f. (CVE-2022-50579)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50579
https://ubuntu.com/security/CVE-2022-50579

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50579

Plugin Information
Published: 2025/10/27, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271602 - Linux Distros Unpatched Vulnerability : CVE-2022-50580
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- blk-throttle: prevent overflow while calculating wait time There is a problem found by code review in tg_with_in_bps_limit() that 'bps_limit * jiffy_elapsed_rnd' might overflow. Fix the problem by calling mul_u64_u64_div_u64() instead. (CVE-2022-50580)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50580
https://ubuntu.com/security/CVE-2022-50580

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50580

Plugin Information
Published: 2025/10/27, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277639 - Linux Distros Unpatched Vulnerability : CVE-2022-50583
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- md/raid0, raid10: Don't set discard sectors for request queue It should use disk_stack_limits to get a proper max_discard_sectors rather than setting a value by stack drivers. And there is a bug. If all member disks are rotational devices, raid0/raid10 set max_discard_sectors. So the member devices are not ssd/nvme, but raid0/raid10 export the wrong value. It reports warning messages in function
__blkdev_issue_discard when mkfs.xfs like this: [ 4616.022599] ------------[ cut here ]------------ [ 4616.027779] WARNING: CPU: 4 PID: 99634 at block/blk-lib.c:50 __blkdev_issue_discard+0x16a/0x1a0 [ 4616.140663] RIP: 0010:__blkdev_issue_discard+0x16a/0x1a0 [ 4616.146601] Code: 24 4c 89 20 31 c0 e9 fe fe ff ff c1 e8 09 8d 48 ff 4c 89 f0 4c 09 e8 48 85 c1 0f 84 55 ff ff ff b8 ea ff ff ff e9 df fe ff ff <0f> 0b 48 8d 74 24 08 e8 ea d6 00 00 48 c7 c6 20 1e 89 ab 48 c7 c7 [ 4616.167567] RSP: 0018:ffffaab88cbffca8 EFLAGS: 00010246 [ 4616.173406] RAX: ffff9ba1f9e44678 RBX: 0000000000000000 RCX: ffff9ba1c9792080 [ 4616.181376] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9ba1c9792080 [ 4616.189345] RBP:
0000000000000cc0 R08: ffffaab88cbffd10 R09: 0000000000000000 [ 4616.197317] R10: 0000000000000012 R11:
0000000000000000 R12: 0000000000000000 [ 4616.205288] R13: 0000000000400000 R14: 0000000000000cc0 R15:
ffff9ba1c9792080 [ 4616.213259] FS: 00007f9a5534e980(0000) GS:ffff9ba1b7c80000(0000) knlGS:0000000000000000 [ 4616.222298] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4616.228719] CR2:
000055a390a4c518 CR3: 0000000123e40006 CR4: 00000000001706e0 [ 4616.236689] Call Trace: [ 4616.239428] blkdev_issue_discard+0x52/0xb0 [ 4616.244108] blkdev_common_ioctl+0x43c/0xa00 [ 4616.248883] blkdev_ioctl+0x116/0x280 [ 4616.252977] __x64_sys_ioctl+0x8a/0xc0 [ 4616.257163] do_syscall_64+0x5c/0x90 [ 4616.261164] ? handle_mm_fault+0xc5/0x2a0 [ 4616.265652] ? do_user_addr_fault+0x1d8/0x690 [ 4616.270527] ? do_syscall_64+0x69/0x90 [ 4616.274717] ? exc_page_fault+0x62/0x150 [ 4616.279097] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 4616.284748] RIP: 0033:0x7f9a55398c6b (CVE-2022-50583)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50583
https://ubuntu.com/security/CVE-2022-50583

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50583

Plugin Information
Published: 2025/12/08, Modified: 2025/12/23
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278089 - Linux Distros Unpatched Vulnerability : CVE-2022-50632
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drivers: perf: marvell_cn10k: Fix hotplug callback leak in tad_pmu_init() tad_pmu_init() won't remove the callback added by cpuhp_setup_state_multi() when platform_driver_register() failed. Remove the callback by cpuhp_remove_multi_state() in fail path. Similar to the handling of arm_ccn_init() in commit 26242b330093 (bus: arm-ccn: Prevent hotplug callback leak) (CVE-2022-50632)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50632
https://ubuntu.com/security/CVE-2022-50632

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50632

Plugin Information
Published: 2025/12/10, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277910 - Linux Distros Unpatched Vulnerability : CVE-2022-50642
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- platform/chrome: cros_ec_typec: zero out stale pointers `cros_typec_get_switch_handles` allocates four pointers when obtaining type-c switch handles. These pointers are all freed if failing to obtain any of them; therefore, pointers in `port` become stale. The stale pointers eventually cause use-after-free or double free in later code paths. Zeroing out all pointer fields after freeing to eliminate these stale pointers. (CVE-2022-50642)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50642
https://security-tracker.debian.org/tracker/CVE-2022-50642
https://ubuntu.com/security/CVE-2022-50642

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50642

Plugin Information
Published: 2025/12/09, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277844 - Linux Distros Unpatched Vulnerability : CVE-2022-50666
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA/siw: Fix QP destroy to wait for all references dropped. Delay QP destroy completion until all siw references to QP are dropped. The calling RDMA core will free QP structure after successful return from siw_qp_destroy() call, so siw must not hold any remaining reference to the QP upon return. A use-after- free was encountered in xfstest generic/460, while testing NFSoRDMA. Here, after a TCP connection drop by peer, the triggered siw_cm_work_handler got delayed until after QP destroy call, referencing a QP which has already freed. (CVE-2022-50666)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50666
https://security-tracker.debian.org/tracker/CVE-2022-50666
https://ubuntu.com/security/CVE-2022-50666

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50666

Plugin Information
Published: 2025/12/09, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277955 - Linux Distros Unpatched Vulnerability : CVE-2022-50669
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- misc: ocxl: fix possible name leak in ocxl_file_register_afu() If device_register() returns error in ocxl_file_register_afu(), the name allocated by dev_set_name() need be freed. As comment of device_register() says, it should use put_device() to give up the reference in the error path. So fix this by calling put_device(), then the name can be freed in kobject_cleanup(), and info is freed in info_release(). (CVE-2022-50669)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50669
https://ubuntu.com/security/CVE-2022-50669

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50669

Plugin Information
Published: 2025/12/09, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279962 - Linux Distros Unpatched Vulnerability : CVE-2022-50697
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mrp: introduce active flags to prevent UAF when applicant uninit The caller of del_timer_sync must prevent restarting of the timer, If we have no this synchronization, there is a small probability that the cancellation will not be successful. And syzbot report the fellowing crash:
================================================================== BUG: KASAN: use-after-free in hlist_add_head include/linux/list.h:929 [inline] BUG: KASAN: use-after-free in enqueue_timer+0x18/0xa4 kernel/time/timer.c:605 Write at addr f9ff000024df6058 by task syz-fuzzer/2256 Pointer tag: [f9], memory tag: [fe] CPU: 1 PID: 2256 Comm: syz-fuzzer Not tainted 6.1.0-rc5-syzkaller-00008- ge01d50cbd6ee #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace.part.0+0xe0/0xf0 arch/arm64/kernel/stacktrace.c:156 dump_backtrace arch/arm64/kernel/stacktrace.c:162 [inline] show_stack+0x18/0x40 arch/arm64/kernel/stacktrace.c:163 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x68/0x84 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x1a8/0x4a0 mm/kasan/report.c:395 kasan_report+0x94/0xb4 mm/kasan/report.c:495
__do_kernel_fault+0x164/0x1e0 arch/arm64/mm/fault.c:320 do_bad_area arch/arm64/mm/fault.c:473 [inline] do_tag_check_fault+0x78/0x8c arch/arm64/mm/fault.c:749 do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:825 el1_abort+0x40/0x60 arch/arm64/kernel/entry-common.c:367 el1h_64_sync_handler+0xd8/0xe4 arch/arm64/kernel/entry-common.c:427 el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:576 hlist_add_head include/linux/list.h:929 [inline] enqueue_timer+0x18/0xa4 kernel/time/timer.c:605 mod_timer+0x14/0x20 kernel/time/timer.c:1161 mrp_periodic_timer_arm net/802/mrp.c:614 [inline] mrp_periodic_timer+0xa0/0xc0 net/802/mrp.c:627 call_timer_fn.constprop.0+0x24/0x80 kernel/time/timer.c:1474 expire_timers+0x98/0xc4 kernel/time/timer.c:1519 To fix it, we can introduce a new active flags to make sure the timer will not restart. (CVE-2022-50697)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50697
https://ubuntu.com/security/CVE-2022-50697

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50697

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279972 - Linux Distros Unpatched Vulnerability : CVE-2022-50703
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe() There are two refcount leak bugs in qcom_smsm_probe(): (1) The 'local_node' is escaped out from for_each_child_of_node() as the break of iteration, we should call of_node_put() for it in error path or when it is not used anymore. (2) The 'node' is escaped out from for_each_available_child_of_node() as the 'goto', we should call of_node_put() for it in goto target. (CVE-2022-50703)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50703
https://ubuntu.com/security/CVE-2022-50703

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50703

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279957 - Linux Distros Unpatched Vulnerability : CVE-2022-50709
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() syzbot is reporting uninit value at ath9k_htc_rx_msg() [1], for ioctl(USB_RAW_IOCTL_EP_WRITE) can call ath9k_hif_usb_rx_stream() with pkt_len = 0 but ath9k_hif_usb_rx_stream() uses __dev_alloc_skb(pkt_len + 32, GFP_ATOMIC) based on an assumption that pkt_len is valid. As a result, ath9k_hif_usb_rx_stream() allocates skb with uninitialized memory and ath9k_htc_rx_msg() is reading from uninitialized memory. Since bytes accessed by ath9k_htc_rx_msg() is not known until ath9k_htc_rx_msg() is called, it would be difficult to check minimal valid pkt_len at if (pkt_len > 2 * MAX_RX_BUF_SIZE) { line in ath9k_hif_usb_rx_stream(). We have two choices. One is to workaround by adding __GFP_ZERO so that ath9k_htc_rx_msg() sees 0 if pkt_len is invalid. The other is to let ath9k_htc_rx_msg() validate pkt_len before accessing. This patch chose the latter. Note that I'm not sure threshold condition is correct, for I can't find details on possible packet length used by this protocol. (CVE-2022-50709)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50709
https://ubuntu.com/security/CVE-2022-50709

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50709

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279865 - Linux Distros Unpatched Vulnerability : CVE-2022-50717
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nvmet-tcp: add bounds check on Transfer Tag ttag is used as an index to get cmd in nvmet_tcp_handle_h2c_data_pdu(), add a bounds check to avoid out-of-bounds access. (CVE-2022-50717)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50717
https://ubuntu.com/security/CVE-2022-50717

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50717

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279940 - Linux Distros Unpatched Vulnerability : CVE-2022-50718
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/amdgpu: fix pci device refcount leak As comment of pci_get_domain_bus_and_slot() says, it returns a pci device with refcount increment, when finish using it, the caller must decrement the reference count by calling pci_dev_put(). So before returning from amdgpu_device_resume|suspend_display_audio(), pci_dev_put() is called to avoid refcount leak. (CVE-2022-50718)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50718
https://ubuntu.com/security/CVE-2022-50718

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50718

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279951 - Linux Distros Unpatched Vulnerability : CVE-2022-50719
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: line6: fix stack overflow in line6_midi_transmit Correctly calculate available space including the size of the chunk buffer. This fixes a buffer overflow when multiple MIDI sysex messages are sent to a PODxt device. (CVE-2022-50719)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50719
https://ubuntu.com/security/CVE-2022-50719

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0008
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50719

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279889 - Linux Distros Unpatched Vulnerability : CVE-2022-50726
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mlx5: Fix possible use-after-free in async command interface mlx5_cmd_cleanup_async_ctx should return only after all its callback handlers were completed. Before this patch, the below race between mlx5_cmd_cleanup_async_ctx and mlx5_cmd_exec_cb_handler was possible and lead to a use-after-free: 1.
mlx5_cmd_cleanup_async_ctx is called while num_inflight is 2 (i.e. elevated by 1, a single inflight callback). 2. mlx5_cmd_cleanup_async_ctx decreases num_inflight to 1. 3. mlx5_cmd_exec_cb_handler is called, decreases num_inflight to 0 and is about to call wake_up(). 4. mlx5_cmd_cleanup_async_ctx calls wait_event, which returns immediately as the condition (num_inflight == 0) holds. 5.
mlx5_cmd_cleanup_async_ctx returns. 6. The caller of mlx5_cmd_cleanup_async_ctx frees the mlx5_async_ctx object. 7. mlx5_cmd_exec_cb_handler goes on and calls wake_up() on the freed object. Fix it by syncing using a completion object. Mark it completed when num_inflight reaches 0. Trace: BUG: KASAN: use-after- free in do_raw_spin_lock+0x23d/0x270 Read of size 4 at addr ffff888139cd12f4 by task swapper/5/0 CPU: 5 PID: 0 Comm: swapper/5 Not tainted 6.0.0-rc3_for_upstream_debug_2022_08_30_13_10 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace:
<IRQ> dump_stack_lvl+0x57/0x7d print_report.cold+0x2d5/0x684 ? do_raw_spin_lock+0x23d/0x270 kasan_report+0xb1/0x1a0 ? do_raw_spin_lock+0x23d/0x270 do_raw_spin_lock+0x23d/0x270 ? rwlock_bug.part.0+0x90/0x90 ? __delete_object+0xb8/0x100 ? lock_downgrade+0x6e0/0x6e0
_raw_spin_lock_irqsave+0x43/0x60 ? __wake_up_common_lock+0xb9/0x140 __wake_up_common_lock+0xb9/0x140 ?
__wake_up_common+0x650/0x650 ? destroy_tis_callback+0x53/0x70 [mlx5_core] ? kasan_set_track+0x21/0x30 ? destroy_tis_callback+0x53/0x70 [mlx5_core] ? kfree+0x1ba/0x520 ? do_raw_spin_unlock+0x54/0x220 mlx5_cmd_exec_cb_handler+0x136/0x1a0 [mlx5_core] ? mlx5_cmd_cleanup_async_ctx+0x220/0x220 [mlx5_core] ? mlx5_cmd_cleanup_async_ctx+0x220/0x220 [mlx5_core] mlx5_cmd_comp_handler+0x65a/0x12b0 [mlx5_core] ? dump_command+0xcc0/0xcc0 [mlx5_core] ? lockdep_hardirqs_on_prepare+0x400/0x400 ? cmd_comp_notifier+0x7e/0xb0 [mlx5_core] cmd_comp_notifier+0x7e/0xb0 [mlx5_core] atomic_notifier_call_chain+0xd7/0x1d0 mlx5_eq_async_int+0x3ce/0xa20 [mlx5_core] atomic_notifier_call_chain+0xd7/0x1d0 ? irq_release+0x140/0x140 [mlx5_core] irq_int_handler+0x19/0x30 [mlx5_core] __handle_irq_event_percpu+0x1f2/0x620 handle_irq_event+0xb2/0x1d0 handle_edge_irq+0x21e/0xb00
__common_interrupt+0x79/0x1a0 common_interrupt+0x78/0xa0 </IRQ> <TASK> asm_common_interrupt+0x22/0x40 RIP:
0010:default_idle+0x42/0x60 Code: c1 83 e0 07 48 c1 e9 03 83 c0 03 0f b6 14 11 38 d0 7c 04 84 d2 75 14 8b 05 eb 47 22 02 85 c0 7e 07 0f 00 2d e0 9f 48 00 fb f4 <c3> 48 c7 c7 80 08 7f 85 e8 d1 d3 3e fe eb de 66 66 2e 0f 1f 84 00 RSP: 0018:ffff888100dbfdf0 EFLAGS: 00000242 RAX: 0000000000000001 RBX: ffffffff84ecbd48 RCX: 1ffffffff0afe110 RDX: 0000000000000004 RSI: 0000000000000000 RDI: ffffffff835cc9bc RBP:
0000000000000005 R08: 0000000000000001 R09: ffff88881dec4ac3 R10: ffffed1103bd8958 R11: 0000017d0ca571c9 R12: 0000000000000005 R13: ffffffff84f024e0 R14: 0000000000000000 R15: dffffc0000000000 ? default_idle_call+0xcc/0x450 default_idle_call+0xec/0x450 do_idle+0x394/0x450 ? arch_cpu_idle_exit+0x40/0x40 ? do_idle+0x17/0x450 cpu_startup_entry+0x19/0x20 start_secondary+0x221/0x2b0 ? set_cpu_sibling_map+0x2070/0x2070 secondary_startup_64_no_verify+0xcd/0xdb </TASK> Allocated by task 49502: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x81/0xa0 kvmalloc_node+0x48/0xe0 mlx5e_bulk_async_init+0x35/0x110 [mlx5_core] mlx5e_tls_priv_tx_list_cleanup+0x84/0x3e0 [mlx5_core] mlx5e_ktls_cleanup_tx+0x38f/0x760 [mlx5_core] mlx5e_cleanup_nic_tx+0xa7/0x100 [mlx5_core] mlx5e_detach_netdev+0x1c ---truncated--- (CVE-2022-50726)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50726
https://ubuntu.com/security/CVE-2022-50726

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50726

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279880 - Linux Distros Unpatched Vulnerability : CVE-2022-50728
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- s390/lcs: Fix return type of lcs_start_xmit() With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. A proposed warning in clang aims to catch these at compile time, which reveals: drivers/s390/net/lcs.c:2090:21: error:
incompatible function pointer types initializing 'netdev_tx_t (*)(struct sk_buff *, struct net_device *)'
(aka 'enum netdev_tx (*)(struct sk_buff *, struct net_device *)') with an expression of type 'int (struct sk_buff *, struct net_device *)' [-Werror,-Wincompatible-function-pointer-types-strict] .ndo_start_xmit = lcs_start_xmit, ^~~~~~~~~~~~~~ drivers/s390/net/lcs.c:2097:21: error: incompatible function pointer types initializing 'netdev_tx_t (*)(struct sk_buff *, struct net_device *)' (aka 'enum netdev_tx (*)(struct sk_buff *, struct net_device *)') with an expression of type 'int (struct sk_buff *, struct net_device *)'
[-Werror,-Wincompatible-function-pointer-types-strict] .ndo_start_xmit = lcs_start_xmit, ^~~~~~~~~~~~~~
->ndo_start_xmit() in 'struct net_device_ops' expects a return type of 'netdev_tx_t', not 'int'. Adjust the return type of lcs_start_xmit() to match the prototype's to resolve the warning and potential CFI failure, should s390 select ARCH_SUPPORTS_CFI_CLANG in the future. (CVE-2022-50728)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50728
https://ubuntu.com/security/CVE-2022-50728

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50728

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279929 - Linux Distros Unpatched Vulnerability : CVE-2022-50730
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: silence the warning when evicting inode with dioread_nolock When evicting an inode with default dioread_nolock, it could be raced by the unwritten extents converting kworker after writeback some new allocated dirty blocks. It convert unwritten extents to written, the extents could be merged to upper level and free extent blocks, so it could mark the inode dirty again even this inode has been marked I_FREEING. But the inode->i_io_list check and warning in ext4_evict_inode() missing this corner case.
Fortunately, ext4_evict_inode() will wait all extents converting finished before this check, so it will not lead to inode use-after-free problem, every thing is OK besides this warning. The WARN_ON_ONCE was originally designed for finding inode use-after-free issues in advance, but if we add current dioread_nolock case in, it will become not quite useful, so fix this warning by just remove this check.
====== WARNING: CPU: 7 PID: 1092 at fs/ext4/inode.c:227 ext4_evict_inode+0x875/0xc60 ... RIP:
0010:ext4_evict_inode+0x875/0xc60 ... Call Trace: <TASK> evict+0x11c/0x2b0 iput+0x236/0x3a0 do_unlinkat+0x1b4/0x490 __x64_sys_unlinkat+0x4c/0xb0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7fa933c1115b ====== rm kworker ext4_end_io_end() vfs_unlink() ext4_unlink() ext4_convert_unwritten_io_end_vec() ext4_convert_unwritten_extents() ext4_map_blocks() ext4_ext_map_blocks() ext4_ext_try_to_merge_up() __mark_inode_dirty() check !I_FREEING locked_inode_to_wb_and_lock_list() iput() iput_final() evict() ext4_evict_inode() truncate_inode_pages_final() //wait release io_end inode_io_list_move_locked() ext4_release_io_end() trigger WARN_ON_ONCE() (CVE-2022-50730)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50730
https://ubuntu.com/security/CVE-2022-50730

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50730

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279939 - Linux Distros Unpatched Vulnerability : CVE-2022-50731
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- crypto: akcipher - default implementation for setting a private key Changes from v1: * removed the default implementation from set_pub_key: it is assumed that an implementation must always have this callback defined as there are no use case for an algorithm, which doesn't need a public key Many akcipher implementations (like ECDSA) support only signature verifications, so they don't have all callbacks defined. Commit 78a0324f4a53 (crypto: akcipher - default implementations for request callbacks) introduced default callbacks for sign/verify operations, which just return an error code. However, these are not enough, because before calling sign the caller would likely call set_priv_key first on the instantiated transform (as the in-kernel testmgr does). This function does not have a default stub, so the kernel crashes, when trying to set a private key on an akcipher, which doesn't support signature generation. I've noticed this, when trying to add a KAT vector for ECDSA signature to the testmgr. With this patch the testmgr returns an error in dmesg (as it should) instead of crashing the kernel NULL ptr dereference. (CVE-2022-50731)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50731
https://ubuntu.com/security/CVE-2022-50731

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50731

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279919 - Linux Distros Unpatched Vulnerability : CVE-2022-50736
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA/siw: Fix immediate work request flush to completion queue Correctly set send queue element opcode during immediate work request flushing in post sendqueue operation, if the QP is in ERROR state. An undefined ocode value results in out-of-bounds access to an array for mapping the opcode between siw internal and RDMA core representation in work completion generation. It resulted in a KASAN BUG report of type 'global-out-of-bounds' during NFSoRDMA testing. This patch further fixes a potential case of a malicious user which may write undefined values for completion queue elements status or opcode, if the CQ is memory mapped to user land. It avoids the same out-of-bounds access to arrays for status and opcode mapping as described above. (CVE-2022-50736)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50736
https://ubuntu.com/security/CVE-2022-50736

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50736

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279752 - Linux Distros Unpatched Vulnerability : CVE-2022-50742
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- misc: ocxl: fix possible refcount leak in afu_ioctl() eventfd_ctx_put need to be called to put the refcount that gotten by eventfd_ctx_fdget when ocxl_irq_set_handler fails. (CVE-2022-50742)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50742
https://ubuntu.com/security/CVE-2022-50742

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50742

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279811 - Linux Distros Unpatched Vulnerability : CVE-2022-50746
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- erofs: validate the extent length for uncompressed pclusters syzkaller reported a KASAN use-after-free:
https://syzkaller.appspot.com/bug?extid=2ae90e873e97f1faf6f2 The referenced fuzzed image actually has two issues: - m_pa == 0 as a non-inlined pcluster; - The logical length is longer than its physical length.
The first issue has already been addressed. This patch addresses the second issue by checking the extent length validity. (CVE-2022-50746)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50746
https://security-tracker.debian.org/tracker/CVE-2022-50746
https://ubuntu.com/security/CVE-2022-50746

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50746

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279767 - Linux Distros Unpatched Vulnerability : CVE-2022-50749
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- acct: fix potential integer overflow in encode_comp_t() The integer overflow is descripted with following codes: > 317 static comp_t encode_comp_t(u64 value) > 318 { > 319 int exp, rnd; ...... > 341 exp <<= MANTSIZE; > 342 exp += value; > 343 return exp; > 344 } Currently comp_t is defined as type of '__u16', but the variable 'exp' is type of 'int', so overflow would happen when variable 'exp' in line 343 is greater than 65535. (CVE-2022-50749)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50749
https://ubuntu.com/security/CVE-2022-50749

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50749

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279839 - Linux Distros Unpatched Vulnerability : CVE-2022-50752
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk() When running chunk-sized reads on disks with badblocks duplicate bio free/puts are observed:
============================================================================= BUG bio-200 (Not tainted):
Object already free ----------------------------------------------------------------------------- Allocated in mempool_alloc_slab+0x17/0x20 age=3 cpu=2 pid=7504 __slab_alloc.constprop.0+0x5a/0xb0 kmem_cache_alloc+0x31e/0x330 mempool_alloc_slab+0x17/0x20 mempool_alloc+0x100/0x2b0 bio_alloc_bioset+0x181/0x460 do_mpage_readpage+0x776/0xd00 mpage_readahead+0x166/0x320 blkdev_readahead+0x15/0x20 read_pages+0x13f/0x5f0 page_cache_ra_unbounded+0x18d/0x220 force_page_cache_ra+0x181/0x1c0 page_cache_sync_ra+0x65/0xb0 filemap_get_pages+0x1df/0xaf0 filemap_read+0x1e1/0x700 blkdev_read_iter+0x1e5/0x330 vfs_read+0x42a/0x570 Freed in mempool_free_slab+0x17/0x20 age=3 cpu=2 pid=7504 kmem_cache_free+0x46d/0x490 mempool_free_slab+0x17/0x20 mempool_free+0x66/0x190 bio_free+0x78/0x90 bio_put+0x100/0x1a0 raid5_make_request+0x2259/0x2450 md_handle_request+0x402/0x600 md_submit_bio+0xd9/0x120 __submit_bio+0x11f/0x1b0 submit_bio_noacct_nocheck+0x204/0x480 submit_bio_noacct+0x32e/0xc70 submit_bio+0x98/0x1a0 mpage_readahead+0x250/0x320 blkdev_readahead+0x15/0x20 read_pages+0x13f/0x5f0 page_cache_ra_unbounded+0x18d/0x220 Slab 0xffffea000481b600 objects=21 used=0 fp=0xffff8881206d8940 flags=0x17ffffc0010201(locked|slab|head|node=0|zone=2|lastcpupid=0x1fffff) CPU: 0 PID: 34525 Comm:
kworker/u24:2 Not tainted 6.0.0-rc2-localyes-265166-gf11c5343fa3f #143 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Workqueue: raid5wq raid5_do_work Call Trace: <TASK>
dump_stack_lvl+0x5a/0x78 dump_stack+0x10/0x16 print_trailer+0x158/0x165 object_err+0x35/0x50 free_debug_processing.cold+0xb7/0xbe __slab_free+0x1ae/0x330 kmem_cache_free+0x46d/0x490 mempool_free_slab+0x17/0x20 mempool_free+0x66/0x190 bio_free+0x78/0x90 bio_put+0x100/0x1a0 mpage_end_io+0x36/0x150 bio_endio+0x2fd/0x360 md_end_io_acct+0x7e/0x90 bio_endio+0x2fd/0x360 handle_failed_stripe+0x960/0xb80 handle_stripe+0x1348/0x3760 handle_active_stripes.constprop.0+0x72a/0xaf0 raid5_do_work+0x177/0x330 process_one_work+0x616/0xb20 worker_thread+0x2bd/0x6f0 kthread+0x179/0x1b0 ret_from_fork+0x22/0x30 </TASK> The double free is caused by an unnecessary bio_put() in the if(is_badblock(...)) error path in raid5_read_one_chunk(). The error path was moved ahead of bio_alloc_clone() in c82aa1b76787c (md/raid5: move checking badblock before clone bio in raid5_read_one_chunk). The previous code checked and freed align_bio which required a bio_put. After the move that is no longer needed as raid_bio is returned to the control of the common io path which performs its own endio resulting in a double free on bad device blocks. (CVE-2022-50752)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50752
https://ubuntu.com/security/CVE-2022-50752

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50752

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279826 - Linux Distros Unpatched Vulnerability : CVE-2022-50756
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nvme-pci: fix mempool alloc size Convert the max size to bytes to match the units of the divisor that calculates the worst-case number of PRP entries. The result is used to determine how many PRP Lists are required. The code was previously rounding this to 1 list, but we can require 2 in the worst case. In that scenario, the driver would corrupt memory beyond the size provided by the mempool. While unlikely to occur (you'd need a 4MB in exactly 127 phys segments on a queue that doesn't support SGLs), this memory corruption has been observed by kfence. (CVE-2022-50756)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50756
https://ubuntu.com/security/CVE-2022-50756

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50756

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279719 - Linux Distros Unpatched Vulnerability : CVE-2022-50764
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipv6/sit: use DEV_STATS_INC() to avoid data-races syzbot/KCSAN reported that multiple cpus are updating dev->stats.tx_error concurrently. This is because sit tunnels are NETIF_F_LLTX, meaning their ndo_start_xmit() is not protected by a spinlock. While original KCSAN report was about tx path, rx path has the same issue. (CVE-2022-50764)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50764
https://security-tracker.debian.org/tracker/CVE-2022-50764
https://ubuntu.com/security/CVE-2022-50764

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50764

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279853 - Linux Distros Unpatched Vulnerability : CVE-2022-50774
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- crypto: qat - fix DMA transfer direction When CONFIG_DMA_API_DEBUG is selected, while running the crypto self test on the QAT crypto algorithms, the function add_dma_entry() reports a warning similar to the one below, saying that overlapping mappings are not supported. This occurs in tests where the input and the output scatter list point to the same buffers (i.e. two different scatter lists which point to the same chunks of memory). The logic that implements the mapping uses the flag DMA_BIDIRECTIONAL for both the input and the output scatter lists which leads to overlapped write mappings. These are not supported by the DMA layer. Fix by specifying the correct DMA transfer directions when mapping buffers. For in-place operations where the input scatter list matches the output scatter list, buffers are mapped once with DMA_BIDIRECTIONAL, otherwise input buffers are mapped using the flag DMA_TO_DEVICE and output buffers are mapped with DMA_FROM_DEVICE. Overlapping a read mapping with a write mapping is a valid case in dma- coherent devices like QAT. The function that frees and unmaps the buffers, qat_alg_free_bufl() has been changed accordingly to the changes to the mapping function. DMA-API: 4xxx 0000:06:00.0: cacheline tracking EEXIST, overlapping mappings aren't supported WARNING: CPU: 53 PID: 4362 at kernel/dma/debug.c:570 add_dma_entry+0x1e9/0x270 ... Call Trace: dma_map_page_attrs+0x82/0x2d0 ? preempt_count_add+0x6a/0xa0 qat_alg_sgl_to_bufl+0x45b/0x990 [intel_qat] qat_alg_aead_dec+0x71/0x250 [intel_qat] crypto_aead_decrypt+0x3d/0x70 test_aead_vec_cfg+0x649/0x810 ? number+0x310/0x3a0 ? vsnprintf+0x2a3/0x550 ? scnprintf+0x42/0x70 ? valid_sg_divisions.constprop.0+0x86/0xa0 ? test_aead_vec+0xdf/0x120 test_aead_vec+0xdf/0x120 alg_test_aead+0x185/0x400 alg_test+0x3d8/0x500 ? crypto_acomp_scomp_free_ctx+0x30/0x30 ? __schedule+0x32a/0x12a0 ? ttwu_queue_wakelist+0xbf/0x110 ?
_raw_spin_unlock_irqrestore+0x23/0x40 ? try_to_wake_up+0x83/0x570 ? _raw_spin_unlock_irqrestore+0x23/0x40 ? __set_cpus_allowed_ptr_locked+0xea/0x1b0 ? crypto_acomp_scomp_free_ctx+0x30/0x30 cryptomgr_test+0x27/0x50 kthread+0xe6/0x110 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 (CVE-2022-50774)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50774
https://ubuntu.com/security/CVE-2022-50774

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50774

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279856 - Linux Distros Unpatched Vulnerability : CVE-2022-50780
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed When the ops_init() interface is invoked to initialize the net, but ops->init() fails, data is released. However, the ptr pointer in net->gen is invalid. In this case, when nfqnl_nf_hook_drop() is invoked to release the net, invalid address access occurs. The process is as follows: setup_net() ops_init() data = kzalloc(...) ---> alloc data net_assign_generic() ---> assign date to ptr in net->gen ... ops->init() ---> failed ... kfree(data);
---> ptr in net->gen is invalid ... ops_exit_list() ... nfqnl_nf_hook_drop() *q = nfnl_queue_pernet(net)
---> q is invalid The following is the Call Trace information: BUG: KASAN: use-after-free in nfqnl_nf_hook_drop+0x264/0x280 Read of size 8 at addr ffff88810396b240 by task ip/15855 Call Trace: <TASK>
dump_stack_lvl+0x8e/0xd1 print_report+0x155/0x454 kasan_report+0xba/0x1f0 nfqnl_nf_hook_drop+0x264/0x280 nf_queue_nf_hook_drop+0x8b/0x1b0 __nf_unregister_net_hook+0x1ae/0x5a0 nf_unregister_net_hooks+0xde/0x130 ops_exit_list+0xb0/0x170 setup_net+0x7ac/0xbd0 copy_net_ns+0x2e6/0x6b0 create_new_namespaces+0x382/0xa50 unshare_nsproxy_namespaces+0xa6/0x1c0 ksys_unshare+0x3a4/0x7e0 __x64_sys_unshare+0x2d/0x40 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK> Allocated by task 15855:
kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0xa1/0xb0 __kmalloc+0x49/0xb0 ops_init+0xe7/0x410 setup_net+0x5aa/0xbd0 copy_net_ns+0x2e6/0x6b0 create_new_namespaces+0x382/0xa50 unshare_nsproxy_namespaces+0xa6/0x1c0 ksys_unshare+0x3a4/0x7e0 __x64_sys_unshare+0x2d/0x40 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Freed by task 15855:
kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40
____kasan_slab_free+0x155/0x1b0 slab_free_freelist_hook+0x11b/0x220 __kmem_cache_free+0xa4/0x360 ops_init+0xb9/0x410 setup_net+0x5aa/0xbd0 copy_net_ns+0x2e6/0x6b0 create_new_namespaces+0x382/0xa50 unshare_nsproxy_namespaces+0xa6/0x1c0 ksys_unshare+0x3a4/0x7e0 __x64_sys_unshare+0x2d/0x40 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 (CVE-2022-50780)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50780
https://ubuntu.com/security/CVE-2022-50780

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50780

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279895 - Linux Distros Unpatched Vulnerability : CVE-2022-50781
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table() In the PP_OD_EDIT_VDDC_CURVE case the input_index variable is capped at 2 but not checked for negative values so it results in an out of bounds read. This value comes from the user via sysfs. (CVE-2022-50781)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50781
https://ubuntu.com/security/CVE-2022-50781

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50781

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279859 - Linux Distros Unpatched Vulnerability : CVE-2022-50782
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: fix bug_on in __es_tree_search caused by bad quota inode We got a issue as fllows:
================================================================== kernel BUG at fs/ext4/extents_status.c:202! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 1 PID: 810 Comm: mount Not tainted 6.1.0-rc1-next-g9631525255e3 #352 RIP: 0010:__es_tree_search.isra.0+0xb8/0xe0 RSP:
0018:ffffc90001227900 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000077512a0f RCX: 0000000000000000 RDX: 0000000000000002 RSI: 0000000000002a10 RDI: ffff8881004cd0c8 RBP: ffff888177512ac8 R08:
47ffffffffffffff R09: 0000000000000001 R10: 0000000000000001 R11: 00000000000679af R12: 0000000000002a10 R13: ffff888177512d88 R14: 0000000077512a10 R15: 0000000000000000 FS:
00007f4bd76dbc40(0000)GS:ffff88842fd00000(0000)knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 CR2: 00005653bf993cf8 CR3: 000000017bfdf000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400 Call Trace: <TASK> ext4_es_cache_extent+0xe2/0x210 ext4_cache_extents+0xd2/0x110 ext4_find_extent+0x5d5/0x8c0 ext4_ext_map_blocks+0x9c/0x1d30 ext4_map_blocks+0x431/0xa50 ext4_getblk+0x82/0x340 ext4_bread+0x14/0x110 ext4_quota_read+0xf0/0x180 v2_read_header+0x24/0x90 v2_check_quota_file+0x2f/0xa0 dquot_load_quota_sb+0x26c/0x760 dquot_load_quota_inode+0xa5/0x190 ext4_enable_quotas+0x14c/0x300 __ext4_fill_super+0x31cc/0x32c0 ext4_fill_super+0x115/0x2d0 get_tree_bdev+0x1d2/0x360 ext4_get_tree+0x19/0x30 vfs_get_tree+0x26/0xe0 path_mount+0x81d/0xfc0 do_mount+0x8d/0xc0 __x64_sys_mount+0xc0/0x160 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK>
================================================================== Above issue may happen as follows:
------------------------------------- ext4_fill_super ext4_orphan_cleanup ext4_enable_quotas ext4_quota_enable ext4_iget --> get error inode <5> ext4_ext_check_inode --> Wrong imode makes it escape inspection make_bad_inode(inode) --> EXT4_BOOT_LOADER_INO set imode dquot_load_quota_inode vfs_setup_quota_inode --> check pass dquot_load_quota_sb v2_check_quota_file v2_read_header ext4_quota_read ext4_bread ext4_getblk ext4_map_blocks ext4_ext_map_blocks ext4_find_extent ext4_cache_extents ext4_es_cache_extent __es_tree_search.isra.0 ext4_es_end --> Wrong extents trigger BUG_ON In the above issue, s_usr_quota_inum is set to 5, but inode<5> contains incorrect imode and disordered extents. Because 5 is EXT4_BOOT_LOADER_INO, the ext4_ext_check_inode check in the ext4_iget function can be bypassed, finally, the extents that are not checked trigger the BUG_ON in the
__es_tree_search function. To solve this issue, check whether the inode is bad_inode in vfs_setup_quota_inode(). (CVE-2022-50782)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50782
https://ubuntu.com/security/CVE-2022-50782

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50782

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281532 - Linux Distros Unpatched Vulnerability : CVE-2022-50811
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: erofs: fix missing unmap if z_erofs_get_extent_compressedlen() fails Otherwise, meta buffers could be leaked. (CVE-2022-50811)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50811

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50811

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280792 - Linux Distros Unpatched Vulnerability : CVE-2022-50820
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: perf/arm_dmc620: Fix hotplug callback leak in dmc620_pmu_init() dmc620_pmu_init() won't remove the callback added by cpuhp_setup_state_multi() when platform_driver_register() failed. Remove the callback by cpuhp_remove_multi_state() in fail path.
Similar to the handling of arm_ccn_init() in commit 26242b330093 (bus: arm-ccn: Prevent hotplug callback leak) (CVE-2022-50820)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50820

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50820

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281468 - Linux Distros Unpatched Vulnerability : CVE-2022-50823
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: clk: tegra: Fix refcount leak in tegra114_clock_init of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.
(CVE-2022-50823)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50823

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50823

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280811 - Linux Distros Unpatched Vulnerability : CVE-2022-50825
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: usb: typec: wusb3801: fix fwnode refcount leak in wusb3801_probe() I got the following report while doing fault injection test: OF: ERROR:
memory leak, expected refcount 1 instead of 4, of_node_get()/of_node_put() unbalanced - destroy cset entry: attach overlay node /i2c/tcpc@60/connector If wusb3801_hw_init() fails, fwnode_handle_put() needs be called to avoid refcount leak. (CVE-2022-50825)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50825

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.7 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50825

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280812 - Linux Distros Unpatched Vulnerability : CVE-2022-50839
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: jbd2: fix potential buffer head reference count leak As in 'jbd2_fc_wait_bufs' if buffer isn't uptodate, will return -EIO without update 'journal->j_fc_off'. But 'jbd2_fc_release_bufs' will release buffer head from j_fc_off - 1' if 'bh' is NULL will terminal release which will lead to buffer head buffer head reference count leak. To solve above issue, update 'journal->j_fc_off' before return -EIO. (CVE-2022-50839)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50839

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50839

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281554 - Linux Distros Unpatched Vulnerability : CVE-2022-50845
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ext4: fix inode leak in ext4_xattr_inode_create() on an error path There is issue as follows when do setxattr with inject fault:
[localhost]# fsck.ext4 -fn /dev/sda e2fsck 1.46.6-rc1 (12-Sep-2022) Pass 1: Checking inodes, blocks, and sizes Pass 2: Checking directory structure Pass 3: Checking directory connectivity Pass 4: Checking reference counts Unattached zero-length inode 15. Clear? no Unattached inode 15 Connect to /lost+found? no Pass 5: Checking group summary information /dev/sda: ********** WARNING: Filesystem still has errors
********** /dev/sda: 15/655360 files (0.0% non-contiguous), 66755/2621440 blocks This occurs in 'ext4_xattr_inode_create()'. If 'ext4_mark_inode_dirty()' fails, dropping i_nlink of the inode is needed.
Or will lead to inode leak. (CVE-2022-50845)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50845

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.7 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50845

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280781 - Linux Distros Unpatched Vulnerability : CVE-2022-50847
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/bridge: it6505: Initialize AUX channel in it6505_i2c_probe During device boot, the HPD interrupt could be triggered before the DRM subsystem registers it6505 as a DRM bridge. In such cases, the driver tries to access AUX channel and causes NULL pointer dereference. Initializing the AUX channel earlier to prevent such error.
(CVE-2022-50847)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50847

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.7 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50847

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280783 - Linux Distros Unpatched Vulnerability : CVE-2022-50850
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: scsi: ipr: Fix WARNING in ipr_init() ipr_init() will not call unregister_reboot_notifier() when pci_register_driver() fails, which causes a WARNING. Call unregister_reboot_notifier() when pci_register_driver() fails. notifier callback ipr_halt [ipr] already registered WARNING: CPU: 3 PID: 299 at kernel/notifier.c:29 notifier_chain_register+0x16d/0x230 Modules linked in: ipr(+) xhci_pci_renesas xhci_hcd ehci_hcd usbcore led_class gpu_sched drm_buddy video wmi drm_ttm_helper ttm drm_display_helper drm_kms_helper drm drm_panel_orientation_quirks agpgart cfbft CPU: 3 PID: 299 Comm: modprobe Tainted: G W 6.1.0-rc1-00190-g39508d23b672-dirty #332 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:notifier_chain_register+0x16d/0x230 Call Trace: <TASK> __blocking_notifier_chain_register+0x73/0xb0 ipr_init+0x30/0x1000 [ipr] do_one_initcall+0xdb/0x480 do_init_module+0x1cf/0x680 load_module+0x6a50/0x70a0
__do_sys_finit_module+0x12f/0x1c0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd (CVE-2022-50850)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50850

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50850

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280815 - Linux Distros Unpatched Vulnerability : CVE-2022-50853
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix a credential leak in
_nfs4_discover_trunking() (CVE-2022-50853)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50853

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.7 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50853

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280800 - Linux Distros Unpatched Vulnerability : CVE-2022-50855
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf: prevent leak of lsm program after failed attach In [0], we added the ability to bpf_prog_attach LSM programs to cgroups, but in our validation to make sure the prog is meant to be attached to BPF_LSM_CGROUP, we return too early if the check fails. This results in lack of decrementing prog's refcnt (through bpf_prog_put) leaving the LSM program alive past the point of the expected lifecycle. This fix allows for the decrement to take place.
[0] https://lore.kernel.org/all/20220628174314.1216643-4-sdf@google.com/ (CVE-2022-50855)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50855

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50855

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280790 - Linux Distros Unpatched Vulnerability : CVE-2022-50856
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cifs: Fix xid leak in cifs_ses_add_channel() Before return, should free the xid, otherwise, the xid will be leaked.
(CVE-2022-50856)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50856

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50856

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281552 - Linux Distros Unpatched Vulnerability : CVE-2022-50861
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: NFSD: Finish converting the NFSv2 GETACL result encoder The xdr_stream conversion inadvertently left some code that set the page_len of the send buffer. The XDR stream encoders should handle this automatically now. This oversight adds garbage past the end of the Reply message. Clients typically ignore the garbage, but NFSD does not need to send it, as it leaks stale memory contents onto the wire. (CVE-2022-50861)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50861

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
8.4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50861

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281558 - Linux Distros Unpatched Vulnerability : CVE-2022-50868
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: hwrng: amd - Fix PCI device refcount leak for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it will increase the reference count for the returned pci_dev and also decrease the reference count for the input pci_dev @from if it is not NULL. If we break for_each_pci_dev() loop with pdev not NULL, we need to call pci_dev_put() to decrease the reference count. Add the missing pci_dev_put() for the normal and error path. (CVE-2022-50868)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50868

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50868

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281498 - Linux Distros Unpatched Vulnerability : CVE-2022-50870
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: avoid device tree lookups in rtas_os_term() rtas_os_term() is called during panic. Its behavior depends on a couple of conditions in the /rtas node of the device tree, the traversal of which entails locking and local IRQ state changes. If the kernel panics while devtree_lock is held, rtas_os_term() as currently written could hang. Instead of discovering the relevant characteristics at panic time, cache them in file-static variables at boot. Note the lookup for ibm,extended-os-term is converted to of_property_read_bool() since it is a boolean property, not an RTAS function token. [mpe: Incorporate suggested change from Nick] (CVE-2022-50870)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50870

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50870

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281508 - Linux Distros Unpatched Vulnerability : CVE-2022-50873
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: vdpa/vp_vdpa: fix kfree a wrong pointer in vp_vdpa_remove In vp_vdpa_remove(), the code kfree(&vp_vdpa_mgtdev->mgtdev.id_table) uses a reference of pointer as the argument of kfree, which is the wrong pointer and then may hit crash like this: Unable to handle kernel paging request at virtual address 00ffff003363e30c Internal error: Oops:
96000004 [#1] SMP Call trace: rb_next+0x20/0x5c ext4_readdir+0x494/0x5c4 [ext4] iterate_dir+0x168/0x1b4
__se_sys_getdents64+0x68/0x170 __arm64_sys_getdents64+0x24/0x30 el0_svc_common.constprop.0+0x7c/0x1bc do_el0_svc+0x2c/0x94 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Code: 54000220 f9400441 b4000161 aa0103e0 (f9400821) SMP: stopping secondary CPUs Starting crashdump kernel...
(CVE-2022-50873)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50873

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50873

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281503 - Linux Distros Unpatched Vulnerability : CVE-2022-50880
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() When peer delete failed in a disconnect operation, use-after-free detected by KFENCE in below log. It is because for each vdev_id and address, it has only one struct ath10k_peer, it is allocated in ath10k_peer_map_event(). When connected to an AP, it has more than one HTT_T2H_MSG_TYPE_PEER_MAP reported from firmware, then the array peer_map of struct ath10k will be set muti-elements to the same ath10k_peer in ath10k_peer_map_event(). When peer delete failed in ath10k_sta_state(), the ath10k_peer will be free for the 1st peer id in array peer_map of struct ath10k, and then use-after-free happened for the 2nd peer id because they map to the same ath10k_peer. And clean up all peers in array peer_map for the ath10k_peer, then user-after-free disappeared peer map event log: [ 306.911021] wlan0: authenticate with b0:2a:43:e6:75:0e [ 306.957187] ath10k_pci 0000:01:00.0: mac vdev 0 peer create b0:2a:43:e6:75:0e (new sta) sta 1 / 32 peer 1 / 33 [ 306.957395] ath10k_pci 0000:01:00.0: htt peer map vdev 0 peer b0:2a:43:e6:75:0e id 246 [ 306.957404] ath10k_pci 0000:01:00.0: htt peer map vdev 0 peer b0:2a:43:e6:75:0e id 198 [ 306.986924] ath10k_pci 0000:01:00.0: htt peer map vdev 0 peer b0:2a:43:e6:75:0e id 166 peer unmap event log: [ 435.715691] wlan0: deauthenticating from b0:2a:43:e6:75:0e by local choice (Reason: 3=DEAUTH_LEAVING) [ 435.716802] ath10k_pci 0000:01:00.0: mac vdev 0 peer delete b0:2a:43:e6:75:0e sta ffff990e0e9c2b50 (sta gone) [ 435.717177] ath10k_pci 0000:01:00.0: htt peer unmap vdev 0 peer b0:2a:43:e6:75:0e id 246 [ 435.717186] ath10k_pci 0000:01:00.0:
htt peer unmap vdev 0 peer b0:2a:43:e6:75:0e id 198 [ 435.717193] ath10k_pci 0000:01:00.0: htt peer unmap vdev 0 peer b0:2a:43:e6:75:0e id 166 use-after-free log: [21705.888627] wlan0: deauthenticating from d0:76:8f:82:be:75 by local choice (Reason: 3=DEAUTH_LEAVING) [21713.799910] ath10k_pci 0000:01:00.0:
failed to delete peer d0:76:8f:82:be:75 for vdev 0: -110 [21713.799925] ath10k_pci 0000:01:00.0: found sta peer d0:76:8f:82:be:75 (ptr 0000000000000000 id 102) entry on vdev 0 after it was supposedly removed [21713.799968] ================================================================== [21713.799991] BUG:
KFENCE: use-after-free read in ath10k_sta_state+0x265/0xb8a [ath10k_core] [21713.799991] [21713.799997] Use-after-free read at 0x00000000abe1c75e (in kfence-#69): [21713.800010] ath10k_sta_state+0x265/0xb8a [ath10k_core] [21713.800041] drv_sta_state+0x115/0x677 [mac80211] [21713.800059]
__sta_info_destroy_part2+0xb1/0x133 [mac80211] [21713.800076] __sta_info_flush+0x11d/0x162 [mac80211] [21713.800093] ieee80211_set_disassoc+0x12d/0x2f4 [mac80211] [21713.800110] ieee80211_mgd_deauth+0x26c/0x29b [mac80211] [21713.800137] cfg80211_mlme_deauth+0x13f/0x1bb [cfg80211] [21713.800153] nl80211_deauthenticate+0xf8/0x121 [cfg80211] [21713.800161] genl_rcv_msg+0x38e/0x3be [21713.800166] netlink_rcv_skb+0x89/0xf7 [21713.800171] genl_rcv+0x28/0x36 [21713.800176] netlink_unicast+0x179/0x24b [21713.800181] netlink_sendmsg+0x3a0/0x40e [21713.800187] sock_sendmsg+0x72/0x76 [21713.800192] ____sys_sendmsg+0x16d/0x1e3 [21713.800196] ___sys_sendmsg+0x95/0xd1 [21713.800200] __sys_sendmsg+0x85/0xbf [21713.800205] do_syscall_64+0x43/0x55 [21713.800210] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [21713.800213] [21713.800219] kfence-#69:
0x000000009149b0d5-0x000000004c0697fb, size=1064, cache=kmalloc-2k [21713.800219] [21713.800224] allocated by task 13 on cpu 0 at 21705.501373s: [21713.800241] ath10k_peer_map_event+0x7e/0x154 [ath10k_core] [21713.800254] ath10k_htt_t2h_msg_handler+0x586/0x1039 [ath10k_core] [21713.800265] ath10k_htt_htc_t2h_msg_handler+0x12/0x28 [ath10k_core] [21713.800277] ath10k_htc_rx_completion_handler+0x14c/0x1b5 [ath10k_core] [21713.800283] ath10k_pci_process_rx_cb+0x195/0x1d ---truncated--- (CVE-2022-50880)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50880

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.7 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50880

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281541 - Linux Distros Unpatched Vulnerability : CVE-2022-50887
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() I got the the following report: OF: ERROR: memory leak, expected refcount 1 instead of 2, of_node_get()/of_node_put() unbalanced - destroy cset entry: attach overlay node /i2c/pmic@62/regulators/exten In of_get_regulator(), the node is returned from of_parse_phandle() with refcount incremented, after using it, of_node_put() need be called. (CVE-2022-50887)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50887

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50887

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281475 - Linux Distros Unpatched Vulnerability : CVE-2022-50889
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: dm integrity: Fix UAF in dm_integrity_dtr() Dm_integrity also has the same UAF problem when dm_resume() and dm_destroy() are concurrent. Therefore, cancelling timer again in dm_integrity_dtr(). (CVE-2022-50889)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50889

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50889

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225854 - Linux Distros Unpatched Vulnerability : CVE-2023-0045
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to the prctl syscall. The patch that added the support for the conditional mitigation via prctl (ib_prctl_set) dates back to the kernel 4.9.176. We recommend upgrading past commit a664ec9158eeddd75121d39c9a0758016097fa96 (CVE-2023-0045)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-0045
https://ubuntu.com/security/CVE-2023-0045

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0014
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.9 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2023-0045

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227100 - Linux Distros Unpatched Vulnerability : CVE-2023-0049
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. (CVE-2023-0049)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-0049
https://security-tracker.debian.org/tracker/CVE-2023-0049

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-0049

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
225947 - Linux Distros Unpatched Vulnerability : CVE-2023-0051
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. (CVE-2023-0051)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-0051
https://security-tracker.debian.org/tracker/CVE-2023-0051

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-0051

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
226728 - Linux Distros Unpatched Vulnerability : CVE-2023-0054
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. (CVE-2023-0054)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-0054

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-0054

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
226056 - Linux Distros Unpatched Vulnerability : CVE-2023-0215
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7. Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream. The OpenSSL cms and smime command line applications are similarly affected. (CVE-2023-0215)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-0215
https://ubuntu.com/security/CVE-2023-0215

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0056
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-0215

Plugin Information
Published: 2025/03/05, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- compat-openssl11
- shim-x64
227353 - Linux Distros Unpatched Vulnerability : CVE-2023-0288
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. (CVE-2023-0288)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-0288
https://security-tracker.debian.org/tracker/CVE-2023-0288

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-0288

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
226131 - Linux Distros Unpatched Vulnerability : CVE-2023-0433
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225. (CVE-2023-0433)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-0433
https://security-tracker.debian.org/tracker/CVE-2023-0433

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-0433

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
226711 - Linux Distros Unpatched Vulnerability : CVE-2023-0464
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. (CVE-2023-0464)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-0464
https://ubuntu.com/security/CVE-2023-0464

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0086
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-0464

Plugin Information
Published: 2025/03/05, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- compat-openssl11
- shim-x64
227275 - Linux Distros Unpatched Vulnerability : CVE-2023-0512
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Divide By Zero in GitHub repository vim/vim prior to 9.0.1247. (CVE-2023-0512)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-0512
https://security-tracker.debian.org/tracker/CVE-2023-0512

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-0512

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
227074 - Linux Distros Unpatched Vulnerability : CVE-2023-1118
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate their privileges on the system. (CVE-2023-1118)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-1118
https://ubuntu.com/security/CVE-2023-1118

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0001
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-1118

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227218 - Linux Distros Unpatched Vulnerability : CVE-2023-1127
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Divide By Zero in GitHub repository vim/vim prior to 9.0.1367. (CVE-2023-1127)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-1127

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-1127

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
227432 - Linux Distros Unpatched Vulnerability : CVE-2023-1579
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Heap based buffer overflow in binutils-gdb/bfd/libbfd.c in bfd_getl64. (CVE-2023-1579)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-1579
https://security-tracker.debian.org/tracker/CVE-2023-1579

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.4 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2023-1579

Plugin Information
Published: 2025/03/05, Modified: 2025/11/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gcc-toolset-12-binutils
- gcc-toolset-12-binutils-devel
- gcc-toolset-12-binutils-gold
226591 - Linux Distros Unpatched Vulnerability : CVE-2023-24607
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3. (CVE-2023-24607)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-24607
https://ubuntu.com/security/CVE-2023-24607

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0192
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-24607

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- qt5-srpm-macros
226258 - Linux Distros Unpatched Vulnerability : CVE-2023-25434
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesBytes() at /libtiff/tools/tiffcrop.c:3215. (CVE-2023-25434)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-25434

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.9 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0029
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-25434

Plugin Information
Published: 2025/03/05, Modified: 2025/09/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libtiff
- libtiff-devel
227396 - Linux Distros Unpatched Vulnerability : CVE-2023-2610
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. (CVE-2023-2610)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-2610

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0014
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-2610

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
226922 - Linux Distros Unpatched Vulnerability : CVE-2023-32636
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499. (CVE-2023-32636)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-32636

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0035
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-32636

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- glib2
- glib2-devel
227109 - Linux Distros Unpatched Vulnerability : CVE-2023-39321
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Processing an incomplete post-handshake message for a QUIC connection can cause a panic. (CVE-2023-39321)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-39321

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.012
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-39321

Plugin Information
Published: 2025/03/05, Modified: 2025/08/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- conmon
226095 - Linux Distros Unpatched Vulnerability : CVE-2023-39322
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size. (CVE-2023-39322)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-39322

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0117
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-39322

Plugin Information
Published: 2025/03/05, Modified: 2025/08/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- conmon
226574 - Linux Distros Unpatched Vulnerability : CVE-2023-4156
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information. (CVE-2023-4156)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-4156
https://security-tracker.debian.org/tracker/CVE-2023-4156

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0009
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-4156

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gawk
- gawk-all-langpacks
226870 - Linux Distros Unpatched Vulnerability : CVE-2023-44488
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding. (CVE-2023-44488)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-44488
https://ubuntu.com/security/CVE-2023-44488

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0309
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-44488

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
227283 - Linux Distros Unpatched Vulnerability : CVE-2023-4504
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023. (CVE-2023-4504)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-4504
https://ubuntu.com/security/CVE-2023-4504

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.3 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0018
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-4504

Plugin Information
Published: 2025/03/05, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- cups
- cups-client
- cups-filesystem
- cups-ipptool
- cups-libs
225825 - Linux Distros Unpatched Vulnerability : CVE-2023-46751
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through 10.02.0 allows remote attackers to crash the application via a dangling pointer. (CVE-2023-46751)
Note that Nessus relies on the presence of the package as reported by the vendor.
Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0097
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-46751

Plugin Information
Published: 2025/03/05, Modified: 2025/03/05
Plugin Output

## tcp/0

Remote package installed : ghostscript-9.54.0-17.el9_4
226578 - Linux Distros Unpatched Vulnerability : CVE-2023-4734
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846. (CVE-2023-4734)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-4734
https://security-tracker.debian.org/tracker/CVE-2023-4734

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0013
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-4734

Plugin Information
Published: 2025/03/05, Modified: 2025/10/08
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
227411 - Linux Distros Unpatched Vulnerability : CVE-2023-4735
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847. (CVE-2023-4735)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-4735
https://security-tracker.debian.org/tracker/CVE-2023-4735

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0017
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-4735

Plugin Information
Published: 2025/03/05, Modified: 2025/09/06
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
226764 - Linux Distros Unpatched Vulnerability : CVE-2023-4738
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848. (CVE-2023-4738)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-4738

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0013
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-4738

Plugin Information
Published: 2025/03/05, Modified: 2025/10/08
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
257908 - Linux Distros Unpatched Vulnerability : CVE-2023-47466
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is the only valid chunk. (CVE-2023-47466)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-47466
https://security-tracker.debian.org/tracker/CVE-2023-47466
https://ubuntu.com/security/CVE-2023-47466

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0001
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-47466

Plugin Information
Published: 2025/08/27, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- taglib
226036 - Linux Distros Unpatched Vulnerability : CVE-2023-4751
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1331. (CVE-2023-4751)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-4751
https://security-tracker.debian.org/tracker/CVE-2023-4751

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0013
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-4751

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
226464 - Linux Distros Unpatched Vulnerability : CVE-2023-4781
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873. (CVE-2023-4781)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-4781

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0017
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-4781

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
226914 - Linux Distros Unpatched Vulnerability : CVE-2023-48161
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information via the DumpSCreen2RGB function in gif2rgb.c (CVE-2023-48161)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-48161
https://security-tracker.debian.org/tracker/CVE-2023-48161
https://ubuntu.com/security/CVE-2023-48161

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0005
CVSS v2.0 Base Score
3.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2023-48161

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- giflib
- java-11-openjdk
- java-11-openjdk-demo
- java-11-openjdk-devel
- java-11-openjdk-headless
- java-11-openjdk-javadoc
- java-11-openjdk-javadoc-zip
- java-11-openjdk-jmods
- java-11-openjdk-src
- java-11-openjdk-static-libs
227195 - Linux Distros Unpatched Vulnerability : CVE-2023-51767
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co- location in which the attacker has user privileges. NOTE: this is disputed by the Supplier, who states we do not consider it to be the application's responsibility to defend against platform architectural weaknesses. (CVE-2023-51767)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-51767
https://ubuntu.com/security/CVE-2023-51767

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
7.4
EPSS Score
0.0007
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-51767

Plugin Information
Published: 2025/03/05, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- openssh
- openssh-clients
- openssh-server
225840 - Linux Distros Unpatched Vulnerability : CVE-2023-5217
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2023-5217)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-5217
https://security-tracker.debian.org/tracker/CVE-2023-5217
https://ubuntu.com/security/CVE-2023-5217

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.6 (CVSS:3.0/E:F/RL:U/RC:C)
VPR Score
8.4
EPSS Score
0.0751
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.5 (CVSS2#E:F/RL:U/RC:C)
References

CVE | CVE-2023-5217
XREF | CISA-KNOWN-EXPLOITED:2023/10/23

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
227260 - Linux Distros Unpatched Vulnerability : CVE-2023-52424
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The IEEE 802.11 standard sometimes enables an adversary to trick a victim into connecting to an unintended or untrusted network with Home WEP, Home WPA3 SAE-loop. Enterprise 802.1X/EAP, Mesh AMPE, or FILS, aka an SSID Confusion issue. This occurs because the SSID is not always used to derive the pairwise master key or session keys, and because there is not a protected exchange of an SSID during a 4-way handshake.
(CVE-2023-52424)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52424
https://ubuntu.com/security/CVE-2023-52424

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.4 (CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0023
CVSS v2.0 Base Score
2.9 (CVSS2#AV:A/AC:M/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
2.5 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52424

Plugin Information
Published: 2025/03/05, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- iwl100-firmware
- iwl1000-firmware
- iwl105-firmware
- iwl135-firmware
- iwl2000-firmware
- iwl2030-firmware
- iwl3160-firmware
- iwl5000-firmware
- iwl5150-firmware
- iwl6000g2a-firmware
- iwl6000g2b-firmware
- iwl6050-firmware
- iwl7260-firmware
- libertas-sd8787-firmware
- linux-firmware
- linux-firmware-whence
- netronome-firmware
- wpa_supplicant
226796 - Linux Distros Unpatched Vulnerability : CVE-2023-52425
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52425
https://security-tracker.debian.org/tracker/CVE-2023-52425
https://ubuntu.com/security/CVE-2023-52425

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0205
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2023-52425

Plugin Information
Published: 2025/03/05, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
226814 - Linux Distros Unpatched Vulnerability : CVE-2023-52452
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Fix accesses to uninit stack slots Privileged programs are supposed to be able to read uninitialized stack memory (ever since 6715df8d5) but, before this patch, these accesses were permitted inconsistently.
In particular, accesses were permitted above state->allocated_stack, but not below it. In other words, if the stack was already large enough, the access was permitted, but otherwise the access was rejected instead of being allowed to grow the stack. This undesired rejection was happening in two places: - in check_stack_slot_within_bounds() - in check_stack_range_initialized() This patch arranges for these accesses to be permitted. A bunch of tests that were relying on the old rejection had to change; all of them were changed to add also run unprivileged, in which case the old behavior persists. One tests couldn't be updated - global_func16 - because it can't run unprivileged for other reasons. This patch also fixes the tracking of the stack size for variable-offset reads. This second fix is bundled in the same commit as the first one because they're inter-related. Before this patch, writes to the stack using registers containing a variable offset (as opposed to registers with fixed, known values) were not properly contributing to the function's needed stack size. As a result, it was possible for a program to verify, but then to attempt to read out-of-bounds data at runtime because a too small stack had been allocated for it. Each function tracks the size of the stack it needs in bpf_subprog_info.stack_depth, which is maintained by update_stack_depth(). For regular memory accesses, check_mem_access() was calling update_state_depth() but it was passing in only the fixed part of the offset register, ignoring the variable offset. This was incorrect; the minimum possible value of that register should be used instead.
This tracking is now fixed by centralizing the tracking of stack size in grow_stack_state(), and by lifting the calls to grow_stack_state() to check_stack_access_within_bounds() as suggested by Andrii. The code is now simpler and more convincingly tracks the correct maximum stack size.
check_stack_range_initialized() can now rely on enough stack having been allocated for the access; this helps with the fix for the first issue. A few tests were changed to also check the stack depth computation. The one that fails without this patch is verifier_var_off:stack_write_priv_vs_unpriv.
(CVE-2023-52452)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52452
https://security-tracker.debian.org/tracker/CVE-2023-52452
https://ubuntu.com/security/CVE-2023-52452

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0008
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52452

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227199 - Linux Distros Unpatched Vulnerability : CVE-2023-52468
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: class: fix use-after-free in class_register() The lock_class_key is still registered and can be found in lock_keys_hash hlist after subsys_private is freed in error handler path.A task who iterate over the lock_keys_hash later may cause use-after-free.So fix that up and unregister the lock_class_key before kfree(cp). On our platform, a driver fails to kset_register because of creating duplicate filename '/class/xxx'.With Kasan enabled, it prints a invalid-access bug report. KASAN bug report: BUG: KASAN: invalid-access in lockdep_register_key+0x19c/0x1bc Write of size 8 at addr 15ffff808b8c0368 by task modprobe/252 Pointer tag: [15], memory tag: [fe] CPU: 7 PID: 252 Comm: modprobe Tainted: G W 6.6.0-mainline-maybe-dirty #1 Call trace: dump_backtrace+0x1b0/0x1e4 show_stack+0x2c/0x40 dump_stack_lvl+0xac/0xe0 print_report+0x18c/0x4d8 kasan_report+0xe8/0x148 __hwasan_store8_noabort+0x88/0x98 lockdep_register_key+0x19c/0x1bc class_register+0x94/0x1ec init_module+0xbc/0xf48 [rfkill] do_one_initcall+0x17c/0x72c do_init_module+0x19c/0x3f8 ... Memory state around the buggy address: ffffff808b8c0100: 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a ffffff808b8c0200: 8a 8a 8a 8a 8a 8a 8a 8a fe fe fe fe fe fe fe fe >ffffff808b8c0300: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe ^ ffffff808b8c0400: 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 As CONFIG_KASAN_GENERIC is not set, Kasan reports invalid-access not use- after-free here.In this case, modprobe is manipulating the corrupted lock_keys_hash hlish where lock_class_key is already freed before. It's worth noting that this only can happen if lockdep is enabled, which is not true for normal system. (CVE-2023-52468)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52468
https://ubuntu.com/security/CVE-2023-52468

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0009
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52468

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248974 - Linux Distros Unpatched Vulnerability : CVE-2023-52519
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit The EHL (Elkhart Lake) based platforms provide a OOB (Out of band) service, which allows to wakup device when the system is in S5 (Soft-Off state). This OOB service can be enabled/disabled from BIOS settings. When enabled, the ISH device gets PME wake capability. To enable PME wakeup, driver also needs to enable ACPI GPE bit. On resume, BIOS will clear the wakeup bit. So driver need to re-enable it in resume function to keep the next wakeup capability. But this BIOS clearing of wakeup bit doesn't decrement internal OS GPE reference count, so this reenabling on every resume will cause reference count to overflow. So first disable and reenable ACPI GPE bit using acpi_disable_gpe(). (CVE-2023-52519)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52519
https://ubuntu.com/security/CVE-2023-52519

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0009
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52519

Plugin Information
Published: 2025/08/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247433 - Linux Distros Unpatched Vulnerability : CVE-2023-52598
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- s390/ptrace: handle setting of fpc register correctly If the content of the floating point control (fpc) register of a traced process is modified with the ptrace interface the new value is tested for validity by temporarily loading it into the fpc register. This may lead to corruption of the fpc register of the tracing process: if an interrupt happens while the value is temporarily loaded into the fpc register, and within interrupt context floating point or vector registers are used, the current fp/vx registers are saved with save_fpu_regs() assuming they belong to user space and will be loaded into fp/vx registers when returning to user space. test_fp_ctl() restores the original user space fpc register value, however it will be discarded, when returning to user space. In result the tracer will incorrectly continue to run with the value that was supposed to be used for the traced process. Fix this by saving fpu register contents with save_fpu_regs() before using test_fp_ctl(). (CVE-2023-52598)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52598
https://ubuntu.com/security/CVE-2023-52598

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0009
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52598

Plugin Information
Published: 2025/08/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226860 - Linux Distros Unpatched Vulnerability : CVE-2023-52739
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: Fix page corruption caused by racy check in __free_pages When we upgraded our kernel, we started seeing some page corruption like the following consistently: BUG: Bad page state in process ganesha.nfsd pfn:1304ca page:0000000022261c55 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0 pfn:0x1304ca flags: 0x17ffffc0000000() raw:
0017ffffc0000000 ffff8a513ffd4c98 ffffeee24b35ec08 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffff7f 0000000000000000 page dumped because: nonzero mapcount CPU: 0 PID: 15567 Comm:
ganesha.nfsd Kdump: loaded Tainted: P B O 5.10.158-1.nutanix.20221209.el7.x86_64 #1 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/05/2016 Call Trace:
dump_stack+0x74/0x96 bad_page.cold+0x63/0x94 check_new_page_bad+0x6d/0x80 rmqueue+0x46e/0x970 get_page_from_freelist+0xcb/0x3f0 ? _cond_resched+0x19/0x40 __alloc_pages_nodemask+0x164/0x300 alloc_pages_current+0x87/0xf0 skb_page_frag_refill+0x84/0x110 ... Sometimes, it would also show up as corruption in the free list pointer and cause crashes. After bisecting the issue, we found the issue started from commit e320d3012d25 (mm/page_alloc.c: fix freeing non-compound pages): if (put_page_testzero(page)) free_the_page(page, order); else if (!PageHead(page)) while (order-- > 0) free_the_page(page + (1 << order), order); So the problem is the check PageHead is racy because at this point we already dropped our reference to the page. So even if we came in with compound page, the page can already be freed and PageHead can return false and we will end up freeing all the tail pages causing double free. (CVE-2023-52739)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52739
https://ubuntu.com/security/CVE-2023-52739

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.001
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52739

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227397 - Linux Distros Unpatched Vulnerability : CVE-2023-52752
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smb: client: fix use-after-free bug in cifs_debug_data_proc_show() Skip SMB sessions that are being teared down (e.g. @ses->ses_status == SES_EXITING) in cifs_debug_data_proc_show() to avoid use-after-free in @ses. This fixes the following GPF when reading from /proc/fs/cifs/DebugData while mounting and umounting [ 816.251274] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6d81: 0000 [#1] PREEMPT SMP NOPTI ... [ 816.260138] Call Trace: [ 816.260329] <TASK> [ 816.260499] ? die_addr+0x36/0x90 [ 816.260762] ? exc_general_protection+0x1b3/0x410 [ 816.261126] ? asm_exc_general_protection+0x26/0x30 [ 816.261502] ? cifs_debug_tcon+0xbd/0x240 [cifs] [ 816.261878] ? cifs_debug_tcon+0xab/0x240 [cifs] [ 816.262249] cifs_debug_data_proc_show+0x516/0xdb0 [cifs] [ 816.262689] ? seq_read_iter+0x379/0x470 [ 816.262995] seq_read_iter+0x118/0x470 [ 816.263291] proc_reg_read_iter+0x53/0x90 [ 816.263596] ? srso_alias_return_thunk+0x5/0x7f [ 816.263945] vfs_read+0x201/0x350 [ 816.264211] ksys_read+0x75/0x100 [ 816.264472] do_syscall_64+0x3f/0x90 [ 816.264750] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 816.265135] RIP: 0033:0x7fd5e669d381 (CVE-2023-52752)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52752
https://ubuntu.com/security/CVE-2023-52752

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0007
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52752

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226061 - Linux Distros Unpatched Vulnerability : CVE-2023-52764
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- media: gspca: cpia1: shift-out-of-bounds in set_flicker Syzkaller reported the following issue: UBSAN:
shift-out-of-bounds in drivers/media/usb/gspca/cpia1.c:1031:27 shift exponent 245 is too large for 32-bit type 'int' When the value of the variable sd->params.exposure.gain exceeds the number of bits in an integer, a shift-out-of-bounds error is reported. It is triggered because the variable currentexp cannot be left-shifted by more than the number of bits in an integer. In order to avoid invalid range during left-shift, the conditional expression is added. (CVE-2023-52764)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52764
https://ubuntu.com/security/CVE-2023-52764

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0037
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52764

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226282 - Linux Distros Unpatched Vulnerability : CVE-2023-52794
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: thermal: intel: powerclamp: fix mismatch in get function for max_idle KASAN reported this [ 444.853098] BUG: KASAN: global-out-of-bounds in param_get_int+0x77/0x90 [ 444.853111] Read of size 4 at addr ffffffffc16c9220 by task cat/2105 ... [ 444.853442] The buggy address belongs to the variable: [ 444.853443] max_idle+0x0/0xffffffffffffcde0 [intel_powerclamp] There is a mismatch between the param_get_int and the definition of max_idle. Replacing param_get_int with param_get_byte resolves this issue. (CVE-2023-52794)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52794
https://ubuntu.com/security/CVE-2023-52794

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.2
EPSS Score
0.0008
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52794

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226053 - Linux Distros Unpatched Vulnerability : CVE-2023-52795
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: fix use after free in vhost_vdpa_probe() The put_device() calls vhost_vdpa_release_dev() which calls ida_simple_remove() and frees v. So this call to ida_simple_remove() is a use after free and a double free. (CVE-2023-52795)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52795
https://ubuntu.com/security/CVE-2023-52795

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0009
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52795

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225912 - Linux Distros Unpatched Vulnerability : CVE-2023-52798
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix dfs radar event locking The ath11k active pdevs are protected by RCU but the DFS radar event handling code calling ath11k_mac_get_ar_by_pdev_id() was not marked as a read-side critical section. Mark the code in question as an RCU read-side critical section to avoid any potential use-after-free issues. Compile tested only.
(CVE-2023-52798)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52798
https://ubuntu.com/security/CVE-2023-52798

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0083
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52798

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227178 - Linux Distros Unpatched Vulnerability : CVE-2023-52818
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/amd: Fix UBSAN array-index-out-of- bounds for SMU7 For pptable structs that use flexible array sizes, use flexible arrays. (CVE-2023-52818)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52818
https://ubuntu.com/security/CVE-2023-52818

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0009
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52818

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226313 - Linux Distros Unpatched Vulnerability : CVE-2023-52835
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- perf/core: Bail out early if the request AUX area is out of bound When perf-record with a large AUX area, e.g 4GB, it fails with: #perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1 failed to mmap with 12 (Cannot allocate memory) and it reveals a WARNING with __alloc_pages(): ------------[ cut here ]------------ WARNING: CPU: 44 PID: 17573 at mm/page_alloc.c:5568 __alloc_pages+0x1ec/0x248 Call trace:
__alloc_pages+0x1ec/0x248 __kmalloc_large_node+0xc0/0x1f8 __kmalloc_node+0x134/0x1e8 rb_alloc_aux+0xe0/0x298 perf_mmap+0x440/0x660 mmap_region+0x308/0x8a8 do_mmap+0x3c0/0x528 vm_mmap_pgoff+0xf4/0x1b8 ksys_mmap_pgoff+0x18c/0x218 __arm64_sys_mmap+0x38/0x58 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0x58/0x188 do_el0_svc+0x34/0x50 el0_svc+0x34/0x108 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x1a4/0x1a8 'rb->aux_pages' allocated by kcalloc() is a pointer array which is used to maintains AUX trace pages. The allocated page for this array is physically contiguous (and virtually contiguous) with an order of 0..MAX_ORDER. If the size of pointer array crosses the limitation set by MAX_ORDER, it reveals a WARNING. So bail out early with -ENOMEM if the request AUX area is out of bound, e.g.: #perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1 failed to mmap with 12 (Cannot allocate memory) (CVE-2023-52835)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52835
https://ubuntu.com/security/CVE-2023-52835

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0027
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52835

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227166 - Linux Distros Unpatched Vulnerability : CVE-2023-52842
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: virtio/vsock: Fix uninit-value in virtio_transport_recv_pkt() KMSAN reported the following uninit-value access issue:
===================================================== BUG: KMSAN: uninit-value in virtio_transport_recv_pkt+0x1dfb/0x26a0 net/vmw_vsock/virtio_transport_common.c:1421 virtio_transport_recv_pkt+0x1dfb/0x26a0 net/vmw_vsock/virtio_transport_common.c:1421 vsock_loopback_work+0x3bb/0x5a0 net/vmw_vsock/vsock_loopback.c:120 process_one_work kernel/workqueue.c:2630 [inline] process_scheduled_works+0xff6/0x1e60 kernel/workqueue.c:2703 worker_thread+0xeca/0x14d0 kernel/workqueue.c:2784 kthread+0x3cc/0x520 kernel/kthread.c:388 ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 Uninit was stored to memory at: virtio_transport_space_update net/vmw_vsock/virtio_transport_common.c:1274 [inline] virtio_transport_recv_pkt+0x1ee8/0x26a0 net/vmw_vsock/virtio_transport_common.c:1415 vsock_loopback_work+0x3bb/0x5a0 net/vmw_vsock/vsock_loopback.c:120 process_one_work kernel/workqueue.c:2630 [inline] process_scheduled_works+0xff6/0x1e60 kernel/workqueue.c:2703 worker_thread+0xeca/0x14d0 kernel/workqueue.c:2784 kthread+0x3cc/0x520 kernel/kthread.c:388 ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 Uninit was created at: slab_post_alloc_hook+0x105/0xad0 mm/slab.h:767 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x5a2/0xaf0 mm/slub.c:3523 kmalloc_reserve+0x13c/0x4a0 net/core/skbuff.c:559
__alloc_skb+0x2fd/0x770 net/core/skbuff.c:650 alloc_skb include/linux/skbuff.h:1286 [inline] virtio_vsock_alloc_skb include/linux/virtio_vsock.h:66 [inline] virtio_transport_alloc_skb+0x90/0x11e0 net/vmw_vsock/virtio_transport_common.c:58 virtio_transport_reset_no_sock net/vmw_vsock/virtio_transport_common.c:957 [inline] virtio_transport_recv_pkt+0x1279/0x26a0 net/vmw_vsock/virtio_transport_common.c:1387 vsock_loopback_work+0x3bb/0x5a0 net/vmw_vsock/vsock_loopback.c:120 process_one_work kernel/workqueue.c:2630 [inline] process_scheduled_works+0xff6/0x1e60 kernel/workqueue.c:2703 worker_thread+0xeca/0x14d0 kernel/workqueue.c:2784 kthread+0x3cc/0x520 kernel/kthread.c:388 ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 CPU: 1 PID: 10664 Comm: kworker/1:5 Not tainted 6.6.0-rc3-00146-g9f3ebbef746f #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc38 04/01/2014 Workqueue: vsock-loopback vsock_loopback_work ===================================================== The following simple reproducer can cause the issue described above: int main(void) { int sock; struct sockaddr_vm addr = { .svm_family = AF_VSOCK, .svm_cid = VMADDR_CID_ANY, .svm_port = 1234, }; sock = socket(AF_VSOCK, SOCK_STREAM, 0); connect(sock, (struct sockaddr *)&addr, sizeof(addr)); return 0; } This issue occurs because the `buf_alloc` and `fwd_cnt` fields of the `struct virtio_vsock_hdr` are not initialized when a new skb is allocated in `virtio_transport_init_hdr()`. This patch resolves the issue by initializing these fields during allocation. (CVE-2023-52842)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52842
https://ubuntu.com/security/CVE-2023-52842

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0008
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52842

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226681 - Linux Distros Unpatched Vulnerability : CVE-2023-52846
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: hsr: Prevent use after free in prp_create_tagged_frame() The prp_fill_rct() function can fail. In that situation, it frees the skb and returns NULL. Meanwhile on the success path, it returns the original skb. So it's straight forward to fix bug by using the returned value. (CVE-2023-52846)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52846
https://ubuntu.com/security/CVE-2023-52846

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0009
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52846

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225875 - Linux Distros Unpatched Vulnerability : CVE-2023-52851
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF In the unlikely event that workqueue allocation fails and returns NULL in mlx5_mkey_cache_init(), delete the call to mlx5r_umr_resource_cleanup() (which frees the QP) in mlx5_ib_stage_post_ib_reg_umr_init(). This will avoid attempted double free of the same QP when
__mlx5_ib_add() does its cleanup. Resolves a splat: Syzkaller reported a UAF in ib_destroy_qp_user workqueue: Failed to create a rescuer kthread for wq mkey_cache: -EINTR infiniband mlx5_0:
mlx5_mkey_cache_init:981:(pid 1642): failed to create work queue infiniband mlx5_0:
mlx5_ib_stage_post_ib_reg_umr_init:4075:(pid 1642): mr cache init failed -12 ================================================================== BUG: KASAN: slab-use-after-free in ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073) Read of size 8 at addr ffff88810da310a8 by task repro_upstream/1642 Call Trace: <TASK> kasan_report (mm/kasan/report.c:590) ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073) mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198)
__mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4178) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ... </TASK> Allocated by task 1642: __kmalloc (./include/linux/kasan.h:198 mm/slab_common.c:1026 mm/slab_common.c:1039) create_qp (./include/linux/slab.h:603 ./include/linux/slab.h:720 ./include/rdma/ib_verbs.h:2795 drivers/infiniband/core/verbs.c:1209) ib_create_qp_kernel (drivers/infiniband/core/verbs.c:1347) mlx5r_umr_resource_init (drivers/infiniband/hw/mlx5/umr.c:164) mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4070) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ... Freed by task 1642: __kmem_cache_free (mm/slub.c:1826 mm/slub.c:3809 mm/slub.c:3822) ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2112) mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198) mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4076 drivers/infiniband/hw/mlx5/main.c:4065) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ...
(CVE-2023-52851)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52851
https://ubuntu.com/security/CVE-2023-52851

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0009
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52851

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226887 - Linux Distros Unpatched Vulnerability : CVE-2023-52854
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- padata: Fix refcnt handling in padata_free_shell() In a high-load arm64 environment, the pcrypt_aead01 test in LTP can lead to system UAF (Use-After-Free) issues. Due to the lengthy analysis of the pcrypt_aead01 function call, I'll describe the problem scenario using a simplified model: Suppose there's a user of padata named `user_function` that adheres to the padata requirement of calling `padata_free_shell` after `serial()` has been invoked, as demonstrated in the following code: ```c struct request { struct padata_priv padata; struct completion *done; }; void parallel(struct padata_priv *padata) { do_something(); } void serial(struct padata_priv *padata) { struct request *request = container_of(padata, struct request, padata); complete(request->done); } void user_function() { DECLARE_COMPLETION(done) padata->parallel = parallel; padata->serial = serial; padata_do_parallel();
wait_for_completion(&done); padata_free_shell(); } ``` In the corresponding padata.c file, there's the following code: ```c static void padata_serial_worker(struct work_struct *serial_work) { ... cnt = 0;
while (!list_empty(&local_list)) { ... padata->serial(padata); cnt++; } local_bh_enable(); if (refcount_sub_and_test(cnt, &pd->refcnt)) padata_free_pd(pd); } ``` Because of the high system load and the accumulation of unexecuted softirq at this moment, `local_bh_enable()` in padata takes longer to execute than usual. Subsequently, when accessing `pd->refcnt`, `pd` has already been released by `padata_free_shell()`, resulting in a UAF issue with `pd->refcnt`. The fix is straightforward: add `refcount_dec_and_test` before calling `padata_free_pd` in `padata_free_shell`. (CVE-2023-52854)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52854
https://ubuntu.com/security/CVE-2023-52854

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0009
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52854

Plugin Information
Published: 2025/03/05, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226948 - Linux Distros Unpatched Vulnerability : CVE-2023-52866
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: Fix user-memory-access bug in uclogic_params_ugee_v2_init_event_hooks() When CONFIG_HID_UCLOGIC=y and CONFIG_KUNIT_ALL_TESTS=y, launch kernel and then the below user-memory-access bug occurs. In hid_test_uclogic_params_cleanup_event_hooks(),it call uclogic_params_ugee_v2_init_event_hooks() with the first arg=NULL, so when it calls uclogic_params_ugee_v2_has_battery(), the hid_get_drvdata() will access hdev->dev with hdev=NULL, which will cause below user-memory-access. So add a fake_device with quirks member and call hid_set_drvdata() to assign hdev->dev->driver_data which avoids the null-ptr-def bug for drvdata->quirks in uclogic_params_ugee_v2_has_battery(). After applying this patch, the below user-memory- access bug never occurs. general protection fault, probably for non-canonical address 0xdffffc0000000329:
0000 [#1] PREEMPT SMP KASAN KASAN: probably user-memory-access in range [0x0000000000001948-0x000000000000194f] CPU: 5 PID: 2189 Comm: kunit_try_catch Tainted: G B W N 6.6.0-rc2+ #30 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP:
0010:uclogic_params_ugee_v2_init_event_hooks+0x87/0x600 Code: f3 f3 65 48 8b 14 25 28 00 00 00 48 89 54 24 60 31 d2 48 89 fa c7 44 24 30 00 00 00 00 48 c7 44 24 28 02 f8 02 01 48 c1 ea 03 <80> 3c 02 00 0f 85 2c 04 00 00 48 8b 9d 48 19 00 00 48 b8 00 00 00 RSP: 0000:ffff88810679fc88 EFLAGS: 00010202 RAX:
dffffc0000000000 RBX: 0000000000000004 RCX: 0000000000000000 RDX: 0000000000000329 RSI: ffff88810679fd88 RDI: 0000000000001948 RBP: 0000000000000000 R08: 0000000000000000 R09: ffffed1020f639f0 R10:
ffff888107b1cf87 R11: 0000000000000400 R12: 1ffff11020cf3f92 R13: ffff88810679fd88 R14: ffff888100b97b08 R15: ffff8881030bb080 FS: 0000000000000000(0000) GS:ffff888119e80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000005286001 CR4: 0000000000770ee0 DR0: ffffffff8fdd6cf4 DR1: ffffffff8fdd6cf5 DR2: ffffffff8fdd6cf6 DR3: ffffffff8fdd6cf7 DR6:
00000000fffe0ff0 DR7: 0000000000000600 PKRU: 55555554 Call Trace: <TASK> ? die_addr+0x3d/0xa0 ? exc_general_protection+0x144/0x220 ? asm_exc_general_protection+0x22/0x30 ? uclogic_params_ugee_v2_init_event_hooks+0x87/0x600 ? sched_clock_cpu+0x69/0x550 ? uclogic_parse_ugee_v2_desc_gen_params+0x70/0x70 ? load_balance+0x2950/0x2950 ? rcu_trc_cmpxchg_need_qs+0x67/0xa0 hid_test_uclogic_params_cleanup_event_hooks+0x9e/0x1a0 ? uclogic_params_ugee_v2_init_event_hooks+0x600/0x600 ? __switch_to+0x5cf/0xe60 ? migrate_enable+0x260/0x260 ? __kthread_parkme+0x83/0x150 ? kunit_try_run_case_cleanup+0xe0/0xe0 kunit_generic_run_threadfn_adapter+0x4a/0x90 ? kunit_try_catch_throw+0x80/0x80 kthread+0x2b5/0x380 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x2d/0x70 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork_asm+0x11/0x20 </TASK> Modules linked in: Dumping ftrace buffer: (ftrace buffer empty) ---[ end trace 0000000000000000 ]--- RIP: 0010:uclogic_params_ugee_v2_init_event_hooks+0x87/0x600 Code: f3 f3 65 48 8b 14 25 28 00 00 00 48 89 54 24 60 31 d2 48 89 fa c7 44 24 30 00 00 00 00 48 c7 44 24 28 02 f8 02 01 48 c1 ea 03 <80> 3c 02 00 0f 85 2c 04 00 00 48 8b 9d 48 19 00 00 48 b8 00 00 00 RSP:
0000:ffff88810679fc88 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000004 RCX: 0000000000000000 RDX: 0000000000000329 RSI: ffff88810679fd88 RDI: 0000000000001948 RBP: 0000000000000000 R08:
0000000000000000 R09: ffffed1020f639f0 R10: ffff888107b1cf87 R11: 0000000000000400 R12: 1ffff11020cf3f92 R13: ffff88810679fd88 R14: ffff888100b97b08 R15: ffff8881030bb080 FS: 0000000000000000(0000) GS:ffff888119e80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
0000000000000000 CR3: 0000000005286001 CR4: 0000000000770ee0 DR0: ffffffff8fdd6cf4 DR1: ---truncated--- (CVE-2023-52866)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52866
https://ubuntu.com/security/CVE-2023-52866

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0009
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52866

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226863 - Linux Distros Unpatched Vulnerability : CVE-2023-52882
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change While PLL CPUX clock rate change when CPU is running from it works in vast majority of cases, now and then it causes instability. This leads to system crashes and other undefined behaviour. After a lot of testing (30+ hours) while also doing a lot of frequency switches, we can't observe any instability issues anymore when doing reparenting to stable clock like 24 MHz oscillator.
(CVE-2023-52882)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52882
https://ubuntu.com/security/CVE-2023-52882

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0035
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52882

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226554 - Linux Distros Unpatched Vulnerability : CVE-2023-52883
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix possible null pointer dereference abo->tbo.resource may be NULL in amdgpu_vm_bo_update. (CVE-2023-52883)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52883
https://ubuntu.com/security/CVE-2023-52883

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52883

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227239 - Linux Distros Unpatched Vulnerability : CVE-2023-52885
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix UAF in svc_tcp_listen_data_ready() After the listener svc_sock is freed, and before invoking svc_tcp_accept() for the established child sock, there is a window that the newsock retaining a freed listener svc_sock in sk_user_data which cloning from parent. In the race window, if data is received on the newsock, we will observe use-after-free report in svc_tcp_listen_data_ready(). Reproduce by two tasks: 1. while :; do rpc.nfsd 0 ; rpc.nfsd; done 2. while :; do echo | ncat -4 127.0.0.1 2049 ; done KASAN report:
================================================================== BUG: KASAN: slab-use-after-free in svc_tcp_listen_data_ready+0x1cf/0x1f0 [sunrpc] Read of size 8 at addr ffff888139d96228 by task nc/102553 CPU: 7 PID: 102553 Comm: nc Not tainted 6.3.0+ #18 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 Call Trace: <IRQ> dump_stack_lvl+0x33/0x50 print_address_description.constprop.0+0x27/0x310 print_report+0x3e/0x70 kasan_report+0xae/0xe0 svc_tcp_listen_data_ready+0x1cf/0x1f0 [sunrpc] tcp_data_queue+0x9f4/0x20e0 tcp_rcv_established+0x666/0x1f60 tcp_v4_do_rcv+0x51c/0x850 tcp_v4_rcv+0x23fc/0x2e80 ip_protocol_deliver_rcu+0x62/0x300 ip_local_deliver_finish+0x267/0x350 ip_local_deliver+0x18b/0x2d0 ip_rcv+0x2fb/0x370 __netif_receive_skb_one_core+0x166/0x1b0 process_backlog+0x24c/0x5e0
__napi_poll+0xa2/0x500 net_rx_action+0x854/0xc90 __do_softirq+0x1bb/0x5de do_softirq+0xcb/0x100 </IRQ>
<TASK> ... </TASK> Allocated by task 102371: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30
__kasan_kmalloc+0x7b/0x90 svc_setup_socket+0x52/0x4f0 [sunrpc] svc_addsock+0x20d/0x400 [sunrpc]
__write_ports_addfd+0x209/0x390 [nfsd] write_ports+0x239/0x2c0 [nfsd] nfsctl_transaction_write+0xac/0x110 [nfsd] vfs_write+0x1c3/0xae0 ksys_write+0xed/0x1c0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Freed by task 102551: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x50 __kasan_slab_free+0x106/0x190
__kmem_cache_free+0x133/0x270 svc_xprt_free+0x1e2/0x350 [sunrpc] svc_xprt_destroy_all+0x25a/0x440 [sunrpc] nfsd_put+0x125/0x240 [nfsd] nfsd_svc+0x2cb/0x3c0 [nfsd] write_threads+0x1ac/0x2a0 [nfsd] nfsctl_transaction_write+0xac/0x110 [nfsd] vfs_write+0x1c3/0xae0 ksys_write+0xed/0x1c0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Fix the UAF by simply doing nothing in svc_tcp_listen_data_ready() if state != TCP_LISTEN, that will avoid dereferencing svsk for all child socket. (CVE-2023-52885)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52885
https://ubuntu.com/security/CVE-2023-52885

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0007
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52885

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227356 - Linux Distros Unpatched Vulnerability : CVE-2023-52906
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mpls: Fix warning during failed attribute validation The 'TCA_MPLS_LABEL' attribute is of 'NLA_U32' type, but has a validation type of 'NLA_VALIDATE_FUNCTION'. This is an invalid combination according to the comment above 'struct nla_policy': Meaning of `validate' field, use via NLA_POLICY_VALIDATE_FN: NLA_BINARY Validation function called for the attribute. All other Unused - but note that it's a union This can trigger the warning [1] in nla_get_range_unsigned() when validation of the attribute fails. Despite being of 'NLA_U32'
type, the associated 'min'/'max' fields in the policy are negative as they are aliased by the 'validate'
field. Fix by changing the attribute type to 'NLA_BINARY' which is consistent with the above comment and all other users of NLA_POLICY_VALIDATE_FN(). As a result, move the length validation to the validation function. No regressions in MPLS tests: # ./tdc.py -f tc-tests/actions/mpls.json [...] # echo $? 0 [1] WARNING: CPU: 0 PID: 17743 at lib/nlattr.c:118 nla_get_range_unsigned+0x1d8/0x1e0 lib/nlattr.c:117 Modules linked in: CPU: 0 PID: 17743 Comm: syz-executor.0 Not tainted 6.1.0-rc8 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-48-gd9c812dda519-prebuilt.qemu.org 04/01/2014 RIP:
0010:nla_get_range_unsigned+0x1d8/0x1e0 lib/nlattr.c:117 [...] Call Trace: <TASK>
__netlink_policy_dump_write_attr+0x23d/0x990 net/netlink/policy.c:310 netlink_policy_dump_write_attr+0x22/0x30 net/netlink/policy.c:411 netlink_ack_tlv_fill net/netlink/af_netlink.c:2454 [inline] netlink_ack+0x546/0x760 net/netlink/af_netlink.c:2506 netlink_rcv_skb+0x1b7/0x240 net/netlink/af_netlink.c:2546 rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:6109 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x5e9/0x6b0 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x739/0x860 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0x38f/0x500 net/socket.c:2482 ___sys_sendmsg net/socket.c:2536 [inline]
__sys_sendmsg+0x197/0x230 net/socket.c:2565 __do_sys_sendmsg net/socket.c:2574 [inline] __se_sys_sendmsg net/socket.c:2572 [inline] __x64_sys_sendmsg+0x42/0x50 net/socket.c:2572 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd (CVE-2023-52906)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52906
https://ubuntu.com/security/CVE-2023-52906

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0008
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52906

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226398 - Linux Distros Unpatched Vulnerability : CVE-2023-52926
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- IORING_OP_READ did not correctly consume the provided buffer list when read i/o returned < 0 (except for
-EAGAIN and -EIOCBQUEUED return). This can lead to a potential use-after-free when the completion via io_rw_done runs at separate context. (CVE-2023-52926)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52926
https://security-tracker.debian.org/tracker/CVE-2023-52926
https://ubuntu.com/security/CVE-2023-52926

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52926

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247669 - Linux Distros Unpatched Vulnerability : CVE-2023-52930
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential bit_17 double- free A userspace with multiple threads racing I915_GEM_SET_TILING to set the tiling to I915_TILING_NONE could trigger a double free of the bit_17 bitmask. (Or conversely leak memory on the transition to tiled.) Move allocation/free'ing of the bitmask within the section protected by the obj lock. [tursulin: Correct fixes tag and added cc stable.] (cherry picked from commit 10e0cbaaf1104f449d695c80bcacf930dcd3c42e) (CVE-2023-52930)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52930
https://ubuntu.com/security/CVE-2023-52930

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52930

Plugin Information
Published: 2025/08/10, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249786 - Linux Distros Unpatched Vulnerability : CVE-2023-52974
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress If during iscsi_sw_tcp_session_create() iscsi_tcp_r2tpool_alloc() fails, userspace could be accessing the host's ipaddress attr. If we then free the session via iscsi_session_teardown() while userspace is still accessing the session we will hit a use after free bug. Set the tcp_sw_host->session after we have completed session creation and can no longer fail. (CVE-2023-52974)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52974
https://ubuntu.com/security/CVE-2023-52974

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52974

Plugin Information
Published: 2025/08/15, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248046 - Linux Distros Unpatched Vulnerability : CVE-2023-52975
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress Bug report and analysis from Ding Hui. During iSCSI session logout, if another task accesses the shost ipaddress attr, we can get a KASAN UAF report like this: [ 276.942144] BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x78/0xe0 [ 276.942535] Write of size 4 at addr ffff8881053b45b8 by task cat/4088 [ 276.943511] CPU: 2 PID: 4088 Comm:
cat Tainted: G E 6.1.0-rc8+ #3 [ 276.943997] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 [ 276.944470] Call Trace: [ 276.944943] <TASK> [ 276.945397] dump_stack_lvl+0x34/0x48 [ 276.945887] print_address_description.constprop.0+0x86/0x1e7 [ 276.946421] print_report+0x36/0x4f [ 276.947358] kasan_report+0xad/0x130 [ 276.948234] kasan_check_range+0x35/0x1c0 [ 276.948674] _raw_spin_lock_bh+0x78/0xe0 [ 276.949989] iscsi_sw_tcp_host_get_param+0xad/0x2e0 [iscsi_tcp] [ 276.951765] show_host_param_ISCSI_HOST_PARAM_IPADDRESS+0xe9/0x130 [scsi_transport_iscsi] [ 276.952185] dev_attr_show+0x3f/0x80 [ 276.953005] sysfs_kf_seq_show+0x1fb/0x3e0 [ 276.953401] seq_read_iter+0x402/0x1020 [ 276.954260] vfs_read+0x532/0x7b0 [ 276.955113] ksys_read+0xed/0x1c0 [ 276.955952] do_syscall_64+0x38/0x90 [ 276.956347] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 276.956769] RIP: 0033:0x7f5d3a679222 [ 276.957161] Code: c0 e9 b2 fe ff ff 50 48 8d 3d 32 c0 0b 00 e8 a5 fe 01 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24 [ 276.958009] RSP: 002b:00007ffc864d16a8 EFLAGS: 00000246 ORIG_RAX:
0000000000000000 [ 276.958431] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f5d3a679222 [ 276.958857] RDX: 0000000000020000 RSI: 00007f5d3a4fe000 RDI: 0000000000000003 [ 276.959281] RBP:
00007f5d3a4fe000 R08: 00000000ffffffff R09: 0000000000000000 [ 276.959682] R10: 0000000000000022 R11:
0000000000000246 R12: 0000000000020000 [ 276.960126] R13: 0000000000000003 R14: 0000000000000000 R15:
0000557a26dada58 [ 276.960536] </TASK> [ 276.961357] Allocated by task 2209: [ 276.961756] kasan_save_stack+0x1e/0x40 [ 276.962170] kasan_set_track+0x21/0x30 [ 276.962557] __kasan_kmalloc+0x7e/0x90 [ 276.962923] __kmalloc+0x5b/0x140 [ 276.963308] iscsi_alloc_session+0x28/0x840 [scsi_transport_iscsi] [ 276.963712] iscsi_session_setup+0xda/0xba0 [libiscsi] [ 276.964078] iscsi_sw_tcp_session_create+0x1fd/0x330 [iscsi_tcp] [ 276.964431] iscsi_if_create_session.isra.0+0x50/0x260 [scsi_transport_iscsi] [ 276.964793] iscsi_if_recv_msg+0xc5a/0x2660 [scsi_transport_iscsi] [ 276.965153] iscsi_if_rx+0x198/0x4b0 [scsi_transport_iscsi] [ 276.965546] netlink_unicast+0x4d5/0x7b0 [ 276.965905] netlink_sendmsg+0x78d/0xc30 [ 276.966236] sock_sendmsg+0xe5/0x120 [ 276.966576] ____sys_sendmsg+0x5fe/0x860 [ 276.966923]
___sys_sendmsg+0xe0/0x170 [ 276.967300] __sys_sendmsg+0xc8/0x170 [ 276.967666] do_syscall_64+0x38/0x90 [ 276.968028] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 276.968773] Freed by task 2209: [ 276.969111] kasan_save_stack+0x1e/0x40 [ 276.969449] kasan_set_track+0x21/0x30 [ 276.969789] kasan_save_free_info+0x2a/0x50 [ 276.970146] __kasan_slab_free+0x106/0x190 [ 276.970470]
__kmem_cache_free+0x133/0x270 [ 276.970816] device_release+0x98/0x210 [ 276.971145] kobject_cleanup+0x101/0x360 [ 276.971462] iscsi_session_teardown+0x3fb/0x530 [libiscsi] [ 276.971775] iscsi_sw_tcp_session_destroy+0xd8/0x130 [iscsi_tcp] [ 276.972143] iscsi_if_recv_msg+0x1bf1/0x2660 [scsi_transport_iscsi] [ 276.972485] iscsi_if_rx+0x198/0x4b0 [scsi_transport_iscsi] [ 276.972808] netlink_unicast+0x4d5/0x7b0 [ 276.973201] netlink_sendmsg+0x78d/0xc30 [ 276.973544] sock_sendmsg+0xe5/0x120 [ 276.973864] ____sys_sendmsg+0x5fe/0x860 [ 276.974248] ___sys_ ---truncated--- (CVE-2023-52975)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52975
https://security-tracker.debian.org/tracker/CVE-2023-52975
https://ubuntu.com/security/CVE-2023-52975

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52975

Plugin Information
Published: 2025/08/11, Modified: 2025/12/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248938 - Linux Distros Unpatched Vulnerability : CVE-2023-52981
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/i915: Fix request ref counting during error capture & debugfs dump When GuC support was added to error capture, the reference counting around the request object was broken. Fix it up. The context based search manages the spinlocking around the search internally. So it needs to grab the reference count internally as well. The execlist only request based search relies on external locking, so it needs an external reference count but within the spinlock not outside it. The only other caller of the context based search is the code for dumping engine state to debugfs. That code wasn't previously getting an explicit reference at all as it does everything while holding the execlist specific spinlock. So, that needs updaing as well as that spinlock doesn't help when using GuC submission. Rather than trying to conditionally get/put depending on submission model, just change it to always do the get/put. v2: Explicitly document adding an extra blank line in some dense code (Andy Shevchenko). Fix multiple potential null pointer derefs in case of no request found (some spotted by Tvrtko, but there was more!). Also fix a leaked request in case of !started and another in __guc_reset_context now that intel_context_find_active_request is actually reference counting the returned request. v3: Add a _get suffix to intel_context_find_active_request now that it grabs a reference (Daniele). v4: Split the intel_guc_find_hung_context change to a separate patch and rename intel_context_find_active_request_get to intel_context_get_active_request (Tvrtko). v5:
s/locking/reference counting/ in commit message (Tvrtko) (cherry picked from commit 3700e353781e27f1bc7222f51f2cc36cbeb9b4ec) (CVE-2023-52981)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52981
https://ubuntu.com/security/CVE-2023-52981

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52981

Plugin Information
Published: 2025/08/12, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247062 - Linux Distros Unpatched Vulnerability : CVE-2023-52982
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: fscache: Use wait_on_bit() to wait for the freeing of relinquished volume The freeing of relinquished volume will wake up the pending volume acquisition by using wake_up_bit(), however it is mismatched with wait_var_event() used in fscache_wait_on_volume_collision() and it will never wake up the waiter in the wait-queue because these two functions operate on different wait-queues. According to the implementation in fscache_wait_on_volume_collision(), if the wake-up of pending acquisition is delayed longer than 20 seconds (e.g., due to the delay of on-demand fd closing), the first wait_var_event_timeout() will timeout and the following wait_var_event() will hang forever as shown below: FS-Cache: Potential volume collision new=00000024 old=00000022 ...... INFO: task mount:1148 blocked for more than 122 seconds. Not tainted 6.1.0-rc6+ #1 task:mount state:D stack:0 pid:1148 ppid:1 Call Trace: <TASK> __schedule+0x2f6/0xb80 schedule+0x67/0xe0 fscache_wait_on_volume_collision.cold+0x80/0x82 __fscache_acquire_volume+0x40d/0x4e0 erofs_fscache_register_volume+0x51/0xe0 [erofs] erofs_fscache_register_fs+0x19c/0x240 [erofs] erofs_fc_fill_super+0x746/0xaf0 [erofs] vfs_get_super+0x7d/0x100 get_tree_nodev+0x16/0x20 erofs_fc_get_tree+0x20/0x30 [erofs] vfs_get_tree+0x24/0xb0 path_mount+0x2fa/0xa90 do_mount+0x7c/0xa0
__x64_sys_mount+0x8b/0xe0 do_syscall_64+0x30/0x60 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Considering that wake_up_bit() is more selective, so fix it by using wait_on_bit() instead of wait_var_event() to wait for the freeing of relinquished volume. In addition because waitqueue_active() is used in wake_up_bit() and clear_bit() doesn't imply any memory barrier, use clear_and_wake_up_bit() to add the missing memory barrier between cursor->flags and waitqueue_active(). (CVE-2023-52982)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52982
https://ubuntu.com/security/CVE-2023-52982

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52982

Plugin Information
Published: 2025/08/09, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247090 - Linux Distros Unpatched Vulnerability : CVE-2023-52983
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix uaf for bfqq in bic_set_bfqq() After commit 64dc8c732f5c (block, bfq: fix possible uaf for 'bfqq->bic'), bic->bfqq will be accessed in bic_set_bfqq(), however, in some context bic->bfqq will be freed, and bic_set_bfqq() is called with the freed bic->bfqq. Fix the problem by always freeing bfqq after bic_set_bfqq().
(CVE-2023-52983)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52983
https://ubuntu.com/security/CVE-2023-52983

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52983

Plugin Information
Published: 2025/08/09, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243359 - Linux Distros Unpatched Vulnerability : CVE-2023-52987
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-mtrace: prevent underflow in sof_ipc4_priority_mask_dfs_write() The id comes from the user. Change the type to unsigned to prevent an array underflow. (CVE-2023-52987)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52987
https://ubuntu.com/security/CVE-2023-52987

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52987

Plugin Information
Published: 2025/08/04, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248272 - Linux Distros Unpatched Vulnerability : CVE-2023-53032
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. When first_ip is 0, last_ip is 0xFFFFFFFF, and netmask is 31, the value of an arithmetic expression 2 << (netmask - mask_bits
- 1) is subject to overflow due to a failure casting operands to a larger data type before performing the arithmetic. Note that it's harmless since the value will be checked at the next step. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE. (CVE-2023-53032)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53032
https://ubuntu.com/security/CVE-2023-53032

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53032

Plugin Information
Published: 2025/08/11, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248651 - Linux Distros Unpatched Vulnerability : CVE-2023-53034
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ntb_hw_switchtec: Fix shift-out-of- bounds in switchtec_ntb_mw_set_trans There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative. [ 23.734156] switchtec switchtec0: MW 0: part 0 addr 0x0000000000000000 size 0x0000000000000000 [ 23.734158] ================================================================================ [ 23.734172] UBSAN:
shift-out-of-bounds in drivers/ntb/hw/mscc/ntb_hw_switchtec.c:293:7 [ 23.734418] shift exponent -1 is negative Ensuring xlate_pos is a positive or zero before BIT. (CVE-2023-53034)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53034
https://ubuntu.com/security/CVE-2023-53034

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53034

Plugin Information
Published: 2025/08/12, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249077 - Linux Distros Unpatched Vulnerability : CVE-2023-53041
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: qla2xxx: Perform lockless command completion in abort path While adding and removing the controller, the following call trace was observed: WARNING: CPU: 3 PID: 623596 at kernel/dma/mapping.c:532 dma_free_attrs+0x33/0x50 CPU: 3 PID: 623596 Comm: sh Kdump: loaded Not tainted 5.14.0-96.el9.x86_64 #1 RIP: 0010:dma_free_attrs+0x33/0x50 Call Trace: qla2x00_async_sns_sp_done+0x107/0x1b0 [qla2xxx] qla2x00_abort_srb+0x8e/0x250 [qla2xxx] ? ql_dbg+0x70/0x100 [qla2xxx] __qla2x00_abort_all_cmds+0x108/0x190 [qla2xxx] qla2x00_abort_all_cmds+0x24/0x70 [qla2xxx] qla2x00_abort_isp_cleanup+0x305/0x3e0 [qla2xxx] qla2x00_remove_one+0x364/0x400 [qla2xxx] pci_device_remove+0x36/0xa0 __device_release_driver+0x17a/0x230 device_release_driver+0x24/0x30 pci_stop_bus_device+0x68/0x90 pci_stop_and_remove_bus_device_locked+0x16/0x30 remove_store+0x75/0x90 kernfs_fop_write_iter+0x11c/0x1b0 new_sync_write+0x11f/0x1b0 vfs_write+0x1eb/0x280 ksys_write+0x5f/0xe0 do_syscall_64+0x5c/0x80 ? do_user_addr_fault+0x1d8/0x680 ? do_syscall_64+0x69/0x80 ? exc_page_fault+0x62/0x140 ? asm_exc_page_fault+0x8/0x30 entry_SYSCALL_64_after_hwframe+0x44/0xae The command was completed in the abort path during driver unload with a lock held, causing the warning in abort path. Hence complete the command without any lock held. (CVE-2023-53041)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53041
https://ubuntu.com/security/CVE-2023-53041

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53041

Plugin Information
Published: 2025/08/12, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245822 - Linux Distros Unpatched Vulnerability : CVE-2023-53075
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ftrace: Fix invalid address access in lookup_rec() when index is 0 KASAN reported follow problem: BUG:
KASAN: use-after-free in lookup_rec Read of size 8 at addr ffff000199270ff0 by task modprobe CPU: 2 Comm:
modprobe Call trace: kasan_report __asan_load8 lookup_rec ftrace_location arch_check_ftrace_location check_kprobe_address_safe register_kprobe When checking pg->records[pg->index - 1].ip in lookup_rec(), it can get a pg which is newly added to ftrace_pages_start in ftrace_process_locs(). Before the first pg->index++, index is 0 and accessing pg->records[-1].ip will cause this problem. Don't check the ip when pg->index is 0. (CVE-2023-53075)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53075
https://ubuntu.com/security/CVE-2023-53075

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53075

Plugin Information
Published: 2025/08/08, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246516 - Linux Distros Unpatched Vulnerability : CVE-2023-53080
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xsk: Add missing overflow check in xdp_umem_reg The number of chunks can overflow u32. Make sure to return
-EINVAL on overflow. Also remove a redundant u32 cast assigning umem->npgs. (CVE-2023-53080)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53080
https://ubuntu.com/security/CVE-2023-53080

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:C/I:P/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53080

Plugin Information
Published: 2025/08/09, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246522 - Linux Distros Unpatched Vulnerability : CVE-2023-53082
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: vp_vdpa: fix the crash in hot unplug with vp_vdpa While unplugging the vp_vdpa device, it triggers a kernel panic The root cause is:
vdpa_mgmtdev_unregister() will accesses modern devices which will cause a use after free. So need to change the sequence in vp_vdpa_remove [ 195.003359] BUG: unable to handle page fault for address:
ff4e8beb80199014 [ 195.004012] #PF: supervisor read access in kernel mode [ 195.004486] #PF:
error_code(0x0000) - not-present page [ 195.004960] PGD 100000067 P4D 1001b6067 PUD 1001b7067 PMD 1001b8067 PTE 0 [ 195.005578] Oops: 0000 1 PREEMPT SMP PTI [ 195.005968] CPU: 13 PID: 164 Comm:
kworker/u56:10 Kdump: loaded Not tainted 5.14.0-252.el9.x86_64 #1 [ 195.006792] Hardware name: Red Hat KVM/RHEL, BIOS edk2-20221207gitfff6d81270b5-2.el9 unknown [ 195.007556] Workqueue: kacpi_hotplug acpi_hotplug_work_fn [ 195.008059] RIP: 0010:ioread8+0x31/0x80 [ 195.008418] Code: 77 28 48 81 ff 00 00 01 00 76 0b 89 fa ec 0f b6 c0 c3 cc cc cc cc 8b 15 ad 72 93 01 b8 ff 00 00 00 85 d2 75 0f c3 cc cc cc cc <8a>
07 0f b6 c0 c3 cc cc cc cc 83 ea 01 48 83 ec 08 48 89 fe 48 c7 [ 195.010104] RSP: 0018:ff4e8beb8067bab8 EFLAGS: 00010292 [ 195.010584] RAX: ffffffffc05834a0 RBX: ffffffffc05843c0 RCX: ff4e8beb8067bae0 [ 195.011233] RDX: ff1bcbd580f88000 RSI: 0000000000000246 RDI: ff4e8beb80199014 [ 195.011881] RBP:
ff1bcbd587e39000 R08: ffffffff916fa2d0 R09: ff4e8beb8067ba68 [ 195.012527] R10: 000000000000001c R11:
0000000000000000 R12: ff1bcbd5a3de9120 [ 195.013179] R13: ffffffffc062d000 R14: 0000000000000080 R15:
ff1bcbe402bc7805 [ 195.013826] FS: 0000000000000000(0000) GS:ff1bcbe402740000(0000) knlGS:0000000000000000 [ 195.014564] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 195.015093] CR2: ff4e8beb80199014 CR3:
0000000107dea002 CR4: 0000000000771ee0 [ 195.015741] PKRU: 55555554 [ 195.016001] Call Trace: [ 195.016233] <TASK> [ 195.016434] vp_modern_get_status+0x12/0x20 [ 195.016823] vp_vdpa_reset+0x1b/0x50 [vp_vdpa] [ 195.017238] virtio_vdpa_reset+0x3c/0x48 [virtio_vdpa] [ 195.017709] remove_vq_common+0x1f/0x3a0 [virtio_net] [ 195.018178] virtnet_remove+0x5d/0x70 [virtio_net] [ 195.018618] virtio_dev_remove+0x3d/0x90 [ 195.018986] device_release_driver_internal+0x1aa/0x230 [ 195.019466] bus_remove_device+0xd8/0x150 [ 195.019841] device_del+0x18b/0x3f0 [ 195.020167] ? kernfs_find_ns+0x35/0xd0 [ 195.020526] device_unregister+0x13/0x60 [ 195.020894] unregister_virtio_device+0x11/0x20 [ 195.021311] device_release_driver_internal+0x1aa/0x230 [ 195.021790] bus_remove_device+0xd8/0x150 [ 195.022162] device_del+0x18b/0x3f0 [ 195.022487] device_unregister+0x13/0x60 [ 195.022852] ? vdpa_dev_remove+0x30/0x30 [vdpa] [ 195.023270] vp_vdpa_dev_del+0x12/0x20 [vp_vdpa] [ 195.023694] vdpa_match_remove+0x2b/0x40 [vdpa] [ 195.024115] bus_for_each_dev+0x78/0xc0 [ 195.024471] vdpa_mgmtdev_unregister+0x65/0x80 [vdpa] [ 195.024937] vp_vdpa_remove+0x23/0x40 [vp_vdpa] [ 195.025353] pci_device_remove+0x36/0xa0 [ 195.025719] device_release_driver_internal+0x1aa/0x230 [ 195.026201] pci_stop_bus_device+0x6c/0x90 [ 195.026580] pci_stop_and_remove_bus_device+0xe/0x20 [ 195.027039] disable_slot+0x49/0x90 [ 195.027366] acpiphp_disable_and_eject_slot+0x15/0x90 [ 195.027832] hotplug_event+0xea/0x210 [ 195.028171] ? hotplug_event+0x210/0x210 [ 195.028535] acpiphp_hotplug_notify+0x22/0x80 [ 195.028942] ? hotplug_event+0x210/0x210 [ 195.029303] acpi_device_hotplug+0x8a/0x1d0 [ 195.029690] acpi_hotplug_work_fn+0x1a/0x30 [ 195.030077] process_one_work+0x1e8/0x3c0 [ 195.030451] worker_thread+0x50/0x3b0 [ 195.030791] ? rescuer_thread+0x3a0/0x3a0 [ 195.031165] kthread+0xd9/0x100 [ 195.031459] ? kthread_complete_and_exit+0x20/0x20 [ 195.031899] ret_from_fork+0x22/0x30 [ 195.032233] </TASK> (CVE-2023-53082)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53082
https://ubuntu.com/security/CVE-2023-53082

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-53082

Plugin Information
Published: 2025/08/09, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249494 - Linux Distros Unpatched Vulnerability : CVE-2023-53091
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: update s_journal_inum if it changes after journal replay When mounting a crafted ext4 image, s_journal_inum may change after journal replay, which is obviously unreasonable because we have successfully loaded and replayed the journal through the old s_journal_inum. And the new s_journal_inum bypasses some of the checks in ext4_get_journal(), which may trigger a null pointer dereference problem.
So if s_journal_inum changes after the journal replay, we ignore the change, and rewrite the current journal_inum to the superblock. (CVE-2023-53091)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53091
https://security-tracker.debian.org/tracker/CVE-2023-53091
https://ubuntu.com/security/CVE-2023-53091

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53091

Plugin Information
Published: 2025/08/15, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247731 - Linux Distros Unpatched Vulnerability : CVE-2023-53101
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: zero i_disksize when initializing the bootloader inode If the boot loader inode has never been used before, the EXT4_IOC_SWAP_BOOT inode will initialize it, including setting the i_size to 0. However, if the never before used boot loader has a non-zero i_size, then i_disksize will be non-zero, and the inconsistency between i_size and i_disksize can trigger a kernel warning: WARNING: CPU: 0 PID: 2580 at fs/ext4/file.c:319 CPU: 0 PID: 2580 Comm: bb Not tainted 6.3.0-rc1-00004-g703695902cfa RIP:
0010:ext4_file_write_iter+0xbc7/0xd10 Call Trace: vfs_write+0x3b1/0x5c0 ksys_write+0x77/0x160
__x64_sys_write+0x22/0x30 do_syscall_64+0x39/0x80 Reproducer: 1. create corrupted image and mount it:
mke2fs -t ext4 /tmp/foo.img 200 debugfs -wR sif <5> size 25700 /tmp/foo.img mount -t ext4 /tmp/foo.img /mnt cd /mnt echo 123 > file 2. Run the reproducer program: posix_memalign(&buf, 1024, 1024) fd = open(file, O_RDWR | O_DIRECT); ioctl(fd, EXT4_IOC_SWAP_BOOT); write(fd, buf, 1024); Fix this by setting i_disksize as well as i_size to zero when initiaizing the boot loader inode. (CVE-2023-53101)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53101
https://ubuntu.com/security/CVE-2023-53101

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53101

Plugin Information
Published: 2025/08/10, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244607 - Linux Distros Unpatched Vulnerability : CVE-2023-53127
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix expander node leak in mpi3mr_remove() Add a missing resource clean up in .remove. (CVE-2023-53127)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53127
https://ubuntu.com/security/CVE-2023-53127

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-53127

Plugin Information
Published: 2025/08/07, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246685 - Linux Distros Unpatched Vulnerability : CVE-2023-53145
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition In btsdio_probe, the data->work is bound with btsdio_work. It will be started in btsdio_send_frame. If the btsdio_remove runs with a unfinished work, there may be a race condition that hdev is freed but used in btsdio_work. Fix it by canceling the work before do cleanup in btsdio_remove. (CVE-2023-53145)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53145
https://ubuntu.com/security/CVE-2023-53145

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53145

Plugin Information
Published: 2025/08/09, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264993 - Linux Distros Unpatched Vulnerability : CVE-2023-53153
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: cfg80211: Fix use after free for wext Key information in wext.connect is not reset on (re)connect and can hold data from a previous connection. Reset key data to avoid that drivers or mac80211 incorrectly detect a WEP connection request and access the freed or already reused memory. Additionally optimize cfg80211_sme_connect() and avoid an useless schedule of conn_work. (CVE-2023-53153)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53153
https://ubuntu.com/security/CVE-2023-53153

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53153

Plugin Information
Published: 2025/09/16, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265053 - Linux Distros Unpatched Vulnerability : CVE-2023-53165
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- udf: Fix uninitialized array access for some pathnames For filenames that begin with . and are between 2 and 5 characters long, UDF charset conversion code would read uninitialized memory in the output buffer.
The only practical impact is that the name may be prepended a unification hash when it is not actually needed but still it is good to fix this. (CVE-2023-53165)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53165
https://ubuntu.com/security/CVE-2023-53165

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53165

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264922 - Linux Distros Unpatched Vulnerability : CVE-2023-53176
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- serial: 8250: Reinit port->pm on port specific driver unbind When we unbind a serial port hardware specific 8250 driver, the generic serial8250 driver takes over the port. After that we see an oops about 10 seconds later. This can produce the following at least on some TI SoCs: Unhandled fault: imprecise external abort (0x1406) Internal error: : 1406 [#1] SMP ARM Turns out that we may still have the serial port hardware specific driver port->pm in use, and serial8250_pm() tries to call it after the port specific driver is gone: serial8250_pm [8250_base] from uart_change_pm+0x54/0x8c [serial_base] uart_change_pm [serial_base] from uart_hangup+0x154/0x198 [serial_base] uart_hangup [serial_base] from
__tty_hangup.part.0+0x328/0x37c __tty_hangup.part.0 from disassociate_ctty+0x154/0x20c disassociate_ctty from do_exit+0x744/0xaac do_exit from do_group_exit+0x40/0x8c do_group_exit from __wake_up_parent+0x0/0x1c Let's fix the issue by calling serial8250_set_defaults() in serial8250_unregister_port(). This will set the port back to using the serial8250 default functions, and sets the port->pm to point to serial8250_pm.
(CVE-2023-53176)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53176
https://ubuntu.com/security/CVE-2023-53176

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53176

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265134 - Linux Distros Unpatched Vulnerability : CVE-2023-53179
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can lead to the use of wrong `CIDR_POS(c)` for calculating array offsets, which can lead to integer underflow. As a result, it leads to slab out-of-bound access. This patch adds back the IP_SET_HASH_WITH_NET0 macro to ip_set_hash_netportnet to address the issue. (CVE-2023-53179)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53179
https://ubuntu.com/security/CVE-2023-53179

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53179

Plugin Information
Published: 2025/09/17, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264951 - Linux Distros Unpatched Vulnerability : CVE-2023-53181
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-resv: Stop leaking on krealloc() failure Currently dma_resv_get_fences() will leak the previously allocated array if the fence iteration got restarted and the krealloc_array() fails. Free the old array by hand, and make sure we still clear the returned *fences so the caller won't end up accessing freed memory. Some (but not all) of the callers of dma_resv_get_fences() seem to still trawl through the array even when dma_resv_get_fences() failed. And let's zero out *num_fences as well for good measure. (CVE-2023-53181)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53181
https://ubuntu.com/security/CVE-2023-53181

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-53181

Plugin Information
Published: 2025/09/16, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264981 - Linux Distros Unpatched Vulnerability : CVE-2023-53184
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: arm64/sme: Set new vector length before reallocating As part of fixing the allocation of the buffer for SVE state when changing SME vector length we introduced an immediate reallocation of the SVE state, this is also done when changing the SVE vector length for consistency. Unfortunately this reallocation is done prior to writing the new vector length to the task struct, meaning the allocation is done with the old vector length and can lead to memory corruption due to an undersized buffer being used. Move the update of the vector length before the allocation to ensure that the new vector length is taken into account. For some reason this isn't triggering any problems when running tests on the arm64 fixes branch (even after repeated tries) but is triggering issues very often after merge into mainline. (CVE-2023-53184)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53184
https://ubuntu.com/security/CVE-2023-53184

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-53184

Plugin Information
Published: 2025/09/16, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264929 - Linux Distros Unpatched Vulnerability : CVE-2023-53186
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: skbuff: Fix a race between coalescing and releasing SKBs Commit 1effe8ca4e34 (skbuff: fix coalescing for page_pool fragment recycling) allowed coalescing to proceed with non page pool page and page pool page when @from is cloned, i.e. to->pp_recycle
--> false from->pp_recycle --> true skb_cloned(from) --> true However, it actually requires skb_cloned(@from) to hold true until coalescing finishes in this situation. If the other cloned SKB is released while the merging is in process, from_shinfo->nr_frags will be set to 0 toward the end of the function, causing the increment of frag page _refcount to be unexpectedly skipped resulting in inconsistent reference counts. Later when SKB(@to) is released, it frees the page directly even though the page pool page is still in use, leading to use-after-free or double-free errors. So it should be prohibited. The double-free error message below prompted us to investigate: BUG: Bad page state in process swapper/1 pfn:0e0d1 page:00000000c6548b28 refcount:-1 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0xe0d1 flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) raw: 000fffffc0000000 0000000000000000 ffffffff00000101 0000000000000000 raw: 0000000000000002 0000000000000000 ffffffffffffffff 0000000000000000 page dumped because: nonzero _refcount CPU: 1 PID: 0 Comm: swapper/1 Tainted: G E 6.2.0+ Call Trace: <IRQ> dump_stack_lvl+0x32/0x50 bad_page+0x69/0xf0 free_pcp_prepare+0x260/0x2f0 free_unref_page+0x20/0x1c0 skb_release_data+0x10b/0x1a0 napi_consume_skb+0x56/0x150 net_rx_action+0xf0/0x350 ? __napi_schedule+0x79/0x90 __do_softirq+0xc8/0x2b1 __irq_exit_rcu+0xb9/0xf0 common_interrupt+0x82/0xa0 </IRQ> <TASK> asm_common_interrupt+0x22/0x40 RIP: 0010:default_idle+0xb/0x20 (CVE-2023-53186)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53186
https://ubuntu.com/security/CVE-2023-53186

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53186

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264973 - Linux Distros Unpatched Vulnerability : CVE-2023-53189
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipv6/addrconf: fix a potential refcount underflow for idev Now in addrconf_mod_rs_timer(), reference idev depends on whether rs_timer is not pending. Then modify rs_timer timeout. There is a time gap in [1], during which if the pending rs_timer becomes not pending. It will miss to hold idev, but the rs_timer is activated. Thus rs_timer callback function addrconf_rs_timer() will be executed and put idev later without holding idev. A refcount underflow issue for idev can be caused by this. if (!timer_pending(&idev->rs_timer)) in6_dev_hold(idev); <--------------[1] mod_timer(&idev->rs_timer, jiffies + when); To fix the issue, hold idev if mod_timer() return 0. (CVE-2023-53189)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53189
https://ubuntu.com/security/CVE-2023-53189

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53189

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265015 - Linux Distros Unpatched Vulnerability : CVE-2023-53193
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpu_irq_put call trace in gmc_v10_0_hw_fini The gmc.ecc_irq is enabled by firmware per IFWI setting, and the host driver is not privileged to enable/disable the interrupt. So, it is meaningless to use the amdgpu_irq_put function in gmc_v10_0_hw_fini, which also leads to the call trace. [ 82.340264] Call Trace: [ 82.340265] <TASK> [ 82.340269] gmc_v10_0_hw_fini+0x83/0xa0 [amdgpu] [ 82.340447] gmc_v10_0_suspend+0xe/0x20 [amdgpu] [ 82.340623] amdgpu_device_ip_suspend_phase2+0x127/0x1c0 [amdgpu] [ 82.340789] amdgpu_device_ip_suspend+0x3d/0x80 [amdgpu] [ 82.340955] amdgpu_device_pre_asic_reset+0xdd/0x2b0 [amdgpu] [ 82.341122] amdgpu_device_gpu_recover.cold+0x4dd/0xbb2 [amdgpu] [ 82.341359] amdgpu_debugfs_reset_work+0x4c/0x70 [amdgpu] [ 82.341529] process_one_work+0x21d/0x3f0 [ 82.341535] worker_thread+0x1fa/0x3c0 [ 82.341538] ? process_one_work+0x3f0/0x3f0 [ 82.341540] kthread+0xff/0x130 [ 82.341544] ? kthread_complete_and_exit+0x20/0x20 [ 82.341547] ret_from_fork+0x22/0x30 (CVE-2023-53193)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53193
https://ubuntu.com/security/CVE-2023-53193

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-53193

Plugin Information
Published: 2025/09/16, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264906 - Linux Distros Unpatched Vulnerability : CVE-2023-53201
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA/bnxt_re: wraparound mbox producer index Driver is not handling the wraparound of the mbox producer index correctly. Currently the wraparound happens once u32 max is reached. Bit 31 of the producer index register is special and should be set only once for the first command. Because the producer index overflow setting bit31 after a long time, FW goes to initialization sequence and this causes FW hang. Fix is to wraparound the mbox producer index once it reaches u16 max. (CVE-2023-53201)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53201
https://ubuntu.com/security/CVE-2023-53201

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53201

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265026 - Linux Distros Unpatched Vulnerability : CVE-2023-53205
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler We do check for target CPU == -1, but this might change at the time we are going to use it. Hold the physical target CPU in a local variable to avoid out-of-bound accesses to the cpu arrays. (CVE-2023-53205)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53205
https://ubuntu.com/security/CVE-2023-53205

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53205

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265043 - Linux Distros Unpatched Vulnerability : CVE-2023-53208
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Load L1's TSC multiplier based on L1 state, not L2 state When emulating nested VM-Exit, load L1's TSC multiplier if L1's desired ratio doesn't match the current ratio, not if the ratio L1 is using for L2 diverges from the default.
Functionally, the end result is the same as KVM will run L2 with L1's multiplier if L2's multiplier is the default, i.e. checking that L1's multiplier is loaded is equivalent to checking if L2 has a non-default multiplier. However, the assertion that TSC scaling is exposed to L1 is flawed, as userspace can trigger the WARN at will by writing the MSR and then updating guest CPUID to hide the feature (modifying guest CPUID is allowed anytime before KVM_RUN). E.g. hacking KVM's state_test selftest to do vcpu_set_msr(vcpu, MSR_AMD64_TSC_RATIO, 0); vcpu_clear_cpuid_feature(vcpu, X86_FEATURE_TSCRATEMSR); after restoring state in a new VM+vCPU yields an endless supply of: ------------[ cut here ]------------ WARNING: CPU: 10 PID:
206939 at arch/x86/kvm/svm/nested.c:1105 nested_svm_vmexit+0x6af/0x720 [kvm_amd] Call Trace:
nested_svm_exit_handled+0x102/0x1f0 [kvm_amd] svm_handle_exit+0xb9/0x180 [kvm_amd] kvm_arch_vcpu_ioctl_run+0x1eab/0x2570 [kvm] kvm_vcpu_ioctl+0x4c9/0x5b0 [kvm] ? trace_hardirqs_off+0x4d/0xa0 __se_sys_ioctl+0x7a/0xc0 __x64_sys_ioctl+0x21/0x30 do_syscall_64+0x41/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Unlike the nested VMRUN path, hoisting the svm->tsc_scaling_enabled check into the if-statement is wrong as KVM needs to ensure L1's multiplier is loaded in the above scenario. Alternatively, the WARN_ON() could simply be deleted, but that would make KVM's behavior even more subtle, e.g. it's not immediately obvious why it's safe to write MSR_AMD64_TSC_RATIO when checking only tsc_ratio_msr. (CVE-2023-53208)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53208
https://ubuntu.com/security/CVE-2023-53208

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-53208

Plugin Information
Published: 2025/09/16, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265006 - Linux Distros Unpatched Vulnerability : CVE-2023-53226
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: mwifiex: Fix OOB and integer underflow when rx packets Make sure mwifiex_process_mgmt_packet, mwifiex_process_sta_rx_packet and mwifiex_process_uap_rx_packet, mwifiex_uap_queue_bridged_pkt and mwifiex_process_rx_packet not out-of-bounds access the skb->data buffer. (CVE-2023-53226)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53226
https://ubuntu.com/security/CVE-2023-53226

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53226

Plugin Information
Published: 2025/09/16, Modified: 2025/11/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264998 - Linux Distros Unpatched Vulnerability : CVE-2023-53257
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: mac80211: check S1G action frame size Before checking the action code, check that it even exists in the frame. (CVE-2023-53257)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53257
https://security-tracker.debian.org/tracker/CVE-2023-53257
https://ubuntu.com/security/CVE-2023-53257

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53257

Plugin Information
Published: 2025/09/16, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265162 - Linux Distros Unpatched Vulnerability : CVE-2023-53265
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ubi: ensure that VID header offset + VID header size <= alloc, size Ensure that the VID header offset + VID header size does not exceed the allocated area to avoid slab OOB. BUG: KASAN: slab-out-of-bounds in crc32_body lib/crc32.c:111 [inline] BUG: KASAN: slab-out-of-bounds in crc32_le_generic lib/crc32.c:179 [inline] BUG: KASAN: slab-out-of-bounds in crc32_le_base+0x58c/0x626 lib/crc32.c:197 Read of size 4 at addr ffff88802bb36f00 by task syz-executor136/1555 CPU: 2 PID: 1555 Comm: syz-executor136 Tainted: G W 6.0.0-1868 #1 Hardware name: Red Hat KVM, BIOS 1.13.0-2.module+el8.3.0+7860+a7792d29 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x85/0xad lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold.13+0xb6/0x6bb mm/kasan/report.c:433 kasan_report+0xa7/0x11b mm/kasan/report.c:495 crc32_body lib/crc32.c:111 [inline] crc32_le_generic lib/crc32.c:179 [inline] crc32_le_base+0x58c/0x626 lib/crc32.c:197 ubi_io_write_vid_hdr+0x1b7/0x472 drivers/mtd/ubi/io.c:1067 create_vtbl+0x4d5/0x9c4 drivers/mtd/ubi/vtbl.c:317 create_empty_lvol drivers/mtd/ubi/vtbl.c:500 [inline] ubi_read_volume_table+0x67b/0x288a drivers/mtd/ubi/vtbl.c:812 ubi_attach+0xf34/0x1603 drivers/mtd/ubi/attach.c:1601 ubi_attach_mtd_dev+0x6f3/0x185e drivers/mtd/ubi/build.c:965 ctrl_cdev_ioctl+0x2db/0x347 drivers/mtd/ubi/cdev.c:1043 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x213 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3e/0x86 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0x0 RIP: 0033:0x7f96d5cf753d Code: RSP: 002b:00007fffd72206f8 EFLAGS:
00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f96d5cf753d RDX:
0000000020000080 RSI: 0000000040186f40 RDI: 0000000000000003 RBP: 0000000000400cd0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000400be0 R13:
00007fffd72207e0 R14: 0000000000000000 R15: 0000000000000000 </TASK> Allocated by task 1555:
kasan_save_stack+0x20/0x3d mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:437 [inline] ____kasan_kmalloc mm/kasan/common.c:516 [inline]
__kasan_kmalloc+0x88/0xa3 mm/kasan/common.c:525 kasan_kmalloc include/linux/kasan.h:234 [inline]
__kmalloc+0x138/0x257 mm/slub.c:4429 kmalloc include/linux/slab.h:605 [inline] ubi_alloc_vid_buf drivers/mtd/ubi/ubi.h:1093 [inline] create_vtbl+0xcc/0x9c4 drivers/mtd/ubi/vtbl.c:295 create_empty_lvol drivers/mtd/ubi/vtbl.c:500 [inline] ubi_read_volume_table+0x67b/0x288a drivers/mtd/ubi/vtbl.c:812 ubi_attach+0xf34/0x1603 drivers/mtd/ubi/attach.c:1601 ubi_attach_mtd_dev+0x6f3/0x185e drivers/mtd/ubi/build.c:965 ctrl_cdev_ioctl+0x2db/0x347 drivers/mtd/ubi/cdev.c:1043 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline]
__x64_sys_ioctl+0x193/0x213 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3e/0x86 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0x0 The buggy address belongs to the object at ffff88802bb36e00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 0 bytes to the right of 256-byte region [ffff88802bb36e00, ffff88802bb36f00) The buggy address belongs to the physical page: page:00000000ea4d1263 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2bb36 head:00000000ea4d1263 order:1 compound_mapcount:0 compound_pincount:0 flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) raw:
000fffffc0010200 ffffea000066c300 dead000000000003 ffff888100042b40 raw: 0000000000000000 00000000001
---truncated--- (CVE-2023-53265)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53265
https://ubuntu.com/security/CVE-2023-53265

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53265

Plugin Information
Published: 2025/09/17, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265180 - Linux Distros Unpatched Vulnerability : CVE-2023-53282
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write During the sysfs firmware write process, a use-after-free read warning is logged from the lpfc_wr_object() routine: BUG: KFENCE:
use-after-free read in lpfc_wr_object+0x235/0x310 [lpfc] Use-after-free read at 0x0000000000cf164d (in kfence-#111): lpfc_wr_object+0x235/0x310 [lpfc] lpfc_write_firmware.cold+0x206/0x30d [lpfc] lpfc_sli4_request_firmware_update+0xa6/0x100 [lpfc] lpfc_request_firmware_upgrade_store+0x66/0xb0 [lpfc] kernfs_fop_write_iter+0x121/0x1b0 new_sync_write+0x11c/0x1b0 vfs_write+0x1ef/0x280 ksys_write+0x5f/0xe0 do_syscall_64+0x59/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd The driver accessed wr_object pointer data, which was initialized into mailbox payload memory, after the mailbox object was released back to the mailbox pool. Fix by moving the mailbox free calls to the end of the routine ensuring that we don't reference internal mailbox memory after release. (CVE-2023-53282)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53282
https://security-tracker.debian.org/tracker/CVE-2023-53282
https://ubuntu.com/security/CVE-2023-53282

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53282

Plugin Information
Published: 2025/09/17, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265171 - Linux Distros Unpatched Vulnerability : CVE-2023-53286
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA/mlx5: Return the firmware result upon destroying QP/RQ Previously when destroying a QP/RQ, the result of the firmware destruction function was ignored and upper layers weren't informed about the failure.
Which in turn could lead to various problems since when upper layer isn't aware of the failure it continues its operation thinking that the related QP/RQ was successfully destroyed while it actually wasn't, which could lead to the below kernel WARN. Currently, we return the correct firmware destruction status to upper layers which in case of the RQ would be mlx5_ib_destroy_wq() which was already capable of handling RQ destruction failure or in case of a QP to destroy_qp_common(), which now would actually warn upon qp destruction failure. WARNING: CPU: 3 PID: 995 at drivers/infiniband/core/rdma_core.c:940 uverbs_destroy_ufile_hw+0xcb/0xe0 [ib_uverbs] Modules linked in: xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi rdma_cm ib_umad ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core overlay mlx5_core fuse CPU: 3 PID: 995 Comm: python3 Not tainted 5.16.0-rc5+ #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP:
0010:uverbs_destroy_ufile_hw+0xcb/0xe0 [ib_uverbs] Code: 41 5c 41 5d 41 5e e9 44 34 f0 e0 48 89 df e8 4c 77 ff ff 49 8b 86 10 01 00 00 48 85 c0 74 a1 4c 89 e7 ff d0 eb 9a 0f 0b eb c1 <0f> 0b be 04 00 00 00 48 89 df e8 b6 f6 ff ff e9 75 ff ff ff 90 0f RSP: 0018:ffff8881533e3e78 EFLAGS: 00010287 RAX: ffff88811b2cf3e0 RBX: ffff888106209700 RCX: 0000000000000000 RDX: ffff888106209780 RSI: ffff8881533e3d30 RDI:
ffff888109b101a0 RBP: 0000000000000001 R08: ffff888127cb381c R09: 0de9890000000009 R10: ffff888127cb3800 R11: 0000000000000000 R12: ffff888106209780 R13: ffff888106209750 R14: ffff888100f20660 R15:
0000000000000000 FS: 00007f8be353b740(0000) GS:ffff88852c980000(0000) knlGS:0000000000000000 CS: 0010 DS:
0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8bd5b117c0 CR3: 000000012cd8a004 CR4: 0000000000370ea0 DR0:
0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ib_uverbs_close+0x1a/0x90 [ib_uverbs] __fput+0x82/0x230 task_work_run+0x59/0x90 exit_to_user_mode_prepare+0x138/0x140 syscall_exit_to_user_mode+0x1d/0x50 ?
__x64_sys_close+0xe/0x40 do_syscall_64+0x4a/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP:
0033:0x7f8be3ae0abb Code: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 83 43 f9 ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 c1 43 f9 ff 8b 44 RSP: 002b:00007ffdb51909c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX:
0000557bb7f7c020 RCX: 00007f8be3ae0abb RDX: 0000557bb7c74010 RSI: 0000557bb7f14ca0 RDI: 0000000000000005 RBP: 0000557bb7fbd598 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11:
0000000000000293 R12: 0000557bb7fbd5b8 R13: 0000557bb7fbd5a8 R14: 0000000000001000 R15: 0000557bb7f7c020 </TASK> (CVE-2023-53286)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53286
https://ubuntu.com/security/CVE-2023-53286

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53286

Plugin Information
Published: 2025/09/17, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265178 - Linux Distros Unpatched Vulnerability : CVE-2023-53290
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- samples/bpf: Fix fout leak in hbm's run_bpf_prog Fix fout being fopen'ed but then not subsequently fclose'd. In the affected branch, fout is otherwise going out of scope. (CVE-2023-53290)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53290
https://ubuntu.com/security/CVE-2023-53290

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53290

Plugin Information
Published: 2025/09/17, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265210 - Linux Distros Unpatched Vulnerability : CVE-2023-53291
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale Running the 'kfree_rcu_test' test case [1] results in a splat [2]. The root cause is the kfree_scale_thread thread(s) continue running after unloading the rcuscale module. This commit fixes that isue by invoking kfree_scale_cleanup() from rcu_scale_cleanup() when removing the rcuscale module. [1] modprobe rcuscale kfree_rcu_test=1 // After some time rmmod rcuscale rmmod torture [2] BUG: unable to handle page fault for address: ffffffffc0601a87 #PF: supervisor instruction fetch in kernel mode #PF: error_code(0x0010) - not-present page PGD 11de4f067 P4D 11de4f067 PUD 11de51067 PMD 112f4d067 PTE 0 Oops: 0010 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 1798 Comm: kfree_scale_thr Not tainted 6.3.0-rc1-rcu+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 RIP:
0010:0xffffffffc0601a87 Code: Unable to access opcode bytes at 0xffffffffc0601a5d. RSP:
0018:ffffb25bc2e57e18 EFLAGS: 00010297 RAX: 0000000000000000 RBX: ffffffffc061f0b6 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff962fd0de RDI: ffffffff962fd0de RBP: ffffb25bc2e57ea8 R08:
0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000000 R14: 000000000000000a R15: 00000000001c1dbe FS: 0000000000000000(0000) GS:ffff921fa2200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
ffffffffc0601a5d CR3: 000000011de4c006 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK>
? kvfree_call_rcu+0xf0/0x3a0 ? kthread+0xf3/0x120 ? kthread_complete_and_exit+0x20/0x20 ? ret_from_fork+0x1f/0x30 </TASK> Modules linked in: rfkill sunrpc ... [last unloaded: torture] CR2:
ffffffffc0601a87 ---[ end trace 0000000000000000 ]--- (CVE-2023-53291)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53291
https://ubuntu.com/security/CVE-2023-53291

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53291

Plugin Information
Published: 2025/09/17, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265281 - Linux Distros Unpatched Vulnerability : CVE-2023-53304
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: fix overlap expiration walk The lazy gc on insert that should remove timed-out entries fails to release the other half of the interval, if any. Can be reproduced with tests/shell/testcases/sets/0044interval_overlap_0 in nftables.git and kmemleak enabled kernel. Second bug is the use of rbe_prev vs. prev pointer. If rbe_prev() returns NULL after at least one iteration, rbe_prev points to element that is not an end interval, hence it should not be removed. Lastly, check the genmask of the end interval if this is active in the current generation. (CVE-2023-53304)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53304
https://ubuntu.com/security/CVE-2023-53304

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53304

Plugin Information
Published: 2025/09/17, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265300 - Linux Distros Unpatched Vulnerability : CVE-2023-53305
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: L2CAP: Fix use-after-free Fix potential use-after-free in l2cap_le_command_rej.
(CVE-2023-53305)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53305
https://ubuntu.com/security/CVE-2023-53305

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53305

Plugin Information
Published: 2025/09/17, Modified: 2025/12/09
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265282 - Linux Distros Unpatched Vulnerability : CVE-2023-53307
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails If getting an ID or setting up a work queue in rbd_dev_create() fails, use-after-free on rbd_dev->rbd_client, rbd_dev->spec and rbd_dev->opts is triggered in do_rbd_add(). The root cause is that the ownership of these structures is transfered to rbd_dev prematurely and they all end up getting freed when rbd_dev_create() calls rbd_dev_free() prior to returning to do_rbd_add(). Found by Linux Verification Center (linuxtesting.org) with SVACE, an incomplete patch submitted by Natalia Petrova <n.petrova@fintech.ru>. (CVE-2023-53307)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53307
https://ubuntu.com/security/CVE-2023-53307

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53307

Plugin Information
Published: 2025/09/17, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265265 - Linux Distros Unpatched Vulnerability : CVE-2023-53309
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/radeon: Fix integer overflow in radeon_cs_parser_init The type of size is unsigned, if size is 0x40000000, there will be an integer overflow, size will be zero after size *= sizeof(uint32_t), will cause uninitialized memory to be referenced later (CVE-2023-53309)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53309
https://ubuntu.com/security/CVE-2023-53309

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53309

Plugin Information
Published: 2025/09/17, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265302 - Linux Distros Unpatched Vulnerability : CVE-2023-53313
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- md/raid10: fix wrong setting of max_corr_read_errors There is no input check when echo md/max_read_errors and overflow might occur. Add check of input number. (CVE-2023-53313)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53313
https://ubuntu.com/security/CVE-2023-53313

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53313

Plugin Information
Published: 2025/09/17, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265304 - Linux Distros Unpatched Vulnerability : CVE-2023-53315
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath11k: Fix SKB corruption in REO destination ring While running traffics for a long time, randomly an RX descriptor filled with value 0 from REO destination ring is received. This descriptor which is invalid causes the wrong SKB (SKB stored in the IDR lookup with buffer id 0) to be fetched which in turn causes SKB memory corruption issue and the same leads to crash after some time. Changed the start id for idr allocation to 1 and the buffer id 0 is reserved for error validation. Introduced Sanity check to validate the descriptor, before processing the SKB. Crash Signature : Unable to handle kernel paging request at virtual address 3f004900 PC points to b15_dma_inv_range+0x30/0x50 LR points to dma_cache_maint_page+0x8c/0x128. The Backtrace obtained is as follows: [<8031716c>] (b15_dma_inv_range) from [<80313a4c>] (dma_cache_maint_page+0x8c/0x128) [<80313a4c>] (dma_cache_maint_page) from [<80313b90>] (__dma_page_dev_to_cpu+0x28/0xcc) [<80313b90>] (__dma_page_dev_to_cpu) from [<7fb5dd68>] (ath11k_dp_process_rx+0x1e8/0x4a4 [ath11k]) [<7fb5dd68>] (ath11k_dp_process_rx [ath11k]) from [<7fb53c20>] (ath11k_dp_service_srng+0xb0/0x2ac [ath11k]) [<7fb53c20>] (ath11k_dp_service_srng [ath11k]) from [<7f67bba4>] (ath11k_pci_ext_grp_napi_poll+0x1c/0x78 [ath11k_pci]) [<7f67bba4>] (ath11k_pci_ext_grp_napi_poll [ath11k_pci]) from [<807d5cf4>] (__napi_poll+0x28/0xb8) [<807d5cf4>] (__napi_poll) from [<807d5f28>] (net_rx_action+0xf0/0x280) [<807d5f28>] (net_rx_action) from [<80302148>] (__do_softirq+0xd0/0x280) [<80302148>] (__do_softirq) from [<80320408>] (irq_exit+0x74/0xd4) [<80320408>] (irq_exit) from [<803638a4>] (__handle_domain_irq+0x90/0xb4) [<803638a4>] (__handle_domain_irq) from [<805bedec>] (gic_handle_irq+0x58/0x90) [<805bedec>] (gic_handle_irq) from [<80301a78>] (__irq_svc+0x58/0x8c) Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 (CVE-2023-53315)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53315
https://ubuntu.com/security/CVE-2023-53315

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53315

Plugin Information
Published: 2025/09/17, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265206 - Linux Distros Unpatched Vulnerability : CVE-2023-53327
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: iommufd/selftest: Catch overflow of uptr and length syzkaller hits a WARN_ON when trying to have a uptr close to UINTPTR_MAX: WARNING: CPU: 1 PID: 393 at drivers/iommu/iommufd/selftest.c:403 iommufd_test+0xb19/0x16f0 Modules linked in: CPU: 1 PID:
393 Comm: repro Not tainted 6.2.0-c9c3395d5e3d #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:iommufd_test+0xb19/0x16f0 Code: 94 c4 31 ff 44 89 e6 e8 a5 54 17 ff 45 84 e4 0f 85 bb 0b 00 00 41 be fb ff ff ff e8 31 53 17 ff e9 a0 f7 ff ff e8 27 53 17 ff <0f> 0b 41 be 8 RSP: 0018:ffffc90000eabdc0 EFLAGS: 00010246 RAX: 0000000000000000 RBX:
0000000000000000 RCX: ffffffff8214c487 RDX: 0000000000000000 RSI: ffff88800f5c8000 RDI: 0000000000000002 RBP: ffffc90000eabe48 R08: 0000000000000000 R09: 0000000000000001 R10: 0000000000000001 R11:
0000000000000000 R12: 00000000cd2b0000 R13: 00000000cd2af000 R14: 0000000000000000 R15: ffffc90000eabe68 FS: 00007f94d76d5740(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000043 CR3: 0000000006880006 CR4: 0000000000770ee0 PKRU: 55555554 Call Trace: <TASK> ? write_comp_data+0x2f/0x90 iommufd_fops_ioctl+0x1ef/0x310 __x64_sys_ioctl+0x10e/0x160 ? __pfx_iommufd_fops_ioctl+0x10/0x10 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Check that the user memory range doesn't overflow. (CVE-2023-53327)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53327
https://ubuntu.com/security/CVE-2023-53327

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-53327

Plugin Information
Published: 2025/09/17, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265145 - Linux Distros Unpatched Vulnerability : CVE-2023-53333
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one Eric Dumazet says:
nf_conntrack_dccp_packet() has an unique: dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); And nothing more is 'pulled' from the packet, depending on the content. dh->dccph_doff, and/or dh->dccph_x ...) So dccp_ack_seq() is happily reading stuff past the _dh buffer. BUG: KASAN: stack-out-of-bounds in nf_conntrack_dccp_packet+0x1134/0x11c0 Read of size 4 at addr ffff000128f66e0c by task syz- executor.2/29371 [..] Fix this by increasing the stack buffer to also include room for the extra sequence numbers and all the known dccp packet type headers, then pull again after the initial validation of the basic header. While at it, mark packets invalid that lack 48bit sequence bit but where RFC says the type MUST use them. Compile tested only. v2: first skb_header_pointer() now needs to adjust the size to only pull the generic header. (Eric) Heads-up: I intend to remove dccp conntrack support later this year.
(CVE-2023-53333)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53333
https://ubuntu.com/security/CVE-2023-53333

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53333

Plugin Information
Published: 2025/09/17, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265614 - Linux Distros Unpatched Vulnerability : CVE-2023-53338
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- lwt: Fix return values of BPF xmit ops BPF encap ops can return different types of positive values, such like NET_RX_DROP, NET_XMIT_CN, NETDEV_TX_BUSY, and so on, from function skb_do_redirect and bpf_lwt_xmit_reroute. At the xmit hook, such return values would be treated implicitly as LWTUNNEL_XMIT_CONTINUE in ip(6)_finish_output2. When this happens, skbs that have been freed would continue to the neighbor subsystem, causing use-after-free bug and kernel crashes. To fix the incorrect behavior, skb_do_redirect return values can be simply discarded, the same as tc-egress behavior. On the other hand, bpf_lwt_xmit_reroute returns useful errors to local senders, e.g. PMTU information. Thus convert its return values to avoid the conflict with LWTUNNEL_XMIT_CONTINUE. (CVE-2023-53338)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53338
https://ubuntu.com/security/CVE-2023-53338

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53338

Plugin Information
Published: 2025/09/20, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265629 - Linux Distros Unpatched Vulnerability : CVE-2023-53340
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Collect command failures data only for known commands DEVX can issue a general command, which is not used by mlx5 driver. In case such command is failed, mlx5 is trying to collect the failure data, However, mlx5 doesn't create a storage for this command, since mlx5 doesn't use it. This lead to array-index-out-of-bounds error. Fix it by checking whether the command is known before collecting the failure data. (CVE-2023-53340)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53340
https://ubuntu.com/security/CVE-2023-53340

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-53340

Plugin Information
Published: 2025/09/20, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265623 - Linux Distros Unpatched Vulnerability : CVE-2023-53341
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: of/fdt: run soc memory setup when early_init_dt_scan_memory fails If memory has been found early_init_dt_scan_memory now returns 1. If it hasn't found any memory it will return 0, allowing other memory setup mechanisms to carry on. Previously early_init_dt_scan_memory always returned 0 without distinguishing between any kind of memory setup being done or not. Any code path after the early_init_dt_scan memory call in the ramips plat_mem_setup code wouldn't be executed anymore. Making early_init_dt_scan_memory the only way to initialize the memory. Some boards, including my mt7621 based Cudy X6 board, depend on memory initialization being done via the soc_info.mem_detect function pointer. Those wouldn't be able to obtain memory and panic the kernel during early bootup with the message early_init_dt_alloc_memory_arch: Failed to allocate 12416 bytes align=0x40. (CVE-2023-53341)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53341
https://ubuntu.com/security/CVE-2023-53341

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-53341

Plugin Information
Published: 2025/09/20, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265636 - Linux Distros Unpatched Vulnerability : CVE-2023-53344
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write Syzkaller reported the following issue:
===================================================== BUG: KMSAN: uninit-value in aio_rw_done fs/aio.c:1520 [inline] BUG: KMSAN: uninit-value in aio_write+0x899/0x950 fs/aio.c:1600 aio_rw_done fs/aio.c:1520 [inline] aio_write+0x899/0x950 fs/aio.c:1600 io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019
__do_sys_io_submit fs/aio.c:2078 [inline] __se_sys_io_submit+0x293/0x770 fs/aio.c:2048
__x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was created at: slab_post_alloc_hook mm/slab.h:766 [inline] slab_alloc_node mm/slub.c:3452 [inline]
__kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491 __do_kmalloc_node mm/slab_common.c:967 [inline]
__kmalloc+0x11d/0x3b0 mm/slab_common.c:981 kmalloc_array include/linux/slab.h:636 [inline] bcm_tx_setup+0x80e/0x29d0 net/can/bcm.c:930 bcm_sendmsg+0x3a2/0xce0 net/can/bcm.c:1351 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] sock_write_iter+0x495/0x5e0 net/socket.c:1108 call_write_iter include/linux/fs.h:2189 [inline] aio_write+0x63a/0x950 fs/aio.c:1600 io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019 __do_sys_io_submit fs/aio.c:2078 [inline]
__se_sys_io_submit+0x293/0x770 fs/aio.c:2048 __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd CPU: 1 PID: 5034 Comm: syz-executor350 Not tainted 6.2.0-rc6-syzkaller-80422-geda666ff2276 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 ===================================================== We can follow the call chain and find that 'bcm_tx_setup' function calls 'memcpy_from_msg' to copy some content to the newly allocated frame of 'op->frames'. After that the 'len' field of copied structure being compared with some constant value (64 or 8). However, if 'memcpy_from_msg' returns an error, we will compare some uninitialized memory. This triggers 'uninit-value' issue. This patch will add 'memcpy_from_msg' possible errors processing to avoid uninit-value issue. Tested via syzkaller (CVE-2023-53344)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53344
https://ubuntu.com/security/CVE-2023-53344

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53344

Plugin Information
Published: 2025/09/20, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265615 - Linux Distros Unpatched Vulnerability : CVE-2023-53357
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- md/raid10: check slab-out-of-bounds in md_bitmap_get_counter If we write a large number to md/bitmap_set_bits, md_bitmap_checkpage() will return -EINVAL because 'page >= bitmap->pages', but the return value was not checked immediately in md_bitmap_get_counter() in order to set *blocks value and slab-out-of-bounds occurs. Move check of 'page >= bitmap->pages' to md_bitmap_get_counter() and return directly if true. (CVE-2023-53357)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53357
https://ubuntu.com/security/CVE-2023-53357

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53357

Plugin Information
Published: 2025/09/20, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265622 - Linux Distros Unpatched Vulnerability : CVE-2023-53360
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: Rework scratch handling for READ_PLUS (again) I found that the read code might send multiple requests using the same nfs_pgio_header, but nfs4_proc_read_setup() is only called once. This is how we ended up occasionally double-freeing the scratch buffer, but also means we set a NULL pointer but non-zero length to the xdr scratch buffer. This results in an oops the first time decoding needs to copy something to scratch, which frequently happens when decoding READ_PLUS hole segments. I fix this by moving scratch handling into the pageio read code. I provide a function to allocate scratch space for decoding read replies, and free the scratch buffer when the nfs_pgio_header is freed. (CVE-2023-53360)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53360
https://ubuntu.com/security/CVE-2023-53360

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-53360

Plugin Information
Published: 2025/09/20, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265675 - Linux Distros Unpatched Vulnerability : CVE-2023-53368
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tracing: Fix race issue between cpu buffer write and swap Warning happened in rb_end_commit() at code: if (RB_WARN_ON(cpu_buffer, !local_read(&cpu_buffer->committing))) WARNING: CPU: 0 PID: 139 at kernel/trace/ring_buffer.c:3142 rb_commit+0x402/0x4a0 Call Trace: ring_buffer_unlock_commit+0x42/0x250 trace_buffer_unlock_commit_regs+0x3b/0x250 trace_event_buffer_commit+0xe5/0x440 trace_event_buffer_reserve+0x11c/0x150 trace_event_raw_event_sched_switch+0x23c/0x2c0
__traceiter_sched_switch+0x59/0x80 __schedule+0x72b/0x1580 schedule+0x92/0x120 worker_thread+0xa0/0x6f0 It is because the race between writing event into cpu buffer and swapping cpu buffer through file per_cpu/cpu0/snapshot: Write on CPU 0 Swap buffer by per_cpu/cpu0/snapshot on CPU 1 -------- -------- tracing_snapshot_write() [...] ring_buffer_lock_reserve() cpu_buffer = buffer->buffers[cpu]; // 1. Suppose find 'cpu_buffer_a'; [...] rb_reserve_next_event() [...] ring_buffer_swap_cpu() if (local_read(&cpu_buffer_a->committing)) goto out_dec; if (local_read(&cpu_buffer_b->committing)) goto out_dec; buffer_a->buffers[cpu] = cpu_buffer_b; buffer_b->buffers[cpu] = cpu_buffer_a; // 2. cpu_buffer has swapped here. rb_start_commit(cpu_buffer); if (unlikely(READ_ONCE(cpu_buffer->buffer) != buffer)) { // 3. This check passed due to 'cpu_buffer->buffer' [...] // has not changed here. return NULL; } cpu_buffer_b->buffer = buffer_a; cpu_buffer_a->buffer = buffer_b; [...] // 4. Reserve event from 'cpu_buffer_a'. ring_buffer_unlock_commit() [...] cpu_buffer = buffer->buffers[cpu]; // 5. Now find 'cpu_buffer_b' !!! rb_commit(cpu_buffer) rb_end_commit() // 6. WARN for the wrong 'committing' state !!! Based on above analysis, we can easily reproduce by following testcase: ``` bash #!/bin/bash dmesg -n 7 sysctl -w kernel.panic_on_warn=1 TR=/sys/kernel/tracing echo 7 > ${TR}/buffer_size_kb echo sched:sched_switch > ${TR}/set_event while [ true ]; do echo 1 > ${TR}/per_cpu/cpu0/snapshot done &
while [ true ]; do echo 1 > ${TR}/per_cpu/cpu0/snapshot done & while [ true ]; do echo 1 >
${TR}/per_cpu/cpu0/snapshot done & ``` To fix it, IIUC, we can use smp_call_function_single() to do the swap on the target cpu where the buffer is located, so that above race would be avoided. (CVE-2023-53368)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53368
https://ubuntu.com/security/CVE-2023-53368

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.1
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53368

Plugin Information
Published: 2025/09/20, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265583 - Linux Distros Unpatched Vulnerability : CVE-2023-53369
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: dcb: choose correct policy to parse DCB_ATTR_BCN The dcbnl_bcn_setcfg uses erroneous policy to parse tb[DCB_ATTR_BCN], which is introduced in commit 859ee3c43812 (DCB: Add support for DCB BCN). Please see the comment in below code static int dcbnl_bcn_setcfg(...) { ... ret = nla_parse_nested_deprecated(..., dcbnl_pfc_up_nest, .. ) // !!! dcbnl_pfc_up_nest for attributes // DCB_PFC_UP_ATTR_0 to DCB_PFC_UP_ATTR_ALL in enum dcbnl_pfc_up_attrs ... for (i = DCB_BCN_ATTR_RP_0; i <= DCB_BCN_ATTR_RP_7;
i++) { // !!! DCB_BCN_ATTR_RP_0 to DCB_BCN_ATTR_RP_7 in enum dcbnl_bcn_attrs ... value_byte = nla_get_u8(data[i]); ... } ... for (i = DCB_BCN_ATTR_BCNA_0; i <= DCB_BCN_ATTR_RI; i++) { // !!! DCB_BCN_ATTR_BCNA_0 to DCB_BCN_ATTR_RI in enum dcbnl_bcn_attrs ... value_int = nla_get_u32(data[i]); ... } ... } That is, the nla_parse_nested_deprecated uses dcbnl_pfc_up_nest attributes to parse nlattr defined in dcbnl_pfc_up_attrs. But the following access code fetch each nlattr as dcbnl_bcn_attrs attributes. By looking up the associated nla_policy for dcbnl_bcn_attrs. We can find the beginning part of these two policies are same. static const struct nla_policy dcbnl_pfc_up_nest[...] = { [DCB_PFC_UP_ATTR_0] = {.type = NLA_U8}, [DCB_PFC_UP_ATTR_1] = {.type = NLA_U8}, [DCB_PFC_UP_ATTR_2] = {.type = NLA_U8}, [DCB_PFC_UP_ATTR_3] = {.type = NLA_U8}, [DCB_PFC_UP_ATTR_4] = {.type = NLA_U8}, [DCB_PFC_UP_ATTR_5] = {.type = NLA_U8}, [DCB_PFC_UP_ATTR_6] = {.type = NLA_U8}, [DCB_PFC_UP_ATTR_7] = {.type = NLA_U8}, [DCB_PFC_UP_ATTR_ALL] = {.type = NLA_FLAG}, }; static const struct nla_policy dcbnl_bcn_nest[...] = { [DCB_BCN_ATTR_RP_0] = {.type = NLA_U8}, [DCB_BCN_ATTR_RP_1] = {.type = NLA_U8}, [DCB_BCN_ATTR_RP_2] = {.type = NLA_U8}, [DCB_BCN_ATTR_RP_3] = {.type = NLA_U8}, [DCB_BCN_ATTR_RP_4] = {.type = NLA_U8}, [DCB_BCN_ATTR_RP_5] = {.type = NLA_U8}, [DCB_BCN_ATTR_RP_6] = {.type = NLA_U8}, [DCB_BCN_ATTR_RP_7] = {.type = NLA_U8}, [DCB_BCN_ATTR_RP_ALL] = {.type = NLA_FLAG}, // from here is somewhat different [DCB_BCN_ATTR_BCNA_0] = {.type = NLA_U32}, ... [DCB_BCN_ATTR_ALL] = {.type = NLA_FLAG}, }; Therefore, the current code is buggy and this nla_parse_nested_deprecated could overflow the dcbnl_pfc_up_nest and use the adjacent nla_policy to parse attributes from DCB_BCN_ATTR_BCNA_0. Hence use the correct policy dcbnl_bcn_nest to parse the nested tb[DCB_ATTR_BCN] TLV. (CVE-2023-53369)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53369
https://ubuntu.com/security/CVE-2023-53369

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
9.7 (CVSS2#AV:N/AC:L/Au:N/C:C/I:P/A:C)
CVSS v2.0 Temporal Score
8.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53369

Plugin Information
Published: 2025/09/20, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265597 - Linux Distros Unpatched Vulnerability : CVE-2023-53372
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: sctp: fix a potential overflow in sctp_ifwdtsn_skip Currently, when traversing ifwdtsn skips with _sctp_walk_ifwdtsn, it only checks the pos against the end of the chunk. However, the data left for the last pos may be < sizeof(struct sctp_ifwdtsn_skip), and dereference it as struct sctp_ifwdtsn_skip may cause coverflow. This patch fixes it by checking the pos against the end of the chunk - sizeof(struct sctp_ifwdtsn_skip) in sctp_ifwdtsn_skip, similar to sctp_fwdtsn_skip. (CVE-2023-53372)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53372
https://ubuntu.com/security/CVE-2023-53372

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53372

Plugin Information
Published: 2025/09/20, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265565 - Linux Distros Unpatched Vulnerability : CVE-2023-53378
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/i915/dpt: Treat the DPT BO as a framebuffer Currently i915_gem_object_is_framebuffer() doesn't treat the BO containing the framebuffer's DPT as a framebuffer itself. This means eg. that the shrinker can evict the DPT BO while leaving the actual FB BO bound, when the DPT is allocated from regular shmem. That causes an immediate oops during hibernate as we try to rewrite the PTEs inside the already evicted DPT obj. TODO: presumably this might also be the reason for the DPT related display faults under heavy memory pressure, but I'm still not sure how that would happen as the object should be pinned by intel_dpt_pin() while in active use by the display engine... (cherry picked from commit 779cb5ba64ec7df80675a956c9022929514f517a) (CVE-2023-53378)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53378
https://ubuntu.com/security/CVE-2023-53378

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-53378

Plugin Information
Published: 2025/09/19, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265546 - Linux Distros Unpatched Vulnerability : CVE-2023-53383
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4 The T241 platform suffers from the T241-FABRIC-4 erratum which causes unexpected behavior in the GIC when multiple transactions are received simultaneously from different sources. This hardware issue impacts NVIDIA server platforms that use more than two T241 chips interconnected. Each chip has support for 320 {E}SPIs. This issue occurs when multiple packets from different GICs are incorrectly interleaved at the target chip. The erratum text below specifies exactly what can cause multiple transfer packets susceptible to interleaving and GIC state corruption. GIC state corruption can lead to a range of problems, including kernel panics, and unexpected behavior. >From the erratum text: In some cases, inter-socket AXI4 Stream packets with multiple transfers, may be interleaved by the fabric when presented to ARM Generic Interrupt Controller. GIC expects all transfers of a packet to be delivered without any interleaving. The following GICv3 commands may result in multiple transfer packets over inter-socket AXI4 Stream interface: - Register reads from GICD_I* and GICD_N* - Register writes to 64-bit GICD registers other than GICD_IROUTERn* - ITS command MOVALL Multiple commands in GICv4+ utilize multiple transfer packets, including VMOVP, VMOVI, VMAPP, and 64-bit register accesses. This issue impacts system configurations with more than 2 sockets, that require multi-transfer packets to be sent over inter-socket AXI4 Stream interface between GIC instances on different sockets. GICv4 cannot be supported. GICv3 SW model can only be supported with the workaround.
Single and Dual socket configurations are not impacted by this issue and support GICv3 and GICv4. Writing to the chip alias region of the GICD_In{E} registers except GICD_ICENABLERn has an equivalent effect as writing to the global distributor. The SPI interrupt deactivate path is not impacted by the erratum. To fix this problem, implement a workaround that ensures read accesses to the GICD_In{E} registers are directed to the chip that owns the SPI, and disable GICv4.x features. To simplify code changes, the gic_configure_irq() function uses the same alias region for both read and write operations to GICD_ICFGR.
(CVE-2023-53383)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53383
https://security-tracker.debian.org/tracker/CVE-2023-53383
https://ubuntu.com/security/CVE-2023-53383

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
8.0 (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53383

Plugin Information
Published: 2025/09/19, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265607 - Linux Distros Unpatched Vulnerability : CVE-2023-53386
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix potential use-after- free when clear keys Similar to commit c5d2b6fa26b5 (Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk). We can not access k after kfree_rcu() call. (CVE-2023-53386)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53386
https://ubuntu.com/security/CVE-2023-53386

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
8.0 (CVSS2#AV:A/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
6.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53386

Plugin Information
Published: 2025/09/20, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265581 - Linux Distros Unpatched Vulnerability : CVE-2023-53391
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs As the ramfs-based tmpfs uses ramfs_init_fs_context() for the init_fs_context method, which allocates fc->s_fs_info, use ramfs_kill_sb() to free it and avoid a memory leak. (CVE-2023-53391)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53391
https://ubuntu.com/security/CVE-2023-53391

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53391

Plugin Information
Published: 2025/09/20, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265609 - Linux Distros Unpatched Vulnerability : CVE-2023-53400
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: hda: Fix Oops by 9.1 surround channel names get_line_out_pfx() may trigger an Oops by overflowing the static array with more than 8 channels. This was reported for MacBookPro 12,1 with Cirrus codec. As a workaround, extend for the 9.1 channels and also fix the potential Oops by unifying the code paths accessing the same array with the proper size check. (CVE-2023-53400)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53400
https://ubuntu.com/security/CVE-2023-53400

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53400

Plugin Information
Published: 2025/09/20, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265494 - Linux Distros Unpatched Vulnerability : CVE-2023-53426
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: xsk: Fix xsk_diag use-after-free error during socket cleanup Fix a use-after-free error that is possible if the xsk_diag interface is used after the socket has been unbound from the device. This can happen either due to the socket being closed or the device disappearing. In the early days of AF_XDP, the way we tested that a socket was not bound to a device was to simply check if the netdevice pointer in the xsk socket structure was NULL. Later, a better system was introduced by having an explicit state variable in the xsk socket struct. For example, the state of a socket that is on the way to being closed and has been unbound from the device is XSK_UNBOUND.
The commit in the Fixes tag below deleted the old way of signalling that a socket is unbound, setting dev to NULL. This in the belief that all code using the old way had been exterminated. That was unfortunately not true as the xsk diagnostics code was still using the old way and thus does not work as intended when a socket is going down. Fix this by introducing a test against the state variable. If the socket is in the state XSK_UNBOUND, simply abort the diagnostic's netlink operation. (CVE-2023-53426)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53426
https://ubuntu.com/security/CVE-2023-53426

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53426

Plugin Information
Published: 2025/09/19, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265532 - Linux Distros Unpatched Vulnerability : CVE-2023-53427
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cifs: Fix warning and UAF when destroy the MR list If the MR allocate failed, the MR recovery work not initialized and list not cleared. Then will be warning and UAF when release the MR: WARNING: CPU: 4 PID: 824 at kernel/workqueue.c:3066
__flush_work.isra.0+0xf7/0x110 CPU: 4 PID: 824 Comm: mount.cifs Not tainted 6.1.0-rc5+ #82 RIP:
0010:__flush_work.isra.0+0xf7/0x110 Call Trace: <TASK> __cancel_work_timer+0x2ba/0x2e0 smbd_destroy+0x4e1/0x990 _smbd_get_connection+0x1cbd/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0
__x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 BUG: KASAN:
use-after-free in smbd_destroy+0x4fc/0x990 Read of size 8 at addr ffff88810b156a08 by task mount.cifs/824 CPU: 4 PID: 824 Comm: mount.cifs Tainted: G W 6.1.0-rc5+ #82 Call Trace: dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 smbd_destroy+0x4fc/0x990
_smbd_get_connection+0x1cbd/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Allocated by task 824: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x7a/0x90 _smbd_get_connection+0x1b6f/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Freed by task 824: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0
__kmem_cache_free+0xc8/0x330 _smbd_get_connection+0x1c6a/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0
__x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Let's initialize the MR recovery work before MR allocate to prevent the warning, remove the MRs from the list to prevent the UAF. (CVE-2023-53427)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53427
https://ubuntu.com/security/CVE-2023-53427

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53427

Plugin Information
Published: 2025/09/19, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226658 - Linux Distros Unpatched Vulnerability : CVE-2023-5344
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1969. (CVE-2023-5344)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-5344

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0048
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-5344

Plugin Information
Published: 2025/03/05, Modified: 2025/10/08
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
265521 - Linux Distros Unpatched Vulnerability : CVE-2023-53446
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free Struct pcie_link_state->downstream is a pointer to the pci_dev of function 0. Previously we retained that pointer when removing function 0, and subsequent ASPM policy changes dereferenced it, resulting in a use-after-free warning from KASAN, e.g.: # echo 1 > /sys/bus/pci/devices/0000:03:00.0/remove # echo powersave >
/sys/module/pcie_aspm/parameters/policy BUG: KASAN: slab-use-after-free in pcie_config_aspm_link+0x42d/0x500 Call Trace: kasan_report+0xae/0xe0 pcie_config_aspm_link+0x42d/0x500 pcie_aspm_set_policy+0x8e/0x1a0 param_attr_store+0x162/0x2c0 module_attr_store+0x3e/0x80 PCIe spec r6.0, sec 7.5.3.7, recommends that software program the same ASPM Control value in all functions of multi- function devices. Disable ASPM and free the pcie_link_state when any child function is removed so we can discard the dangling pcie_link_state->downstream pointer and maintain the same ASPM Control configuration for all functions. [bhelgaas: commit log and comment] (CVE-2023-53446)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53446
https://ubuntu.com/security/CVE-2023-53446

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:C/I:P/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53446

Plugin Information
Published: 2025/09/19, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269520 - Linux Distros Unpatched Vulnerability : CVE-2023-53452
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: rtw89: fix potential race condition between napi_init and napi_enable A race condition can happen if netdev is registered, but NAPI isn't initialized yet, and meanwhile user space starts the netdev that will enable NAPI. Then, it hits BUG_ON(): kernel BUG at net/core/dev.c:6423! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 417 Comm: iwd Not tainted 6.2.7-slab-dirty #3 eb0f5a8a9d91 Hardware name: LENOVO 21DL/LNVNB161216, BIOS JPCN20WW(V1.06) 09/20/2022 RIP: 0010:napi_enable+0x3f/0x50 Code: 48 89 c2 48 83 e2 f6 f6 81 89 08 00 00 02 74 0d 48 83 ... RSP: 0018:ffffada1414f3548 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffa01425802080 RCX: 0000000000000000 RDX: 00000000000002ff RSI: ffffada14e50c614 RDI:
ffffa01425808dc0 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000100 R12: ffffa01425808f58 R13: 0000000000000000 R14: ffffa01423498940 R15:
0000000000000001 FS: 00007f5577c0a740(0000) GS:ffffa0169fc00000(0000) knlGS:0000000000000000 CS: 0010 DS:
0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5577a19972 CR3: 0000000125a7a000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> rtw89_pci_ops_start+0x1c/0x70 [rtw89_pci 6cbc75429515c181cbc386478d5cfb32ffc5a0f8] rtw89_core_start+0xbe/0x160 [rtw89_core fe07ecb874820b6d778370d4acb6ef8a37847f22] rtw89_ops_start+0x26/0x40 [rtw89_core fe07ecb874820b6d778370d4acb6ef8a37847f22] drv_start+0x42/0x100 [mac80211 c07fa22af8c3cf3f7d7ab3884ca990784d72e2d2] ieee80211_do_open+0x311/0x7d0 [mac80211 c07fa22af8c3cf3f7d7ab3884ca990784d72e2d2] ieee80211_open+0x6a/0x90 [mac80211 c07fa22af8c3cf3f7d7ab3884ca990784d72e2d2] __dev_open+0xe0/0x180 __dev_change_flags+0x1da/0x250 dev_change_flags+0x26/0x70 do_setlink+0x37c/0x12c0 ? ep_poll_callback+0x246/0x290 ?
__nla_validate_parse+0x61/0xd00 ? __wake_up_common_lock+0x8f/0xd0 To fix this, follow Jonas' suggestion to switch the order of these functions and move register netdev to be the last step of PCI probe. Also, correct the error handling of rtw89_core_register_hw(). (CVE-2023-53452)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53452
https://ubuntu.com/security/CVE-2023-53452

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53452

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269572 - Linux Distros Unpatched Vulnerability : CVE-2023-53454
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- HID: multitouch: Correct devm device reference for hidinput input_dev name Reference the HID device rather than the input device for the devm allocation of the input_dev name. Referencing the input_dev would lead to a use-after-free when the input_dev was unregistered and subsequently fires a uevent that depends on the name. At the point of firing the uevent, the name would be freed by devres management. Use devm_kasprintf to simplify the logic for allocating memory and formatting the input_dev name string.
(CVE-2023-53454)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53454
https://ubuntu.com/security/CVE-2023-53454

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0004
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53454

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269618 - Linux Distros Unpatched Vulnerability : CVE-2023-53456
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: qla4xxx: Add length check when parsing nlattrs There are three places that qla4xxx parses nlattrs: - qla4xxx_set_chap_entry() - qla4xxx_iface_set_param() - qla4xxx_sysfs_ddb_set_param() and each of them directly converts the nlattr to specific pointer of structure without length checking. This could be dangerous as those attributes are not validated and a malformed nlattr (e.g., length 0) could result in an OOB read that leaks heap dirty data. Add the nla_len check before accessing the nlattr data and return EINVAL if the length check fails. (CVE-2023-53456)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53456
https://ubuntu.com/security/CVE-2023-53456

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0004
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53456

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269535 - Linux Distros Unpatched Vulnerability : CVE-2023-53457
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- FS: JFS: Fix null-ptr-deref Read in txBegin Syzkaller reported an issue where txBegin may be called on a superblock in a read-only mounted filesystem which leads to NULL pointer deref. This could be solved by checking if the filesystem is read-only before calling txBegin, and returning with appropiate error code.
(CVE-2023-53457)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53457
https://ubuntu.com/security/CVE-2023-53457

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53457

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269599 - Linux Distros Unpatched Vulnerability : CVE-2023-53467
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix potential leak in rtw89_append_probe_req_ie() Do `kfree_skb(new)` before `goto out` to prevent potential leak.
(CVE-2023-53467)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53467
https://ubuntu.com/security/CVE-2023-53467

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53467

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269551 - Linux Distros Unpatched Vulnerability : CVE-2023-53469
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- af_unix: Fix null-ptr-deref in unix_stream_sendpage(). Bing-Jhong Billy Jheng reported null-ptr-deref in unix_stream_sendpage() with detailed analysis and a nice repro. unix_stream_sendpage() tries to add data to the last skb in the peer's recv queue without locking the queue. If the peer's FD is passed to another socket and the socket's FD is passed to the peer, there is a loop between them. If we close both sockets without receiving FD, the sockets will be cleaned up by garbage collection. The garbage collection iterates such sockets and unlinks skb with FD from the socket's receive queue under the queue's lock. So, there is a race where unix_stream_sendpage() could access an skb locklessly that is being released by garbage collection, resulting in use-after-free. To avoid the issue, unix_stream_sendpage() must lock the peer's recv queue. Note the issue does not exist in 6.5+ thanks to the recent sendpage() refactoring. This patch is originally written by Linus Torvalds. BUG: unable to handle page fault for address:
ffff988004dd6870 PF: supervisor read access in kernel mode PF: error_code(0x0000) - not-present page PGD 0 P4D 0 PREEMPT SMP PTI CPU: 4 PID: 297 Comm: garbage_uaf Not tainted 6.1.46 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP:
0010:kmem_cache_alloc_node+0xa2/0x1e0 Code: c0 0f 84 32 01 00 00 41 83 fd ff 74 10 48 8b 00 48 c1 e8 3a 41 39 c5 0f 85 1c 01 00 00 41 8b 44 24 28 49 8b 3c 24 48 8d 4a 40 <49> 8b 1c 06 4c 89 f0 65 48 0f c7 0f 0f 94 c0 84 c0 74 a1 41 8b 44 RSP: 0018:ffffc9000079fac0 EFLAGS: 00000246 RAX: 0000000000000070 RBX:
0000000000000005 RCX: 000000000001a284 RDX: 000000000001a244 RSI: 0000000000400cc0 RDI: 000000000002eee0 RBP: 0000000000400cc0 R08: 0000000000400cc0 R09: 0000000000000003 R10: 0000000000000001 R11:
0000000000000000 R12: ffff888003970f00 R13: 00000000ffffffff R14: ffff988004dd6800 R15: 00000000000000e8 FS: 00007f174d6f3600(0000) GS:ffff88807db00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff988004dd6870 CR3: 00000000092be000 CR4: 00000000007506e0 PKRU: 55555554 Call Trace: <TASK> ? __die_body.cold+0x1a/0x1f ? page_fault_oops+0xa9/0x1e0 ? fixup_exception+0x1d/0x310 ? exc_page_fault+0xa8/0x150 ? asm_exc_page_fault+0x22/0x30 ? kmem_cache_alloc_node+0xa2/0x1e0 ?
__alloc_skb+0x16c/0x1e0 __alloc_skb+0x16c/0x1e0 alloc_skb_with_frags+0x48/0x1e0 sock_alloc_send_pskb+0x234/0x270 unix_stream_sendmsg+0x1f5/0x690 sock_sendmsg+0x5d/0x60
____sys_sendmsg+0x210/0x260 ___sys_sendmsg+0x83/0xd0 ? kmem_cache_alloc+0xc6/0x1c0 ? avc_disable+0x20/0x20 ? percpu_counter_add_batch+0x53/0xc0 ? alloc_empty_file+0x5d/0xb0 ? alloc_file+0x91/0x170 ? alloc_file_pseudo+0x94/0x100 ? __fget_light+0x9f/0x120 __sys_sendmsg+0x54/0xa0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x69/0xd3 RIP: 0033:0x7f174d639a7d Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 8a c1 f4 ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 de c1 f4 ff 48 RSP: 002b:00007ffcb563ea50 EFLAGS: 00000293 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f174d639a7d RDX:
0000000000000000 RSI: 00007ffcb563eab0 RDI: 0000000000000007 RBP: 00007ffcb563eb10 R08: 0000000000000000 R09: 00000000ffffffff R10: 00000000004040a0 R11: 0000000000000293 R12: 00007ffcb563ec28 R13:
0000000000401398 R14: 0000000000403e00 R15: 00007f174d72c000 </TASK> (CVE-2023-53469)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53469
https://security-tracker.debian.org/tracker/CVE-2023-53469
https://ubuntu.com/security/CVE-2023-53469

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53469

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269540 - Linux Distros Unpatched Vulnerability : CVE-2023-53484
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- lib: cpu_rmap: Avoid use after free on rmap->obj array entries When calling irq_set_affinity_notifier() with NULL at the notify argument, it will cause freeing of the glue pointer in the corresponding array entry but will leave the pointer in the array. A subsequent call to free_irq_cpu_rmap() will try to free this entry again leading to possible use after free. Fix that by setting NULL to the array entry and checking that we have non-zero at the array entry when iterating over the array in free_irq_cpu_rmap().
The current code does not suffer from this since there are no cases where irq_set_affinity_notifier(irq, NULL) (note the NULL passed for the notify arg) is called, followed by a call to free_irq_cpu_rmap() so we don't hit and issue. Subsequent patches in this series excersize this flow, hence the required fix.
(CVE-2023-53484)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53484
https://ubuntu.com/security/CVE-2023-53484

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53484

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269517 - Linux Distros Unpatched Vulnerability : CVE-2023-53494
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- crypto: xts - Handle EBUSY correctly As it is xts only handles the special return value of EINPROGRESS, which means that in all other cases it will free data related to the request. However, as the caller of xts may specify MAY_BACKLOG, we also need to expect EBUSY and treat it in the same way. Otherwise backlogged requests will trigger a use-after-free. (CVE-2023-53494)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53494
https://ubuntu.com/security/CVE-2023-53494

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53494

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269614 - Linux Distros Unpatched Vulnerability : CVE-2023-53500
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xfrm: fix slab-use-after-free in decode_session6 When the xfrm device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when the xfrm device sends IPv6 packets. The stack information is as follows: BUG: KASAN: slab-use-after-free in decode_session6+0x103f/0x1890 Read of size 1 at addr ffff8881111458ef by task swapper/3/0 CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.4.0-next-20230707 #409 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <IRQ> dump_stack_lvl+0xd9/0x150 print_address_description.constprop.0+0x2c/0x3c0 kasan_report+0x11d/0x130 decode_session6+0x103f/0x1890
__xfrm_decode_session+0x54/0xb0 xfrmi_xmit+0x173/0x1ca0 dev_hard_start_xmit+0x187/0x700 sch_direct_xmit+0x1a3/0xc30 __qdisc_run+0x510/0x17a0 __dev_queue_xmit+0x2215/0x3b10 neigh_connected_output+0x3c2/0x550 ip6_finish_output2+0x55a/0x1550 ip6_finish_output+0x6b9/0x1270 ip6_output+0x1f1/0x540 ndisc_send_skb+0xa63/0x1890 ndisc_send_rs+0x132/0x6f0 addrconf_rs_timer+0x3f1/0x870 call_timer_fn+0x1a0/0x580 expire_timers+0x29b/0x4b0 run_timer_softirq+0x326/0x910 __do_softirq+0x1d4/0x905 irq_exit_rcu+0xb7/0x120 sysvec_apic_timer_interrupt+0x97/0xc0 </IRQ> <TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:intel_idle_hlt+0x23/0x30 Code: 1f 84 00 00 00 00 00 f3 0f 1e fa 41 54 41 89 d4 0f 1f 44 00 00 66 90 0f 1f 44 00 00 0f 00 2d c4 9f ab 00 0f 1f 44 00 00 fb f4 <fa>
44 89 e0 41 5c c3 66 0f 1f 44 00 00 f3 0f 1e fa 41 54 41 89 d4 RSP: 0018:ffffc90000197d78 EFLAGS: 00000246 RAX: 00000000000a83c3 RBX: ffffe8ffffd09c50 RCX: ffffffff8a22d8e5 RDX: 0000000000000001 RSI:
ffffffff8d3f8080 RDI: ffffe8ffffd09c50 RBP: ffffffff8d3f8080 R08: 0000000000000001 R09: ffffed1026ba6d9d R10: ffff888135d36ceb R11: 0000000000000001 R12: 0000000000000001 R13: ffffffff8d3f8100 R14:
0000000000000001 R15: 0000000000000000 cpuidle_enter_state+0xd3/0x6f0 cpuidle_enter+0x4e/0xa0 do_idle+0x2fe/0x3c0 cpu_startup_entry+0x18/0x20 start_secondary+0x200/0x290 secondary_startup_64_no_verify+0x167/0x16b </TASK> Allocated by task 939: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 __kasan_slab_alloc+0x7f/0x90 kmem_cache_alloc_node+0x1cd/0x410 kmalloc_reserve+0x165/0x270 __alloc_skb+0x129/0x330 inet6_ifa_notify+0x118/0x230
__ipv6_ifa_notify+0x177/0xbe0 addrconf_dad_completed+0x133/0xe00 addrconf_dad_work+0x764/0x1390 process_one_work+0xa32/0x16f0 worker_thread+0x67d/0x10c0 kthread+0x344/0x440 ret_from_fork+0x1f/0x30 The buggy address belongs to the object at ffff888111145800 which belongs to the cache skbuff_small_head of size 640 The buggy address is located 239 bytes inside of freed 640-byte region [ffff888111145800, ffff888111145a80) As commit f855691975bb (xfrm6: Fix the nexthdr offset in _decode_session6.) showed, xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets. (CVE-2023-53500)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53500
https://ubuntu.com/security/CVE-2023-53500

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53500

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269595 - Linux Distros Unpatched Vulnerability : CVE-2023-53510
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: ufs: core: Fix handling of lrbp->cmd ufshcd_queuecommand() may be called two times in a row for a SCSI command before it is completed. Hence make the following changes: - In the functions that submit a command, do not check the old value of lrbp->cmd nor clear lrbp->cmd in error paths. - In ufshcd_release_scsi_cmd(), do not clear lrbp->cmd. See also scsi_send_eh_cmnd(). This commit prevents that the following appears if a command times out: WARNING: at drivers/ufs/core/ufshcd.c:2965 ufshcd_queuecommand+0x6f8/0x9a8 Call trace: ufshcd_queuecommand+0x6f8/0x9a8 scsi_send_eh_cmnd+0x2c0/0x960 scsi_eh_test_devices+0x100/0x314 scsi_eh_ready_devs+0xd90/0x114c scsi_error_handler+0x2b4/0xb70 kthread+0x16c/0x1e0 (CVE-2023-53510)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53510
https://security-tracker.debian.org/tracker/CVE-2023-53510
https://ubuntu.com/security/CVE-2023-53510

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53510

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269581 - Linux Distros Unpatched Vulnerability : CVE-2023-53513
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nbd: fix incomplete validation of ioctl arg We tested and found an alarm caused by nbd_ioctl arg without verification. The UBSAN warning calltrace like below: UBSAN: Undefined behaviour in fs/buffer.c:1709:35 signed integer overflow: -9223372036854775808 - 1 cannot be represented in type 'long long int' CPU: 3 PID: 2523 Comm: syz-executor.0 Not tainted 4.19.90 #1 Hardware name: linux,dummy-virt (DT) Call trace:
dump_backtrace+0x0/0x3f0 arch/arm64/kernel/time.c:78 show_stack+0x28/0x38 arch/arm64/kernel/traps.c:158
__dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x170/0x1dc lib/dump_stack.c:118 ubsan_epilogue+0x18/0xb4 lib/ubsan.c:161 handle_overflow+0x188/0x1dc lib/ubsan.c:192
__ubsan_handle_sub_overflow+0x34/0x44 lib/ubsan.c:206 __block_write_full_page+0x94c/0xa20 fs/buffer.c:1709 block_write_full_page+0x1f0/0x280 fs/buffer.c:2934 blkdev_writepage+0x34/0x40 fs/block_dev.c:607
__writepage+0x68/0xe8 mm/page-writeback.c:2305 write_cache_pages+0x44c/0xc70 mm/page-writeback.c:2240 generic_writepages+0xdc/0x148 mm/page-writeback.c:2329 blkdev_writepages+0x2c/0x38 fs/block_dev.c:2114 do_writepages+0xd4/0x250 mm/page-writeback.c:2344 The reason for triggering this warning is
__block_write_full_page() -> i_size_read(inode) - 1 overflow. inode->i_size is assigned in __nbd_ioctl()
-> nbd_set_size() -> bytesize. We think it is necessary to limit the size of arg to prevent errors.
Moreover, __nbd_ioctl() -> nbd_add_socket(), arg will be cast to int. Assuming the value of arg is 0x80000000000000001) (on a 64-bit machine), it will become 1 after the coercion, which will return unexpected results. Fix it by adding checks to prevent passing in too large numbers. (CVE-2023-53513)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53513
https://security-tracker.debian.org/tracker/CVE-2023-53513
https://ubuntu.com/security/CVE-2023-53513

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53513

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269593 - Linux Distros Unpatched Vulnerability : CVE-2023-53515
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- virtio-mmio: don't break lifecycle of vm_dev vm_dev has a separate lifecycle because it has a 'struct device' embedded. Thus, having a release callback for it is correct. Allocating the vm_dev struct with devres totally breaks this protection, though. Instead of waiting for the vm_dev release callback, the memory is freed when the platform_device is removed. Resulting in a use-after-free when finally the callback is to be called. To easily see the problem, compile the kernel with CONFIG_DEBUG_KOBJECT_RELEASE and unbind with sysfs. The fix is easy, don't use devres in this case. Found during my research about object lifetime problems. (CVE-2023-53515)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53515
https://ubuntu.com/security/CVE-2023-53515

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53515

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269639 - Linux Distros Unpatched Vulnerability : CVE-2023-53516
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF The previous commit 954d1fa1ac93 (macvlan: Add netlink attribute for broadcast cutoff) added one additional attribute named IFLA_MACVLAN_BC_CUTOFF to allow broadcast cutfoff. However, it forgot to describe the nla_policy at macvlan_policy (drivers/net/macvlan.c). Hence, this suppose NLA_S32 (4 bytes) integer can be faked as empty (0 bytes) by a malicious user, which could leads to OOB in heap just like CVE-2023-3773. To fix it, this commit just completes the nla_policy description for IFLA_MACVLAN_BC_CUTOFF. This enforces the length check and avoids the potential OOB read. (CVE-2023-53516)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53516
https://ubuntu.com/security/CVE-2023-53516

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53516

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269636 - Linux Distros Unpatched Vulnerability : CVE-2023-53518
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- PM / devfreq: Fix leak in devfreq_dev_release() srcu_init_notifier_head() allocates resources that need to be released with a srcu_cleanup_notifier_head() call. Reported by kmemleak. (CVE-2023-53518)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53518
https://ubuntu.com/security/CVE-2023-53518

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53518

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269529 - Linux Distros Unpatched Vulnerability : CVE-2023-53524
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf An integer overflow occurs in the iwl_write_to_user_buf() function, which is called by the iwl_dbgfs_monitor_data_read() function. static bool iwl_write_to_user_buf(char __user *user_buf, ssize_t count, void *buf, ssize_t *size, ssize_t
*bytes_copied) { int buf_size_left = count - *bytes_copied; buf_size_left = buf_size_left - (buf_size_left % sizeof(u32)); if (*size > buf_size_left) *size = buf_size_left; If the user passes a SIZE_MAX value to the ssize_t count parameter, the ssize_t count parameter is assigned to int buf_size_left. Then compare *size with buf_size_left . Here, buf_size_left is a negative number, so *size is assigned buf_size_left and goes into the third argument of the copy_to_user function, causing a heap overflow.
This is not a security vulnerability because iwl_dbgfs_monitor_data_read() is a debugfs operation with 0400 privileges. (CVE-2023-53524)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53524
https://ubuntu.com/security/CVE-2023-53524

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53524

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269522 - Linux Distros Unpatched Vulnerability : CVE-2023-53525
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Allow UD qp_type to join multicast only As for multicast: - The SIDR is the only mode that makes sense; - Besides PS_UDP, other port spaces like PS_IB is also allowed, as it is UD compatible. In this case qkey also needs to be set [1]. This patch allows only UD qp_type to join multicast, and set qkey to default if it's not set, to fix an uninit-value error: the ib->rec.qkey field is accessed without being initialized.
===================================================== BUG: KMSAN: uninit-value in cma_set_qkey drivers/infiniband/core/cma.c:510 [inline] BUG: KMSAN: uninit-value in cma_make_mc_event+0xb73/0xe00 drivers/infiniband/core/cma.c:4570 cma_set_qkey drivers/infiniband/core/cma.c:510 [inline] cma_make_mc_event+0xb73/0xe00 drivers/infiniband/core/cma.c:4570 cma_iboe_join_multicast drivers/infiniband/core/cma.c:4782 [inline] rdma_join_multicast+0x2b83/0x30a0 drivers/infiniband/core/cma.c:4814 ucma_process_join+0xa76/0xf60 drivers/infiniband/core/ucma.c:1479 ucma_join_multicast+0x1e3/0x250 drivers/infiniband/core/ucma.c:1546 ucma_write+0x639/0x6d0 drivers/infiniband/core/ucma.c:1732 vfs_write+0x8ce/0x2030 fs/read_write.c:588 ksys_write+0x28c/0x520 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __ia32_sys_write+0xdb/0x120 fs/read_write.c:652 do_syscall_32_irqs_on arch/x86/entry/common.c:114 [inline] __do_fast_syscall_32+0x96/0xf0 arch/x86/entry/common.c:180 do_fast_syscall_32+0x34/0x70 arch/x86/entry/common.c:205 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:248 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c Local variable ib.i created at: cma_iboe_join_multicast drivers/infiniband/core/cma.c:4737 [inline] rdma_join_multicast+0x586/0x30a0 drivers/infiniband/core/cma.c:4814 ucma_process_join+0xa76/0xf60 drivers/infiniband/core/ucma.c:1479 CPU:
0 PID: 29874 Comm: syz-executor.3 Not tainted 5.16.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ===================================================== [1] https://lore.kernel.org/linux-rdma/20220117183832.GD84788@nvidia.com/ (CVE-2023-53525)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53525
https://ubuntu.com/security/CVE-2023-53525

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53525

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269611 - Linux Distros Unpatched Vulnerability : CVE-2023-53526
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: jbd2: check 'jh->b_transaction' before removing it from checkpoint Following process will corrupt ext4 image: Step 1:
jbd2_journal_commit_transaction __jbd2_journal_insert_checkpoint(jh, commit_transaction) // Put jh into trans1->t_checkpoint_list journal->j_checkpoint_transactions = commit_transaction // Put trans1 into journal->j_checkpoint_transactions Step 2: do_get_write_access test_clear_buffer_dirty(bh) // clear buffer dirtyset jbd dirty __jbd2_journal_file_buffer(jh, transaction) // jh belongs to trans2 Step 3: drop_cache journal_shrink_one_cp_list jbd2_journal_try_remove_checkpoint if (!trylock_buffer(bh)) // lock bh, true if (buffer_dirty(bh)) // buffer is not dirty __jbd2_journal_remove_checkpoint(jh) // remove jh from trans1->t_checkpoint_list Step 4: jbd2_log_do_checkpoint trans1 = journal->j_checkpoint_transactions // jh is not in trans1->t_checkpoint_list jbd2_cleanup_journal_tail(journal) // trans1 is done Step 5: Power cut, trans2 is not committed, jh is lost in next mounting. Fix it by checking 'jh->b_transaction' before remove it from checkpoint. (CVE-2023-53526)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53526
https://ubuntu.com/security/CVE-2023-53526

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53526

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269571 - Linux Distros Unpatched Vulnerability : CVE-2023-53528
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix unsafe drain work queue code If create_qp does not fully succeed it is possible for qp cleanup code to attempt to drain the send or recv work queues before the queues have been created causing a seg fault. This patch checks to see if the queues exist before attempting to drain them. (CVE-2023-53528)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53528
https://ubuntu.com/security/CVE-2023-53528

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53528

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269598 - Linux Distros Unpatched Vulnerability : CVE-2023-53530
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id() The following call trace was observed: localhost kernel: nvme nvme0: NVME-FC{0}: controller connect complete localhost kernel: BUG:
using smp_processor_id() in preemptible [00000000] code: kworker/u129:4/75092 localhost kernel: nvme nvme0: NVME-FC{0}: new ctrl: NQN nqn.1992-08.com.netapp:sn.b42d198afb4d11ecad6d00a098d6abfa:subsystem.PR_Channel2022_RH84_subsystem_291 localhost kernel: caller is qla_nvme_post_cmd+0x216/0x1380 [qla2xxx] localhost kernel: CPU: 6 PID: 75092 Comm: kworker/u129:4 Kdump: loaded Tainted: G B W OE --------- --- 5.14.0-70.22.1.el9_0.x86_64+debug #1 localhost kernel: Hardware name: HPE ProLiant XL420 Gen10/ProLiant XL420 Gen10, BIOS U39 01/13/2022 localhost kernel: Workqueue: nvme-wq nvme_async_event_work [nvme_core] localhost kernel: Call Trace:
localhost kernel: dump_stack_lvl+0x57/0x7d localhost kernel: check_preemption_disabled+0xc8/0xd0 localhost kernel: qla_nvme_post_cmd+0x216/0x1380 [qla2xxx] Use raw_smp_processor_id() instead of smp_processor_id().
Also use queue_work() across the driver instead of queue_work_on() thus avoiding usage of smp_processor_id() when CONFIG_DEBUG_PREEMPT is enabled. (CVE-2023-53530)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53530
https://security-tracker.debian.org/tracker/CVE-2023-53530
https://ubuntu.com/security/CVE-2023-53530

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53530

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269350 - Linux Distros Unpatched Vulnerability : CVE-2023-53548
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb The syzbot fuzzer identified a problem in the usbnet driver: usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 754 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Modules linked in: CPU:
0 PID: 754 Comm: kworker/0:2 Not tainted 6.4.0-rc7-syzkaller-00014-g692b7dc87ca6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Workqueue: mld mld_ifc_work RIP:
0010:usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Code: 7c 24 18 e8 2c b4 5b fb 48 8b 7c 24 18 e8 42 07 f0 fe 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 a0 c9 fc 8a e8 5a 6f 23 fb <0f> 0b e9 58 f8 ff ff e8 fe b3 5b fb 48 81 c5 c0 05 00 00 e9 84 f7 RSP: 0018:ffffc9000463f568 EFLAGS: 00010086 RAX:
0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: ffff88801eb28000 RSI: ffffffff814c03b7 RDI: 0000000000000001 RBP: ffff8881443b7190 R08: 0000000000000001 R09: 0000000000000000 R10:
0000000000000000 R11: 0000000000000001 R12: 0000000000000003 R13: ffff88802a77cb18 R14: 0000000000000003 R15: ffff888018262500 FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000556a99c15a18 CR3: 0000000028c71000 CR4: 0000000000350ef0 Call Trace: <TASK> usbnet_start_xmit+0xfe5/0x2190 drivers/net/usb/usbnet.c:1453 __netdev_start_xmit include/linux/netdevice.h:4918 [inline] netdev_start_xmit include/linux/netdevice.h:4932 [inline] xmit_one net/core/dev.c:3578 [inline] dev_hard_start_xmit+0x187/0x700 net/core/dev.c:3594 ... This bug is caused by the fact that usbnet trusts the bulk endpoint addresses its probe routine receives in the driver_info structure, and it does not check to see that these endpoints actually exist and have the expected type and directions. The fix is simply to add such a check. (CVE-2023-53548)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53548
https://ubuntu.com/security/CVE-2023-53548

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53548

Plugin Information
Published: 2025/10/08, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269334 - Linux Distros Unpatched Vulnerability : CVE-2023-53550
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cpufreq: amd-pstate: fix global sysfs attribute type In commit 3666062b87ec (cpufreq: amd-pstate: move to use bus_get_dev_root()) the amd_pstate attributes where moved from a dedicated kobject to the cpu root kobject. While the dedicated kobject expects to contain kobj_attributes the root kobject needs device_attributes. As the changed arguments are not used by the callbacks it works most of the time. However CFI will detect this issue: [ 4947.849350] CFI failure at dev_attr_show+0x24/0x60 (target: show_status+0x0/0x70; expected type:
0x8651b1de) ... [ 4947.849409] Call Trace: [ 4947.849410] <TASK> [ 4947.849411] ? __warn+0xcf/0x1c0 [ 4947.849414] ? dev_attr_show+0x24/0x60 [ 4947.849415] ? report_cfi_failure+0x4e/0x60 [ 4947.849417] ? handle_cfi_failure+0x14c/0x1d0 [ 4947.849419] ? __cfi_show_status+0x10/0x10 [ 4947.849420] ? handle_bug+0x4f/0x90 [ 4947.849421] ? exc_invalid_op+0x1a/0x60 [ 4947.849422] ? asm_exc_invalid_op+0x1a/0x20 [ 4947.849424] ? __cfi_show_status+0x10/0x10 [ 4947.849425] ? dev_attr_show+0x24/0x60 [ 4947.849426] sysfs_kf_seq_show+0xa6/0x110 [ 4947.849433] seq_read_iter+0x16c/0x4b0 [ 4947.849436] vfs_read+0x272/0x2d0 [ 4947.849438] ksys_read+0x72/0xe0 [ 4947.849439] do_syscall_64+0x76/0xb0 [ 4947.849440] ? do_user_addr_fault+0x252/0x650 [ 4947.849442] ? exc_page_fault+0x7a/0x1b0 [ 4947.849443] entry_SYSCALL_64_after_hwframe+0x72/0xdc (CVE-2023-53550)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53550
https://ubuntu.com/security/CVE-2023-53550

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53550

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269406 - Linux Distros Unpatched Vulnerability : CVE-2023-53560
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Add histograms to hist_vars if they have referenced variables Hist triggers can have referenced variables without having direct variables fields. This can be the case if referenced variables are added for trigger actions. In this case the newly added references will not have field variables. Not taking such referenced variables into consideration can result in a bug where it would be possible to remove hist trigger with variables being refenced. This will result in a bug that is easily reproducable like so $ cd /sys/kernel/tracing $ echo 'synthetic_sys_enter char[] comm; long id' >> synthetic_events $ echo 'hist:keys=common_pid.execname,id.syscall:vals=hitcount:comm=common_pid.execname' >>
events/raw_syscalls/sys_enter/trigger $ echo 'hist:keys=common_pid.execname,id.syscall:onmatch(raw_syscalls.sys_enter).synthetic_sys_enter($comm, id)'
>> events/raw_syscalls/sys_enter/trigger $ echo '!hist:keys=common_pid.execname,id.syscall:vals=hitcount:comm=common_pid.execname' >>
events/raw_syscalls/sys_enter/trigger [ 100.263533] ================================================================== [ 100.264634] BUG: KASAN: slab-use- after-free in resolve_var_refs+0xc7/0x180 [ 100.265520] Read of size 8 at addr ffff88810375d0f0 by task bash/439 [ 100.266320] [ 100.266533] CPU: 2 PID: 439 Comm: bash Not tainted 6.5.0-rc1 #4 [ 100.267277] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-20220807_005459-localhost 04/01/2014 [ 100.268561] Call Trace: [ 100.268902] <TASK> [ 100.269189] dump_stack_lvl+0x4c/0x70 [ 100.269680] print_report+0xc5/0x600 [ 100.270165] ? resolve_var_refs+0xc7/0x180 [ 100.270697] ? kasan_complete_mode_report_info+0x80/0x1f0 [ 100.271389] ? resolve_var_refs+0xc7/0x180 [ 100.271913] kasan_report+0xbd/0x100 [ 100.272380] ? resolve_var_refs+0xc7/0x180 [ 100.272920] __asan_load8+0x71/0xa0 [ 100.273377] resolve_var_refs+0xc7/0x180 [ 100.273888] event_hist_trigger+0x749/0x860 [ 100.274505] ? kasan_save_stack+0x2a/0x50 [ 100.275024] ? kasan_set_track+0x29/0x40 [ 100.275536] ?
__pfx_event_hist_trigger+0x10/0x10 [ 100.276138] ? ksys_write+0xd1/0x170 [ 100.276607] ? do_syscall_64+0x3c/0x90 [ 100.277099] ? entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 100.277771] ? destroy_hist_data+0x446/0x470 [ 100.278324] ? event_hist_trigger_parse+0xa6c/0x3860 [ 100.278962] ?
__pfx_event_hist_trigger_parse+0x10/0x10 [ 100.279627] ? __kasan_check_write+0x18/0x20 [ 100.280177] ? mutex_unlock+0x85/0xd0 [ 100.280660] ? __pfx_mutex_unlock+0x10/0x10 [ 100.281200] ? kfree+0x7b/0x120 [ 100.281619] ? ____kasan_slab_free+0x15d/0x1d0 [ 100.282197] ? event_trigger_write+0xac/0x100 [ 100.282764] ? __kasan_slab_free+0x16/0x20 [ 100.283293] ? __kmem_cache_free+0x153/0x2f0 [ 100.283844] ? sched_mm_cid_remote_clear+0xb1/0x250 [ 100.284550] ? __pfx_sched_mm_cid_remote_clear+0x10/0x10 [ 100.285221] ? event_trigger_write+0xbc/0x100 [ 100.285781] ? __kasan_check_read+0x15/0x20 [ 100.286321] ?
__bitmap_weight+0x66/0xa0 [ 100.286833] ? _find_next_bit+0x46/0xe0 [ 100.287334] ? task_mm_cid_work+0x37f/0x450 [ 100.287872] event_triggers_call+0x84/0x150 [ 100.288408] trace_event_buffer_commit+0x339/0x430 [ 100.289073] ? ring_buffer_event_data+0x3f/0x60 [ 100.292189] trace_event_raw_event_sys_enter+0x8b/0xe0 [ 100.295434] syscall_trace_enter.constprop.0+0x18f/0x1b0 [ 100.298653] syscall_enter_from_user_mode+0x32/0x40 [ 100.301808] do_syscall_64+0x1a/0x90 [ 100.304748] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 100.307775] RIP: 0033:0x7f686c75c1cb [ 100.310617] Code: 73 01 c3 48 8b 0d 65 3c 10 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 21 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 35 3c 10 00 f7 d8 64 89 01 48 [ 100.317847] RSP:
002b:00007ffc60137a38 EFLAGS: 00000246 ORIG_RAX: 0000000000000021 [ 100.321200] RA ---truncated--- (CVE-2023-53560)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53560
https://ubuntu.com/security/CVE-2023-53560

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.2 (CVSS2#AV:L/AC:L/Au:S/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53560

Plugin Information
Published: 2025/10/08, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269362 - Linux Distros Unpatched Vulnerability : CVE-2023-53587
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ring-buffer: Sync IRQ works before buffer destruction If something was written to the buffer just before destruction, it may be possible (maybe not in a real system, but it did happen in ARCH=um with time- travel) to destroy the ringbuffer before the IRQ work ran, leading this KASAN report (or a crash without KASAN): BUG: KASAN: slab-use-after-free in irq_work_run_list+0x11a/0x13a Read of size 8 at addr 000000006d640a48 by task swapper/0 CPU: 0 PID: 0 Comm: swapper Tainted: G W O 6.3.0-rc1 #7 Stack: 60c4f20f 0c203d48 41b58ab3 60f224fc 600477fa 60f35687 60c4f20f 601273dd 00000008 6101eb00 6101eab0 615be548 Call Trace: [<60047a58>] show_stack+0x25e/0x282 [<60c609e0>] dump_stack_lvl+0x96/0xfd [<60c50d4c>] print_report+0x1a7/0x5a8 [<603078d3>] kasan_report+0xc1/0xe9 [<60308950>]
__asan_report_load8_noabort+0x1b/0x1d [<60232844>] irq_work_run_list+0x11a/0x13a [<602328b4>] irq_work_tick+0x24/0x34 [<6017f9dc>] update_process_times+0x162/0x196 [<6019f335>] tick_sched_handle+0x1a4/0x1c3 [<6019fd9e>] tick_sched_timer+0x79/0x10c [<601812b9>]
__hrtimer_run_queues.constprop.0+0x425/0x695 [<60182913>] hrtimer_interrupt+0x16c/0x2c4 [<600486a3>] um_timer+0x164/0x183 [...] Allocated by task 411: save_stack_trace+0x99/0xb5 stack_trace_save+0x81/0x9b kasan_save_stack+0x2d/0x54 kasan_set_track+0x34/0x3e kasan_save_alloc_info+0x25/0x28
____kasan_kmalloc+0x8b/0x97 __kasan_kmalloc+0x10/0x12 __kmalloc+0xb2/0xe8 load_elf_phdrs+0xee/0x182 [...] The buggy address belongs to the object at 000000006d640800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 584 bytes inside of freed 1024-byte region [000000006d640800, 000000006d640c00) Add the appropriate irq_work_sync() so the work finishes before the buffers are destroyed. Prior to the commit in the Fixes tag below, there was only a single global IRQ work, so this issue didn't exist. (CVE-2023-53587)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53587
https://ubuntu.com/security/CVE-2023-53587

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53587

Plugin Information
Published: 2025/10/08, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269422 - Linux Distros Unpatched Vulnerability : CVE-2023-53588
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: mac80211: check for station first in client probe When probing a client, first check if we have it, and then check for the channel context, otherwise you can trigger the warning there easily by probing when the AP isn't even started yet. Since a client existing means the AP is also operating, we can then keep the warning. Also simplify the moved code a bit. (CVE-2023-53588)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53588
https://security-tracker.debian.org/tracker/CVE-2023-53588
https://ubuntu.com/security/CVE-2023-53588

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53588

Plugin Information
Published: 2025/10/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269340 - Linux Distros Unpatched Vulnerability : CVE-2023-53610
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: irqchip: Fix refcount leak in platform_irqchip_probe of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak.
(CVE-2023-53610)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53610
https://ubuntu.com/security/CVE-2023-53610

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53610

Plugin Information
Published: 2025/10/08, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
270148 - Linux Distros Unpatched Vulnerability : CVE-2023-53619
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfilter: conntrack: Avoid nf_ct_helper_hash uses after free If nf_conntrack_init_start() fails (for example due to a register_nf_conntrack_bpf() failure), the nf_conntrack_helper_fini() clean-up path frees the nf_ct_helper_hash map. When built with NF_CONNTRACK=y, further netfilter modules (e.g:
netfilter_conntrack_ftp) can still be loaded and call nf_conntrack_helpers_register(), independently of whether nf_conntrack initialized correctly. This accesses the nf_ct_helper_hash dangling pointer and causes a uaf, possibly leading to random memory corruption. This patch guards nf_conntrack_helper_register() from accessing a freed or uninitialized nf_ct_helper_hash pointer and fixes possible uses-after-free when loading a conntrack module. (CVE-2023-53619)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53619
https://ubuntu.com/security/CVE-2023-53619

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53619

Plugin Information
Published: 2025/10/13, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
270168 - Linux Distros Unpatched Vulnerability : CVE-2023-53629
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fs: dlm: fix use after free in midcomms commit While working on processing dlm message in softirq context I experienced the following KASAN use-after-free warning: [ 151.760477] ================================================================== [ 151.761803] BUG: KASAN: use-after- free in dlm_midcomms_commit_mhandle+0x19d/0x4b0 [ 151.763414] Read of size 4 at addr ffff88811a980c60 by task lock_torture/1347 [ 151.765284] CPU: 7 PID: 1347 Comm: lock_torture Not tainted 6.1.0-rc4+ #2828 [ 151.766778] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-3.module+el8.7.0+16134+e5908aa2 04/01/2014 [ 151.768726] Call Trace: [ 151.769277] <TASK> [ 151.769748] dump_stack_lvl+0x5b/0x86 [ 151.770556] print_report+0x180/0x4c8 [ 151.771378] ? kasan_complete_mode_report_info+0x7c/0x1e0 [ 151.772241] ? dlm_midcomms_commit_mhandle+0x19d/0x4b0 [ 151.773069] kasan_report+0x93/0x1a0 [ 151.773668] ? dlm_midcomms_commit_mhandle+0x19d/0x4b0 [ 151.774514] __asan_load4+0x7e/0xa0 [ 151.775089] dlm_midcomms_commit_mhandle+0x19d/0x4b0 [ 151.775890] ? create_message.isra.29.constprop.64+0x57/0xc0 [ 151.776770] send_common+0x19f/0x1b0 [ 151.777342] ? remove_from_waiters+0x60/0x60 [ 151.778017] ? lock_downgrade+0x410/0x410 [ 151.778648] ? __this_cpu_preempt_check+0x13/0x20 [ 151.779421] ? rcu_lockdep_current_cpu_online+0x88/0xc0 [ 151.780292] _convert_lock+0x46/0x150 [ 151.780893] convert_lock+0x7b/0xc0 [ 151.781459] dlm_lock+0x3ac/0x580 [ 151.781993] ? 0xffffffffc0540000 [ 151.782522] ? torture_stop+0x120/0x120 [dlm_locktorture] [ 151.783379] ? dlm_scan_rsbs+0xa70/0xa70 [ 151.784003] ? preempt_count_sub+0xd6/0x130 [ 151.784661] ? is_module_address+0x47/0x70 [ 151.785309] ? torture_stop+0x120/0x120 [dlm_locktorture] [ 151.786166] ? 0xffffffffc0540000 [ 151.786693] ? lockdep_init_map_type+0xc3/0x360 [ 151.787414] ? 0xffffffffc0540000 [ 151.787947] torture_dlm_lock_sync.isra.3+0xe9/0x150 [dlm_locktorture] [ 151.789004] ? torture_stop+0x120/0x120 [dlm_locktorture] [ 151.789858] ? 0xffffffffc0540000 [ 151.790392] ? lock_torture_cleanup+0x20/0x20 [dlm_locktorture] [ 151.791347] ? delay_tsc+0x94/0xc0 [ 151.791898] torture_ex_iter+0xc3/0xea [dlm_locktorture] [ 151.792735] ? torture_start+0x30/0x30 [dlm_locktorture] [ 151.793606] lock_torture+0x177/0x270 [dlm_locktorture] [ 151.794448] ? torture_dlm_lock_sync.isra.3+0x150/0x150 [dlm_locktorture] [ 151.795539] ? lock_torture_stats+0x80/0x80 [dlm_locktorture] [ 151.796476] ? do_raw_spin_lock+0x11e/0x1e0 [ 151.797152] ? mark_held_locks+0x34/0xb0 [ 151.797784] ?
_raw_spin_unlock_irqrestore+0x30/0x70 [ 151.798581] ? __kthread_parkme+0x79/0x110 [ 151.799246] ? trace_preempt_on+0x2a/0xf0 [ 151.799902] ? __kthread_parkme+0x79/0x110 [ 151.800579] ? preempt_count_sub+0xd6/0x130 [ 151.801271] ? __kasan_check_read+0x11/0x20 [ 151.801963] ?
__kthread_parkme+0xec/0x110 [ 151.802630] ? lock_torture_stats+0x80/0x80 [dlm_locktorture] [ 151.803569] kthread+0x192/0x1d0 [ 151.804104] ? kthread_complete_and_exit+0x30/0x30 [ 151.804881] ret_from_fork+0x1f/0x30 [ 151.805480] </TASK> [ 151.806111] Allocated by task 1347: [ 151.806681] kasan_save_stack+0x26/0x50 [ 151.807308] kasan_set_track+0x25/0x30 [ 151.807920] kasan_save_alloc_info+0x1e/0x30 [ 151.808609] __kasan_slab_alloc+0x63/0x80 [ 151.809263] kmem_cache_alloc+0x1ad/0x830 [ 151.809916] dlm_allocate_mhandle+0x17/0x20 [ 151.810590] dlm_midcomms_get_mhandle+0x96/0x260 [ 151.811344] _create_message+0x95/0x180 [ 151.811994] create_message.isra.29.constprop.64+0x57/0xc0 [ 151.812880] send_common+0x129/0x1b0 [ 151.813467]
_convert_lock+0x46/0x150 [ 151.814074] convert_lock+0x7b/0xc0 [ 151.814648] dlm_lock+0x3ac/0x580 [ 151.815199] torture_dlm_lock_sync.isra.3+0xe9/0x150 [dlm_locktorture] [ 151.816258] torture_ex_iter+0xc3/0xea [dlm_locktorture] [ 151.817129] lock_t ---truncated--- (CVE-2023-53629)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53629
https://ubuntu.com/security/CVE-2023-53629

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:M/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53629

Plugin Information
Published: 2025/10/13, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269260 - Linux Distros Unpatched Vulnerability : CVE-2023-53631
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-sysman: Fix reference leak If a duplicate attribute is found using kset_find_obj(), a reference to that attribute is returned. This means that we need to dispose it accordingly. Use kobject_put() to dispose the duplicate attribute in such a case. Compile-tested only. (CVE-2023-53631)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53631
https://ubuntu.com/security/CVE-2023-53631

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53631

Plugin Information
Published: 2025/10/08, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269261 - Linux Distros Unpatched Vulnerability : CVE-2023-53659
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: iavf: Fix out-of-bounds when setting channels on remove If we set channels greater during iavf_remove(), and waiting reset done would be timeout, then returned with error but changed num_active_queues directly, that will lead to OOB like the following logs. Because the num_active_queues is greater than tx/rx_rings[] allocated actually.
Reproducer: [root@host ~]# cat repro.sh #!/bin/bash pf_dbsf=0000:41:00.0 vf0_dbsf=0000:41:02.0 g_pids=() function do_set_numvf() { echo 2 >/sys/bus/pci/devices/${pf_dbsf}/sriov_numvfs sleep $((RANDOM%3+1)) echo 0 >/sys/bus/pci/devices/${pf_dbsf}/sriov_numvfs sleep $((RANDOM%3+1)) } function do_set_channel() { local nic=$(ls -1 --indicator-style=none /sys/bus/pci/devices/${vf0_dbsf}/net/) [ -z $nic ] && { sleep $((RANDOM%3)) ; return 1; } ifconfig $nic 192.168.18.5 netmask 255.255.255.0 ifconfig $nic up ethtool -L $nic combined 1 ethtool -L $nic combined 4 sleep $((RANDOM%3)) } function on_exit() { local pid for pid in ${g_pids[@]}; do kill -0 $pid &>/dev/null && kill $pid &>/dev/null done g_pids=() } trap on_exit; exit EXIT while :; do do_set_numvf ; done & g_pids+=($!) while :; do do_set_channel ; done & g_pids+=($!) wait Result: [ 3506.152887] iavf 0000:41:02.0: Removing device [ 3510.400799] ================================================================== [ 3510.400820] BUG: KASAN:
slab-out-of-bounds in iavf_free_all_tx_resources+0x156/0x160 [iavf] [ 3510.400823] Read of size 8 at addr ffff88b6f9311008 by task repro.sh/55536 [ 3510.400823] [ 3510.400830] CPU: 101 PID: 55536 Comm: repro.sh Kdump: loaded Tainted: G O --------- -t - 4.18.0 #1 [ 3510.400832] Hardware name: Powerleader PR2008AL/H12DSi-N6, BIOS 2.0 04/09/2021 [ 3510.400835] Call Trace: [ 3510.400851] dump_stack+0x71/0xab [ 3510.400860] print_address_description+0x6b/0x290 [ 3510.400865] ? iavf_free_all_tx_resources+0x156/0x160 [iavf] [ 3510.400868] kasan_report+0x14a/0x2b0 [ 3510.400873] iavf_free_all_tx_resources+0x156/0x160 [iavf] [ 3510.400880] iavf_remove+0x2b6/0xc70 [iavf] [ 3510.400884] ? iavf_free_all_rx_resources+0x160/0x160 [iavf] [ 3510.400891] ? wait_woken+0x1d0/0x1d0 [ 3510.400895] ? notifier_call_chain+0xc1/0x130 [ 3510.400903] pci_device_remove+0xa8/0x1f0 [ 3510.400910] device_release_driver_internal+0x1c6/0x460 [ 3510.400916] pci_stop_bus_device+0x101/0x150 [ 3510.400919] pci_stop_and_remove_bus_device+0xe/0x20 [ 3510.400924] pci_iov_remove_virtfn+0x187/0x420 [ 3510.400927] ? pci_iov_add_virtfn+0xe10/0xe10 [ 3510.400929] ? pci_get_subsys+0x90/0x90 [ 3510.400932] sriov_disable+0xed/0x3e0 [ 3510.400936] ? bus_find_device+0x12d/0x1a0 [ 3510.400953] i40e_free_vfs+0x754/0x1210 [i40e] [ 3510.400966] ? i40e_reset_all_vfs+0x880/0x880 [i40e] [ 3510.400968] ? pci_get_device+0x7c/0x90 [ 3510.400970] ? pci_get_subsys+0x90/0x90 [ 3510.400982] ? pci_vfs_assigned.part.7+0x144/0x210 [ 3510.400987] ? __mutex_lock_slowpath+0x10/0x10 [ 3510.400996] i40e_pci_sriov_configure+0x1fa/0x2e0 [i40e] [ 3510.401001] sriov_numvfs_store+0x214/0x290 [ 3510.401005] ? sriov_totalvfs_show+0x30/0x30 [ 3510.401007] ? __mutex_lock_slowpath+0x10/0x10 [ 3510.401011] ?
__check_object_size+0x15a/0x350 [ 3510.401018] kernfs_fop_write+0x280/0x3f0 [ 3510.401022] vfs_write+0x145/0x440 [ 3510.401025] ksys_write+0xab/0x160 [ 3510.401028] ? __ia32_sys_read+0xb0/0xb0 [ 3510.401031] ? fput_many+0x1a/0x120 [ 3510.401032] ? filp_close+0xf0/0x130 [ 3510.401038] do_syscall_64+0xa0/0x370 [ 3510.401041] ? page_fault+0x8/0x30 [ 3510.401043] entry_SYSCALL_64_after_hwframe+0x65/0xca [ 3510.401073] RIP: 0033:0x7f3a9bb842c0 [ 3510.401079] Code: 73 01 c3 48 8b 0d d8 cb 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 89 24 2d 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d ---truncated--- (CVE-2023-53659)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53659
https://ubuntu.com/security/CVE-2023-53659

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53659

Plugin Information
Published: 2025/10/08, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269264 - Linux Distros Unpatched Vulnerability : CVE-2023-53668
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ring-buffer: Fix deadloop issue on reading trace_pipe Soft lockup occurs when reading file 'trace_pipe':
watchdog: BUG: soft lockup - CPU#6 stuck for 22s! [cat:4488] [...] RIP:
0010:ring_buffer_empty_cpu+0xed/0x170 RSP: 0018:ffff88810dd6fc48 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000246 RCX: ffffffff93d1aaeb RDX: ffff88810a280040 RSI: 0000000000000008 RDI:
ffff88811164b218 RBP: ffff88811164b218 R08: 0000000000000000 R09: ffff88815156600f R10: ffffed102a2acc01 R11: 0000000000000001 R12: 0000000051651901 R13: 0000000000000000 R14: ffff888115e49500 R15:
0000000000000000 [...] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8d853c2000 CR3:
000000010dcd8000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace:
__find_next_entry+0x1a8/0x4b0 ? peek_next_entry+0x250/0x250 ? down_write+0xa5/0x120 ? down_write_killable+0x130/0x130 trace_find_next_entry_inc+0x3b/0x1d0 tracing_read_pipe+0x423/0xae0 ? tracing_splice_read_pipe+0xcb0/0xcb0 vfs_read+0x16b/0x490 ksys_read+0x105/0x210 ?
__ia32_sys_pwrite64+0x200/0x200 ? switch_fpu_return+0x108/0x220 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x61/0xc6 Through the vmcore, I found it's because in tracing_read_pipe(), ring_buffer_empty_cpu() found some buffer is not empty but then it cannot read anything due to rb_num_of_entries() == 0 always true, Then it infinitely loop the procedure due to user buffer not been filled, see following code path: tracing_read_pipe() { ... ... waitagain: tracing_wait_pipe() // 1. find non-empty buffer here trace_find_next_entry_inc() // 2. loop here try to find an entry __find_next_entry() ring_buffer_empty_cpu(); // 3. find non-empty buffer peek_next_entry() // 4. but peek always return NULL ring_buffer_peek() rb_buffer_peek() rb_get_reader_page() // 5. because rb_num_of_entries() == 0 always true here // then return NULL // 6. user buffer not been filled so goto 'waitgain' // and eventually leads to an deadloop in kernel!!! } By some analyzing, I found that when resetting ringbuffer, the 'entries' of its pages are not all cleared (see rb_reset_cpu()). Then when reducing the ringbuffer, and if some reduced pages exist dirty 'entries' data, they will be added into 'cpu_buffer->overrun' (see rb_remove_pages()), which cause wrong 'overrun' count and eventually cause the deadloop issue. To fix it, we need to clear every pages in rb_reset_cpu(). (CVE-2023-53668)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53668
https://ubuntu.com/security/CVE-2023-53668

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53668

Plugin Information
Published: 2025/10/08, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
270185 - Linux Distros Unpatched Vulnerability : CVE-2023-53676
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() The function lio_target_nacl_info_show() uses sprintf() in a loop to print details for every iSCSI connection in a session without checking for the buffer length. With enough iSCSI connections it's possible to overflow the buffer provided by configfs and corrupt the memory. This patch replaces sprintf() with sysfs_emit_at() that checks for buffer boundries. (CVE-2023-53676)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53676
https://ubuntu.com/security/CVE-2023-53676

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0003
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53676

Plugin Information
Published: 2025/10/13, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
270181 - Linux Distros Unpatched Vulnerability : CVE-2023-53684
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xfrm: Zero padding when dumping algos and encap When copying data to user-space we should ensure that only valid data is copied over. Padding in structures may be filled with random (possibly sensitve) data and should never be given directly to user-space. This patch fixes the copying of xfrm algorithms and the encap template in xfrm_user so that padding is zeroed. (CVE-2023-53684)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53684
https://security-tracker.debian.org/tracker/CVE-2023-53684
https://ubuntu.com/security/CVE-2023-53684

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53684

Plugin Information
Published: 2025/10/13, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271600 - Linux Distros Unpatched Vulnerability : CVE-2023-53695
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- udf: Detect system inodes linked into directory hierarchy When UDF filesystem is corrupted, hidden system inodes can be linked into directory hierarchy which is an avenue for further serious corruption of the filesystem and kernel confusion as noticed by syzbot fuzzed images. Refuse to access system inodes linked into directory hierarchy and vice versa. (CVE-2023-53695)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53695
https://ubuntu.com/security/CVE-2023-53695

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53695

Plugin Information
Published: 2025/10/27, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271612 - Linux Distros Unpatched Vulnerability : CVE-2023-53698
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: xsk: fix refcount underflow in error path Fix a refcount underflow problem reported by syzbot that can happen when a system is running out of memory. If xp_alloc_tx_descs() fails, and it can only fail due to not having enough memory, then the error path is triggered. In this error path, the refcount of the pool is decremented as it has incremented before. However, the reference to the pool in the socket was not nulled. This means that when the socket is closed later, the socket teardown logic will think that there is a pool attached to the socket and try to decrease the refcount again, leading to a refcount underflow. I chose this fix as it involved adding just a single line. Another option would have been to move xp_get_pool() and the assignment of xs->pool to after the if-statement and using xs_umem->pool instead of xs->pool in the whole if-statement resulting in somewhat simpler code, but this would have led to much more churn in the code base perhaps making it harder to backport. (CVE-2023-53698)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53698
https://ubuntu.com/security/CVE-2023-53698

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53698

Plugin Information
Published: 2025/10/27, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271584 - Linux Distros Unpatched Vulnerability : CVE-2023-53703
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: HID: amd_sfh: Fix for shift-out-of- bounds Shift operation of 'exp' and 'shift' variables exceeds the maximum number of shift values in the u32 range leading to UBSAN shift-out-of-bounds. ... [ 6.120512] UBSAN: shift-out-of-bounds in drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c:149:50 [ 6.120598] shift exponent 104 is too large for 64-bit type 'long unsigned int' [ 6.120659] CPU: 4 PID: 96 Comm: kworker/4:1 Not tainted 6.4.0amd_1-next-20230519-dirty #10 [ 6.120665] Hardware name: AMD Birman-PHX/Birman-PHX, BIOS SFH_with_HPD_SEN.FD 04/05/2023 [ 6.120667] Workqueue: events amd_sfh_work_buffer [amd_sfh] [ 6.120687] Call Trace: [ 6.120690] <TASK> [ 6.120694] dump_stack_lvl+0x48/0x70 [ 6.120704] dump_stack+0x10/0x20 [ 6.120707] ubsan_epilogue+0x9/0x40 [ 6.120716] __ubsan_handle_shift_out_of_bounds+0x10f/0x170 [ 6.120720] ? psi_group_change+0x25f/0x4b0 [ 6.120729] float_to_int.cold+0x18/0xba [amd_sfh] [ 6.120739] get_input_rep+0x57/0x340 [amd_sfh] [ 6.120748] ? __schedule+0xba7/0x1b60 [ 6.120756] ?
__pfx_get_input_rep+0x10/0x10 [amd_sfh] [ 6.120764] amd_sfh_work_buffer+0x91/0x180 [amd_sfh] [ 6.120772] process_one_work+0x229/0x430 [ 6.120780] worker_thread+0x4a/0x3c0 [ 6.120784] ?
__pfx_worker_thread+0x10/0x10 [ 6.120788] kthread+0xf7/0x130 [ 6.120792] ? __pfx_kthread+0x10/0x10 [ 6.120795] ret_from_fork+0x29/0x50 [ 6.120804] </TASK> ... Fix this by adding the condition to validate shift ranges. (CVE-2023-53703)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53703
https://ubuntu.com/security/CVE-2023-53703

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53703

Plugin Information
Published: 2025/10/27, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271585 - Linux Distros Unpatched Vulnerability : CVE-2023-53715
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex Apparently the hex passphrase mechanism does not work on newer chips/firmware (e.g. BCM4387). It seems there was a simple way of passing it in binary all along, so use that and avoid the hexification. OpenBSD has been doing it like this from the beginning, so this should work on all chips. Also clear the structure before setting the PMK. This was leaking uninitialized stack contents to the device. (CVE-2023-53715)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53715
https://ubuntu.com/security/CVE-2023-53715

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53715

Plugin Information
Published: 2025/10/27, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271610 - Linux Distros Unpatched Vulnerability : CVE-2023-53719
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- serial: arc_uart: fix of_iomap leak in `arc_serial_probe` Smatch reports:
drivers/tty/serial/arc_uart.c:631 arc_serial_probe() warn: 'port->membase' from of_iomap() not released on lines: 631. In arc_serial_probe(), if uart_add_one_port() fails, port->membase is not released, which would cause a resource leak. To fix this, I replace of_iomap with devm_platform_ioremap_resource.
(CVE-2023-53719)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53719
https://ubuntu.com/security/CVE-2023-53719

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53719

Plugin Information
Published: 2025/10/27, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277782 - Linux Distros Unpatched Vulnerability : CVE-2023-53743
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- PCI: Free released resource after coalescing release_resource() doesn't actually free the resource or resource list entry so free the resource list entry to avoid a leak. (CVE-2023-53743)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53743
https://ubuntu.com/security/CVE-2023-53743

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53743

Plugin Information
Published: 2025/12/08, Modified: 2025/12/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277787 - Linux Distros Unpatched Vulnerability : CVE-2023-53747
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF After a call to console_unlock() in vcs_write() the vc_data struct can be freed by vc_port_destruct(). Because of that, the struct vc_data pointer must be reloaded in the while loop in vcs_write() after console_lock() to avoid a UAF when vcs_size() is called. Syzkaller reported a UAF in vcs_size(). BUG: KASAN: slab-use-after-free in vcs_size (drivers/tty/vt/vc_screen.c:215) Read of size 4 at addr ffff8880beab89a8 by task repro_vcs_size/4119 Call Trace: <TASK> __asan_report_load4_noabort (mm/kasan/report_generic.c:380) vcs_size (drivers/tty/vt/vc_screen.c:215) vcs_write (drivers/tty/vt/vc_screen.c:664) vfs_write (fs/read_write.c:582 fs/read_write.c:564) ... <TASK> Allocated by task 1213: kmalloc_trace (mm/slab_common.c:1064) vc_allocate (./include/linux/slab.h:559 ./include/linux/slab.h:680 drivers/tty/vt/vt.c:1078 drivers/tty/vt/vt.c:1058) con_install (drivers/tty/vt/vt.c:3334) tty_init_dev (drivers/tty/tty_io.c:1303 drivers/tty/tty_io.c:1415 drivers/tty/tty_io.c:1392) tty_open (drivers/tty/tty_io.c:2082 drivers/tty/tty_io.c:2128) chrdev_open (fs/char_dev.c:415) do_dentry_open (fs/open.c:921) vfs_open (fs/open.c:1052) ... Freed by task 4116: kfree (mm/slab_common.c:1016) vc_port_destruct (drivers/tty/vt/vt.c:1044) tty_port_destructor (drivers/tty/tty_port.c:296) tty_port_put (drivers/tty/tty_port.c:312) vt_disallocate_all (drivers/tty/vt/vt_ioctl.c:662 (discriminator 2)) vt_ioctl (drivers/tty/vt/vt_ioctl.c:903) tty_ioctl (drivers/tty/tty_io.c:2778) ... The buggy address belongs to the object at ffff8880beab8800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 424 bytes inside of freed 1024-byte region [ffff8880beab8800, ffff8880beab8c00) The buggy address belongs to the physical page: page:00000000afc77580 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xbeab8 head:00000000afc77580 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags:
0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) page_type: 0xffffffff() raw: 000fffffc0010200 ffff888100042dc0 ffffea000426de00 dead000000000002 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address:
ffff8880beab8880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880beab8900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880beab8980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880beab8a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880beab8a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Disabling lock debugging due to kernel taint (CVE-2023-53747)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53747
https://ubuntu.com/security/CVE-2023-53747

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53747

Plugin Information
Published: 2025/12/08, Modified: 2025/12/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277785 - Linux Distros Unpatched Vulnerability : CVE-2023-53752
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: deal with integer overflows in kmalloc_reserve() Blamed commit changed: ptr = kmalloc(size); if (ptr) size = ksize(ptr); size = kmalloc_size_roundup(size); ptr = kmalloc(size); This allowed various crash as reported by syzbot [1] and Kyle Zeng. Problem is that if @size is bigger than 0x80000001, kmalloc_size_roundup(size) returns 2^32. kmalloc_reserve() uses a 32bit variable (obj_size), so 2^32 is truncated to 0. kmalloc(0) returns ZERO_SIZE_PTR which is not handled by skb allocations. Following trace can be triggered if a netdev->mtu is set close to 0x7fffffff We might in the future limit netdev->mtu to more sensible limit (like KMALLOC_MAX_SIZE). This patch is based on a syzbot report, and also a report and tentative fix from Kyle Zeng. [1] BUG: KASAN: user-memory-access in __build_skb_around net/core/skbuff.c:294 [inline] BUG: KASAN: user-memory-access in __alloc_skb+0x3c4/0x6e8 net/core/skbuff.c:527 Write of size 32 at addr 00000000fffffd10 by task syz-executor.4/22554 CPU: 1 PID:
22554 Comm: syz-executor.4 Not tainted 6.1.39-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023 Call trace: dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:279 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:286 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x120/0x1a0 lib/dump_stack.c:106 print_report+0xe4/0x4b4 mm/kasan/report.c:398 kasan_report+0x150/0x1ac mm/kasan/report.c:495 kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:189 memset+0x40/0x70 mm/kasan/shadow.c:44 __build_skb_around net/core/skbuff.c:294 [inline] __alloc_skb+0x3c4/0x6e8 net/core/skbuff.c:527 alloc_skb include/linux/skbuff.h:1316 [inline] igmpv3_newpack+0x104/0x1088 net/ipv4/igmp.c:359 add_grec+0x81c/0x1124 net/ipv4/igmp.c:534 igmpv3_send_cr net/ipv4/igmp.c:667 [inline] igmp_ifc_timer_expire+0x1b0/0x1008 net/ipv4/igmp.c:810 call_timer_fn+0x1c0/0x9f0 kernel/time/timer.c:1474 expire_timers kernel/time/timer.c:1519 [inline]
__run_timers+0x54c/0x710 kernel/time/timer.c:1790 run_timer_softirq+0x28/0x4c kernel/time/timer.c:1803
_stext+0x380/0xfbc ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:79 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:891 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:84 invoke_softirq kernel/softirq.c:437 [inline] __irq_exit_rcu+0x1c0/0x4cc kernel/softirq.c:683 irq_exit_rcu+0x14/0x78 kernel/softirq.c:695 el0_interrupt+0x7c/0x2e0 arch/arm64/kernel/entry-common.c:717
__el0_irq_handler_common+0x18/0x24 arch/arm64/kernel/entry-common.c:724 el0t_64_irq_handler+0x10/0x1c arch/arm64/kernel/entry-common.c:729 el0t_64_irq+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 (CVE-2023-53752)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53752
https://ubuntu.com/security/CVE-2023-53752

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53752

Plugin Information
Published: 2025/12/08, Modified: 2025/12/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277642 - Linux Distros Unpatched Vulnerability : CVE-2023-53764
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath12k: Handle lock during peer_id find ath12k_peer_find_by_id() requires that the caller hold the ab->base_lock. Currently the WBM error path does not hold the lock and calling that function, leads to the following lockdep_assert()in QCN9274: [105162.160893] ------------[ cut here ]------------ [105162.160916] WARNING: CPU: 3 PID: 0 at drivers/net/wireless/ath/ath12k/peer.c:71 ath12k_peer_find_by_id+0x52/0x60 [ath12k] [105162.160933] Modules linked in: ath12k(O) qrtr_mhi qrtr mac80211 cfg80211 mhi qmi_helpers libarc4 nvme nvme_core [last unloaded: ath12k(O)] [105162.160967] CPU: 3 PID: 0 Comm: swapper/3 Tainted: G W O 6.1.0-rc2+ #3 [105162.160972] Hardware name: Intel(R) Client Systems NUC8i7HVK/NUC8i7HVB, BIOS HNKBLi70.86A.0056.2019.0506.1527 05/06/2019 [105162.160977] RIP: 0010:ath12k_peer_find_by_id+0x52/0x60 [ath12k] [105162.160990] Code: 07 eb 0f 39 68 24 74 0a 48 8b 00 48 39 f8 75 f3 31 c0 5b 5d c3 48 8d bf b0 f2 00 00 be ff ff ff ff e8 22 20 c4 e2 85 c0 75 bf <0f> 0b eb bb 66 2e 0f 1f 84 00 00 00 00 00 41 54 4c 8d a7 98 f2 00 [105162.160996] RSP: 0018:ffffa223001acc60 EFLAGS: 00010246 [105162.161003] RAX:
0000000000000000 RBX: ffff9f0573940000 RCX: 0000000000000000 [105162.161008] RDX: 0000000000000001 RSI:
ffffffffa3951c8e RDI: ffffffffa39a96d7 [105162.161013] RBP: 000000000000000a R08: 0000000000000000 R09:
0000000000000000 [105162.161017] R10: ffffa223001acb40 R11: ffffffffa3d57c60 R12: ffff9f057394f2e0 [105162.161022] R13: ffff9f0573940000 R14: ffff9f04ecd659c0 R15: ffff9f04d5a9b040 [105162.161026] FS:
0000000000000000(0000) GS:ffff9f0575600000(0000) knlGS:0000000000000000 [105162.161031] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [105162.161036] CR2: 00001d5c8277a008 CR3: 00000001e6224006 CR4:
00000000003706e0 [105162.161041] Call Trace: [105162.161046] <IRQ> [105162.161051] ath12k_dp_rx_process_wbm_err+0x6da/0xaf0 [ath12k] [105162.161072] ? ath12k_dp_rx_process_err+0x80e/0x15a0 [ath12k] [105162.161084] ? __lock_acquire+0x4ca/0x1a60 [105162.161104] ath12k_dp_service_srng+0x263/0x310 [ath12k] [105162.161120] ath12k_pci_ext_grp_napi_poll+0x1c/0x70 [ath12k] [105162.161133]
__napi_poll+0x22/0x260 [105162.161141] net_rx_action+0x2f8/0x380 [105162.161153] __do_softirq+0xd0/0x4c9 [105162.161162] irq_exit_rcu+0x88/0xe0 [105162.161169] common_interrupt+0xa5/0xc0 [105162.161174] </IRQ>
[105162.161179] <TASK> [105162.161184] asm_common_interrupt+0x22/0x40 Handle spin lock/unlock in WBM error path to hold the necessary lock expected by ath12k_peer_find_by_id(). Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0-03171-QCAHKSWPL_SILICONZ-1 (CVE-2023-53764)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53764
https://ubuntu.com/security/CVE-2023-53764

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:P)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53764

Plugin Information
Published: 2025/12/08, Modified: 2025/12/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277775 - Linux Distros Unpatched Vulnerability : CVE-2023-53769
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- virt/coco/sev-guest: Double-buffer messages The encryption algorithms read and write directly to shared unencrypted memory, which may leak information as well as permit the host to tamper with the message integrity. Instead, copy whole messages in or out as needed before doing any computation on them.
(CVE-2023-53769)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53769
https://ubuntu.com/security/CVE-2023-53769

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53769

Plugin Information
Published: 2025/12/08, Modified: 2025/12/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277906 - Linux Distros Unpatched Vulnerability : CVE-2023-53780
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/amd/display: fix FCLK pstate change underflow [Why] Currently we set FCLK p-state change watermark calculated based on dummy p-state latency when UCLK p-state is not supported [How] Calculate FCLK p-state change watermark based on on FCLK pstate change latency in case UCLK p-state is not supported (CVE-2023-53780)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53780
https://security-tracker.debian.org/tracker/CVE-2023-53780
https://ubuntu.com/security/CVE-2023-53780

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53780

Plugin Information
Published: 2025/12/09, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277904 - Linux Distros Unpatched Vulnerability : CVE-2023-53794
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cifs: fix session state check in reconnect to avoid use-after-free issue Don't collect exiting session in smb2_reconnect_server(), because it will be released soon. Note that the exiting session will stay in server->smb_ses_list until it complete the cifs_free_ipc() and logoff() and then delete itself from the list. (CVE-2023-53794)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53794
https://security-tracker.debian.org/tracker/CVE-2023-53794
https://ubuntu.com/security/CVE-2023-53794

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53794

Plugin Information
Published: 2025/12/09, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278071 - Linux Distros Unpatched Vulnerability : CVE-2023-53800
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ubi: Fix use-after-free when volume resizing failed There is an use-after-free problem reported by KASAN:
================================================================== BUG: KASAN: use-after-free in ubi_eba_copy_table+0x11f/0x1c0 [ubi] Read of size 8 at addr ffff888101eec008 by task ubirsvol/4735 CPU: 2 PID: 4735 Comm: ubirsvol Not tainted 6.1.0-rc1-00003-g84fa3304a7fc-dirty #14 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 ubi_eba_copy_table+0x11f/0x1c0 [ubi] ubi_resize_volume+0x4f9/0xbc0 [ubi] ubi_cdev_ioctl+0x701/0x1850 [ubi] __x64_sys_ioctl+0x11d/0x170 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK> When ubi_change_vtbl_record() returns an error in ubi_resize_volume(), new_eba_tbl will be freed on error handing path, but it is holded by vol->eba_tbl in ubi_eba_replace_table(). It means that the liftcycle of vol->eba_tbl and vol are different, so when resizing volume in next time, it causing an use-after-free fault. Fix it by not freeing new_eba_tbl after it replaced in ubi_eba_replace_table(), while will be freed in next volume resizing. (CVE-2023-53800)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53800
https://ubuntu.com/security/CVE-2023-53800

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53800

Plugin Information
Published: 2025/12/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278101 - Linux Distros Unpatched Vulnerability : CVE-2023-53803
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() A fix for: BUG: KASAN: slab-out-of- bounds in ses_enclosure_data_process+0x949/0xe30 [ses] Read of size 1 at addr ffff88a1b043a451 by task systemd-udevd/3271 Checking after (and before in next loop) addl_desc_ptr[1] is sufficient, we expect the size to be sanitized before first access to addl_desc_ptr[1]. Make sure we don't walk beyond end of page.
(CVE-2023-53803)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53803
https://ubuntu.com/security/CVE-2023-53803

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53803

Plugin Information
Published: 2025/12/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278098 - Linux Distros Unpatched Vulnerability : CVE-2023-53815
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- posix-timers: Prevent RT livelock in itimer_delete() itimer_delete() has a retry loop when the timer is concurrently expired. On non-RT kernels this just spin-waits until the timer callback has completed, except for posix CPU timers which have HAVE_POSIX_CPU_TIMERS_TASK_WORK enabled. In that case and on RT kernels the existing task could live lock when preempting the task which does the timer delivery. Replace spin_unlock() with an invocation of timer_wait_running() to handle it the same way as the other retry loops in the posix timer code. (CVE-2023-53815)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53815
https://ubuntu.com/security/CVE-2023-53815

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53815

Plugin Information
Published: 2025/12/10, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278103 - Linux Distros Unpatched Vulnerability : CVE-2023-53818
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ARM: zynq: Fix refcount leak in zynq_early_slcr_init of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on error path. Add missing of_node_put() to avoid refcount leak. (CVE-2023-53818)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53818
https://ubuntu.com/security/CVE-2023-53818

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53818

Plugin Information
Published: 2025/12/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278018 - Linux Distros Unpatched Vulnerability : CVE-2023-53826
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() Wear-leveling entry could be freed in error path, which may be accessed again in eraseblk_count_seq_show(), for example: __erase_worker eraseblk_count_seq_show wl = ubi->lookuptbl[*block_number] if (wl) wl_entry_destroy ubi->lookuptbl[e->pnum] = NULL kmem_cache_free(ubi_wl_entry_slab, e) erase_count = wl->ec // UAF! Wear- leveling entry updating/accessing in ubi->lookuptbl should be protected by ubi->wl_lock, fix it by adding ubi->wl_lock to serialize wl entry accessing between wl_entry_destroy() and eraseblk_count_seq_show().
Fetch a reproducer in [Link]. (CVE-2023-53826)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53826
https://ubuntu.com/security/CVE-2023-53826

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53826

Plugin Information
Published: 2025/12/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278053 - Linux Distros Unpatched Vulnerability : CVE-2023-53828
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() KSAN reports use-after-free in hci_add_adv_monitor(). While adding an adv monitor, hci_add_adv_monitor() calls ->
msft_add_monitor_pattern() calls -> msft_add_monitor_sync() calls -> msft_le_monitor_advertisement_cb() calls in an error case -> hci_free_adv_monitor() which frees the *moniter. This is referenced by bt_dev_dbg() in hci_add_adv_monitor(). Fix the bt_dev_dbg() by using handle instead of monitor->handle.
(CVE-2023-53828)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53828
https://ubuntu.com/security/CVE-2023-53828

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53828

Plugin Information
Published: 2025/12/10, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278060 - Linux Distros Unpatched Vulnerability : CVE-2023-53831
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: read sk->sk_family once in sk_mc_loop() syzbot is playing with IPV6_ADDRFORM quite a lot these days, and managed to hit the WARN_ON_ONCE(1) in sk_mc_loop() We have many more similar issues to fix. WARNING:
CPU: 1 PID: 1593 at net/core/sock.c:782 sk_mc_loop+0x165/0x260 Modules linked in: CPU: 1 PID: 1593 Comm:
kworker/1:3 Not tainted 6.1.40-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 Workqueue: events_power_efficient gc_worker RIP:
0010:sk_mc_loop+0x165/0x260 net/core/sock.c:782 Code: 34 1b fd 49 81 c7 18 05 00 00 4c 89 f8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ff e8 25 36 6d fd 4d 8b 37 eb 13 e8 db 33 1b fd <0f> 0b b3 01 eb 34 e8 d0 33 1b fd 45 31 f6 49 83 c6 38 4c 89 f0 48 RSP: 0018:ffffc90000388530 EFLAGS: 00010246 RAX: ffffffff846d9b55 RBX:
0000000000000011 RCX: ffff88814f884980 RDX: 0000000000000102 RSI: ffffffff87ae5160 RDI: 0000000000000011 RBP: ffffc90000388550 R08: 0000000000000003 R09: ffffffff846d9a65 R10: 0000000000000002 R11:
ffff88814f884980 R12: dffffc0000000000 R13: ffff88810dbee000 R14: 0000000000000010 R15: ffff888150084000 FS: 0000000000000000(0000) GS:ffff8881f6b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000180 CR3: 000000014ee5b000 CR4: 00000000003506e0 DR0:
0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> [<ffffffff8507734f>] ip6_finish_output2+0x33f/0x1ae0 net/ipv6/ip6_output.c:83 [<ffffffff85062766>] __ip6_finish_output net/ipv6/ip6_output.c:200 [inline] [<ffffffff85062766>] ip6_finish_output+0x6c6/0xb10 net/ipv6/ip6_output.c:211 [<ffffffff85061f8c>] NF_HOOK_COND include/linux/netfilter.h:298 [inline] [<ffffffff85061f8c>] ip6_output+0x2bc/0x3d0 net/ipv6/ip6_output.c:232 [<ffffffff852071cf>] dst_output include/net/dst.h:444 [inline] [<ffffffff852071cf>] ip6_local_out+0x10f/0x140 net/ipv6/output_core.c:161 [<ffffffff83618fb4>] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:483 [inline] [<ffffffff83618fb4>] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline] [<ffffffff83618fb4>] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] [<ffffffff83618fb4>] ipvlan_queue_xmit+0x1174/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677 [<ffffffff8361ddd9>] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229 [<ffffffff84763fc0>] netdev_start_xmit include/linux/netdevice.h:4925 [inline] [<ffffffff84763fc0>] xmit_one net/core/dev.c:3644 [inline] [<ffffffff84763fc0>] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660 [<ffffffff8494c650>] sch_direct_xmit+0x2a0/0x9c0 net/sched/sch_generic.c:342 [<ffffffff8494d883>] qdisc_restart net/sched/sch_generic.c:407 [inline] [<ffffffff8494d883>] __qdisc_run+0xb13/0x1e70 net/sched/sch_generic.c:415 [<ffffffff8478c426>] qdisc_run+0xd6/0x260 include/net/pkt_sched.h:125 [<ffffffff84796eac>] net_tx_action+0x7ac/0x940 net/core/dev.c:5247 [<ffffffff858002bd>]
__do_softirq+0x2bd/0x9bd kernel/softirq.c:599 [<ffffffff814c3fe8>] invoke_softirq kernel/softirq.c:430 [inline] [<ffffffff814c3fe8>] __irq_exit_rcu+0xc8/0x170 kernel/softirq.c:683 [<ffffffff814c3f09>] irq_exit_rcu+0x9/0x20 kernel/softirq.c:695 (CVE-2023-53831)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53831
https://ubuntu.com/security/CVE-2023-53831

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53831

Plugin Information
Published: 2025/12/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277963 - Linux Distros Unpatched Vulnerability : CVE-2023-53836
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf, sockmap: Fix skb refcnt race after locking changes There is a race where skb's from the sk_psock_backlog can be referenced after userspace side has already skb_consumed() the sk_buff and its refcnt dropped to zer0 causing use after free. The flow is the following: while ((skb = skb_peek(&psock->ingress_skb)) sk_psock_handle_Skb(psock, skb, ..., ingress) if (!ingress) ...
sk_psock_skb_ingress sk_psock_skb_ingress_enqueue(skb) msg->skb = skb sk_psock_queue_msg(psock, msg) skb_dequeue(&psock->ingress_skb) The sk_psock_queue_msg() puts the msg on the ingress_msg queue. This is what the application reads when recvmsg() is called. An application can read this anytime after the msg is placed on the queue. The recvmsg hook will also read msg->skb and then after user space reads the msg will call consume_skb(skb) on it effectively free'ing it. But, the race is in above where backlog queue still has a reference to the skb and calls skb_dequeue(). If the skb_dequeue happens after the user reads and free's the skb we have a use after free. The !ingress case does not suffer from this problem because it uses sendmsg_*(sk, msg) which does not pass the sk_buff further down the stack. The following splat was observed with 'test_progs -t sockmap_listen': [ 1022.710250][ T2556] general protection fault, ... [...] [ 1022.712830][ T2556] Workqueue: events sk_psock_backlog [ 1022.713262][ T2556] RIP:
0010:skb_dequeue+0x4c/0x80 [ 1022.713653][ T2556] Code: ... [...] [ 1022.720699][ T2556] Call Trace: [ 1022.720984][ T2556] <TASK> [ 1022.721254][ T2556] ? die_addr+0x32/0x80^M [ 1022.721589][ T2556] ? exc_general_protection+0x25a/0x4b0 [ 1022.722026][ T2556] ? asm_exc_general_protection+0x22/0x30 [ 1022.722489][ T2556] ? skb_dequeue+0x4c/0x80 [ 1022.722854][ T2556] sk_psock_backlog+0x27a/0x300 [ 1022.723243][ T2556] process_one_work+0x2a7/0x5b0 [ 1022.723633][ T2556] worker_thread+0x4f/0x3a0 [ 1022.723998][ T2556] ? __pfx_worker_thread+0x10/0x10 [ 1022.724386][ T2556] kthread+0xfd/0x130 [ 1022.724709][ T2556] ? __pfx_kthread+0x10/0x10 [ 1022.725066][ T2556] ret_from_fork+0x2d/0x50 [ 1022.725409][ T2556] ? __pfx_kthread+0x10/0x10 [ 1022.725799][ T2556] ret_from_fork_asm+0x1b/0x30 [ 1022.726201][ T2556] </TASK> To fix we add an skb_get() before passing the skb to be enqueued in the engress queue. This bumps the skb->users refcnt so that consume_skb() and kfree_skb will not immediately free the sk_buff. With this we can be sure the skb is still around when we do the dequeue. Then we just need to decrement the refcnt or free the skb in the backlog case which we do by calling kfree_skb() on the ingress case as well as the sendmsg case. Before locking change from fixes tag we had the sock locked so we couldn't race with user and there was no issue here. (CVE-2023-53836)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53836
https://ubuntu.com/security/CVE-2023-53836

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53836

Plugin Information
Published: 2025/12/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277966 - Linux Distros Unpatched Vulnerability : CVE-2023-53841
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- devlink: report devlink_port_type_warn source device devlink_port_type_warn is scheduled for port devlink and warning when the port type is not set. But from this warning it is not easy found out which device (driver) has no devlink port set. [ 3709.975552] Type was not set for devlink port. [ 3709.975579] WARNING: CPU: 1 PID: 13092 at net/devlink/leftover.c:6775 devlink_port_type_warn+0x11/0x20 [ 3709.993967] Modules linked in: openvswitch nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nfnetlink bluetooth rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs vhost_net vhost vhost_iotlb tap tun bridge stp llc qrtr intel_rapl_msr intel_rapl_common i10nm_edac nfit libnvdimm x86_pkg_temp_thermal mlx5_ib intel_powerclamp coretemp dell_wmi ledtrig_audio sparse_keymap ipmi_ssif kvm_intel ib_uverbs rfkill ib_core video kvm iTCO_wdt acpi_ipmi intel_vsec irqbypass ipmi_si iTCO_vendor_support dcdbas ipmi_devintf mei_me ipmi_msghandler rapl mei intel_cstate isst_if_mmio isst_if_mbox_pci dell_smbios intel_uncore isst_if_common i2c_i801 dell_wmi_descriptor wmi_bmof i2c_smbus intel_pch_thermal pcspkr acpi_power_meter xfs libcrc32c sd_mod sg nvme_tcp mgag200 i2c_algo_bit nvme_fabrics drm_shmem_helper drm_kms_helper nvme syscopyarea ahci sysfillrect sysimgblt nvme_core fb_sys_fops crct10dif_pclmul libahci mlx5_core sfc crc32_pclmul nvme_common drm [ 3709.994030] crc32c_intel mtd t10_pi mlxfw libata tg3 mdio megaraid_sas psample ghash_clmulni_intel pci_hyperv_intf wmi dm_multipath sunrpc dm_mirror dm_region_hash dm_log dm_mod be2iscsi bnx2i cnic uio cxgb4i cxgb4 tls libcxgbi libcxgb qla4xxx iscsi_boot_sysfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi fuse [ 3710.108431] CPU: 1 PID: 13092 Comm: kworker/1:1 Kdump: loaded Not tainted 5.14.0-319.el9.x86_64 #1 [ 3710.108435] Hardware name: Dell Inc. PowerEdge R750/0PJ80M, BIOS 1.8.2 09/14/2022 [ 3710.108437] Workqueue: events devlink_port_type_warn [ 3710.108440] RIP: 0010:devlink_port_type_warn+0x11/0x20 [ 3710.108443] Code: 84 76 fe ff ff 48 c7 03 20 0e 1a ad 31 c0 e9 96 fd ff ff 66 0f 1f 44 00 00 0f 1f 44 00 00 48 c7 c7 18 24 4e ad e8 ef 71 62 ff <0f> 0b c3 cc cc cc cc 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 f6 87 [ 3710.108445] RSP: 0018:ff3b6d2e8b3c7e90 EFLAGS: 00010282 [ 3710.108447] RAX: 0000000000000000 RBX:
ff366d6580127080 RCX: 0000000000000027 [ 3710.108448] RDX: 0000000000000027 RSI: 00000000ffff86de RDI:
ff366d753f41f8c8 [ 3710.108449] RBP: ff366d658ff5a0c0 R08: ff366d753f41f8c0 R09: ff3b6d2e8b3c7e18 [ 3710.108450] R10: 0000000000000001 R11: 0000000000000023 R12: ff366d753f430600 [ 3710.108451] R13:
ff366d753f436900 R14: 0000000000000000 R15: ff366d753f436905 [ 3710.108452] FS: 0000000000000000(0000) GS:ff366d753f400000(0000) knlGS:0000000000000000 [ 3710.108453] CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 [ 3710.108454] CR2: 00007f1c57bc74e0 CR3: 000000111d26a001 CR4: 0000000000773ee0 [ 3710.108456] PKRU: 55555554 [ 3710.108457] Call Trace: [ 3710.108458] <TASK> [ 3710.108459] process_one_work+0x1e2/0x3b0 [ 3710.108466] ? rescuer_thread+0x390/0x390 [ 3710.108468] worker_thread+0x50/0x3a0 [ 3710.108471] ? rescuer_thread+0x390/0x390 [ 3710.108473] kthread+0xdd/0x100 [ 3710.108477] ? kthread_complete_and_exit+0x20/0x20 [ 3710.108479] ret_from_fork+0x1f/0x30 [ 3710.108485] </TASK> [ 3710.108486] ---[ end trace 1b4b23cd0c65d6a0 ]--- After patch: [ 402.473064] ice 0000:41:00.0:
Type was not set for devlink port. [ 402.473064] ice 0000:41:00.1: Type was not set for devlink port.
(CVE-2023-53841)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53841
https://ubuntu.com/security/CVE-2023-53841

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53841

Plugin Information
Published: 2025/12/09, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279771 - Linux Distros Unpatched Vulnerability : CVE-2023-53867
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ceph: fix potential use-after-free bug when trimming caps When trimming the caps and just after the 'session->s_cap_lock' is released in ceph_iterate_session_caps() the cap maybe removed by another thread, and when using the stale cap memory in the callbacks it will trigger use-after-free crash. We need to check the existence of the cap just after the 'ci->i_ceph_lock' being acquired. And do nothing if it's already removed. (CVE-2023-53867)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53867
https://security-tracker.debian.org/tracker/CVE-2023-53867
https://ubuntu.com/security/CVE-2023-53867

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53867

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279806 - Linux Distros Unpatched Vulnerability : CVE-2023-53989
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- arm64: mm: fix VA-range sanity check Both create_mapping_noalloc() and update_mapping_prot() sanity-check their 'virt' parameter, but the check itself doesn't make much sense. The condition used today appears to be a historical accident. The sanity-check condition: if ((virt >= PAGE_END) && (virt < VMALLOC_START)) { [ ... warning here ... ] return; } ... can only be true for the KASAN shadow region or the module region, and there's no reason to exclude these specifically for creating and updateing mappings. When arm64 support was first upstreamed in commit: c1cc1552616d0f35 (arm64: MMU initialisation) ... the condition was: if (virt < VMALLOC_START) { [ ... warning here ... ] return; } At the time, VMALLOC_START was the lowest kernel address, and this was checking whether 'virt' would be translated via TTBR1. Subsequently in commit: 14c127c957c1c607 (arm64: mm: Flip kernel VA space) ... the condition was changed to: if ((virt >= VA_START) && (virt < VMALLOC_START)) { [ ... warning here ... ] return; } This appear to have been a thinko. The commit moved the linear map to the bottom of the kernel address space, with VMALLOC_START being at the halfway point. The old condition would warn for changes to the linear map below this, and at the time VA_START was the end of the linear map. Subsequently we cleaned up the naming of VA_START in commit: 77ad4ce69321abbe (arm64: memory: rename VA_START to PAGE_END) ... keeping the erroneous condition as: if ((virt >= PAGE_END) && (virt < VMALLOC_START)) { [ ... warning here ... ] return; } Correct the condition to check against the start of the TTBR1 address space, which is currently PAGE_OFFSET. This simplifies the logic, and more clearly matches the outside kernel range message in the warning. (CVE-2023-53989)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53989
https://security-tracker.debian.org/tracker/CVE-2023-53989
https://ubuntu.com/security/CVE-2023-53989

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
8.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53989

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279971 - Linux Distros Unpatched Vulnerability : CVE-2023-53990
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- SMB3: Add missing locks to protect deferred close file list cifs_del_deferred_close function has a critical section which modifies the deferred close file list. We must acquire deferred_lock before calling cifs_del_deferred_close function. (CVE-2023-53990)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53990
https://ubuntu.com/security/CVE-2023-53990

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53990

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279963 - Linux Distros Unpatched Vulnerability : CVE-2023-53994
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ionic: remove WARN_ON to prevent panic_on_warn Remove unnecessary early code development check and the WARN_ON that it uses. The irq alloc and free paths have long been cleaned up and this check shouldn't have stuck around so long. (CVE-2023-53994)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53994
https://ubuntu.com/security/CVE-2023-53994

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53994

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279954 - Linux Distros Unpatched Vulnerability : CVE-2023-53997
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- thermal: of: fix double-free on unregistration Since commit 3d439b1a2ad3 (thermal/core: Alloc-copy-free the thermal zone parameters structure), thermal_zone_device_register() allocates a copy of the tzp argument and frees it when unregistering, so thermal_of_zone_register() now ends up leaking its original tzp and double-freeing the tzp copy. Fix this by locating tzp on stack instead. (CVE-2023-53997)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53997
https://ubuntu.com/security/CVE-2023-53997

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53997

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279913 - Linux Distros Unpatched Vulnerability : CVE-2023-54003
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA/core: Fix GID entry ref leak when create_ah fails If AH create request fails, release sgid_attr to avoid GID entry referrence leak reported while releasing GID table (CVE-2023-54003)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54003
https://ubuntu.com/security/CVE-2023-54003

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54003

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279933 - Linux Distros Unpatched Vulnerability : CVE-2023-54006
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- af_unix: Fix data-race around unix_tot_inflight. unix_tot_inflight is changed under spin_lock(unix_gc_lock), but unix_release_sock() reads it locklessly. Let's use READ_ONCE() for unix_tot_inflight. Note that the writer side was marked by commit 9d6d7f1cb67c (af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress) BUG: KCSAN: data-race in unix_inflight / unix_release_sock write (marked) to 0xffffffff871852b8 of 4 bytes by task 123 on cpu 1:
unix_inflight+0x130/0x180 net/unix/scm.c:64 unix_attach_fds+0x137/0x1b0 net/unix/scm.c:123 unix_scm_to_skb net/unix/af_unix.c:1832 [inline] unix_dgram_sendmsg+0x46a/0x14f0 net/unix/af_unix.c:1955 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg+0x148/0x160 net/socket.c:747
____sys_sendmsg+0x4e4/0x610 net/socket.c:2493 ___sys_sendmsg+0xc6/0x140 net/socket.c:2547
__sys_sendmsg+0x94/0x140 net/socket.c:2576 __do_sys_sendmsg net/socket.c:2585 [inline] __se_sys_sendmsg net/socket.c:2583 [inline] __x64_sys_sendmsg+0x45/0x50 net/socket.c:2583 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc read to 0xffffffff871852b8 of 4 bytes by task 4891 on cpu 0:
unix_release_sock+0x608/0x910 net/unix/af_unix.c:671 unix_release+0x59/0x80 net/unix/af_unix.c:1058
__sock_release+0x7d/0x170 net/socket.c:653 sock_close+0x19/0x30 net/socket.c:1385 __fput+0x179/0x5e0 fs/file_table.c:321 ____fput+0x15/0x20 fs/file_table.c:349 task_work_run+0x116/0x1a0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x174/0x180 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:297 do_syscall_64+0x4b/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc value changed: 0x00000000 ->
0x00000001 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 4891 Comm: systemd-coredum Not tainted 6.4.0-rc5-01219-gfa0e21fa4443 #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 (CVE-2023-54006)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54006
https://ubuntu.com/security/CVE-2023-54006

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
8.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54006

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279979 - Linux Distros Unpatched Vulnerability : CVE-2023-54011
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: mpi3mr: Fix an issue found by KASAN Write only correct size (32 instead of 64 bytes).
(CVE-2023-54011)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54011
https://ubuntu.com/security/CVE-2023-54011

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54011

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279978 - Linux Distros Unpatched Vulnerability : CVE-2023-54012
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: fix stack overflow when LRO is disabled for virtual interfaces When the virtual interface's feature is updated, it synchronizes the updated feature for its own lower interface. This propagation logic should be worked as the iteration, not recursively. But it works recursively due to the netdev notification unexpectedly. This problem occurs when it disables LRO only for the team and bonding interface type. team0 | +------+------+-----+-----+ | | | | | team1 team2 team3 ... team200 If team0's LRO feature is updated, it generates the NETDEV_FEAT_CHANGE event to its own lower interfaces(team1 ~ team200). It is worked by netdev_sync_lower_features(). So, the NETDEV_FEAT_CHANGE notification logic of each lower interface work iteratively. But generated NETDEV_FEAT_CHANGE event is also sent to the upper interface too. upper interface(team0) generates the NETDEV_FEAT_CHANGE event for its own lower interfaces again. lower and upper interfaces receive this event and generate this event again and again. So, the stack overflow occurs. But it is not the infinite loop issue. Because the netdev_sync_lower_features() updates features before generating the NETDEV_FEAT_CHANGE event. Already synchronized lower interfaces skip notification logic. So, it is just the problem that iteration logic is changed to the recursive unexpectedly due to the notification mechanism. Reproducer: ip link add team0 type team ethtool -K team0 lro on for i in {1..200} do ip link add team$i master team0 type team ethtool -K team$i lro on done ethtool -K team0 lro off In order to fix it, the notifier_ctx member of bonding/team is introduced. (CVE-2023-54012)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54012
https://ubuntu.com/security/CVE-2023-54012

Solution
There is no known solution at this time.
Risk Factor
Critical
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
8.5 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54012

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279817 - Linux Distros Unpatched Vulnerability : CVE-2023-54030
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- io_uring/net: don't overflow multishot recv Don't allow overflowing multishot recv CQEs, it might get out of hand, hurt performance, and in the worst case scenario OOM the task. (CVE-2023-54030)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54030
https://security-tracker.debian.org/tracker/CVE-2023-54030
https://ubuntu.com/security/CVE-2023-54030

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54030

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279781 - Linux Distros Unpatched Vulnerability : CVE-2023-54035
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfilter: nf_tables: fix underflow in chain reference counter Set element addition error path decrements reference counter on chains twice: once on element release and again via nft_data_release(). Then, d6b478666ffa (netfilter: nf_tables: fix underflow in object reference counter) incorrectly fixed this by removing the stateful object reference count decrement. Restore the stateful object decrement as in b91d90368837 (netfilter: nf_tables: fix leaking object reference count) and let nft_data_release() decrement the chain reference counter, so this is done only once. (CVE-2023-54035)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54035
https://security-tracker.debian.org/tracker/CVE-2023-54035
https://ubuntu.com/security/CVE-2023-54035

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54035

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279966 - Linux Distros Unpatched Vulnerability : CVE-2023-54039
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access In the j1939_tp_tx_dat_new() function, an out-of-bounds memory access could occur during the memcpy() operation if the size of skb->cb is larger than the size of struct j1939_sk_buff_cb. This is because the memcpy() operation uses the size of skb->cb, leading to a read beyond the struct j1939_sk_buff_cb. Updated the memcpy() operation to use the size of struct j1939_sk_buff_cb instead of the size of skb->cb. This ensures that the memcpy() operation only reads the memory within the bounds of struct j1939_sk_buff_cb, preventing out-of-bounds memory access.
Additionally, add a BUILD_BUG_ON() to check that the size of skb->cb is greater than or equal to the size of struct j1939_sk_buff_cb. This ensures that the skb->cb buffer is large enough to hold the j1939_sk_buff_cb structure. [mkl: rephrase commit message] (CVE-2023-54039)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54039
https://ubuntu.com/security/CVE-2023-54039

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
3.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
3.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54039

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279946 - Linux Distros Unpatched Vulnerability : CVE-2023-54042
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- powerpc/64s: Fix VAS mm use after free The refcount on mm is dropped before the coprocessor is detached.
(CVE-2023-54042)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54042
https://ubuntu.com/security/CVE-2023-54042

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54042

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279869 - Linux Distros Unpatched Vulnerability : CVE-2023-54043
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- iommufd: Do not add the same hwpt to the ioas->hwpt_list twice The hwpt is added to the hwpt_list only during its creation, it is never added again. This hunk is some missed leftover from rework. Adding it twice will corrupt the linked list in some cases. It effects HWPT specific attachment, which is something the test suite cannot cover until we can create a legitimate struct device with a non-system iommu driver (ie we need the bus removed from the iommu code) (CVE-2023-54043)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54043
https://ubuntu.com/security/CVE-2023-54043

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54043

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279947 - Linux Distros Unpatched Vulnerability : CVE-2023-54046
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- crypto: essiv - Handle EBUSY correctly As it is essiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request. However, as the caller of essiv may specify MAY_BACKLOG, we also need to expect EBUSY and treat it in the same way.
Otherwise backlogged requests will trigger a use-after-free. (CVE-2023-54046)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54046
https://ubuntu.com/security/CVE-2023-54046

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54046

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279935 - Linux Distros Unpatched Vulnerability : CVE-2023-54054
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: qla2xxx: Fix buffer overrun Klocwork warning: Buffer Overflow - Array Index Out of Bounds Driver uses fc_els_flogi to calculate size of buffer. The actual buffer is nested inside of fc_els_flogi which is smaller. Replace structure name to allow proper size calculation. (CVE-2023-54054)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54054
https://ubuntu.com/security/CVE-2023-54054

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54054

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279952 - Linux Distros Unpatched Vulnerability : CVE-2023-54056
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- kheaders: Use array declaration instead of char Under CONFIG_FORTIFY_SOURCE, memcpy() will check the size of destination and source buffers. Defining kernel_headers_data as char would trip this check. Since these addresses are treated as byte arrays, define them as arrays (as done everywhere else). This was seen with: $ cat /sys/kernel/kheaders.tar.xz >> /dev/null detected buffer overflow in memcpy kernel BUG at lib/string_helpers.c:1027! ... RIP: 0010:fortify_panic+0xf/0x20 [...] Call Trace: <TASK>
ikheaders_read+0x45/0x50 [kheaders] kernfs_fop_read_iter+0x1a4/0x2f0 ... (CVE-2023-54056)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54056
https://ubuntu.com/security/CVE-2023-54056

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54056

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279948 - Linux Distros Unpatched Vulnerability : CVE-2023-54057
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter The 'acpiid' buffer in the parse_ivrs_acpihid function may overflow, because the string specifier in the format string sscanf() has no width limitation. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE. (CVE-2023-54057)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54057
https://ubuntu.com/security/CVE-2023-54057

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54057

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279916 - Linux Distros Unpatched Vulnerability : CVE-2023-54062
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: fix invalid free tracking in ext4_xattr_move_to_block() In ext4_xattr_move_to_block(), the value of the extended attribute which we need to move to an external block may be allocated by kvmalloc() if the value is stored in an external inode. So at the end of the function the code tried to check if this was the case by testing entry->e_value_inum. However, at this point, the pointer to the xattr entry is no longer valid, because it was removed from the original location where it had been stored. So we could end up calling kvfree() on a pointer which was not allocated by kvmalloc(); or we could also potentially leak memory by not freeing the buffer when it should be freed. Fix this by storing whether it should be freed in a separate variable. (CVE-2023-54062)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54062
https://ubuntu.com/security/CVE-2023-54062

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54062

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279890 - Linux Distros Unpatched Vulnerability : CVE-2023-54069
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow When we calculate the end position of ext4_free_extent, this position may be exactly where ext4_lblk_t (i.e. uint) overflows. For example, if ac_g_ex.fe_logical is 4294965248 and ac_orig_goal_len is 2048, then the computed end is 0x100000000, which is 0. If ac->ac_o_ex.fe_logical is not the first case of adjusting the best extent, that is, new_bex_end >
0, the following BUG_ON will be triggered: ========================================================= kernel BUG at fs/ext4/mballoc.c:5116! invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 3 PID: 673 Comm:
xfs_io Tainted: G E 6.5.0-rc1+ #279 RIP: 0010:ext4_mb_new_inode_pa+0xc5/0x430 Call Trace: <TASK>
ext4_mb_use_best_found+0x203/0x2f0 ext4_mb_try_best_found+0x163/0x240 ext4_mb_regular_allocator+0x158/0x1550 ext4_mb_new_blocks+0x86a/0xe10 ext4_ext_map_blocks+0xb0c/0x13a0 ext4_map_blocks+0x2cd/0x8f0 ext4_iomap_begin+0x27b/0x400 iomap_iter+0x222/0x3d0 __iomap_dio_rw+0x243/0xcb0 iomap_dio_rw+0x16/0x80 ========================================================= A simple reproducer demonstrating the problem: mkfs.ext4 -F /dev/sda -b 4096 100M mount /dev/sda /tmp/test fallocate -l1M /tmp/test/tmp fallocate -l10M /tmp/test/file fallocate -i -o 1M -l16777203M /tmp/test/file fsstress -d /tmp/test -l 0 -n 100000 -p 8 & sleep 10 && killall -9 fsstress rm -f /tmp/test/tmp xfs_io -c open -ad /tmp/test/file -c pwrite -S 0xff 0 8192 We simply refactor the logic for adjusting the best extent by adding a temporary ext4_free_extent ex and use extent_logical_end() to avoid overflow, which also simplifies the code. (CVE-2023-54069)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54069
https://ubuntu.com/security/CVE-2023-54069

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54069

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279864 - Linux Distros Unpatched Vulnerability : CVE-2023-54076
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smb: client: fix missed ses refcounting Use new cifs_smb_ses_inc_refcount() helper to get an active reference of @ses and @ses->dfs_root_ses (if set). This will prevent @ses->dfs_root_ses of being put in the next call to cifs_put_smb_ses() and thus potentially causing an use-after-free bug. (CVE-2023-54076)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54076
https://ubuntu.com/security/CVE-2023-54076

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54076

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279766 - Linux Distros Unpatched Vulnerability : CVE-2023-54083
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- phy: tegra: xusb: Clear the driver reference in usb-phy dev For the dual-role port, it will assign the phy dev to usb-phy dev and use the port dev driver as the dev driver of usb-phy. When we try to destroy the port dev, it will destroy its dev driver as well. But we did not remove the reference from usb-phy dev.
This might cause the use-after-free issue in KASAN. (CVE-2023-54083)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54083
https://ubuntu.com/security/CVE-2023-54083

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54083

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279744 - Linux Distros Unpatched Vulnerability : CVE-2023-54088
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- blk-cgroup: hold queue_lock when removing blkg->q_node When blkg is removed from q->blkg_list from blkg_free_workfn(), queue_lock has to be held, otherwise, all kinds of bugs(list corruption, hard lockup, ..) can be triggered from blkg_destroy_all(). (CVE-2023-54088)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54088
https://security-tracker.debian.org/tracker/CVE-2023-54088
https://ubuntu.com/security/CVE-2023-54088

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54088

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279885 - Linux Distros Unpatched Vulnerability : CVE-2023-54095
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- powerpc/iommu: Fix notifiers being shared by PCI and VIO buses fail_iommu_setup() registers the fail_iommu_bus_notifier struct to both PCI and VIO buses. struct notifier_block is a linked list node, so this causes any notifiers later registered to either bus type to also be registered to the other since they share the same node. This causes issues in (at least) the vgaarb code, which registers a notifier for PCI buses. pci_notify() ends up being called on a vio device, converted with to_pci_dev() even though it's not a PCI device, and finally makes a bad access in vga_arbiter_add_pci_device() as discovered with KASAN:
BUG: KASAN: slab-out-of-bounds in vga_arbiter_add_pci_device+0x60/0xe00 Read of size 4 at addr c000000264c26fdc by task swapper/0/1 Call Trace: dump_stack_lvl+0x1bc/0x2b8 (unreliable) print_report+0x3f4/0xc60 kasan_report+0x244/0x698 __asan_load4+0xe8/0x250 vga_arbiter_add_pci_device+0x60/0xe00 pci_notify+0x88/0x444 notifier_call_chain+0x104/0x320 blocking_notifier_call_chain+0xa0/0x140 device_add+0xac8/0x1d30 device_register+0x58/0x80 vio_register_device_node+0x9ac/0xce0 vio_bus_scan_register_devices+0xc4/0x13c
__machine_initcall_pseries_vio_device_init+0x94/0xf0 do_one_initcall+0x12c/0xaa8 kernel_init_freeable+0xa48/0xba8 kernel_init+0x64/0x400 ret_from_kernel_thread+0x5c/0x64 Fix this by creating separate notifier_block structs for each bus type. [mpe: Add #ifdef to fix CONFIG_IBMVIO=n build] (CVE-2023-54095)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54095
https://ubuntu.com/security/CVE-2023-54095

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54095

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279872 - Linux Distros Unpatched Vulnerability : CVE-2023-54096
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- soundwire: fix enumeration completion The soundwire subsystem uses two completion structures that allow drivers to wait for soundwire device to become enumerated on the bus and initialised by their drivers, respectively. The code implementing the signalling is currently broken as it does not signal all current and future waiters and also uses the wrong reinitialisation function, which can potentially lead to memory corruption if there are still waiters on the queue. Not signalling future waiters specifically breaks sound card probe deferrals as codec drivers can not tell that the soundwire device is already attached when being reprobed. Some codec runtime PM implementations suffer from similar problems as waiting for enumeration during resume can also timeout despite the device already having been enumerated.
(CVE-2023-54096)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54096
https://ubuntu.com/security/CVE-2023-54096

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54096

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279759 - Linux Distros Unpatched Vulnerability : CVE-2023-54097
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- regulator: stm32-pwr: fix of_iomap leak Smatch reports: drivers/regulator/stm32-pwr.c:166 stm32_pwr_regulator_probe() warn: 'base' from of_iomap() not released on lines: 151,166. In stm32_pwr_regulator_probe(), base is not released when devm_kzalloc() fails to allocate memory or devm_regulator_register() fails to register a new regulator device, which may cause a leak. To fix this issue, replace of_iomap() with devm_platform_ioremap_resource(). devm_platform_ioremap_resource() is a specialized function for platform devices. It allows 'base' to be automatically released whether the probe function succeeds or fails. Besides, use IS_ERR(base) instead of !base as the return value of devm_platform_ioremap_resource() can either be a pointer to the remapped memory or an ERR_PTR() encoded error code if the operation fails. (CVE-2023-54097)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54097
https://ubuntu.com/security/CVE-2023-54097

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54097

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279899 - Linux Distros Unpatched Vulnerability : CVE-2023-54099
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fs: Protect reconfiguration of sb read-write from racing writes The reconfigure / remount code takes a lot of effort to protect filesystem's reconfiguration code from racing writes on remounting read-only. However during remounting read-only filesystem to read-write mode userspace writes can start immediately once we clear SB_RDONLY flag. This is inconvenient for example for ext4 because we need to do some writes to the filesystem (such as preparation of quota files) before we can take userspace writes so we are clearing SB_RDONLY flag before we are fully ready to accept userpace writes and syzbot has found a way to exploit this [1]. Also as far as I'm reading the code the filesystem remount code was protected from racing writes in the legacy mount path by the mount's MNT_READONLY flag so this is relatively new problem. It is actually fairly easy to protect remount read-write from racing writes using sb->s_readonly_remount flag so let's just do that instead of having to workaround these races in the filesystem code. [1] https://lore.kernel.org/all/00000000000006a0df05f6667499@google.com/T/ (CVE-2023-54099)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54099
https://ubuntu.com/security/CVE-2023-54099

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54099

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279884 - Linux Distros Unpatched Vulnerability : CVE-2023-54100
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: qedi: Fix use after free bug in qedi_remove() In qedi_probe() we call __qedi_probe() which initializes &qedi->recovery_work with qedi_recovery_handler() and &qedi->board_disable_work with qedi_board_disable_work(). When qedi_schedule_recovery_handler() is called, schedule_delayed_work() will finally start the work. In qedi_remove(), which is called to remove the driver, the following sequence may be observed: Fix this by finishing the work before cleanup in qedi_remove(). CPU0 CPU1 |qedi_recovery_handler qedi_remove | __qedi_remove | iscsi_host_free | scsi_host_put | //free shost | |iscsi_host_for_each_session |//use qedi->shost Cancel recovery_work and board_disable_work in
__qedi_remove(). (CVE-2023-54100)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54100
https://ubuntu.com/security/CVE-2023-54100

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54100

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279861 - Linux Distros Unpatched Vulnerability : CVE-2023-54102
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow A static code analysis tool flagged the possibility of buffer overflow when using copy_from_user() for a debugfs entry. Currently, it is possible that copy_from_user() copies more bytes than what would fit in the mybuf char array. Add a min() restriction check between sizeof(mybuf) - 1 and nbytes passed from the userspace buffer to protect against buffer overflow. (CVE-2023-54102)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54102
https://ubuntu.com/security/CVE-2023-54102

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54102

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279858 - Linux Distros Unpatched Vulnerability : CVE-2023-54105
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- can: isotp: check CAN address family in isotp_bind() Add missing check to block non-AF_CAN binds. Syzbot created some code which matched the right sockaddr struct size but used AF_XDP (0x2C) instead of AF_CAN (0x1D) in the address family field: bind$xdp(r2, &(0x7f0000000540)={0x2c, 0x0, r4, 0x0, r2}, 0x10) ^^^^ This has no funtional impact but the userspace should be notified about the wrong address family field content. (CVE-2023-54105)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54105
https://ubuntu.com/security/CVE-2023-54105

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54105

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279878 - Linux Distros Unpatched Vulnerability : CVE-2023-54110
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: rndis_host: Secure rndis_query check against int overflow Variables off and len typed as uint32 in rndis_query function are controlled by incoming RNDIS response message thus their value may be manipulated. Setting off to a unexpectetly large value will cause the sum with len and 8 to overflow and pass the implemented validation step. Consequently the response pointer will be referring to a location past the expected buffer boundaries allowing information leakage e.g. via RNDIS_OID_802_3_PERMANENT_ADDRESS OID. (CVE-2023-54110)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54110
https://ubuntu.com/security/CVE-2023-54110

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54110

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279736 - Linux Distros Unpatched Vulnerability : CVE-2023-54114
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() As the call trace shows, skb_panic was caused by wrong skb->mac_header in nsh_gso_segment(): invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 3 PID: 2737 Comm: syz Not tainted 6.3.0-next-20230505 #1 RIP: 0010:skb_panic+0xda/0xe0 call Trace:
skb_push+0x91/0xa0 nsh_gso_segment+0x4f3/0x570 skb_mac_gso_segment+0x19e/0x270
__skb_gso_segment+0x1e8/0x3c0 validate_xmit_skb+0x452/0x890 validate_xmit_skb_list+0x99/0xd0 sch_direct_xmit+0x294/0x7c0 __dev_queue_xmit+0x16f0/0x1d70 packet_xmit+0x185/0x210 packet_snd+0xc15/0x1170 packet_sendmsg+0x7b/0xa0 sock_sendmsg+0x14f/0x160 The root cause is: nsh_gso_segment() use skb->network_header - nhoff to reset mac_header in skb_gso_error_unwind() if inner-layer protocol gso fails. However, skb->network_header may be reset by inner-layer protocol gso function e.g.
mpls_gso_segment. skb->mac_header reset by the inaccurate network_header will be larger than skb headroom.
nsh_gso_segment nhoff = skb->network_header - skb->mac_header; __skb_pull(skb,nsh_len) skb_mac_gso_segment mpls_gso_segment skb_reset_network_header(skb);//skb->network_header+=nsh_len return -EINVAL;
skb_gso_error_unwind skb_push(skb, nsh_len); skb->mac_header = skb->network_header - nhoff; // skb->mac_header > skb->headroom, cause skb_push panic Use correct mac_offset to restore mac_header and get rid of nhoff. (CVE-2023-54114)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54114
https://ubuntu.com/security/CVE-2023-54114

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54114

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279778 - Linux Distros Unpatched Vulnerability : CVE-2023-54116
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/fbdev-generic: prohibit potential out-of-bounds access The fbdev test of IGT may write after EOF, which lead to out-of-bound access for drm drivers with fbdev-generic. For example, run fbdev test on a x86+ast2400 platform, with 1680x1050 resolution, will cause the linux kernel hang with the following call trace: Oops: 0000 [#1] PREEMPT SMP PTI [IGT] fbdev: starting subtest eof Workqueue: events drm_fb_helper_damage_work [drm_kms_helper] [IGT] fbdev: starting subtest nullptr RIP:
0010:memcpy_erms+0xa/0x20 RSP: 0018:ffffa17d40167d98 EFLAGS: 00010246 RAX: ffffa17d4eb7fa80 RBX:
ffffa17d40e0aa80 RCX: 00000000000014c0 RDX: 0000000000001a40 RSI: ffffa17d40e0b000 RDI: ffffa17d4eb80000 RBP: ffffa17d40167e20 R08: 0000000000000000 R09: ffff89522ecff8c0 R10: ffffa17d4e4c5000 R11:
0000000000000000 R12: ffffa17d4eb7fa80 R13: 0000000000001a40 R14: 000000000000041a R15: ffffa17d40167e30 FS: 0000000000000000(0000) GS:ffff895257380000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffa17d40e0b000 CR3: 00000001eaeca006 CR4: 00000000001706e0 Call Trace: <TASK>
? drm_fbdev_generic_helper_fb_dirty+0x207/0x330 [drm_kms_helper] drm_fb_helper_damage_work+0x8f/0x170 [drm_kms_helper] process_one_work+0x21f/0x430 worker_thread+0x4e/0x3c0 ? __pfx_worker_thread+0x10/0x10 kthread+0xf4/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 </TASK> CR2: ffffa17d40e0b000 ---[ end trace 0000000000000000 ]--- The is because damage rectangles computed by drm_fb_helper_memory_range_to_clip() function is not guaranteed to be bound in the screen's active display area. Possible reasons are: 1) Buffers are allocated in the granularity of page size, for mmap system call support. The shadow screen buffer consumed by fbdev emulation may also choosed be page size aligned. 2) The DIV_ROUND_UP() used in drm_fb_helper_memory_range_to_clip() will introduce off-by-one error. For example, on a 16KB page size system, in order to store a 1920x1080 XRGB framebuffer, we need allocate 507 pages. Unfortunately, the size 1920*1080*4 can not be divided exactly by 16KB. 1920 * 1080 * 4 = 8294400 bytes 506 * 16 * 1024 = 8290304 bytes 507 * 16 * 1024 = 8306688 bytes line_length = 1920*4 = 7680 bytes 507 * 16 * 1024 / 7680 = 1081.6 off / line_length = 507 * 16 * 1024 / 7680 = 1081 DIV_ROUND_UP(507 * 16 * 1024, 7680) will yeild 1082 memcpy_toio() typically issue the copy line by line, when copy the last line, out-of-bound access will be happen. Because: 1082 * line_length = 1082 * 7680 = 8309760, and 8309760 >
8306688 Note that userspace may still write to the invisiable area if a larger buffer than width x stride is exposed. But it is not a big issue as long as there still have memory resolve the access if not drafting so far. - Also limit the y1 (Daniel) - keep fix patch it to minimal (Daniel) - screen_size is page size aligned because of it need mmap (Thomas) - Adding fixes tag (Thomas) (CVE-2023-54116)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54116
https://ubuntu.com/security/CVE-2023-54116

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54116

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279894 - Linux Distros Unpatched Vulnerability : CVE-2023-54118
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- serial: sc16is7xx: setup GPIO controller later in probe The GPIO controller component of the sc16is7xx driver is setup too early, which can result in a race condition where another device tries to utilise the GPIO lines before the sc16is7xx device has finished initialising. This issue manifests itself as an Oops when the GPIO lines are configured: Unable to handle kernel read from unreadable memory at virtual address ... pc : sc16is7xx_gpio_direction_output+0x68/0x108 [sc16is7xx] lr :
sc16is7xx_gpio_direction_output+0x4c/0x108 [sc16is7xx] ... Call trace:
sc16is7xx_gpio_direction_output+0x68/0x108 [sc16is7xx] gpiod_direction_output_raw_commit+0x64/0x318 gpiod_direction_output+0xb0/0x170 create_gpio_led+0xec/0x198 gpio_led_probe+0x16c/0x4f0 platform_drv_probe+0x5c/0xb0 really_probe+0xe8/0x448 driver_probe_device+0xe8/0x138
__device_attach_driver+0x94/0x118 bus_for_each_drv+0x8c/0xe0 __device_attach+0x100/0x1b8 device_initial_probe+0x28/0x38 bus_probe_device+0xa4/0xb0 deferred_probe_work_func+0x90/0xe0 process_one_work+0x1c4/0x480 worker_thread+0x54/0x430 kthread+0x138/0x150 ret_from_fork+0x10/0x1c This patch moves the setup of the GPIO controller functions to later in the probe function, ensuring the sc16is7xx device has already finished initialising by the time other devices try to make use of the GPIO lines. The error handling has also been reordered to reflect the new initialisation order.
(CVE-2023-54118)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54118
https://ubuntu.com/security/CVE-2023-54118

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54118

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279789 - Linux Distros Unpatched Vulnerability : CVE-2023-54120
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: Fix race condition in hidp_session_thread There is a potential race condition in hidp_session_thread that may lead to use-after-free. For instance, the timer is active while hidp_del_timer is called in hidp_session_thread(). After hidp_session_put, then 'session' will be freed, causing kernel panic when hidp_idle_timeout is running. The solution is to use del_timer_sync instead of del_timer. Here is the call trace: ? hidp_session_probe+0x780/0x780 call_timer_fn+0x2d/0x1e0
__run_timers.part.0+0x569/0x940 hidp_session_probe+0x780/0x780 call_timer_fn+0x1e0/0x1e0 ktime_get+0x5c/0xf0 lapic_next_deadline+0x2c/0x40 clockevents_program_event+0x205/0x320 run_timer_softirq+0xa9/0x1b0 __do_softirq+0x1b9/0x641 __irq_exit_rcu+0xdc/0x190 irq_exit_rcu+0xe/0x20 sysvec_apic_timer_interrupt+0xa1/0xc0 (CVE-2023-54120)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54120
https://ubuntu.com/security/CVE-2023-54120

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
8.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:M/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54120

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279874 - Linux Distros Unpatched Vulnerability : CVE-2023-54123
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- md/raid10: fix memleak for 'conf->bio_split' In the error path of raid10_run(), 'conf' need be freed, however, 'conf->bio_split' is missed and memory will be leaked. Since there are 3 places to free 'conf', factor out a helper to fix the problem. (CVE-2023-54123)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54123
https://ubuntu.com/security/CVE-2023-54123

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54123

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279854 - Linux Distros Unpatched Vulnerability : CVE-2023-54135
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- maple_tree: fix potential out-of-bounds access in mas_wr_end_piv() Check the write offset end bounds before using it as the offset into the pivot array. This avoids a possible out-of-bounds access on the pivot array if the write extends to the last slot in the node, in which case the node maximum should be used as the end pivot. akpm: this doesn't affect any current callers, but new users of mapletree may encounter this problem if backported into earlier kernels, so let's fix it in -stable kernels in case of this. (CVE-2023-54135)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54135
https://ubuntu.com/security/CVE-2023-54135

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54135

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279814 - Linux Distros Unpatched Vulnerability : CVE-2023-54146
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- x86/kexec: Fix double-free of elf header buffer After b3e34a47f989 (x86/kexec: fix memory leak of elf header buffer), freeing image->elf_headers in the error path of crash_load_segments() is not needed because kimage_file_post_load_cleanup() will take care of that later. And not clearing it could result in a double-free. Drop the superfluous vfree() call at the error path of crash_load_segments().
(CVE-2023-54146)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54146
https://ubuntu.com/security/CVE-2023-54146

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54146

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279871 - Linux Distros Unpatched Vulnerability : CVE-2023-54148
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mlx5e: Move representor neigh cleanup to profile cleanup_tx For IP tunnel encapsulation in ECMP (Equal-Cost Multipath) mode, as the flow is duplicated to the peer eswitch, the related neighbour information on the peer uplink representor is created as well. In the cited commit, eswitch devcom unpair is moved to uplink unload API, specifically the profile->cleanup_tx. If there is a encap rule offloaded in ECMP mode, when one eswitch does unpair (because of unloading the driver, for instance), and the peer rule from the peer eswitch is going to be deleted, the use-after-free error is triggered while accessing neigh info, as it is already cleaned up in uplink's profile->disable, which is before its profile->cleanup_tx.
To fix this issue, move the neigh cleanup to profile's cleanup_tx callback, and after mlx5e_cleanup_uplink_rep_tx is called. The neigh init is moved to init_tx for symmeter. [ 2453.376299] BUG: KASAN: slab-use-after-free in mlx5e_rep_neigh_entry_release+0x109/0x3a0 [mlx5_core] [ 2453.379125] Read of size 4 at addr ffff888127af9008 by task modprobe/2496 [ 2453.381542] CPU: 7 PID: 2496 Comm:
modprobe Tainted: G B 6.4.0-rc7+ #15 [ 2453.383386] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 2453.384335] Call Trace: [ 2453.384625] <TASK> [ 2453.384891] dump_stack_lvl+0x33/0x50 [ 2453.385285] print_report+0xc2/0x610 [ 2453.385667] ?
__virt_addr_valid+0xb1/0x130 [ 2453.386091] ? mlx5e_rep_neigh_entry_release+0x109/0x3a0 [mlx5_core] [ 2453.386757] kasan_report+0xae/0xe0 [ 2453.387123] ? mlx5e_rep_neigh_entry_release+0x109/0x3a0 [mlx5_core] [ 2453.387798] mlx5e_rep_neigh_entry_release+0x109/0x3a0 [mlx5_core] [ 2453.388465] mlx5e_rep_encap_entry_detach+0xa6/0xe0 [mlx5_core] [ 2453.389111] mlx5e_encap_dealloc+0xa7/0x100 [mlx5_core] [ 2453.389706] mlx5e_tc_tun_encap_dests_unset+0x61/0xb0 [mlx5_core] [ 2453.390361] mlx5_free_flow_attr_actions+0x11e/0x340 [mlx5_core] [ 2453.391015] ? complete_all+0x43/0xd0 [ 2453.391398] ? free_flow_post_acts+0x38/0x120 [mlx5_core] [ 2453.392004] mlx5e_tc_del_fdb_flow+0x4ae/0x690 [mlx5_core] [ 2453.392618] mlx5e_tc_del_fdb_peers_flow+0x308/0x370 [mlx5_core] [ 2453.393276] mlx5e_tc_clean_fdb_peer_flows+0xf5/0x140 [mlx5_core] [ 2453.393925] mlx5_esw_offloads_unpair+0x86/0x540 [mlx5_core] [ 2453.394546] ? mlx5_esw_offloads_set_ns_peer.isra.0+0x180/0x180 [mlx5_core] [ 2453.395268] ? down_write+0xaa/0x100 [ 2453.395652] mlx5_esw_offloads_devcom_event+0x203/0x530 [mlx5_core] [ 2453.396317] mlx5_devcom_send_event+0xbb/0x190 [mlx5_core] [ 2453.396917] mlx5_esw_offloads_devcom_cleanup+0xb0/0xd0 [mlx5_core] [ 2453.397582] mlx5e_tc_esw_cleanup+0x42/0x120 [mlx5_core] [ 2453.398182] mlx5e_rep_tc_cleanup+0x15/0x30 [mlx5_core] [ 2453.398768] mlx5e_cleanup_rep_tx+0x6c/0x80 [mlx5_core] [ 2453.399367] mlx5e_detach_netdev+0xee/0x120 [mlx5_core] [ 2453.399957] mlx5e_netdev_change_profile+0x84/0x170 [mlx5_core] [ 2453.400598] mlx5e_vport_rep_unload+0xe0/0xf0 [mlx5_core] [ 2453.403781] mlx5_eswitch_unregister_vport_reps+0x15e/0x190 [mlx5_core] [ 2453.404479] ? mlx5_eswitch_register_vport_reps+0x200/0x200 [mlx5_core] [ 2453.405170] ? up_write+0x39/0x60 [ 2453.405529] ? kernfs_remove_by_name_ns+0xb7/0xe0 [ 2453.405985] auxiliary_bus_remove+0x2e/0x40 [ 2453.406405] device_release_driver_internal+0x243/0x2d0 [ 2453.406900] ? kobject_put+0x42/0x2d0 [ 2453.407284] bus_remove_device+0x128/0x1d0 [ 2453.407687] device_del+0x240/0x550 [ 2453.408053] ? waiting_for_supplier_show+0xe0/0xe0 [ 2453.408511] ? kobject_put+0xfa/0x2d0 [ 2453.408889] ?
__kmem_cache_free+0x14d/0x280 [ 2453.409310] mlx5_rescan_drivers_locked.part.0+0xcd/0x2b0 [mlx5_core] [ 2453.409973] mlx5_unregister_device+0x40/0x50 [mlx5_core] [ 2453.410561] mlx5_uninit_one+0x3d/0x110 [mlx5_core] [ 2453.411111] remove_one+0x89/0x130 [mlx5_core] [ 24 ---truncated--- (CVE-2023-54148)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54148
https://ubuntu.com/security/CVE-2023-54148

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54148

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281527 - Linux Distros Unpatched Vulnerability : CVE-2023-54164
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix iso_conn related locking and validity issues sk->sk_state indicates whether iso_pi(sk)->conn is valid. Operations that check/update sk_state and access conn should hold lock_sock, otherwise they can race. The order of taking locks is hci_dev_lock > lock_sock > iso_conn_lock, which is how it is in connect/disconnect_cfm ->
iso_conn_del -> iso_chan_del. Fix locking in iso_connect_cis/bis and sendmsg/recvmsg to take lock_sock around updating sk_state and conn. iso_conn_del must not occur during iso_connect_cis/bis, as it frees the iso_conn. Hold hdev->lock longer to prevent that. This should not reintroduce the issue fixed in commit 241f51931c35 (Bluetooth: ISO: Avoid circular locking dependency), since the we acquire locks in order.
We retain the fix in iso_sock_connect to release lock_sock before iso_connect_* acquires hdev->lock.
Similarly for commit 6a5ad251b7cd (Bluetooth: ISO: Fix possible circular locking dependency). We retain the fix in iso_conn_ready to not acquire iso_conn_lock before lock_sock. iso_conn_add shall return iso_conn with valid hcon. Make it so also when reusing an old CIS connection waiting for disconnect timeout (see __iso_sock_close where conn->hcon is set to NULL). Trace with iso_conn_del after iso_chan_add in iso_connect_cis: =============================================================== iso_sock_create:771:
sock 00000000be9b69b7 iso_sock_init:693: sk 000000004dff667e iso_sock_bind:827: sk 000000004dff667e 70:1a:b8:98:ff:a2 type 1 iso_sock_setsockopt:1289: sk 000000004dff667e iso_sock_setsockopt:1289: sk 000000004dff667e iso_sock_setsockopt:1289: sk 000000004dff667e iso_sock_connect:875: sk 000000004dff667e iso_connect_cis:353: 70:1a:b8:98:ff:a2 -> 28:3d:c2:4a:7e:da hci_get_route:1199: 70:1a:b8:98:ff:a2 ->
28:3d:c2:4a:7e:da hci_conn_add:1005: hci0 dst 28:3d:c2:4a:7e:da iso_conn_add:140: hcon 000000007b65d182 conn 00000000daf8625e __iso_chan_add:214: conn 00000000daf8625e iso_connect_cfm:1700: hcon 000000007b65d182 bdaddr 28:3d:c2:4a:7e:da status 12 iso_conn_del:187: hcon 000000007b65d182 conn 00000000daf8625e, err 16 iso_sock_clear_timer:117: sock 000000004dff667e state 3 <Note: sk_state is BT_BOUND (3), so iso_connect_cis is still running at this point> iso_chan_del:153: sk 000000004dff667e, conn 00000000daf8625e, err 16 hci_conn_del:1151: hci0 hcon 000000007b65d182 handle 65535 hci_conn_unlink:1102: hci0: hcon 000000007b65d182 hci_chan_list_flush:2780: hcon 000000007b65d182 iso_sock_getsockopt:1376: sk 000000004dff667e iso_sock_getname:1070: sock 00000000be9b69b7, sk 000000004dff667e iso_sock_getname:1070: sock 00000000be9b69b7, sk 000000004dff667e iso_sock_getsockopt:1376: sk 000000004dff667e iso_sock_getname:1070: sock 00000000be9b69b7, sk 000000004dff667e iso_sock_getname:1070: sock 00000000be9b69b7, sk 000000004dff667e iso_sock_shutdown:1434:
sock 00000000be9b69b7, sk 000000004dff667e, how 1 __iso_sock_close:632: sk 000000004dff667e state 5 socket 00000000be9b69b7 <Note: sk_state is BT_CONNECT (5), even though iso_chan_del sets BT_CLOSED (6). Only iso_connect_cis sets it to BT_CONNECT, so it must be that iso_chan_del occurred between iso_chan_add and end of iso_connect_cis.> BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 8000000006467067 P4D 8000000006467067 PUD 3f5f067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI Hardware name:
QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 RIP: 0010:__iso_sock_close (net/bluetooth/iso.c:664) bluetooth =============================================================== Trace with iso_conn_del before iso_chan_add in iso_connect_cis:
=============================================================== iso_connect_cis:356: 70:1a:b8:98:ff:a2 ->
28:3d:c2:4a:7e:da ... iso_conn_add:140: hcon 0000000093bc551f conn 00000000768ae504 hci_dev_put:1487: hci0 orig refcnt 21 hci_event_packet:7607: hci0: e ---truncated--- (CVE-2023-54164)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54164

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
8.4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54164

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280752 - Linux Distros Unpatched Vulnerability : CVE-2023-54177
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: quota: fix warning in dqgrab() There's issue as follows when do fault injection: WARNING: CPU: 1 PID: 14870 at include/linux/quotaops.h:51 dquot_disable+0x13b7/0x18c0 Modules linked in: CPU: 1 PID: 14870 Comm: fsconfig Not tainted 6.3.0-next-20230505-00006-g5107a9c821af-dirty #541 RIP: 0010:dquot_disable+0x13b7/0x18c0 RSP:
0018:ffffc9000acc79e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88825e41b980 RDX: 0000000000000000 RSI: ffff88825e41b980 RDI: 0000000000000002 RBP: ffff888179f68000 R08:
ffffffff82087ca7 R09: 0000000000000000 R10: 0000000000000001 R11: ffffed102f3ed026 R12: ffff888179f68130 R13: ffff888179f68110 R14: dffffc0000000000 R15: ffff888179f68118 FS: 00007f450a073740(0000) GS:ffff88882fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
00007ffe96f2efd8 CR3: 000000025c8ad000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK>
dquot_load_quota_sb+0xd53/0x1060 dquot_resume+0x172/0x230 ext4_reconfigure+0x1dc6/0x27b0 reconfigure_super+0x515/0xa90 __x64_sys_fsconfig+0xb19/0xd20 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Above issue may happens as follows: ProcessA ProcessB ProcessC sys_fsconfig vfs_fsconfig_locked reconfigure_super ext4_remount dquot_suspend -> suspend all type quota sys_fsconfig vfs_fsconfig_locked reconfigure_super ext4_remount dquot_resume ret = dquot_load_quota_sb add_dquot_ref do_open -> open file O_RDWR vfs_open do_dentry_open get_write_access atomic_inc_unless_negative(&inode->i_writecount) ext4_file_open dquot_file_open dquot_initialize
__dquot_initialize dqget atomic_inc(&dquot->dq_count); __dquot_initialize __dquot_initialize dqget if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) ext4_acquire_dquot -> Return error DQ_ACTIVE_B flag isn't set dquot_disable invalidate_dquots if (atomic_read(&dquot->dq_count)) dqgrab WARN_ON_ONCE(!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) -> Trigger warning In the above scenario, 'dquot->dq_flags' has no DQ_ACTIVE_B is normal when dqgrab(). To solve above issue just replace the dqgrab() use in invalidate_dquots() with atomic_inc(&dquot->dq_count). (CVE-2023-54177)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54177

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
8.4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54177

Plugin Information
Published: 2025/12/30, Modified: 2025/12/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280816 - Linux Distros Unpatched Vulnerability : CVE-2023-54186
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: fix pin_assignment_show This patch fixes negative indexing of buf array in pin_assignment_show when get_current_pin_assignments returns 0 i.e. no compatible pin assignments are found. BUG: KASAN: use-after- free in pin_assignment_show+0x26c/0x33c ... Call trace: dump_backtrace+0x110/0x204 dump_stack_lvl+0x84/0xbc print_report+0x358/0x974 kasan_report+0x9c/0xfc __do_kernel_fault+0xd4/0x2d4 do_bad_area+0x48/0x168 do_tag_check_fault+0x24/0x38 do_mem_abort+0x6c/0x14c el1_abort+0x44/0x68 el1h_64_sync_handler+0x64/0xa4 el1h_64_sync+0x78/0x7c pin_assignment_show+0x26c/0x33c dev_attr_show+0x50/0xc0 (CVE-2023-54186)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54186

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
8.4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54186

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281555 - Linux Distros Unpatched Vulnerability : CVE-2023-54189
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: pstore/ram: Add check for kstrdup Add check for the return value of kstrdup() and return the error if it fails in order to avoid NULL pointer dereference. (CVE-2023-54189)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54189

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54189

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281538 - Linux Distros Unpatched Vulnerability : CVE-2023-54190
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: leds: led-core: Fix refcount leak in of_led_get() class_find_device_by_of_node() calls class_find_device(), it will take the reference, use the put_device() to drop the reference when not need anymore. (CVE-2023-54190)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54190

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54190

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280794 - Linux Distros Unpatched Vulnerability : CVE-2023-54195
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix timeout of a call that hasn't yet been granted a channel afs_make_call() calls rxrpc_kernel_begin_call() to begin a call (which may get stalled in the background waiting for a connection to become available); it then calls rxrpc_kernel_set_max_life() to set the timeouts - but that starts the call timer so the call timer might then expire before we get a connection assigned - leading to the following oops if the call stalled: BUG:
kernel NULL pointer dereference, address: 0000000000000000 ... CPU: 1 PID: 5111 Comm: krxrpcio/0 Not tainted 6.3.0-rc7-build3+ #701 RIP: 0010:rxrpc_alloc_txbuf+0xc0/0x157 ... Call Trace: <TASK>
rxrpc_send_ACK+0x50/0x13b rxrpc_input_call_event+0x16a/0x67d rxrpc_io_thread+0x1b6/0x45f ?
_raw_spin_unlock_irqrestore+0x1f/0x35 ? rxrpc_input_packet+0x519/0x519 kthread+0xe7/0xef ? kthread_complete_and_exit+0x1b/0x1b ret_from_fork+0x22/0x30 Fix this by noting the timeouts in struct rxrpc_call when the call is created. The timer will be started when the first packet is transmitted. It shouldn't be possible to trigger this directly from userspace through AF_RXRPC as sendmsg() will return EBUSY if the call is in the waiting-for-conn state if it dropped out of the wait due to a signal.
(CVE-2023-54195)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54195

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.7 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54195

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280778 - Linux Distros Unpatched Vulnerability : CVE-2023-54198
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tty: fix out-of-bounds access in tty_driver_lookup_tty() When specifying an invalid console= device like console=tty3270, tty_driver_lookup_tty() returns the tty struct without checking whether index is a valid number. To reproduce: qemu-system-x86_64 -enable-kvm -nographic -serial mon:stdio \ -kernel ../linux- build-x86/arch/x86/boot/bzImage \ -append console=ttyS0 console=tty3270 This crashes with: [ 0.770599] BUG: kernel NULL pointer dereference, address: 00000000000000ef [ 0.771265] #PF: supervisor read access in kernel mode [ 0.771773] #PF: error_code(0x0000) - not-present page [ 0.772609] Oops: 0000 [#1] PREEMPT SMP PTI [ 0.774878] RIP: 0010:tty_open+0x268/0x6f0 [ 0.784013] chrdev_open+0xbd/0x230 [ 0.784444] ? cdev_device_add+0x80/0x80 [ 0.784920] do_dentry_open+0x1e0/0x410 [ 0.785389] path_openat+0xca9/0x1050 [ 0.785813] do_filp_open+0xaa/0x150 [ 0.786240] file_open_name+0x133/0x1b0 [ 0.786746] filp_open+0x27/0x50 [ 0.787244] console_on_rootfs+0x14/0x4d [ 0.787800] kernel_init_freeable+0x1e4/0x20d [ 0.788383] ? rest_init+0xc0/0xc0 [ 0.788881] kernel_init+0x11/0x120 [ 0.789356] ret_from_fork+0x22/0x30 (CVE-2023-54198)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54198

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54198

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280809 - Linux Distros Unpatched Vulnerability : CVE-2023-54200
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: always release netdev hooks from notifier This reverts netfilter: nf_tables: skip netdev events generated on netns removal. The problem is that when a veth device is released, the veth release callback will also queue the peer netns device for removal. Its possible that the peer netns is also slated for removal. In this case, the device memory is already released before the pre_exit hook of the peer netns runs: BUG: KASAN:
slab-use-after-free in nf_hook_entry_head+0x1b8/0x1d0 Read of size 8 at addr ffff88812c0124f0 by task kworker/u8:1/45 Workqueue: netns cleanup_net Call Trace: nf_hook_entry_head+0x1b8/0x1d0
__nf_unregister_net_hook+0x76/0x510 nft_netdev_unregister_hooks+0xa0/0x220 __nft_release_hook+0x184/0x490 nf_tables_pre_exit_net+0x12f/0x1b0 .. Order is: 1. First netns is released, veth_dellink() queues peer netns device for removal 2. peer netns is queued for removal 3. peer netns device is released, unreg event is triggered 4. unreg event is ignored because netns is going down 5. pre_exit hook calls nft_netdev_unregister_hooks but device memory might be free'd already. (CVE-2023-54200)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54200

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54200

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280725 - Linux Distros Unpatched Vulnerability : CVE-2023-54201
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA/efa: Fix wrong resources deallocation order When trying to destroy QP or CQ, we first decrease the refcount and potentially free memory regions allocated for the object and then request the device to destroy the object. If the device fails, the object isn't fully destroyed so the user/IB core can try to destroy the object again which will lead to underflow when trying to decrease an already zeroed refcount.
Deallocate resources in reverse order of allocating them to safely free them. (CVE-2023-54201)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54201
https://security-tracker.debian.org/tracker/CVE-2023-54201

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54201

Plugin Information
Published: 2025/12/30, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280723 - Linux Distros Unpatched Vulnerability : CVE-2023-54207
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- HID: uclogic: Correct devm device reference for hidinput input_dev name Reference the HID device rather than the input device for the devm allocation of the input_dev name. Referencing the input_dev would lead to a use-after-free when the input_dev was unregistered and subsequently fires a uevent that depends on the name. At the point of firing the uevent, the name would be freed by devres management. Use devm_kasprintf to simplify the logic for allocating memory and formatting the input_dev name string.
(CVE-2023-54207)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54207
https://security-tracker.debian.org/tracker/CVE-2023-54207

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54207

Plugin Information
Published: 2025/12/30, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281513 - Linux Distros Unpatched Vulnerability : CVE-2023-54226
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix data races around sk->sk_shutdown. KCSAN found a data race around sk->sk_shutdown where unix_release_sock() and unix_shutdown() update it under unix_state_lock(), OTOH unix_poll() and unix_dgram_poll() read it locklessly. We need to annotate the writes and reads with WRITE_ONCE() and READ_ONCE(). BUG: KCSAN: data- race in unix_poll / unix_release_sock write to 0xffff88800d0f8aec of 1 bytes by task 264 on cpu 0:
unix_release_sock+0x75c/0x910 net/unix/af_unix.c:631 unix_release+0x59/0x80 net/unix/af_unix.c:1042
__sock_release+0x7d/0x170 net/socket.c:653 sock_close+0x19/0x30 net/socket.c:1397 __fput+0x179/0x5e0 fs/file_table.c:321 ____fput+0x15/0x20 fs/file_table.c:349 task_work_run+0x116/0x1a0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x174/0x180 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:297 do_syscall_64+0x4b/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc read to 0xffff88800d0f8aec of 1 bytes by task 222 on cpu 1: unix_poll+0xa3/0x2a0 net/unix/af_unix.c:3170 sock_poll+0xcf/0x2b0 net/socket.c:1385 vfs_poll include/linux/poll.h:88 [inline] ep_item_poll.isra.0+0x78/0xc0 fs/eventpoll.c:855 ep_send_events fs/eventpoll.c:1694 [inline] ep_poll fs/eventpoll.c:1823 [inline] do_epoll_wait+0x6c4/0xea0 fs/eventpoll.c:2258 __do_sys_epoll_wait fs/eventpoll.c:2270 [inline] __se_sys_epoll_wait fs/eventpoll.c:2265 [inline] __x64_sys_epoll_wait+0xcc/0x190 fs/eventpoll.c:2265 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc value changed: 0x00 -> 0x03 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 222 Comm: dbus-broker Not tainted 6.3.0-rc7-02330-gca6270c12e20 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 (CVE-2023-54226)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54226

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54226

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280700 - Linux Distros Unpatched Vulnerability : CVE-2023-54227
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- blk-mq: fix tags leak when shrink nr_hw_queues Although we don't need to realloc set->tags[] when shrink nr_hw_queues, we need to free them. Or these tags will be leaked. How to reproduce: 1. mount -t configfs configfs /mnt 2. modprobe null_blk nr_devices=0 submit_queues=8 3. mkdir /mnt/nullb/nullb0 4. echo 1 >
/mnt/nullb/nullb0/power 5. echo 4 > /mnt/nullb/nullb0/submit_queues 6. rmdir /mnt/nullb/nullb0 In step 4, will alloc 9 tags (8 submit queues and 1 poll queue), then in step 5, new_nr_hw_queues = 5 (4 submit queues and 1 poll queue). At last in step 6, only these 5 tags are freed, the other 4 tags leaked.
(CVE-2023-54227)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54227
https://security-tracker.debian.org/tracker/CVE-2023-54227

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54227

Plugin Information
Published: 2025/12/30, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280799 - Linux Distros Unpatched Vulnerability : CVE-2023-54230
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: amba: bus: fix refcount leak commit 5de1540b7bc4 (drivers/amba: create devices from device tree) increases the refcount of of_node, but not releases it in amba_device_release, so there is refcount leak. By using of_node_put to avoid refcount leak. (CVE-2023-54230)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54230

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54230

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280773 - Linux Distros Unpatched Vulnerability : CVE-2023-54234
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization Commit c1af985d27da (scsi: mpi3mr: Add Event acknowledgment logic) introduced an array mrioc->evtack_cmds but initialization of the array elements was missed. They are just zero cleared. The function mpi3mr_complete_evt_ack() refers host_tag field of the elements. Due to the zero value of the host_tag field, the function calls clear_bit() for mrico->evtack_cmds_bitmap with wrong bit index. This results in memory access to invalid address and BUG: KASAN: use-after-free. This BUG was observed at eHBA-9600 firmware update to version 8.3.1.0. To fix it, add the missing initialization of mrioc->evtack_cmds. (CVE-2023-54234)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54234

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54234

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281472 - Linux Distros Unpatched Vulnerability : CVE-2023-54238
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mlx5: fix skb leak while fifo resync and push During ptp resync operation SKBs were poped from the fifo but were never freed neither by napi_consume nor by dev_kfree_skb_any. Add call to napi_consume_skb to properly free SKBs. Another leak was happening because mlx5e_skb_fifo_has_room() had an error in the check. Comparing free running counters works well unless C promotes the types to something wider than the counter. In this case counters are u16 but the result of the substraction is promouted to int and it causes wrong result (negative value) of the check when producer have already overlapped but consumer haven't yet. Explicit cast to u16 fixes the issue. (CVE-2023-54238)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54238

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.7 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54238

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280721 - Linux Distros Unpatched Vulnerability : CVE-2023-54245
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ASoC: codecs: tx-macro: Fix for KASAN: slab-out-of-bounds When we run syzkaller we get below Out of Bound.
KASAN: slab-out-of-bounds Read in regcache_flat_read Below is the backtrace of the issue:
dump_backtrace+0x0/0x4c8 show_stack+0x34/0x44 dump_stack_lvl+0xd8/0x118 print_address_description+0x30/0x2d8 kasan_report+0x158/0x198 __asan_report_load4_noabort+0x44/0x50 regcache_flat_read+0x10c/0x110 regcache_read+0xf4/0x180 _regmap_read+0xc4/0x278
_regmap_update_bits+0x130/0x290 regmap_update_bits_base+0xc0/0x15c snd_soc_component_update_bits+0xa8/0x22c snd_soc_component_write_field+0x68/0xd4 tx_macro_digital_mute+0xec/0x140 Actually There is no need to have decimator with 32 bits. By limiting the variable with short type u8 issue is resolved. (CVE-2023-54245)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54245
https://security-tracker.debian.org/tracker/CVE-2023-54245

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54245

Plugin Information
Published: 2025/12/30, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281522 - Linux Distros Unpatched Vulnerability : CVE-2023-54252
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: platform/x86: think-lmi: Fix memory leaks when parsing ThinkStation WMI strings My previous commit introduced a memory leak where the item allocated from tlmi_setting was not freed. This commit also renames it to avoid confusion with the similarly name variable in the same function. (CVE-2023-54252)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54252

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.7 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54252

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280701 - Linux Distros Unpatched Vulnerability : CVE-2023-54259
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- soundwire: bus: Fix unbalanced pm_runtime_put() causing usage count underflow This reverts commit 443a98e649b4 (soundwire: bus: use pm_runtime_resume_and_get()) Change calls to pm_runtime_resume_and_get() back to pm_runtime_get_sync(). This fixes a usage count underrun caused by doing a pm_runtime_put() even though pm_runtime_resume_and_get() returned an error. The three affected functions ignore -EACCES error from trying to get pm_runtime, and carry on, including a put at the end of the function. But pm_runtime_resume_and_get() does not increment the usage count if it returns an error.
So in the -EACCES case you must not call pm_runtime_put(). The documentation for pm_runtime_get_sync() says: Consider using pm_runtime_resume_and_get() ... as this is likely to result in cleaner code. In this case I don't think it results in cleaner code because the pm_runtime_put() at the end of the function would have to be conditional on the return value from pm_runtime_resume_and_get() at the top of the function. pm_runtime_get_sync() doesn't have this problem because it always increments the count, so always needs a put. The code can just flow through and do the pm_runtime_put() unconditionally.
(CVE-2023-54259)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54259
https://security-tracker.debian.org/tracker/CVE-2023-54259

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54259

Plugin Information
Published: 2025/12/30, Modified: 2025/12/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281557 - Linux Distros Unpatched Vulnerability : CVE-2023-54265
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix an uninit variable access bug in __ip6_make_skb() Syzbot reported a bug as following:
===================================================== BUG: KMSAN: uninit-value in arch_atomic64_inc arch/x86/include/asm/atomic64_64.h:88 [inline] BUG: KMSAN: uninit-value in arch_atomic_long_inc include/linux/atomic/atomic-long.h:161 [inline] BUG: KMSAN: uninit-value in atomic_long_inc include/linux/atomic/atomic-instrumented.h:1429 [inline] BUG: KMSAN: uninit-value in
__ip6_make_skb+0x2f37/0x30f0 net/ipv6/ip6_output.c:1956 arch_atomic64_inc arch/x86/include/asm/atomic64_64.h:88 [inline] arch_atomic_long_inc include/linux/atomic/atomic-long.h:161 [inline] atomic_long_inc include/linux/atomic/atomic-instrumented.h:1429 [inline]
__ip6_make_skb+0x2f37/0x30f0 net/ipv6/ip6_output.c:1956 ip6_finish_skb include/net/ipv6.h:1122 [inline] ip6_push_pending_frames+0x10e/0x550 net/ipv6/ip6_output.c:1987 rawv6_push_pending_frames+0xb12/0xb90 net/ipv6/raw.c:579 rawv6_sendmsg+0x297e/0x2e60 net/ipv6/raw.c:922 inet_sendmsg+0x101/0x180 net/ipv4/af_inet.c:827 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline]
____sys_sendmsg+0xa8e/0xe70 net/socket.c:2476 ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2530 __sys_sendmsg net/socket.c:2559 [inline] __do_sys_sendmsg net/socket.c:2568 [inline] __se_sys_sendmsg net/socket.c:2566 [inline] __x64_sys_sendmsg+0x367/0x540 net/socket.c:2566 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was created at: slab_post_alloc_hook mm/slab.h:766 [inline] slab_alloc_node mm/slub.c:3452 [inline]
__kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491 __do_kmalloc_node mm/slab_common.c:967 [inline]
__kmalloc_node_track_caller+0x114/0x3b0 mm/slab_common.c:988 kmalloc_reserve net/core/skbuff.c:492 [inline] __alloc_skb+0x3af/0x8f0 net/core/skbuff.c:565 alloc_skb include/linux/skbuff.h:1270 [inline]
__ip6_append_data+0x51c1/0x6bb0 net/ipv6/ip6_output.c:1684 ip6_append_data+0x411/0x580 net/ipv6/ip6_output.c:1854 rawv6_sendmsg+0x2882/0x2e60 net/ipv6/raw.c:915 inet_sendmsg+0x101/0x180 net/ipv4/af_inet.c:827 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline]
____sys_sendmsg+0xa8e/0xe70 net/socket.c:2476 ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2530 __sys_sendmsg net/socket.c:2559 [inline] __do_sys_sendmsg net/socket.c:2568 [inline] __se_sys_sendmsg net/socket.c:2566 [inline] __x64_sys_sendmsg+0x367/0x540 net/socket.c:2566 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd It is because icmp6hdr does not in skb linear region under the scenario of SOCK_RAW socket. Access icmp6_hdr(skb)->icmp6_type directly will trigger the uninit variable access bug. Use a local variable icmp6_type to carry the correct value in different scenarios. (CVE-2023-54265)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54265

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54265

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281548 - Linux Distros Unpatched Vulnerability : CVE-2023-54269
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: SUNRPC: double free xprt_ctxt while still in use When an RPC request is deferred, the rq_xprt_ctxt pointer is moved out of the svc_rqst into the svc_deferred_req. When the deferred request is revisited, the pointer is copied into the new svc_rqst
- and also remains in the svc_deferred_req. In the (rare?) case that the request is deferred a second time, the old svc_deferred_req is reused - it still has all the correct content. However in that case the rq_xprt_ctxt pointer is NOT cleared so that when xpo_release_xprt is called, the ctxt is freed (UDP) or possible added to a free list (RDMA). When the deferred request is revisited for a second time, it will reference this ctxt which may be invalid, and the free the object a second time which is likely to oops.
So change svc_defer() to *always* clear rq_xprt_ctxt, and assert that the value is now stored in the svc_deferred_req. (CVE-2023-54269)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54269

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
9.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
7.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54269

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280774 - Linux Distros Unpatched Vulnerability : CVE-2023-54273
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix leak of dev tracker At the stage of direction checks, the netdev reference tracker is already initialized, but released with wrong
*_put() call. (CVE-2023-54273)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54273

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.7 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54273

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281546 - Linux Distros Unpatched Vulnerability : CVE-2023-54274
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Add a check for valid 'mad_agent' pointer When unregistering MAD agent, srpt module has a non-null check for 'mad_agent' pointer before invoking ib_unregister_mad_agent(). This check can pass if 'mad_agent' variable holds an error value. The 'mad_agent' can have an error value for a short window when srpt_add_one() and srpt_remove_one() is executed simultaneously. In srpt module, added a valid pointer check for 'sport->mad_agent' before unregistering MAD agent. This issue can hit when RoCE driver unregisters ib_device Stack Trace: ------------ BUG: kernel NULL pointer dereference, address: 000000000000004d PGD 145003067 P4D 145003067 PUD 2324fe067 PMD 0 Oops: 0002 [#1] PREEMPT SMP NOPTI CPU: 10 PID: 4459 Comm:
kworker/u80:0 Kdump: loaded Tainted: P Hardware name: Dell Inc. PowerEdge R640/06NR82, BIOS 2.5.4 01/13/2020 Workqueue: bnxt_re bnxt_re_task [bnxt_re] RIP: 0010:_raw_spin_lock_irqsave+0x19/0x40 Call Trace: ib_unregister_mad_agent+0x46/0x2f0 [ib_core] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready ? __schedule+0x20b/0x560 srpt_unregister_mad_agent+0x93/0xd0 [ib_srpt] srpt_remove_one+0x20/0x150 [ib_srpt] remove_client_context+0x88/0xd0 [ib_core] bond0: (slave p2p1): link status definitely up, 100000 Mbps full duplex disable_device+0x8a/0x160 [ib_core] bond0: active interface up! ? kernfs_name_hash+0x12/0x80 (NULL device *): Bonding Info Received: rdev: 000000006c0b8247
__ib_unregister_device+0x42/0xb0 [ib_core] (NULL device *): Master: mode: 4 num_slaves:2 ib_unregister_device+0x22/0x30 [ib_core] (NULL device *): Slave: id: 105069936 name:p2p1 link:0 state:0 bnxt_re_stopqps_and_ib_uninit+0x83/0x90 [bnxt_re] bnxt_re_alloc_lag+0x12e/0x4e0 [bnxt_re] (CVE-2023-54274)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54274

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54274

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280699 - Linux Distros Unpatched Vulnerability : CVE-2023-54280
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cifs: fix potential race when tree connecting ipc Protect access of TCP_Server_Info::hostname when building the ipc tree name as it might get freed in cifsd thread and thus causing an use-after-free bug in
__tree_connect_dfs_target(). Also, while at it, update status of IPC tcon on success and then avoid any extra tree connects. (CVE-2023-54280)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54280
https://security-tracker.debian.org/tracker/CVE-2023-54280

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
8.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54280

Plugin Information
Published: 2025/12/30, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280715 - Linux Distros Unpatched Vulnerability : CVE-2023-54285
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- iomap: Fix possible overflow condition in iomap_write_delalloc_scan folio_next_index() returns an unsigned long value which left shifted by PAGE_SHIFT could possibly cause an overflow on 32-bit system. Instead use folio_pos(folio) + folio_size(folio), which does this correctly. (CVE-2023-54285)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54285
https://security-tracker.debian.org/tracker/CVE-2023-54285

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54285

Plugin Information
Published: 2025/12/30, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281500 - Linux Distros Unpatched Vulnerability : CVE-2023-54288
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fortify the spinlock against deadlock by interrupt In the function ieee80211_tx_dequeue() there is a particular locking sequence: begin: spin_lock(&local->queue_stop_reason_lock); q_stopped = local->queue_stop_reasons[q];
spin_unlock(&local->queue_stop_reason_lock); However small the chance (increased by ftracetest), an asynchronous interrupt can occur in between of spin_lock() and spin_unlock(), and the interrupt routine will attempt to lock the same &local->queue_stop_reason_lock again. This will cause a costly reset of the CPU and the wifi device or an altogether hang in the single CPU and single core scenario. The only remaining spin_lock(&local->queue_stop_reason_lock) that did not disable interrupts was patched, which should prevent any deadlocks on the same CPU/core and the same wifi device. This is the probable trace of the deadlock: kernel: ================================ kernel: WARNING: inconsistent lock state kernel:
6.3.0-rc6-mt-20230401-00001-gf86822a1170f #4 Tainted: G W kernel: -------------------------------- kernel:
inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. kernel: kworker/5:0/25656 [HC0[0]:SC0[0]:HE1:SE1] takes: kernel: ffff9d6190779478 (&local->queue_stop_reason_lock){+.?.}-{2:2}, at:
return_to_handler+0x0/0x40 kernel: {IN-SOFTIRQ-W} state was registered at: kernel: lock_acquire+0xc7/0x2d0 kernel: _raw_spin_lock+0x36/0x50 kernel: ieee80211_tx_dequeue+0xb4/0x1330 [mac80211] kernel:
iwl_mvm_mac_itxq_xmit+0xae/0x210 [iwlmvm] kernel: iwl_mvm_mac_wake_tx_queue+0x2d/0xd0 [iwlmvm] kernel:
ieee80211_queue_skb+0x450/0x730 [mac80211] kernel: __ieee80211_xmit_fast.constprop.66+0x834/0xa50 [mac80211] kernel: __ieee80211_subif_start_xmit+0x217/0x530 [mac80211] kernel:
ieee80211_subif_start_xmit+0x60/0x580 [mac80211] kernel: dev_hard_start_xmit+0xb5/0x260 kernel:
__dev_queue_xmit+0xdbe/0x1200 kernel: neigh_resolve_output+0x166/0x260 kernel:
ip_finish_output2+0x216/0xb80 kernel: __ip_finish_output+0x2a4/0x4d0 kernel: ip_finish_output+0x2d/0xd0 kernel: ip_output+0x82/0x2b0 kernel: ip_local_out+0xec/0x110 kernel: igmpv3_sendpack+0x5c/0x90 kernel:
igmp_ifc_timer_expire+0x26e/0x4e0 kernel: call_timer_fn+0xa5/0x230 kernel: run_timer_softirq+0x27f/0x550 kernel: __do_softirq+0xb4/0x3a4 kernel: irq_exit_rcu+0x9b/0xc0 kernel:
sysvec_apic_timer_interrupt+0x80/0xa0 kernel: asm_sysvec_apic_timer_interrupt+0x1f/0x30 kernel:
_raw_spin_unlock_irqrestore+0x3f/0x70 kernel: free_to_partial_list+0x3d6/0x590 kernel:
__slab_free+0x1b7/0x310 kernel: kmem_cache_free+0x52d/0x550 kernel: putname+0x5d/0x70 kernel:
do_sys_openat2+0x1d7/0x310 kernel: do_sys_open+0x51/0x80 kernel: __x64_sys_openat+0x24/0x30 kernel:
do_syscall_64+0x5c/0x90 kernel: entry_SYSCALL_64_after_hwframe+0x72/0xdc kernel: irq event stamp: 5120729 kernel: hardirqs last enabled at (5120729): [<ffffffff9d149936>] trace_graph_return+0xd6/0x120 kernel:
hardirqs last disabled at (5120728): [<ffffffff9d149950>] trace_graph_return+0xf0/0x120 kernel: softirqs last enabled at (5069900): [<ffffffff9cf65b60>] return_to_handler+0x0/0x40 kernel: softirqs last disabled at (5067555): [<ffffffff9cf65b60>] return_to_handler+0x0/0x40 kernel: other info that might help us debug this: kernel: Possible unsafe locking scenario: kernel: CPU0 kernel: ---- kernel:
lock(&local->queue_stop_reason_lock); kernel: <Interrupt> kernel: lock(&local->queue_stop_reason_lock);
kernel: *** DEADLOCK *** kernel: 8 locks held by kworker/5:0/25656: kernel: #0: ffff9d618009d138 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work+0x1ca/0x530 kernel: #1:
ffffb1ef4637fe68 ((work_completion)(&local->restart_work)){+.+.}-{0:0}, at: process_one_work+0x1ce/0x530 kernel: #2: ffffffff9f166548 (rtnl_mutex){+.+.}-{3:3}, at: return_to_handler+0x0/0x40 kernel: #3:
ffff9d619 ---truncated--- (CVE-2023-54288)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54288

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54288

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281497 - Linux Distros Unpatched Vulnerability : CVE-2023-54300
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx For the reasons also described in commit b383e8abed41 (wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()), ath9k_htc_rx_msg() should validate pkt_len before accessing the SKB. For example, the obtained SKB may have been badly constructed with pkt_len = 8. In this case, the SKB can only contain a valid htc_frame_hdr but after being processed in ath9k_htc_rx_msg() and passed to ath9k_wmi_ctrl_rx() endpoint RX handler, it is expected to have a WMI command header which should be located inside its data payload. Implement sanity checking inside ath9k_wmi_ctrl_rx(). Otherwise, uninit memory can be referenced. Tested on Qualcomm Atheros Communications AR9271 802.11n . Found by Linux Verification Center (linuxtesting.org) with Syzkaller. (CVE-2023-54300)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54300

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54300

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280741 - Linux Distros Unpatched Vulnerability : CVE-2023-54301
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: serial: 8250_bcm7271: fix leak in `brcmuart_probe` Smatch reports: drivers/tty/serial/8250/8250_bcm7271.c:1120 brcmuart_probe() warn:
'baud_mux_clk' from clk_prepare_enable() not released on lines: 1032. The issue is fixed by using a managed clock. (CVE-2023-54301)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54301

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54301

Plugin Information
Published: 2025/12/30, Modified: 2025/12/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281487 - Linux Distros Unpatched Vulnerability : CVE-2023-54305
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ext4: refuse to create ea block when umounted The ea block expansion need to access s_root while it is already set as NULL when umount is triggered. Refuse this request to avoid panic. (CVE-2023-54305)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54305

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54305

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281531 - Linux Distros Unpatched Vulnerability : CVE-2023-54308
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ALSA: ymfpci: Create card with device- managed snd_devm_card_new() snd_card_ymfpci_remove() was removed in commit c6e6bb5eab74 (ALSA: ymfpci:
Allocate resources with device-managed APIs), but the call to snd_card_new() was not replaced with snd_devm_card_new(). Since there was no longer a call to snd_card_free, unloading the module would eventually result in Oops: [697561.532887] BUG: unable to handle page fault for address: ffffffffc0924480 [697561.532893] #PF: supervisor read access in kernel mode [697561.532896] #PF: error_code(0x0000) - not- present page [697561.532899] PGD ae1e15067 P4D ae1e15067 PUD ae1e17067 PMD 11a8f5067 PTE 0 [697561.532905] Oops: 0000 [#1] PREEMPT SMP NOPTI [697561.532909] CPU: 21 PID: 5080 Comm: wireplumber Tainted: G W OE 6.2.7 #1 [697561.532914] Hardware name: System manufacturer System Product Name/TUF GAMING X570-PLUS, BIOS 4408 10/28/2022 [697561.532916] RIP: 0010:try_module_get.part.0+0x1a/0xe0 [697561.532924] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 49 89 fc bf 01 00 00 00 e8 56 3c f8 ff <41> 83 3c 24 02 0f 84 96 00 00 00 41 8b 84 24 30 03 00 00 85 c0 0f [697561.532927] RSP:
0018:ffffbe9b858c3bd8 EFLAGS: 00010246 [697561.532930] RAX: ffff9815d14f1900 RBX: ffff9815c14e6000 RCX:
0000000000000000 [697561.532933] RDX: 0000000000000000 RSI: ffffffffc055092c RDI: ffffffffb3778c1a [697561.532935] RBP: ffffbe9b858c3be8 R08: 0000000000000040 R09: ffff981a1a741380 [697561.532937] R10:
ffffbe9b858c3c80 R11: 00000009d56533a6 R12: ffffffffc0924480 [697561.532939] R13: ffff9823439d8500 R14:
0000000000000025 R15: ffff9815cd109f80 [697561.532942] FS: 00007f13084f1f80(0000) GS:ffff9824aef40000(0000) knlGS:0000000000000000 [697561.532945] CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 [697561.532947] CR2: ffffffffc0924480 CR3: 0000000145344000 CR4: 0000000000350ee0 [697561.532949] Call Trace: [697561.532951] <TASK> [697561.532955] try_module_get+0x13/0x30 [697561.532960] snd_ctl_open+0x61/0x1c0 [snd] [697561.532976] snd_open+0xb4/0x1e0 [snd] [697561.532989] chrdev_open+0xc7/0x240 [697561.532995] ? fsnotify_perm.part.0+0x6e/0x160 [697561.533000] ?
__pfx_chrdev_open+0x10/0x10 [697561.533005] do_dentry_open+0x169/0x440 [697561.533009] vfs_open+0x2d/0x40 [697561.533012] path_openat+0xa9d/0x10d0 [697561.533017] ? debug_smp_processor_id+0x17/0x20 [697561.533022] ? trigger_load_balance+0x65/0x370 [697561.533026] do_filp_open+0xb2/0x160 [697561.533032] ? _raw_spin_unlock+0x19/0x40 [697561.533036] ? alloc_fd+0xa9/0x190 [697561.533040] do_sys_openat2+0x9f/0x160 [697561.533044] __x64_sys_openat+0x55/0x90 [697561.533048] do_syscall_64+0x3b/0x90 [697561.533052] entry_SYSCALL_64_after_hwframe+0x72/0xdc [697561.533056] RIP:
0033:0x7f1308a40db4 [697561.533059] Code: 24 20 eb 8f 66 90 44 89 54 24 0c e8 46 68 f8 ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 32 44 89 c7 89 44 24 0c e8 78 68 f8 ff 8b 44 [697561.533062] RSP: 002b:00007ffcce664450 EFLAGS: 00000293 ORIG_RAX:
0000000000000101 [697561.533066] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f1308a40db4 [697561.533068] RDX: 0000000000080000 RSI: 00007ffcce664690 RDI: 00000000ffffff9c [697561.533070] RBP:
00007ffcce664690 R08: 0000000000000000 R09: 0000000000000012 [697561.533072] R10: 0000000000000000 R11:
0000000000000293 R12: 0000000000080000 [697561.533074] R13: 00007f13054b069b R14: 0000565209f83200 R15:
0000000000000000 [697561.533078] </TASK> (CVE-2023-54308)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54308

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54308

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281499 - Linux Distros Unpatched Vulnerability : CVE-2023-54311
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ext4: fix deadlock when converting an inline directory in nojournal mode In no journal mode, ext4_finish_convert_inline_dir() can self-deadlock by calling ext4_handle_dirty_dirblock() when it already has taken the directory lock. There is a similar self-deadlock in ext4_incvert_inline_data_nolock() for data files which we'll fix at the same time. A simple reproducer demonstrating the problem: mke2fs -Fq -t ext2 -O inline_data -b 4k /dev/vdc 64 mount -t ext4 -o dirsync /dev/vdc /vdc cd /vdc mkdir file0 cd file0 touch file0 touch file1 attr -s BurnSpaceInEA
-V abcde . touch supercalifragilisticexpialidocious (CVE-2023-54311)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54311

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54311

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280817 - Linux Distros Unpatched Vulnerability : CVE-2023-54318
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add While doing smcr_port_add, there maybe linkgroup add into or delete from smc_lgr_list.list at the same time, which may result kernel crash. So, use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add. The crash calltrace show below:
BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI CPU:
0 PID: 559726 Comm: kworker/0:92 Kdump: loaded Tainted: G Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 449e491 04/01/2014 Workqueue: events smc_ib_port_event_work [smc] RIP: 0010:smcr_port_add+0xa6/0xf0 [smc] RSP: 0000:ffffa5a2c8f67de0 EFLAGS: 00010297 RAX: 0000000000000001 RBX: ffff9935e0650000 RCX:
0000000000000000 RDX: 0000000000000010 RSI: ffff9935e0654290 RDI: ffff9935c8560000 RBP: 0000000000000000 R08: 0000000000000000 R09: ffff9934c0401918 R10: 0000000000000000 R11: ffffffffb4a5c278 R12:
ffff99364029aae4 R13: ffff99364029aa00 R14: 00000000ffffffed R15: ffff99364029ab08 FS:
0000000000000000(0000) GS:ffff994380600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 CR2: 0000000000000000 CR3: 0000000f06a10003 CR4: 0000000002770ef0 PKRU: 55555554 Call Trace: smc_ib_port_event_work+0x18f/0x380 [smc] process_one_work+0x19b/0x340 worker_thread+0x30/0x370 ? process_one_work+0x340/0x340 kthread+0x114/0x130 ? __kthread_cancel_work+0x50/0x50 ret_from_fork+0x1f/0x30 (CVE-2023-54318)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54318

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54318

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280702 - Linux Distros Unpatched Vulnerability : CVE-2023-54322
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- arm64: set __exception_irq_entry with __irq_entry as a default filter_irq_stacks() is supposed to cut entries which are related irq entries from its call stack. And in_irqentry_text() which is called by filter_irq_stacks() uses __irqentry_text_start/end symbol to find irq entries in callstack. But it doesn't work correctly as without CONFIG_FUNCTION_GRAPH_TRACER, arm64 kernel doesn't include gic_handle_irq which is entry point of arm64 irq between __irqentry_text_start and __irqentry_text_end as we discussed in below link. https://lore.kernel.org/all/CACT4Y+aReMGLYua2rCLHgFpS9io5cZC04Q8GLs- uNmrn1ezxYQ@mail.gmail.com/#t This problem can makes unintentional deep call stack entries especially in KASAN enabled situation as below. [ 2479.383395]I[0:launcher-loader: 1719] Stack depot reached limit capacity [ 2479.383538]I[0:launcher-loader: 1719] WARNING: CPU: 0 PID: 1719 at lib/stackdepot.c:129
__stack_depot_save+0x464/0x46c [ 2479.385693]I[0:launcher-loader: 1719] pstate: 624000c5 (nZCv daIF +PAN
-UAO +TCO -DIT -SSBS BTYPE=--) [ 2479.385724]I[0:launcher-loader: 1719] pc :
__stack_depot_save+0x464/0x46c [ 2479.385751]I[0:launcher-loader: 1719] lr :
__stack_depot_save+0x460/0x46c [ 2479.385774]I[0:launcher-loader: 1719] sp : ffffffc0080073c0 [ 2479.385793]I[0:launcher-loader: 1719] x29: ffffffc0080073e0 x28: ffffffd00b78a000 x27: 0000000000000000 [ 2479.385839]I[0:launcher-loader: 1719] x26: 000000000004d1dd x25: ffffff891474f000 x24: 00000000ca64d1dd [ 2479.385882]I[0:launcher-loader: 1719] x23: 0000000000000200 x22: 0000000000000220 x21: 0000000000000040 [ 2479.385925]I[0:launcher-loader: 1719] x20: ffffffc008007440 x19: 0000000000000000 x18: 0000000000000000 [ 2479.385969]I[0:launcher-loader: 1719] x17: 2065726568207475 x16: 000000000000005e x15: 2d2d2d2d2d2d2d20 [ 2479.386013]I[0:launcher-loader: 1719] x14: 5d39313731203a72 x13: 00000000002f6b30 x12: 00000000002f6af8 [ 2479.386057]I[0:launcher-loader: 1719] x11: 00000000ffffffff x10: ffffffb90aacf000 x9 : e8a74a6c16008800 [ 2479.386101]I[0:launcher-loader: 1719] x8 : e8a74a6c16008800 x7 : 00000000002f6b30 x6 : 00000000002f6af8 [ 2479.386145]I[0:launcher-loader: 1719] x5 : ffffffc0080070c8 x4 : ffffffd00b192380 x3 : ffffffd0092b313c [ 2479.386189]I[0:launcher-loader: 1719] x2 : 0000000000000001 x1 : 0000000000000004 x0 : 0000000000000022 [ 2479.386231]I[0:launcher-loader: 1719] Call trace: [ 2479.386248]I[0:launcher-loader: 1719]
__stack_depot_save+0x464/0x46c [ 2479.386273]I[0:launcher-loader: 1719] kasan_save_stack+0x58/0x70 [ 2479.386303]I[0:launcher-loader: 1719] save_stack_info+0x34/0x138 [ 2479.386331]I[0:launcher-loader: 1719] kasan_save_free_info+0x18/0x24 [ 2479.386358]I[0:launcher-loader: 1719] ____kasan_slab_free+0x16c/0x170 [ 2479.386385]I[0:launcher-loader: 1719] __kasan_slab_free+0x10/0x20 [ 2479.386410]I[0:launcher-loader:
1719] kmem_cache_free+0x238/0x53c [ 2479.386435]I[0:launcher-loader: 1719] mempool_free_slab+0x1c/0x28 [ 2479.386460]I[0:launcher-loader: 1719] mempool_free+0x7c/0x1a0 [ 2479.386484]I[0:launcher-loader: 1719] bvec_free+0x34/0x80 [ 2479.386514]I[0:launcher-loader: 1719] bio_free+0x60/0x98 [ 2479.386540]I[0:launcher-loader: 1719] bio_put+0x50/0x21c [ 2479.386567]I[0:launcher-loader: 1719] f2fs_write_end_io+0x4ac/0x4d0 [ 2479.386594]I[0:launcher-loader: 1719] bio_endio+0x2dc/0x300 [ 2479.386622]I[0:launcher-loader: 1719] __dm_io_complete+0x324/0x37c [ 2479.386650]I[0:launcher-loader:
1719] dm_io_dec_pending+0x60/0xa4 [ 2479.386676]I[0:launcher-loader: 1719] clone_endio+0xf8/0x2f0 [ 2479.386700]I[0:launcher-loader: 1719] bio_endio+0x2dc/0x300 [ 2479.386727]I[0:launcher-loader: 1719] blk_update_request+0x258/0x63c [ 2479.386754]I[0:launcher-loader: 1719] scsi_end_request+0x50/0x304 [ 2479.386782]I[0:launcher-loader: 1719] scsi_io_completion+0x88/0x160 [ 2479.386808]I[0:launcher-loader:
1719] scsi_finish_command+0x17c/0x194 [ 2479.386833]I ---truncated--- (CVE-2023-54322)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54322
https://security-tracker.debian.org/tracker/CVE-2023-54322

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54322

Plugin Information
Published: 2025/12/30, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280695 - Linux Distros Unpatched Vulnerability : CVE-2023-54324
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dm: fix a race condition in retrieve_deps There's a race condition in the multipath target when retrieve_deps races with multipath_message calling dm_get_device and dm_put_device. retrieve_deps walks the list of open devices without holding any lock but multipath may add or remove devices to the list while it is running. The end result may be memory corruption or use-after-free memory access. See this description of a UAF with multipath_message(): https://listman.redhat.com/archives/dm- devel/2022-October/052373.html Fix this bug by introducing a new rw semaphore devices_lock. We grab devices_lock for read in retrieve_deps and we grab it for write in dm_get_device and dm_put_device.
(CVE-2023-54324)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54324
https://security-tracker.debian.org/tracker/CVE-2023-54324

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
8.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54324

Plugin Information
Published: 2025/12/30, Modified: 2025/12/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281476 - Linux Distros Unpatched Vulnerability : CVE-2023-54325
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix out-of-bounds read When preparing an AER-CTR request, the driver copies the key provided by the user into a data structure that is accessible by the firmware. If the target device is QAT GEN4, the key size is rounded up by 16 since a rounded up size is expected by the device. If the key size is rounded up before the copy, the size used for copying the key might be bigger than the size of the region containing the key, causing an out- of-bounds read. Fix by doing the copy first and then update the keylen. This is to fix the following warning reported by KASAN: [ 138.150574] BUG: KASAN: global-out-of-bounds in qat_alg_skcipher_init_com.isra.0+0x197/0x250 [intel_qat] [ 138.150641] Read of size 32 at addr ffffffff88c402c0 by task cryptomgr_test/2340 [ 138.150651] CPU: 15 PID: 2340 Comm: cryptomgr_test Not tainted 6.2.0-rc1+ #45 [ 138.150659] Hardware name: Intel Corporation ArcherCity/ArcherCity, BIOS EGSDCRB1.86B.0087.D13.2208261706 08/26/2022 [ 138.150663] Call Trace: [ 138.150668] <TASK> [ 138.150922] kasan_check_range+0x13a/0x1c0 [ 138.150931] memcpy+0x1f/0x60 [ 138.150940] qat_alg_skcipher_init_com.isra.0+0x197/0x250 [intel_qat] [ 138.151006] qat_alg_skcipher_init_sessions+0xc1/0x240 [intel_qat] [ 138.151073] crypto_skcipher_setkey+0x82/0x160 [ 138.151085] ? prepare_keybuf+0xa2/0xd0 [ 138.151095] test_skcipher_vec_cfg+0x2b8/0x800 (CVE-2023-54325)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54325

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.7 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54325

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280756 - Linux Distros Unpatched Vulnerability : CVE-2023-54326
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: misc: pci_endpoint_test: Free IRQs before removing the device In pci_endpoint_test_remove(), freeing the IRQs after removing the device creates a small race window for IRQs to be received with the test device memory already released, causing the IRQ handler to access invalid memory, resulting in an oops. Free the device IRQs before removing the device to avoid this issue. (CVE-2023-54326)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54326

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
8.4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54326

Plugin Information
Published: 2025/12/30, Modified: 2025/12/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227301 - Linux Distros Unpatched Vulnerability : CVE-2023-5535
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Use After Free in GitHub repository vim/vim prior to v9.0.2010. (CVE-2023-5535)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-5535
https://security-tracker.debian.org/tracker/CVE-2023-5535

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0011
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-5535

Plugin Information
Published: 2025/03/05, Modified: 2025/10/08
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
227388 - Linux Distros Unpatched Vulnerability : CVE-2023-5574
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode).
If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.
(CVE-2023-5574)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-5574
https://security-tracker.debian.org/tracker/CVE-2023-5574
https://ubuntu.com/security/CVE-2023-5574

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-5574

Plugin Information
Published: 2025/03/05, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- xorg-x11-server-Xorg
- xorg-x11-server-common
225869 - Linux Distros Unpatched Vulnerability : CVE-2023-6349
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a heap overflow in libvpx. We recommend upgrading to version 1.13.1 or above (CVE-2023-6349)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-6349
https://ubuntu.com/security/CVE-2023-6349

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
5.7 (CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N)
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-6349

Plugin Information
Published: 2025/03/05, Modified: 2025/08/21
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libvpx
271972 - Linux Distros Unpatched Vulnerability : CVE-2023-7324
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses Sanitize possible addl_desc_ptr out-of-bounds accesses in ses_enclosure_data_process(). (CVE-2023-7324)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-7324
https://ubuntu.com/security/CVE-2023-7324

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-7324

Plugin Information
Published: 2025/10/29, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227798 - Linux Distros Unpatched Vulnerability : CVE-2024-0775
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This flaw allows a local user to cause an information leak problem while freeing the old quota file names before a potential failure, leading to a use-after-free. (CVE-2024-0775)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-0775
https://ubuntu.com/security/CVE-2024-0775

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-0775

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228073 - Linux Distros Unpatched Vulnerability : CVE-2024-11498
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to use large amounts of stack space (up to 256mb is possible, maybe 512mb), potentially exhausting the stack. An attacker can craft a file that will cause excessive memory usage. We recommend upgrading past commit 65fbec56bc578b6b6ee02a527be70787bbd053b0. (CVE-2024-11498)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-11498

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
6.9 (CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H)
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-11498

Plugin Information
Published: 2025/03/05, Modified: 2025/08/12
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
252185 - Linux Distros Unpatched Vulnerability : CVE-2024-12224
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname. (CVE-2024-12224)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-12224
https://security-tracker.debian.org/tracker/CVE-2024-12224
https://ubuntu.com/security/CVE-2024-12224

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
5.1 (CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N)
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.3 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2024-12224

Plugin Information
Published: 2025/08/19, Modified: 2025/11/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
- gjs
- librsvg2
- librsvg2-tools
227818 - Linux Distros Unpatched Vulnerability : CVE-2024-1931
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NLnet Labs Unbound version 1.18.0 up to and including version 1.19.1 contain a vulnerability that can cause denial of service by a certain code path that can lead to an infinite loop. Unbound 1.18.0 introduced a feature that removes EDE records from responses with size higher than the client's advertised buffer size. Before removing all the EDE records however, it would try to see if trimming the extra text fields on those records would result in an acceptable size while still retaining the EDE codes. Due to an unchecked condition, the code that trims the text of the EDE records could loop indefinitely. This happens when Unbound would reply with attached EDE information on a positive reply and the client's buffer size is smaller than the needed space to include EDE records. The vulnerability can only be triggered when the 'ede: yes' option is used; non default configuration. From version 1.19.2 on, the code is fixed to avoid looping indefinitely. (CVE-2024-1931)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-1931

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0675
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-1931

Plugin Information
Published: 2025/03/05, Modified: 2025/09/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- unbound-libs
227841 - Linux Distros Unpatched Vulnerability : CVE-2024-22667
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions. (CVE-2024-22667)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-22667

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0008
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-22667

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
227884 - Linux Distros Unpatched Vulnerability : CVE-2024-26598
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the cache, such as a DISCARD ITS command. The root of the problem is that vgic_its_check_cache() does not elevate the refcount on the vgic_irq before dropping the lock that serializes refcount changes. Have vgic_its_check_cache() raise the refcount on the returned vgic_irq and add the corresponding decrement after queueing the interrupt. (CVE-2024-26598)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26598
https://ubuntu.com/security/CVE-2024-26598

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0009
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26598

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243613 - Linux Distros Unpatched Vulnerability : CVE-2024-26666
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix RCU use in TDLS fast-xmit This looks up the link under RCU protection, but isn't guaranteed to actually have protection.
Fix that. (CVE-2024-26666)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26666
https://ubuntu.com/security/CVE-2024-26666

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0008
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-26666

Plugin Information
Published: 2025/08/05, Modified: 2025/09/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228036 - Linux Distros Unpatched Vulnerability : CVE-2024-26689
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ceph: prevent use-after-free in encode_cap_msg() In fs/ceph/caps.c, in encode_cap_msg(), use after free error was caught by KASAN at this line - 'ceph_buffer_get(arg->xattr_buf);'. This implies before the refcount could be increment here, it was freed. In same file, in handle_cap_grant() refcount is decremented by this line - 'ceph_buffer_put(ci->i_xattrs.blob);'. It appears that a race occurred and resource was freed by the latter line before the former line could increment it. encode_cap_msg() is called by __send_cap() and __send_cap() is called by ceph_check_caps() after calling __prep_cap().
__prep_cap() is where arg->xattr_buf is assigned to ci->i_xattrs.blob. This is the spot where the refcount must be increased to prevent use after free error. (CVE-2024-26689)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26689
https://ubuntu.com/security/CVE-2024-26689

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0009
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26689

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227539 - Linux Distros Unpatched Vulnerability : CVE-2024-26742
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: smartpqi: Fix disable_managed_interrupts Correct blk-mq registration issue with module parameter disable_managed_interrupts enabled. When we turn off the default PCI_IRQ_AFFINITY flag, the driver needs to register with blk-mq using blk_mq_map_queues(). The driver is currently calling blk_mq_pci_map_queues() which results in a stack trace and possibly undefined behavior. Stack Trace: [ 7.860089] scsi host2:
smartpqi [ 7.871934] WARNING: CPU: 0 PID: 238 at block/blk-mq-pci.c:52 blk_mq_pci_map_queues+0xca/0xd0 [ 7.889231] Modules linked in: sd_mod t10_pi sg uas smartpqi(+) crc32c_intel scsi_transport_sas usb_storage dm_mirror dm_region_hash dm_log dm_mod ipmi_devintf ipmi_msghandler fuse [ 7.924755] CPU: 0 PID: 238 Comm:
kworker/0:3 Not tainted 4.18.0-372.88.1.el8_6_smartpqi_test.x86_64 #1 [ 7.944336] Hardware name: HPE ProLiant DL380 Gen10/ProLiant DL380 Gen10, BIOS U30 03/08/2022 [ 7.963026] Workqueue: events work_for_cpu_fn [ 7.978275] RIP: 0010:blk_mq_pci_map_queues+0xca/0xd0 [ 7.978278] Code: 48 89 de 89 c7 e8 f6 0f 4f 00 3b 05 c4 b7 8e 01 72 e1 5b 31 c0 5d 41 5c 41 5d 41 5e 41 5f e9 7d df 73 00 31 c0 e9 76 df 73 00 <0f> 0b eb bc 90 90 0f 1f 44 00 00 41 57 49 89 ff 41 56 41 55 41 54 [ 7.978280] RSP:
0018:ffffa95fc3707d50 EFLAGS: 00010216 [ 7.978283] RAX: 00000000ffffffff RBX: 0000000000000000 RCX:
0000000000000010 [ 7.978284] RDX: 0000000000000004 RSI: 0000000000000000 RDI: ffff9190c32d4310 [ 7.978286] RBP: 0000000000000000 R08: ffffa95fc3707d38 R09: ffff91929b81ac00 [ 7.978287] R10: 0000000000000001 R11:
ffffa95fc3707ac0 R12: 0000000000000000 [ 7.978288] R13: ffff9190c32d4000 R14: 00000000ffffffff R15:
ffff9190c4c950a8 [ 7.978290] FS: 0000000000000000(0000) GS:ffff9193efc00000(0000) knlGS:0000000000000000 [ 7.978292] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8.172814] CR2: 000055d11166c000 CR3:
00000002dae10002 CR4: 00000000007706f0 [ 8.172816] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000 [ 8.172817] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 8.172818] PKRU: 55555554 [ 8.172819] Call Trace: [ 8.172823] blk_mq_alloc_tag_set+0x12e/0x310 [ 8.264339] scsi_add_host_with_dma.cold.9+0x30/0x245 [ 8.279302] pqi_ctrl_init+0xacf/0xc8e [smartpqi] [ 8.294085] ? pqi_pci_probe+0x480/0x4c8 [smartpqi] [ 8.309015] pqi_pci_probe+0x480/0x4c8 [smartpqi] [ 8.323286] local_pci_probe+0x42/0x80 [ 8.337855] work_for_cpu_fn+0x16/0x20 [ 8.351193] process_one_work+0x1a7/0x360 [ 8.364462] ? create_worker+0x1a0/0x1a0 [ 8.379252] worker_thread+0x1ce/0x390 [ 8.392623] ? create_worker+0x1a0/0x1a0 [ 8.406295] kthread+0x10a/0x120 [ 8.418428] ? set_kthread_struct+0x50/0x50 [ 8.431532] ret_from_fork+0x1f/0x40 [ 8.444137] ---[ end trace 1bf0173d39354506 ]--- (CVE-2024-26742)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26742
https://ubuntu.com/security/CVE-2024-26742

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0005
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26742

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228149 - Linux Distros Unpatched Vulnerability : CVE-2024-26854
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ice: fix uninitialized dplls mutex usage The pf->dplls.lock mutex is initialized too late, after its first use. Move it to the top of ice_dpll_init. Note that the err_exit error path destroys the mutex. And the mutex is the last thing destroyed in ice_dpll_deinit. This fixes the following warning with CONFIG_DEBUG_MUTEXES: ice 0000:10:00.0: The DDP package was successfully loaded: ICE OS Default Package version 1.3.36.0 ice 0000:10:00.0: 252.048 Gb/s available PCIe bandwidth (16.0 GT/s PCIe x16 link) ice 0000:10:00.0: PTP init successful ------------[ cut here ]------------ DEBUG_LOCKS_WARN_ON(lock->magic != lock) WARNING: CPU: 0 PID: 410 at kernel/locking/mutex.c:587 __mutex_lock+0x773/0xd40 Modules linked in: crct10dif_pclmul crc32_pclmul crc32c_intel polyval_clmulni polyval_generic ice(+) nvme nvme_c> CPU: 0 PID: 410 Comm:
kworker/0:4 Not tainted 6.8.0-rc5+ #3 Hardware name: HPE ProLiant DL110 Gen10 Plus/ProLiant DL110 Gen10 Plus, BIOS U56 10/19/2023 Workqueue: events work_for_cpu_fn RIP: 0010:__mutex_lock+0x773/0xd40 Code: c0 0f 84 1d f9 ff ff 44 8b 35 0d 9c 69 01 45 85 f6 0f 85 0d f9 ff ff 48 c7 c6 12 a2 a9 85 48 c7 c7 12 f1 a> RSP:
0018:ff7eb1a3417a7ae0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000 RDX: 0000000000000002 RSI: ffffffff85ac2bff RDI: 00000000ffffffff RBP: ff7eb1a3417a7b80 R08:
0000000000000000 R09: 00000000ffffbfff R10: ff7eb1a3417a7978 R11: ff32b80f7fd2e568 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ff32b7f02c50e0d8 FS: 0000000000000000(0000) GS:ff32b80efe800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
000055b5852cc000 CR3: 000000003c43a004 CR4: 0000000000771ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __warn+0x84/0x170 ? __mutex_lock+0x773/0xd40 ? report_bug+0x1c7/0x1d0 ? prb_read_valid+0x1b/0x30 ? handle_bug+0x42/0x70 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? __mutex_lock+0x773/0xd40 ? rcu_is_watching+0x11/0x50 ? __kmalloc_node_track_caller+0x346/0x490 ? ice_dpll_lock_status_get+0x28/0x50 [ice] ? __pfx_ice_dpll_lock_status_get+0x10/0x10 [ice] ? ice_dpll_lock_status_get+0x28/0x50 [ice] ice_dpll_lock_status_get+0x28/0x50 [ice] dpll_device_get_one+0x14f/0x2e0 dpll_device_event_send+0x7d/0x150 dpll_device_register+0x124/0x180 ice_dpll_init_dpll+0x7b/0xd0 [ice] ice_dpll_init+0x224/0xa40 [ice] ? _dev_info+0x70/0x90 ice_load+0x468/0x690 [ice] ice_probe+0x75b/0xa10 [ice] ? _raw_spin_unlock_irqrestore+0x4f/0x80 ? process_one_work+0x1a3/0x500 local_pci_probe+0x47/0xa0 work_for_cpu_fn+0x17/0x30 process_one_work+0x20d/0x500 worker_thread+0x1df/0x3e0 ? __pfx_worker_thread+0x10/0x10 kthread+0x103/0x140 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> irq event stamp: 125197 hardirqs last enabled at (125197): [<ffffffff8416409d>] finish_task_switch.isra.0+0x12d/0x3d0 hardirqs last disabled at (125196): [<ffffffff85134044>]
__schedule+0xea4/0x19f0 softirqs last enabled at (105334): [<ffffffff84e1e65a>] napi_get_frags_check+0x1a/0x60 softirqs last disabled at (105332): [<ffffffff84e1e65a>] napi_get_frags_check+0x1a/0x60 ---[ end trace 0000000000000000 ]--- (CVE-2024-26854)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26854
https://ubuntu.com/security/CVE-2024-26854

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0054
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-26854

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246485 - Linux Distros Unpatched Vulnerability : CVE-2024-26883
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Fix stackmap overflow check on 32-bit arches The stackmap code relies on roundup_pow_of_two() to compute the number of hash buckets, and contains an overflow check by checking if the resulting value is 0. However, on 32-bit arches, the roundup code itself can overflow by doing a 32-bit left-shift of an unsigned long value, which is undefined behaviour, so it is not guaranteed to truncate neatly. This was triggered by syzbot on the DEVMAP_HASH type, which contains the same check, copied from the hashtab code.
The commit in the fixes tag actually attempted to fix this, but the fix did not account for the UB, so the fix only works on CPUs where an overflow does result in a neat truncation to zero, which is not guaranteed. Checking the value before rounding does not have this problem. (CVE-2024-26883)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26883
https://ubuntu.com/security/CVE-2024-26883

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0007
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26883

Plugin Information
Published: 2025/08/09, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227553 - Linux Distros Unpatched Vulnerability : CVE-2024-26926
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: binder: check offset alignment in binder_get_object() Commit 6d98eb95b450 (binder: avoid potential data leakage when copying txn) introduced changes to how binder objects are copied. In doing so, it unintentionally removed an offset alignment check done through calls to binder_alloc_copy_from_buffer() -> check_buffer(). These calls were replaced in binder_get_object() with copy_from_user(), so now an explicit offset alignment check is needed here. This avoids later complications when unwinding the objects gets harder. It is worth noting this check existed prior to commit 7a67a39320df (binder: add function to copy binder object from buffer), likely removed due to redundancy at the time. (CVE-2024-26926)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26926
https://ubuntu.com/security/CVE-2024-26926

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0114
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26926

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228268 - Linux Distros Unpatched Vulnerability : CVE-2024-26945
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - Fix nr_cpus < nr_iaa case If nr_cpus < nr_iaa, the calculated cpus_per_iaa will be 0, which causes a divide-by-0 in rebalance_wq_table(). Make sure cpus_per_iaa is 1 in that case, and also in the nr_iaa == 0 case, even though cpus_per_iaa is never used if nr_iaa == 0, for paranoia. (CVE-2024-26945)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26945
https://ubuntu.com/security/CVE-2024-26945

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
8.4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.3 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-26945

Plugin Information
Published: 2025/03/05, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227803 - Linux Distros Unpatched Vulnerability : CVE-2024-29506
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Artifex Ghostscript before 10.03.0 has a stack-based buffer overflow in the pdfi_apply_filter() function via a long PDF filter name. (CVE-2024-29506)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-29506

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0023
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-29506

Plugin Information
Published: 2025/03/05, Modified: 2025/08/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- ghostscript
- ghostscript-tools-fonts
- ghostscript-tools-printing
- libgs
227904 - Linux Distros Unpatched Vulnerability : CVE-2024-29509
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Artifex Ghostscript before 10.03.0 has a heap-based overflow when PDFPassword (e.g., for runpdf) has a \000 byte in the middle. (CVE-2024-29509)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-29509

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0073
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-29509

Plugin Information
Published: 2025/03/05, Modified: 2025/08/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- ghostscript
- ghostscript-tools-fonts
- ghostscript-tools-printing
- libgs
227440 - Linux Distros Unpatched Vulnerability : CVE-2024-33655
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS queries to be accumulated for seconds, such that responses are later sent in a pulsing burst (which can be considered traffic amplification in some cases), aka the DNSBomb issue. (CVE-2024-33655)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-33655
https://ubuntu.com/security/CVE-2024-33655

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0272
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-33655

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- unbound-libs
249668 - Linux Distros Unpatched Vulnerability : CVE-2024-34459
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.
(CVE-2024-34459)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-34459

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0046
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-34459

Plugin Information
Published: 2025/08/15, Modified: 2025/08/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libxml2
- libxml2-devel
- python3-libxml2
228803 - Linux Distros Unpatched Vulnerability : CVE-2024-35868
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smb: client: fix potential UAF in cifs_stats_proc_write() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF. (CVE-2024-35868)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-35868
https://security-tracker.debian.org/tracker/CVE-2024-35868
https://ubuntu.com/security/CVE-2024-35868

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0009
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-35868

Plugin Information
Published: 2025/03/05, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229612 - Linux Distros Unpatched Vulnerability : CVE-2024-36898
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- gpiolib: cdev: fix uninitialised kfifo If a line is requested with debounce, and that results in debouncing in software, and the line is subsequently reconfigured to enable edge detection then the allocation of the kfifo to contain edge events is overlooked. This results in events being written to and read from an uninitialised kfifo. Read events are returned to userspace. Initialise the kfifo in the case where the software debounce is already active. (CVE-2024-36898)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-36898
https://security-tracker.debian.org/tracker/CVE-2024-36898
https://ubuntu.com/security/CVE-2024-36898

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0017
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-36898

Plugin Information
Published: 2025/03/05, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229074 - Linux Distros Unpatched Vulnerability : CVE-2024-36906
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ARM: 9381/1: kasan: clear stale stack poison We found below OOB crash: [ 33.452494] ================================================================== [ 33.453513] BUG: KASAN: stack-out-of- bounds in refresh_cpu_vm_stats.constprop.0+0xcc/0x2ec [ 33.454660] Write of size 164 at addr c1d03d30 by task swapper/0/0 [ 33.455515] [ 33.455767] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G O 6.1.25-mainline #1 [ 33.456880] Hardware name: Generic DT based system [ 33.457555] unwind_backtrace from show_stack+0x18/0x1c [ 33.458326] show_stack from dump_stack_lvl+0x40/0x4c [ 33.459072] dump_stack_lvl from print_report+0x158/0x4a4 [ 33.459863] print_report from kasan_report+0x9c/0x148 [ 33.460616] kasan_report from kasan_check_range+0x94/0x1a0 [ 33.461424] kasan_check_range from memset+0x20/0x3c [ 33.462157] memset from refresh_cpu_vm_stats.constprop.0+0xcc/0x2ec [ 33.463064] refresh_cpu_vm_stats.constprop.0 from tick_nohz_idle_stop_tick+0x180/0x53c [ 33.464181] tick_nohz_idle_stop_tick from do_idle+0x264/0x354 [ 33.465029] do_idle from cpu_startup_entry+0x20/0x24 [ 33.465769] cpu_startup_entry from rest_init+0xf0/0xf4 [ 33.466528] rest_init from arch_post_acpi_subsys_init+0x0/0x18 [ 33.467397] [ 33.467644] The buggy address belongs to stack of task swapper/0/0 [ 33.468493] and is located at offset 112 in frame: [ 33.469172] refresh_cpu_vm_stats.constprop.0+0x0/0x2ec [ 33.469917] [ 33.470165] This frame has 2 objects: [ 33.470696] [32, 76) 'global_zone_diff' [ 33.470729] [112, 276) 'global_node_diff' [ 33.471294] [ 33.472095] The buggy address belongs to the physical page: [ 33.472862] page:3cd72da8 refcount:1 mapcount:0 mapping:00000000 index:0x0 pfn:0x41d03 [ 33.473944] flags: 0x1000(reserved|zone=0) [ 33.474565] raw: 00001000 ed741470 ed741470 00000000 00000000 00000000 ffffffff 00000001 [ 33.475656] raw:
00000000 [ 33.476050] page dumped because: kasan: bad access detected [ 33.476816] [ 33.477061] Memory state around the buggy address: [ 33.477732] c1d03c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.478630] c1d03c80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 [ 33.479526] >c1d03d00: 00 04 f2 f2 f2 f2 00 00 00 00 00 00 f1 f1 f1 f1 [ 33.480415] ^ [ 33.481195] c1d03d80: 00 00 00 00 00 00 00 00 00 00 04 f3 f3 f3 f3 f3 [ 33.482088] c1d03e00: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.482978] ================================================================== We find the root cause of this OOB is that arm does not clear stale stack poison in the case of cpuidle. This patch refer to arch/arm64/kernel/sleep.S to resolve this issue. From cited commit [1] that explain the problem Functions which the compiler has instrumented for KASAN place poison on the stack shadow upon entry and remove this poison prior to returning. In the case of cpuidle, CPUs exit the kernel a number of levels deep in C code.
Any instrumented functions on this critical path will leave portions of the stack shadow poisoned. If CPUs lose context and return to the kernel via a cold path, we restore a prior context saved in
__cpu_suspend_enter are forgotten, and we never remove the poison they placed in the stack shadow area by functions calls between this and the actual exit of the kernel. Thus, (depending on stackframe layout) subsequent calls to instrumented functions may hit this stale poison, resulting in (spurious) KASAN splats to the console. To avoid this, clear any stale poison from the idle thread for a CPU prior to bringing a CPU online. From cited commit [2] Extend to check for CONFIG_KASAN_STACK [1] commit 0d97e6d8024c (arm64:
kasan: clear stale stack poison) [2] commit d56a9ef84bd0 (kasan, arm64: unpoison stack only with CONFIG_KASAN_STACK) (CVE-2024-36906)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-36906
https://ubuntu.com/security/CVE-2024-36906

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0018
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-36906

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228749 - Linux Distros Unpatched Vulnerability : CVE-2024-38384
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix list corruption from reorder of WRITE ->lqueued __blkcg_rstat_flush() can be run anytime, especially when blk_cgroup_bio_start is being executed. If WRITE of `->lqueued` is re-ordered with READ of 'bisc->lnode.next' in the loop of
__blkcg_rstat_flush(), `next_bisc` can be assigned with one stat instance being added in blk_cgroup_bio_start(), then the local list in __blkcg_rstat_flush() could be corrupted. Fix the issue by adding one barrier. (CVE-2024-38384)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-38384
https://ubuntu.com/security/CVE-2024-38384

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
8.4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.3 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0008
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-38384

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229287 - Linux Distros Unpatched Vulnerability : CVE-2024-38561
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: kunit: Fix kthread reference There is a race condition when a kthread finishes after the deadline and before the call to kthread_stop(), which may lead to use after free. (CVE-2024-38561)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-38561
https://ubuntu.com/security/CVE-2024-38561

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0009
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-38561

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228892 - Linux Distros Unpatched Vulnerability : CVE-2024-38588
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ftrace: Fix possible use-after-free issue in ftrace_location() KASAN reports a bug: BUG: KASAN: use-after- free in ftrace_location+0x90/0x120 Read of size 8 at addr ffff888141d40010 by task insmod/424 CPU: 8 PID:
424 Comm: insmod Tainted: G W 6.9.0-rc2+ [...] Call Trace: <TASK> dump_stack_lvl+0x68/0xa0 print_report+0xcf/0x610 kasan_report+0xb5/0xe0 ftrace_location+0x90/0x120 register_kprobe+0x14b/0xa40 kprobe_init+0x2d/0xff0 [kprobe_example] do_one_initcall+0x8f/0x2d0 do_init_module+0x13a/0x3c0 load_module+0x3082/0x33d0 init_module_from_file+0xd2/0x130 __x64_sys_finit_module+0x306/0x440 do_syscall_64+0x68/0x140 entry_SYSCALL_64_after_hwframe+0x71/0x79 The root cause is that, in lookup_rec(), ftrace record of some address is being searched in ftrace pages of some module, but those ftrace pages at the same time is being freed in ftrace_release_mod() as the corresponding module is being deleted: CPU1 | CPU2 register_kprobes() { | delete_module() { check_kprobe_address_safe() { | arch_check_ftrace_location() { | ftrace_location() { | lookup_rec() // USE! | ftrace_release_mod() // Free! To fix this issue: 1. Hold rcu lock as accessing ftrace pages in ftrace_location_range(); 2. Use ftrace_location_range() instead of lookup_rec() in ftrace_location(); 3. Call synchronize_rcu() before freeing any ftrace pages both in ftrace_process_locs()/ftrace_release_mod()/ftrace_free_mem(). (CVE-2024-38588)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-38588
https://ubuntu.com/security/CVE-2024-38588

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0009
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-38588

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228799 - Linux Distros Unpatched Vulnerability : CVE-2024-38606
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate slices count returned by FW The function adf_send_admin_tl_start() enables the telemetry (TL) feature on a QAT device by sending the ICP_QAT_FW_TL_START message to the firmware. This triggers the FW to start writing TL data to a DMA buffer in memory and returns an array containing the number of accelerators of each type (slices) supported by this HW. The pointer to this array is stored in the adf_tl_hw_data data structure called slice_cnt. The array slice_cnt is then used in the function tl_print_dev_data() to report in debugfs only statistics about the supported accelerators. An incorrect value of the elements in slice_cnt might lead to an out of bounds memory read. At the moment, there isn't an implementation of FW that returns a wrong value, but for robustness validate the slice count array returned by FW. (CVE-2024-38606)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-38606
https://ubuntu.com/security/CVE-2024-38606

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0007
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-38606

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245707 - Linux Distros Unpatched Vulnerability : CVE-2024-39480
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- kdb: Fix buffer overflow during tab-complete Currently, when the user attempts symbol completion with the Tab key, kdb will use strncpy() to insert the completed symbol into the command buffer. Unfortunately it passes the size of the source buffer rather than the destination to strncpy() with predictably horrible results. Most obviously if the command buffer is already full but cp, the cursor position, is in the middle of the buffer, then we will write past the end of the supplied buffer. Fix this by replacing the dubious strncpy() calls with memmove()/memcpy() calls plus explicit boundary checks to make sure we have enough space before we start moving characters around. (CVE-2024-39480)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-39480
https://ubuntu.com/security/CVE-2024-39480

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-39480

Plugin Information
Published: 2025/08/08, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228417 - Linux Distros Unpatched Vulnerability : CVE-2024-39494
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ima: Fix use-after-free on a dentry's dname.name ->d_name.name can change on rename and the earlier value can be freed; there are conditions sufficient to stabilize it (->d_lock on dentry, ->d_lock on its parent, ->i_rwsem exclusive on the parent's inode, rename_lock), but none of those are met at any of the sites. Take a stable snapshot of the name instead. (CVE-2024-39494)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-39494
https://ubuntu.com/security/CVE-2024-39494

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-39494

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229518 - Linux Distros Unpatched Vulnerability : CVE-2024-40900
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cachefiles: remove requests from xarray during flushing requests Even with CACHEFILES_DEAD set, we can still read the requests, so in the following concurrency the request may be used after it has been freed:
mount | daemon_thread1 | daemon_thread2 ------------------------------------------------------------ cachefiles_ondemand_init_object cachefiles_ondemand_send_req REQ_A = kzalloc(sizeof(*req) + data_len) wait_for_completion(&REQ_A->done) cachefiles_daemon_read cachefiles_ondemand_daemon_read // close dev fd cachefiles_flush_reqs complete(&REQ_A->done) kfree(REQ_A) xa_lock(&cache->reqs);
cachefiles_ondemand_select_req req->msg.opcode != CACHEFILES_OP_READ // req use-after-free !!! xa_unlock(&cache->reqs); xa_destroy(&cache->reqs) Hence remove requests from cache->reqs when flushing them to avoid accessing freed requests. (CVE-2024-40900)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-40900
https://ubuntu.com/security/CVE-2024-40900

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0011
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-40900

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228742 - Linux Distros Unpatched Vulnerability : CVE-2024-40974
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- powerpc/pseries: Enforce hcall result buffer validity and size plpar_hcall(), plpar_hcall9(), and related functions expect callers to provide valid result buffers of certain minimum size. Currently this is communicated only through comments in the code and the compiler has no idea. For example, if I write a bug like this: long retbuf[PLPAR_HCALL_BUFSIZE]; // should be PLPAR_HCALL9_BUFSIZE plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf, ...); This compiles with no diagnostics emitted, but likely results in stack corruption at runtime when plpar_hcall9() stores results past the end of the array. (To be clear this is a contrived example and I have not found a real instance yet.) To make this class of error less likely, we can use explicitly-sized array parameters instead of pointers in the declarations for the hcall APIs. When compiled with -Warray-bounds[1], the code above now provokes a diagnostic like this: error: array argument is too small; is of size 32, callee requires at least 72 [-Werror,-Warray- bounds] 60 | plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf, | ^ ~~~~~~ [1] Enabled for LLVM builds but not GCC for now. See commit 0da6e5fd6c37 (gcc: disable '-Warray-bounds' for gcc-13 too) and related changes.
(CVE-2024-40974)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-40974
https://ubuntu.com/security/CVE-2024-40974

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0022
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-40974

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228522 - Linux Distros Unpatched Vulnerability : CVE-2024-40994
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ptp: fix integer overflow in max_vclocks_store On 32bit systems, the 4 * max multiply can overflow. Use kcalloc() to do the allocation to prevent this. (CVE-2024-40994)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-40994
https://ubuntu.com/security/CVE-2024-40994

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0008
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-40994

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228849 - Linux Distros Unpatched Vulnerability : CVE-2024-41000
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- block/ioctl: prefer different overflow check Running syzkaller with the newly reintroduced signed integer overflow sanitizer shows this report: [ 62.982337] ------------[ cut here ]------------ [ 62.985692] cgroup: Invalid name [ 62.986211] UBSAN: signed-integer-overflow in ../block/ioctl.c:36:46 [ 62.989370] 9pnet_fd: p9_fd_create_tcp (7343): problem connecting socket to 127.0.0.1 [ 62.992992] 9223372036854775807 + 4095 cannot be represented in type 'long long' [ 62.997827] 9pnet_fd: p9_fd_create_tcp (7345): problem connecting socket to 127.0.0.1 [ 62.999369] random: crng reseeded on system resumption [ 63.000634] GUP no longer grows the stack in syz-executor.2 (7353): 20002000-20003000 (20001000) [ 63.000668] CPU: 0 PID:
7353 Comm: syz-executor.2 Not tainted 6.8.0-rc2-00035-gb3ef86b5a957 #1 [ 63.000677] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 63.000682] Call Trace: [ 63.000686] <TASK> [ 63.000731] dump_stack_lvl+0x93/0xd0 [ 63.000919] __get_user_pages+0x903/0xd30 [ 63.001030] __gup_longterm_locked+0x153e/0x1ba0 [ 63.001041] ? _raw_read_unlock_irqrestore+0x17/0x50 [ 63.001072] ? try_get_folio+0x29c/0x2d0 [ 63.001083] internal_get_user_pages_fast+0x1119/0x1530 [ 63.001109] iov_iter_extract_pages+0x23b/0x580 [ 63.001206] bio_iov_iter_get_pages+0x4de/0x1220 [ 63.001235] iomap_dio_bio_iter+0x9b6/0x1410 [ 63.001297] __iomap_dio_rw+0xab4/0x1810 [ 63.001316] iomap_dio_rw+0x45/0xa0 [ 63.001328] ext4_file_write_iter+0xdde/0x1390 [ 63.001372] vfs_write+0x599/0xbd0 [ 63.001394] ksys_write+0xc8/0x190 [ 63.001403] do_syscall_64+0xd4/0x1b0 [ 63.001421] ? arch_exit_to_user_mode_prepare+0x3a/0x60 [ 63.001479] entry_SYSCALL_64_after_hwframe+0x6f/0x77 [ 63.001535] RIP: 0033:0x7f7fd3ebf539 [ 63.001551] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 63.001562] RSP: 002b:00007f7fd32570c8 EFLAGS: 00000246 ORIG_RAX:
0000000000000001 [ 63.001584] RAX: ffffffffffffffda RBX: 00007f7fd3ff3f80 RCX: 00007f7fd3ebf539 [ 63.001590] RDX: 4db6d1e4f7e43360 RSI: 0000000020000000 RDI: 0000000000000004 [ 63.001595] RBP:
00007f7fd3f1e496 R08: 0000000000000000 R09: 0000000000000000 [ 63.001599] R10: 0000000000000000 R11:
0000000000000246 R12: 0000000000000000 [ 63.001604] R13: 0000000000000006 R14: 00007f7fd3ff3f80 R15:
00007ffd415ad2b8 ... [ 63.018142] ---[ end trace ]--- Historically, the signed integer overflow sanitizer did not work in the kernel due to its interaction with `-fwrapv` but this has since been changed [1] in the newest version of Clang; It was re-enabled in the kernel with Commit 557f8c582a9ba8ab (ubsan:
Reintroduce signed overflow sanitizer). Let's rework this overflow checking logic to not actually perform an overflow during the check itself, thus avoiding the UBSAN splat. [1]: https://github.com/llvm/llvm- project/pull/82432 (CVE-2024-41000)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-41000
https://ubuntu.com/security/CVE-2024-41000

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-41000

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228473 - Linux Distros Unpatched Vulnerability : CVE-2024-41003
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf: Fix reg_set_min_max corruption of fake_reg Juan reported that after doing some changes to buzzer [0] and implementing a new fuzzing strategy guided by coverage, they noticed the following in one of the probes: [...] 13: (79) r6 = *(u64 *)(r0 +0) ;
R0=map_value(ks=4,vs=8) R6_w=scalar() 14: (b7) r0 = 0 ; R0_w=0 15: (b4) w0 = -1 ; R0_w=0xffffffff 16: (74) w0 >>= 1 ; R0_w=0x7fffffff 17: (5c) w6 &= w0 ; R0_w=0x7fffffff R6_w=scalar(smin=smin32=0,smax=umax=umax32=0x7fffffff,var_off=(0x0; 0x7fffffff)) 18: (44) w6 |= 2 ;
R6_w=scalar(smin=umin=smin32=umin32=2,smax=umax=umax32=0x7fffffff,var_off=(0x2; 0x7ffffffd)) 19: (56) if w6 != 0x7ffffffd goto pc+1 REG INVARIANTS VIOLATION (true_reg2): range bounds violation u64=[0x7fffffff, 0x7ffffffd] s64=[0x7fffffff, 0x7ffffffd] u32=[0x7fffffff, 0x7ffffffd] s32=[0x7fffffff, 0x7ffffffd] var_off=(0x7fffffff, 0x0) REG INVARIANTS VIOLATION (false_reg1): range bounds violation u64=[0x7fffffff, 0x7ffffffd] s64=[0x7fffffff, 0x7ffffffd] u32=[0x7fffffff, 0x7ffffffd] s32=[0x7fffffff, 0x7ffffffd] var_off=(0x7fffffff, 0x0) REG INVARIANTS VIOLATION (false_reg2): const tnum out of sync with range bounds u64=[0x0, 0xffffffffffffffff] s64=[0x8000000000000000, 0x7fffffffffffffff] u32=[0x0, 0xffffffff] s32=[0x80000000, 0x7fffffff] var_off=(0x7fffffff, 0x0) 19: R6_w=0x7fffffff 20: (95) exit from 19 to 21:
R0=0x7fffffff R6=scalar(smin=umin=smin32=umin32=2,smax=umax=smax32=umax32=0x7ffffffe,var_off=(0x2;
0x7ffffffd)) R7=map_ptr(ks=4,vs=8) R9=ctx() R10=fp0 fp-24=map_ptr(ks=4,vs=8) fp-40=mmmmmmmm 21:
R0=0x7fffffff R6=scalar(smin=umin=smin32=umin32=2,smax=umax=smax32=umax32=0x7ffffffe,var_off=(0x2;
0x7ffffffd)) R7=map_ptr(ks=4,vs=8) R9=ctx() R10=fp0 fp-24=map_ptr(ks=4,vs=8) fp-40=mmmmmmmm 21: (14) w6 -= 2147483632 ; R6_w=scalar(smin=umin=umin32=2,smax=umax=0xffffffff,smin32=0x80000012,smax32=14,var_off=(0x2;
0xfffffffd)) 22: (76) if w6 s>= 0xe goto pc+1 ;
R6_w=scalar(smin=umin=umin32=2,smax=umax=0xffffffff,smin32=0x80000012,smax32=13,var_off=(0x2; 0xfffffffd)) 23: (95) exit from 22 to 24: R0=0x7fffffff R6_w=14 R7=map_ptr(ks=4,vs=8) R9=ctx() R10=fp0 fp-24=map_ptr(ks=4,vs=8) fp-40=mmmmmmmm 24: R0=0x7fffffff R6_w=14 R7=map_ptr(ks=4,vs=8) R9=ctx() R10=fp0 fp-24=map_ptr(ks=4,vs=8) fp-40=mmmmmmmm 24: (14) w6 -= 14 ; R6_w=0 [...] What can be seen here is a register invariant violation on line 19. After the binary-or in line 18, the verifier knows that bit 2 is set but knows nothing about the rest of the content which was loaded from a map value, meaning, range is [2,0x7fffffff] with var_off=(0x2; 0x7ffffffd). When in line 19 the verifier analyzes the branch, it splits the register states in reg_set_min_max() into the registers of the true branch (true_reg1, true_reg2) and the registers of the false branch (false_reg1, false_reg2). Since the test is w6 != 0x7ffffffd, the src_reg is a known constant. Internally, the verifier creates a fake register initialized as scalar to the value of 0x7ffffffd, and then passes it onto reg_set_min_max(). Now, for line 19, it is mathematically impossible to take the false branch of this program, yet the verifier analyzes it. It is impossible because the second bit of r6 will be set due to the prior or operation and the constant in the condition has that bit unset (hex(fd) == binary(1111 1101). When the verifier first analyzes the false / fall- through branch, it will compute an intersection between the var_off of r6 and of the constant. This is because the verifier creates a fake register initialized to the value of the constant. The intersection result later refines both registers in regs_refine_cond_op(): [...] t = tnum_intersect(tnum_subreg(reg1->var_off), tnum_subreg(reg2->var_off)); reg1->var_o ---truncated--- (CVE-2024-41003)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-41003
https://ubuntu.com/security/CVE-2024-41003

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0011
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-41003

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229279 - Linux Distros Unpatched Vulnerability : CVE-2024-41045
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Defer work in bpf_timer_cancel_and_free Currently, the same case as previous patch (two timer callbacks trying to cancel each other) can be invoked through bpf_map_update_elem as well, or more precisely, freeing map elements containing timers. Since this relies on hrtimer_cancel as well, it is prone to the same deadlock situation as the previous patch. It would be sufficient to use hrtimer_try_to_cancel to fix this problem, as the timer cannot be enqueued after async_cancel_and_free.
Once async_cancel_and_free has been done, the timer must be reinitialized before it can be armed again.
The callback running in parallel trying to arm the timer will fail, and freeing bpf_hrtimer without waiting is sufficient (given kfree_rcu), and bpf_timer_cb will return HRTIMER_NORESTART, preventing the timer from being rearmed again. However, there exists a UAF scenario where the callback arms the timer before entering this function, such that if cancellation fails (due to timer callback invoking this routine, or the target timer callback running concurrently). In such a case, if the timer expiration is significantly far in the future, the RCU grace period expiration happening before it will free the bpf_hrtimer state and along with it the struct hrtimer, that is enqueued. Hence, it is clear cancellation needs to occur after async_cancel_and_free, and yet it cannot be done inline due to deadlock issues. We thus modify bpf_timer_cancel_and_free to defer work to the global workqueue, adding a work_struct alongside rcu_head (both used at _different_ points of time, so can share space). Update existing code comments to reflect the new state of affairs. (CVE-2024-41045)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-41045
https://security-tracker.debian.org/tracker/CVE-2024-41045
https://ubuntu.com/security/CVE-2024-41045

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.001
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-41045

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229410 - Linux Distros Unpatched Vulnerability : CVE-2024-41069
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ASoC: topology: Fix references to freed memory Most users after parsing a topology file, release memory used by it, so having pointer references directly into topology file contents is wrong. Use devm_kmemdup(), to allocate memory as needed. (CVE-2024-41069)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-41069
https://security-tracker.debian.org/tracker/CVE-2024-41069
https://ubuntu.com/security/CVE-2024-41069

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0015
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-41069

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229474 - Linux Distros Unpatched Vulnerability : CVE-2024-41087
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Fix double free on error If e.g. the ata_port_alloc() call in ata_host_alloc() fails, we will jump to the err_out label, which will call devres_release_group(). devres_release_group() will trigger a call to ata_host_release().
ata_host_release() calls kfree(host), so executing the kfree(host) in ata_host_alloc() will lead to a double free: kernel BUG at mm/slub.c:553! Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 11 PID:
599 Comm: (udev-worker) Not tainted 6.10.0-rc5 #47 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:kfree+0x2cf/0x2f0 Code: 5d 41 5e 41 5f 5d e9 80 d6 ff ff 4d 89 f1 41 b8 01 00 00 00 48 89 d9 48 89 da RSP: 0018:ffffc90000f377f0 EFLAGS: 00010246 RAX: ffff888112b1f2c0 RBX:
ffff888112b1f2c0 RCX: ffff888112b1f320 RDX: 000000000000400b RSI: ffffffffc02c9de5 RDI: ffff888112b1f2c0 RBP: ffffc90000f37830 R08: 0000000000000000 R09: 0000000000000000 R10: ffffc90000f37610 R11:
617461203a736b6e R12: ffffea00044ac780 R13: ffff888100046400 R14: ffffffffc02c9de5 R15: 0000000000000006 FS: 00007f2f1cabe980(0000) GS:ffff88813b380000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2f1c3acf75 CR3: 0000000111724000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> ? __die_body.cold+0x19/0x27 ? die+0x2e/0x50 ? do_trap+0xca/0x110 ? do_error_trap+0x6a/0x90 ? kfree+0x2cf/0x2f0 ? exc_invalid_op+0x50/0x70 ? kfree+0x2cf/0x2f0 ? asm_exc_invalid_op+0x1a/0x20 ? ata_host_alloc+0xf5/0x120 [libata] ? ata_host_alloc+0xf5/0x120 [libata] ? kfree+0x2cf/0x2f0 ata_host_alloc+0xf5/0x120 [libata] ata_host_alloc_pinfo+0x14/0xa0 [libata] ahci_init_one+0x6c9/0xd20 [ahci] Ensure that we will not call kfree(host) twice, by performing the kfree() only if the devres_open_group() call failed. (CVE-2024-41087)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-41087
https://ubuntu.com/security/CVE-2024-41087

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0007
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-41087

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228387 - Linux Distros Unpatched Vulnerability : CVE-2024-41996
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption.
The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key. (CVE-2024-41996)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-41996
https://ubuntu.com/security/CVE-2024-41996

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0039
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-41996

Plugin Information
Published: 2025/03/05, Modified: 2025/09/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- compat-openssl11
- openssl
- openssl-devel
- openssl-libs
229183 - Linux Distros Unpatched Vulnerability : CVE-2024-42136
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cdrom: rearrange last_media_change check to avoid unintentional overflow When running syzkaller with the newly reintroduced signed integer wrap sanitizer we encounter this splat: [ 366.015950] UBSAN: signed-integer-overflow in ../drivers/cdrom/cdrom.c:2361:33 [ 366.021089] -9223372036854775808 - 346321 cannot be represented in type '__s64' (aka 'long long') [ 366.025894] program syz-executor.4 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 366.027502] CPU: 5 PID: 28472 Comm: syz-executor.7 Not tainted 6.8.0-rc2-00035-gb3ef86b5a957 #1 [ 366.027512] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 366.027518] Call Trace: [ 366.027523] <TASK> [ 366.027533] dump_stack_lvl+0x93/0xd0 [ 366.027899] handle_overflow+0x171/0x1b0 [ 366.038787] ata1.00: invalid multi_count 32 ignored [ 366.043924] cdrom_ioctl+0x2c3f/0x2d10 [ 366.063932] ?
__pm_runtime_resume+0xe6/0x130 [ 366.071923] sr_block_ioctl+0x15d/0x1d0 [ 366.074624] ?
__pfx_sr_block_ioctl+0x10/0x10 [ 366.077642] blkdev_ioctl+0x419/0x500 [ 366.080231] ?
__pfx_blkdev_ioctl+0x10/0x10 ... Historically, the signed integer overflow sanitizer did not work in the kernel due to its interaction with `-fwrapv` but this has since been changed [1] in the newest version of Clang. It was re-enabled in the kernel with Commit 557f8c582a9ba8ab (ubsan: Reintroduce signed overflow sanitizer). Let's rearrange the check to not perform any arithmetic, thus not tripping the sanitizer.
(CVE-2024-42136)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42136
https://ubuntu.com/security/CVE-2024-42136

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-42136

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244769 - Linux Distros Unpatched Vulnerability : CVE-2024-42138
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file In case of invalid INI file mlxsw_linecard_types_init() deallocates memory but doesn't reset pointer to NULL and returns 0. In case of any error occurred after mlxsw_linecard_types_init() call, mlxsw_linecards_init() calls mlxsw_linecard_types_fini() which performs memory deallocation again. Add pointer reset to NULL. Found by Linux Verification Center (linuxtesting.org) with SVACE. (CVE-2024-42138)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42138
https://ubuntu.com/security/CVE-2024-42138

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-42138

Plugin Information
Published: 2025/08/07, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228676 - Linux Distros Unpatched Vulnerability : CVE-2024-42148
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bnx2x: Fix multiple UBSAN array-index-out-of-bounds Fix UBSAN warnings that occur when using a system with 32 physical cpu cores or more, or when the user defines a number of Ethernet queues greater than or equal to FP_SB_MAX_E1x using the num_queues module parameter. Currently there is a read/write out of bounds that occurs on the array struct stats_query_entry query present inside the bnx2x_fw_stats_req struct in drivers/net/ethernet/broadcom/bnx2x/bnx2x.h. Looking at the definition of the struct stats_query_entry query array: struct stats_query_entry query[FP_SB_MAX_E1x+ BNX2X_FIRST_QUEUE_QUERY_IDX]; FP_SB_MAX_E1x is defined as the maximum number of fast path interrupts and has a value of 16, while BNX2X_FIRST_QUEUE_QUERY_IDX has a value of 3 meaning the array has a total size of 19. Since accesses to struct stats_query_entry query are offset-ted by BNX2X_FIRST_QUEUE_QUERY_IDX, that means that the total number of Ethernet queues should not exceed FP_SB_MAX_E1x (16). However one of these queues is reserved for FCOE and thus the number of Ethernet queues should be set to [FP_SB_MAX_E1x -1] (15) if FCOE is enabled or [FP_SB_MAX_E1x] (16) if it is not. This is also described in a comment in the source code in drivers/net/ethernet/broadcom/bnx2x/bnx2x.h just above the Macro definition of FP_SB_MAX_E1x. Below is the part of this explanation that it important for this patch /* * The total number of L2 queues, MSIX vectors and HW contexts (CIDs) is * control by the number of fast-path status blocks supported by the * device (HW/FW). Each fast-path status block (FP-SB) aka non-default * status block represents an independent interrupts context that can * serve a regular L2 networking queue. However special L2 queues such * as the FCoE queue do not require a FP-SB and other components like * the CNIC may consume FP-SB reducing the number of possible L2 queues * * If the maximum number of FP-SB available is X then: * a. If CNIC is supported it consumes 1 FP-SB thus the max number of * regular L2 queues is Y=X-1 * b. In MF mode the actual number of L2 queues is Y= (X-1/MF_factor) * c. If the FCoE L2 queue is supported the actual number of L2 queues * is Y+1 * d. The number of irqs (MSIX vectors) is either Y+1 (one extra for * slow-path interrupts) or Y+2 if CNIC is supported (one additional * FP interrupt context for the CNIC). * e. The number of HW context (CID count) is always X or X+1 if FCoE * L2 queue is supported. The cid for the FCoE L2 queue is always X. */ However this driver also supports NICs that use the E2 controller which can handle more queues due to having more FP-SB represented by FP_SB_MAX_E2. Looking at the commits when the E2 support was added, it was originally using the E1x parameters: commit f2e0899f0f27 (bnx2x: Add 57712 support). Back then FP_SB_MAX_E2 was set to 16 the same as E1x. However the driver was later updated to take full advantage of the E2 instead of having it be limited to the capabilities of the E1x. But as far as we can tell, the array stats_query_entry query was still limited to using the FP-SB available to the E1x cards as part of an oversignt when the driver was updated to take full advantage of the E2, and now with the driver being aware of the greater queue size supported by E2 NICs, it causes the UBSAN warnings seen in the stack traces below. This patch increases the size of the stats_query_entry query array by replacing FP_SB_MAX_E1x with FP_SB_MAX_E2 to be large enough to handle both types of NICs. Stack traces:
UBSAN: array-index-out-of-bounds in drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c:1529:11 index 20 is out of range for type 'stats_query_entry [19]' CPU: 12 PID: 858 Comm: systemd-network Not tainted 6.9.0-060900rc7-generic #202405052133 Hardware name: HP ProLiant DL360 Gen9/ProLiant DL360 ---truncated--- (CVE-2024-42148)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42148
https://ubuntu.com/security/CVE-2024-42148

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.4
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42148

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228890 - Linux Distros Unpatched Vulnerability : CVE-2024-42162
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- gve: Account for stopped queues when reading NIC stats We now account for the fact that the NIC might send us stats for a subset of queues. Without this change, gve_get_ethtool_stats might make an invalid access on the priv->stats_report->stats array. (CVE-2024-42162)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42162
https://security-tracker.debian.org/tracker/CVE-2024-42162
https://ubuntu.com/security/CVE-2024-42162

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0005
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-42162

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228514 - Linux Distros Unpatched Vulnerability : CVE-2024-42285
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA/iwcm: Fix a use-after-free related to destroying CM IDs iw_conn_req_handler() associates a new struct rdma_id_private (conn_id) with an existing struct iw_cm_id (cm_id) as follows: conn_id->cm_id.iw = cm_id;
cm_id->context = conn_id; cm_id->cm_handler = cma_iw_handler; rdma_destroy_id() frees both the cm_id and the struct rdma_id_private. Make sure that cm_work_handler() does not trigger a use-after-free by only freeing of the struct rdma_id_private after all pending work has finished. (CVE-2024-42285)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42285
https://ubuntu.com/security/CVE-2024-42285

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0007
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42285

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229284 - Linux Distros Unpatched Vulnerability : CVE-2024-42317
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm/huge_memory: avoid PMD-size page cache if needed xarray can't support arbitrary page cache size. the largest and supported page cache size is defined as MAX_PAGECACHE_ORDER by commit 099d90642a71 (mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray). However, it's possible to have 512MB page cache in the huge memory's collapsing path on ARM64 system whose base page size is 64KB. 512MB page cache is breaking the limitation and a warning is raised when the xarray entry is split as shown in the following example. [root@dhcp-10-26-1-207 ~]# cat /proc/1/smaps | grep KernelPageSize KernelPageSize: 64 kB [root@dhcp-10-26-1-207 ~]# cat /tmp/test.c : int main(int argc, char **argv) { const char *filename = TEST_XFS_FILENAME; int fd = 0; void *buf = (void *)-1, *p; int pgsize = getpagesize(); int ret = 0; if (pgsize != 0x10000) { fprintf(stdout, System with 64KB base page size is required! ); return -EPERM; } system(echo 0 > /sys/devices/virtual/bdi/253:0/read_ahead_kb); system(echo 1 >
/proc/sys/vm/drop_caches); /* Open the xfs file */ fd = open(filename, O_RDONLY); assert(fd > 0); /* Create VMA */ buf = mmap(NULL, TEST_MEM_SIZE, PROT_READ, MAP_SHARED, fd, 0); assert(buf != (void *)-1);
fprintf(stdout, mapped buffer at 0x%p , buf); /* Populate VMA */ ret = madvise(buf, TEST_MEM_SIZE, MADV_NOHUGEPAGE); assert(ret == 0); ret = madvise(buf, TEST_MEM_SIZE, MADV_POPULATE_READ); assert(ret == 0); /* Collapse VMA */ ret = madvise(buf, TEST_MEM_SIZE, MADV_HUGEPAGE); assert(ret == 0); ret = madvise(buf, TEST_MEM_SIZE, MADV_COLLAPSE); if (ret) { fprintf(stdout, Error %d to madvise(MADV_COLLAPSE) , errno); goto out; } /* Split xarray entry. Write permission is needed */ munmap(buf, TEST_MEM_SIZE); buf = (void *)-1; close(fd); fd = open(filename, O_RDWR); assert(fd > 0);
fallocate(fd, FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE, TEST_MEM_SIZE - pgsize, pgsize); out: if (buf != (void *)-1) munmap(buf, TEST_MEM_SIZE); if (fd > 0) close(fd); return ret; } [root@dhcp-10-26-1-207 ~]# gcc /tmp/test.c -o /tmp/test [root@dhcp-10-26-1-207 ~]# /tmp/test ------------[ cut here ]------------ WARNING: CPU: 25 PID: 7560 at lib/xarray.c:1025 xas_split_alloc+0xf8/0x128 Modules linked in: nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib \ nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct \ nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 \ ip_set rfkill nf_tables nfnetlink vfat fat virtio_balloon drm fuse \ xfs libcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64 virtio_net \ sha1_ce net_failover virtio_blk virtio_console failover dimlib virtio_mmio CPU: 25 PID: 7560 Comm: test Kdump: loaded Not tainted 6.10.0-rc7-gavin+ #9 Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20240524-1.el9 05/24/2024 pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc :
xas_split_alloc+0xf8/0x128 lr : split_huge_page_to_list_to_order+0x1c4/0x780 sp : ffff8000ac32f660 x29:
ffff8000ac32f660 x28: ffff0000e0969eb0 x27: ffff8000ac32f6c0 x26: 0000000000000c40 x25: ffff0000e0969eb0 x24: 000000000000000d x23: ffff8000ac32f6c0 x22: ffffffdfc0700000 x21: 0000000000000000 x20:
0000000000000000 x19: ffffffdfc0700000 x18: 0000000000000000 x17: 0000000000000000 x16: ffffd5f3708ffc70 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11:
ffffffffffffffc0 x10: 0000000000000040 x9 : ffffd5f3708e692c x8 : 0000000000000003 x7 : 0000000000000000 x6 : ffff0000e0969eb8 x5 : ffffd5f37289e378 x4 : 0000000000000000 x3 : 0000000000000c40 x2 :
000000000000000d x1 : 000000000000000c x0 : 0000000000000000 Call trace: xas_split_alloc+0xf8/0x128 split_huge_page_to_list_to_order+0x1c4/0x780 truncate_inode_partial_folio+0xdc/0x160 truncate_inode_pages_range+0x1b4/0x4a8 truncate_pagecache_range+0x84/0xa ---truncated--- (CVE-2024-42317)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42317
https://security-tracker.debian.org/tracker/CVE-2024-42317
https://ubuntu.com/security/CVE-2024-42317

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.001
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-42317

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229076 - Linux Distros Unpatched Vulnerability : CVE-2024-44967
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/mgag200: Bind I2C lifetime to DRM device Managed cleanup with devm_add_action_or_reset() will release the I2C adapter when the underlying Linux device goes away. But the connector still refers to it, so this cleanup leaves behind a stale pointer in struct drm_connector.ddc. Bind the lifetime of the I2C adapter to the connector's lifetime by using DRM's managed release. When the DRM device goes away (after the Linux device) DRM will first clean up the connector and then clean up the I2C adapter. (CVE-2024-44967)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-44967
https://ubuntu.com/security/CVE-2024-44967

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-44967

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228656 - Linux Distros Unpatched Vulnerability : CVE-2024-44974
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: avoid possible UaF when selecting endp select_local_address() and select_signal_address() both select an endpoint entry from the list inside an RCU protected section, but return a reference to it, to be read later on. If the entry is dereferenced after the RCU unlock, reading info could cause a Use-after-Free. A simple solution is to copy the required info while inside the RCU protected section to avoid any risk of UaF later. The address ID might need to be modified later to handle the ID0 case later, so a copy seems OK to deal with.
(CVE-2024-44974)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-44974
https://ubuntu.com/security/CVE-2024-44974

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-44974

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229000 - Linux Distros Unpatched Vulnerability : CVE-2024-44977
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Validate TA binary size Add TA binary size validation to avoid OOB write. (cherry picked from commit c0a04e3570d72aaf090962156ad085e37c62e442) (CVE-2024-44977)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-44977
https://ubuntu.com/security/CVE-2024-44977

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-44977

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228684 - Linux Distros Unpatched Vulnerability : CVE-2024-44983
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: validate vlan header Ensure there is sufficient room to access the protocol field of the VLAN header, validate it once before the flowtable lookup. ===================================================== BUG: KMSAN: uninit- value in nf_flow_offload_inet_hook+0x45a/0x5f0 net/netfilter/nf_flow_table_inet.c:32 nf_flow_offload_inet_hook+0x45a/0x5f0 net/netfilter/nf_flow_table_inet.c:32 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook_ingress include/linux/netfilter_netdev.h:34 [inline] nf_ingress net/core/dev.c:5440 [inline] (CVE-2024-44983)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-44983
https://ubuntu.com/security/CVE-2024-44983

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0007
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-44983

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229033 - Linux Distros Unpatched Vulnerability : CVE-2024-44985
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UAF in ip6_xmit() If skb_expand_head() returns NULL, skb has been freed and the associated dst/idev could also have been freed. We must use rcu_read_lock() to prevent a possible UAF. (CVE-2024-44985)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-44985
https://ubuntu.com/security/CVE-2024-44985

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-44985

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229551 - Linux Distros Unpatched Vulnerability : CVE-2024-44986
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipv6: fix possible UAF in ip6_finish_output2() If skb_expand_head() returns NULL, skb has been freed and associated dst/idev could also have been freed. We need to hold rcu_read_lock() to make sure the dst and associated idev are alive. (CVE-2024-44986)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-44986
https://security-tracker.debian.org/tracker/CVE-2024-44986
https://ubuntu.com/security/CVE-2024-44986

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0012
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-44986

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229218 - Linux Distros Unpatched Vulnerability : CVE-2024-44998
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- atm: idt77252: prevent use after free in dequeue_rx() We can't dereference skb after calling vcc->push() because the skb is released. (CVE-2024-44998)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-44998
https://ubuntu.com/security/CVE-2024-44998

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-44998

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228323 - Linux Distros Unpatched Vulnerability : CVE-2024-45026
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- s390/dasd: fix error recovery leading to data corruption on ESE devices Extent Space Efficient (ESE) or thin provisioned volumes need to be formatted on demand during usual IO processing. The dasd_ese_needs_format function checks for error codes that signal the non existence of a proper track format. The check for incorrect length is to imprecise since other error cases leading to transport of insufficient data also have this flag set. This might lead to data corruption in certain error cases for example during a storage server warmstart. Fix by removing the check for incorrect length and replacing by explicitly checking for invalid track format in transport mode. Also remove the check for file protected since this is not a valid ESE handling case. (CVE-2024-45026)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-45026
https://security-tracker.debian.org/tracker/CVE-2024-45026
https://ubuntu.com/security/CVE-2024-45026

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-45026

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228556 - Linux Distros Unpatched Vulnerability : CVE-2024-45490
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer. (CVE-2024-45490)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-45490
https://security-tracker.debian.org/tracker/CVE-2024-45490
https://ubuntu.com/security/CVE-2024-45490

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-45490

Plugin Information
Published: 2025/03/05, Modified: 2025/11/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
228940 - Linux Distros Unpatched Vulnerability : CVE-2024-46738
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- VMCI: Fix use-after-free when removing resource in vmci_resource_remove() When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143
__fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220
__syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). (CVE-2024-46738)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46738
https://ubuntu.com/security/CVE-2024-46738

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46738

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229002 - Linux Distros Unpatched Vulnerability : CVE-2024-46746
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: HID: amd_sfh: free driver_data after destroying hid device HID driver callbacks aren't called anymore once hid_destroy_device() has been called. Hence, hid driver_data should be freed only after the hid_destroy_device() function returned as driver_data is used in several callbacks. I observed a crash with kernel 6.10.0 on my T14s Gen 3, after enabling KASAN to debug memory allocation, I got this output: [ 13.050438] ================================================================== [ 13.054060] BUG: KASAN: slab-use- after-free in amd_sfh_get_report+0x3ec/0x530 [amd_sfh] [ 13.054809] psmouse serio1: trackpoint: Synaptics TrackPoint firmware: 0x02, buttons: 3/3 [ 13.056432] Read of size 8 at addr ffff88813152f408 by task (udev-worker)/479 [ 13.060970] CPU: 5 PID: 479 Comm: (udev-worker) Not tainted 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0 [ 13.063978] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024 [ 13.067860] Call Trace: [ 13.069383] input: TPPS/2 Synaptics TrackPoint as /devices/platform/i8042/serio1/input/input8 [ 13.071486] <TASK> [ 13.071492] dump_stack_lvl+0x5d/0x80 [ 13.074870] snd_hda_intel 0000:33:00.6: enabling device (0000 -> 0002) [ 13.078296] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.082199] print_report+0x174/0x505 [ 13.085776] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.089367] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.093255] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.097464] kasan_report+0xc8/0x150 [ 13.101461] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.105802] amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.110303] amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.114879] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.119450] sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082] [ 13.124097] hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.127404] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.131925] ? __pfx_hid_sensor_parse_common_attributes+0x10/0x10 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.136455] ?
_raw_spin_lock_irqsave+0x96/0xf0 [ 13.140197] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.143602] ? devm_iio_device_alloc+0x34/0x50 [industrialio 3d261d5e5765625d2b052be40e526d62b1d2123b] [ 13.147234] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.150446] ? __devm_add_action+0x167/0x1d0 [ 13.155061] hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.158581] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.161814] platform_probe+0xa2/0x150 [ 13.165029] really_probe+0x1e3/0x8a0 [ 13.168243] __driver_probe_device+0x18c/0x370 [ 13.171500] driver_probe_device+0x4a/0x120 [ 13.175000] __driver_attach+0x190/0x4a0 [ 13.178521] ?
__pfx___driver_attach+0x10/0x10 [ 13.181771] bus_for_each_dev+0x106/0x180 [ 13.185033] ?
__pfx__raw_spin_lock+0x10/0x10 [ 13.188229] ? __pfx_bus_for_each_dev+0x10/0x10 [ 13.191446] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.194382] bus_add_driver+0x29e/0x4d0 [ 13.197328] driver_register+0x1a5/0x360 [ 13.200283] ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.203362] do_one_initcall+0xa7/0x380 [ 13.206432] ? __pfx_do_one_initcall+0x10/0x10 [ 13.210175] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.213211] ? kasan_unpoison+0x44/0x70 [ 13.216688] do_init_module+0x238/0x750 [ 13.2196 ---truncated--- (CVE-2024-46746)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46746
https://ubuntu.com/security/CVE-2024-46746

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46746

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229333 - Linux Distros Unpatched Vulnerability : CVE-2024-46766
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ice: move netif_queue_set_napi to rtnl-protected sections Currently, netif_queue_set_napi() is called from ice_vsi_rebuild() that is not rtnl-locked when called from the reset. This creates the need to take the rtnl_lock just for a single function and complicates the synchronization with .ndo_bpf. At the same time, there no actual need to fill napi-to-queue information at this exact point. Fill napi-to-queue information when opening the VSI and clear it when the VSI is being closed. Those routines are already rtnl-locked. Also, rewrite napi-to-queue assignment in a way that prevents inclusion of XDP queues, as this leads to out-of-bounds writes, such as one below. [ +0.000004] BUG: KASAN: slab-out-of-bounds in netif_queue_set_napi+0x1c2/0x1e0 [ +0.000012] Write of size 8 at addr ffff889881727c80 by task bash/7047 [ +0.000006] CPU: 24 PID: 7047 Comm: bash Not tainted 6.10.0-rc2+ #2 [ +0.000004] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0014.082620210524 08/26/2021 [ +0.000003] Call Trace: [ +0.000003] <TASK> [ +0.000002] dump_stack_lvl+0x60/0x80 [ +0.000007] print_report+0xce/0x630 [ +0.000007] ?
__pfx__raw_spin_lock_irqsave+0x10/0x10 [ +0.000007] ? __virt_addr_valid+0x1c9/0x2c0 [ +0.000005] ? netif_queue_set_napi+0x1c2/0x1e0 [ +0.000003] kasan_report+0xe9/0x120 [ +0.000004] ? netif_queue_set_napi+0x1c2/0x1e0 [ +0.000004] netif_queue_set_napi+0x1c2/0x1e0 [ +0.000005] ice_vsi_close+0x161/0x670 [ice] [ +0.000114] ice_dis_vsi+0x22f/0x270 [ice] [ +0.000095] ice_pf_dis_all_vsi.constprop.0+0xae/0x1c0 [ice] [ +0.000086] ice_prepare_for_reset+0x299/0x750 [ice] [ +0.000087] pci_dev_save_and_disable+0x82/0xd0 [ +0.000006] pci_reset_function+0x12d/0x230 [ +0.000004] reset_store+0xa0/0x100 [ +0.000006] ? __pfx_reset_store+0x10/0x10 [ +0.000002] ?
__pfx_mutex_lock+0x10/0x10 [ +0.000004] ? __check_object_size+0x4c1/0x640 [ +0.000007] kernfs_fop_write_iter+0x30b/0x4a0 [ +0.000006] vfs_write+0x5d6/0xdf0 [ +0.000005] ? fd_install+0x180/0x350 [ +0.000005] ? __pfx_vfs_write+0x10/0xA10 [ +0.000004] ? do_fcntl+0x52c/0xcd0 [ +0.000004] ? kasan_save_track+0x13/0x60 [ +0.000003] ? kasan_save_free_info+0x37/0x60 [ +0.000006] ksys_write+0xfa/0x1d0 [ +0.000003] ? __pfx_ksys_write+0x10/0x10 [ +0.000002] ? __x64_sys_fcntl+0x121/0x180 [ +0.000004] ? _raw_spin_lock+0x87/0xe0 [ +0.000005] do_syscall_64+0x80/0x170 [ +0.000007] ?
_raw_spin_lock+0x87/0xe0 [ +0.000004] ? __pfx__raw_spin_lock+0x10/0x10 [ +0.000003] ? file_close_fd_locked+0x167/0x230 [ +0.000005] ? syscall_exit_to_user_mode+0x7d/0x220 [ +0.000005] ? do_syscall_64+0x8c/0x170 [ +0.000004] ? do_syscall_64+0x8c/0x170 [ +0.000003] ? do_syscall_64+0x8c/0x170 [ +0.000003] ? fput+0x1a/0x2c0 [ +0.000004] ? filp_close+0x19/0x30 [ +0.000004] ? do_dup2+0x25a/0x4c0 [ +0.000004] ? __x64_sys_dup2+0x6e/0x2e0 [ +0.000002] ? syscall_exit_to_user_mode+0x7d/0x220 [ +0.000004] ? do_syscall_64+0x8c/0x170 [ +0.000003] ? __count_memcg_events+0x113/0x380 [ +0.000005] ? handle_mm_fault+0x136/0x820 [ +0.000005] ? do_user_addr_fault+0x444/0xa80 [ +0.000004] ? clear_bhb_loop+0x25/0x80 [ +0.000004] ? clear_bhb_loop+0x25/0x80 [ +0.000002] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ +0.000005] RIP: 0033:0x7f2033593154 (CVE-2024-46766)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46766
https://ubuntu.com/security/CVE-2024-46766

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-46766

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228368 - Linux Distros Unpatched Vulnerability : CVE-2024-46774
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas() Smatch warns:
arch/powerpc/kernel/rtas.c:1932 __do_sys_rtas() warn: potential spectre issue 'args.args' [r] (local cap) The 'nargs' and 'nret' locals come directly from a user-supplied buffer and are used as indexes into a small stack-based array and as inputs to copy_to_user() after they are subject to bounds checks. Use array_index_nospec() after the bounds checks to clamp these values for speculative execution.
(CVE-2024-46774)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46774
https://security-tracker.debian.org/tracker/CVE-2024-46774
https://ubuntu.com/security/CVE-2024-46774

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0005
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46774

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229527 - Linux Distros Unpatched Vulnerability : CVE-2024-46796
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double put of @cfile in smb2_set_path_size() If smb2_compound_op() is called with a valid @cfile and returned -EINVAL, we need to call cifs_get_writable_path() before retrying it as the reference of @cfile was already dropped by previous call. This fixes the following KASAN splat when running fstests generic/013 against Windows Server 2022: CIFS: Attempting to mount //w22-fs0/scratch run fstests generic/013 at 2024-09-02 19:48:59 ================================================================== BUG: KASAN: slab-use-after-free in detach_if_pending+0xab/0x200 Write of size 8 at addr ffff88811f1a3730 by task kworker/3:2/176 CPU: 3 UID:
0 PID: 176 Comm: kworker/3:2 Not tainted 6.11.0-rc6 #2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 Workqueue: cifsoplockd cifs_oplock_break [cifs] Call Trace: <TASK>
dump_stack_lvl+0x5d/0x80 ? detach_if_pending+0xab/0x200 print_report+0x156/0x4d9 ? detach_if_pending+0xab/0x200 ? __virt_addr_valid+0x145/0x300 ? __phys_addr+0x46/0x90 ? detach_if_pending+0xab/0x200 kasan_report+0xda/0x110 ? detach_if_pending+0xab/0x200 detach_if_pending+0xab/0x200 timer_delete+0x96/0xe0 ? __pfx_timer_delete+0x10/0x10 ? rcu_is_watching+0x20/0x50 try_to_grab_pending+0x46/0x3b0 __cancel_work+0x89/0x1b0 ?
__pfx___cancel_work+0x10/0x10 ? kasan_save_track+0x14/0x30 cifs_close_deferred_file+0x110/0x2c0 [cifs] ?
__pfx_cifs_close_deferred_file+0x10/0x10 [cifs] ? __pfx_down_read+0x10/0x10 cifs_oplock_break+0x4c1/0xa50 [cifs] ? __pfx_cifs_oplock_break+0x10/0x10 [cifs] ? lock_is_held_type+0x85/0xf0 ? mark_held_locks+0x1a/0x90 process_one_work+0x4c6/0x9f0 ? find_held_lock+0x8a/0xa0 ?
__pfx_process_one_work+0x10/0x10 ? lock_acquired+0x220/0x550 ? __list_add_valid_or_report+0x37/0x100 worker_thread+0x2e4/0x570 ? __kthread_parkme+0xd1/0xf0 ? __pfx_worker_thread+0x10/0x10 kthread+0x17f/0x1c0 ? kthread+0xda/0x1c0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 1118: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 cifs_new_fileinfo+0xc8/0x9d0 [cifs] cifs_atomic_open+0x467/0x770 [cifs] lookup_open.isra.0+0x665/0x8b0 path_openat+0x4c3/0x1380 do_filp_open+0x167/0x270 do_sys_openat2+0x129/0x160 __x64_sys_creat+0xad/0xe0 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 83: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x70 poison_slab_object+0xe9/0x160
__kasan_slab_free+0x32/0x50 kfree+0xf2/0x300 process_one_work+0x4c6/0x9f0 worker_thread+0x2e4/0x570 kthread+0x17f/0x1c0 ret_from_fork+0x31/0x60 ret_from_fork_asm+0x1a/0x30 Last potentially related work creation: kasan_save_stack+0x30/0x50 __kasan_record_aux_stack+0xad/0xc0 insert_work+0x29/0xe0
__queue_work+0x5ea/0x760 queue_work_on+0x6d/0x90 _cifsFileInfo_put+0x3f6/0x770 [cifs] smb2_compound_op+0x911/0x3940 [cifs] smb2_set_path_size+0x228/0x270 [cifs] cifs_set_file_size+0x197/0x460 [cifs] cifs_setattr+0xd9c/0x14b0 [cifs] notify_change+0x4e3/0x740 do_truncate+0xfa/0x180 vfs_truncate+0x195/0x200 __x64_sys_truncate+0x109/0x150 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f (CVE-2024-46796)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46796
https://ubuntu.com/security/CVE-2024-46796

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-46796

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229326 - Linux Distros Unpatched Vulnerability : CVE-2024-46798
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object When using kernel with the following extra config, - CONFIG_KASAN=y - CONFIG_KASAN_GENERIC=y - CONFIG_KASAN_INLINE=y - CONFIG_KASAN_VMALLOC=y - CONFIG_FRAME_WARN=4096 kernel detects that snd_pcm_suspend_all() access a freed 'snd_soc_pcm_runtime' object when the system is suspended, which leads to a use-after-free bug: [ 52.047746] BUG: KASAN: use-after-free in snd_pcm_suspend_all+0x1a8/0x270 [ 52.047765] Read of size 1 at addr ffff0000b9434d50 by task systemd- sleep/2330 [ 52.047785] Call trace: [ 52.047787] dump_backtrace+0x0/0x3c0 [ 52.047794] show_stack+0x34/0x50 [ 52.047797] dump_stack_lvl+0x68/0x8c [ 52.047802] print_address_description.constprop.0+0x74/0x2c0 [ 52.047809] kasan_report+0x210/0x230 [ 52.047815]
__asan_report_load1_noabort+0x3c/0x50 [ 52.047820] snd_pcm_suspend_all+0x1a8/0x270 [ 52.047824] snd_soc_suspend+0x19c/0x4e0 The snd_pcm_sync_stop() has a NULL check on 'substream->runtime' before making any access. So we need to always set 'substream->runtime' to NULL everytime we kfree() it.
(CVE-2024-46798)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46798
https://ubuntu.com/security/CVE-2024-46798

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46798

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229125 - Linux Distros Unpatched Vulnerability : CVE-2024-46845
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tracing/timerlat: Only clear timer if a kthread exists The timerlat tracer can use user space threads to check for osnoise and timer latency. If the program using this is killed via a SIGTERM, the threads are shutdown one at a time and another tracing instance can start up resetting the threads before they are fully closed. That causes the hrtimer assigned to the kthread to be shutdown and freed twice when the dying thread finally closes the file descriptors, causing a use-after-free bug. Only cancel the hrtimer if the associated thread is still around. Also add the interface_lock around the resetting of the tlat_var->kthread. Note, this is just a quick fix that can be backported to stable. A real fix is to have a better synchronization between the shutdown of old threads and the starting of new ones. (CVE-2024-46845)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46845
https://ubuntu.com/security/CVE-2024-46845

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-46845

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228694 - Linux Distros Unpatched Vulnerability : CVE-2024-46859
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses The panasonic laptop code in various places uses the SINF array with index values of 0 - SINF_CUR_BRIGHT(0x0d) without checking that the SINF array is big enough. Not all panasonic laptops have this many SINF array entries, for example the Toughbook CF-18 model only has 10 SINF array entries. So it only supports the AC+DC brightness entries and mute. Check that the SINF array has a minimum size which covers all AC+DC brightness entries and refuse to load if the SINF array is smaller. For higher SINF indexes hide the sysfs attributes when the SINF array does not contain an entry for that attribute, avoiding show()/store() accessing the array out of bounds and add bounds checking to the probe() and resume() code accessing these. (CVE-2024-46859)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46859
https://security-tracker.debian.org/tracker/CVE-2024-46859
https://ubuntu.com/security/CVE-2024-46859

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46859

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229348 - Linux Distros Unpatched Vulnerability : CVE-2024-4741
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, only applications that directly call the SSL_free_buffers function are affected by this issue. Applications that do not call this function are not vulnerable. Our investigations indicate that this function is rarely used by applications. The SSL_free_buffers function is used to free the internal OpenSSL buffer used when processing an incoming record from the network. The call is only expected to succeed if the buffer is not currently in use. However, two scenarios have been identified where the buffer is freed even when still in use. The first scenario occurs where a record header has been received from the network and processed by OpenSSL, but the full record body has not yet arrived. In this case calling SSL_free_buffers will succeed even though a record has only been partially processed and the buffer is still in use. The second scenario occurs where a full record containing application data has been received and processed by OpenSSL but the application has only read part of this data. Again a call to SSL_free_buffers will succeed even though the buffer is still in use. While these scenarios could occur accidentally during normal operation a malicious attacker could attempt to engineer a stituation where this occurs. We are not aware of this issue being actively exploited. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue. (CVE-2024-4741)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-4741
https://ubuntu.com/security/CVE-2024-4741

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0008
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-4741

Plugin Information
Published: 2025/03/05, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- compat-openssl11
228471 - Linux Distros Unpatched Vulnerability : CVE-2024-47682
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix off-by-one error in sd_read_block_characteristics() Ff the device returns page 0xb1 with length 8 (happens with qemu v2.x, for example), sd_read_block_characteristics() may attempt an out-of-bounds memory access when accessing the zoned field at offset 8. (CVE-2024-47682)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-47682
https://ubuntu.com/security/CVE-2024-47682

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0004
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-47682

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228723 - Linux Distros Unpatched Vulnerability : CVE-2024-47696
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency In the commit aee2424246f9 (RDMA/iwcm: Fix a use- after-free related to destroying CM IDs), the function flush_workqueue is invoked to flush the work queue iwcm_wq. But at that time, the work queue iwcm_wq was created via the function alloc_ordered_workqueue without the flag WQ_MEM_RECLAIM. Because the current process is trying to flush the whole iwcm_wq, if iwcm_wq doesn't have the flag WQ_MEM_RECLAIM, verify that the current process is not reclaiming memory or running on a workqueue which doesn't have the flag WQ_MEM_RECLAIM as that can break forward-progress guarantee leading to a deadlock. The call trace is as below: [ 125.350876][ T1430] Call Trace: [ 125.356281][ T1430] <TASK> [ 125.361285][ T1430] ? __warn (kernel/panic.c:693) [ 125.367640][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9)) [ 125.375689][ T1430] ? report_bug (lib/bug.c:180 lib/bug.c:219) [ 125.382505][ T1430] ? handle_bug (arch/x86/kernel/traps.c:239) [ 125.388987][ T1430] ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminator 1)) [ 125.395831][ T1430] ? asm_exc_invalid_op (arch/x86/include/asm/idtentry.h:621) [ 125.403125][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9)) [ 125.410984][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9)) [ 125.418764][ T1430] __flush_workqueue (kernel/workqueue.c:3970) [ 125.426021][ T1430] ? __pfx___might_resched (kernel/sched/core.c:10151) [ 125.433431][ T1430] ? destroy_cm_id (drivers/infiniband/core/iwcm.c:375) iw_cm [ 125.441209][ T1430] ?
__pfx___flush_workqueue (kernel/workqueue.c:3910) [ 125.473900][ T1430] ? _raw_spin_lock_irqsave (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:111 kernel/locking/spinlock.c:162) [ 125.473909][ T1430] ? __pfx__raw_spin_lock_irqsave (kernel/locking/spinlock.c:161) [ 125.482537][ T1430]
_destroy_id (drivers/infiniband/core/cma.c:2044) rdma_cm [ 125.495072][ T1430] nvme_rdma_free_queue (drivers/nvme/host/rdma.c:656 drivers/nvme/host/rdma.c:650) nvme_rdma [ 125.505827][ T1430] nvme_rdma_reset_ctrl_work (drivers/nvme/host/rdma.c:2180) nvme_rdma [ 125.505831][ T1430] process_one_work (kernel/workqueue.c:3231) [ 125.515122][ T1430] worker_thread (kernel/workqueue.c:3306 kernel/workqueue.c:3393) [ 125.515127][ T1430] ? __pfx_worker_thread (kernel/workqueue.c:3339) [ 125.531837][ T1430] kthread (kernel/kthread.c:389) [ 125.539864][ T1430] ? __pfx_kthread (kernel/kthread.c:342) [ 125.550628][ T1430] ret_from_fork (arch/x86/kernel/process.c:147) [ 125.558840][ T1430] ? __pfx_kthread (kernel/kthread.c:342) [ 125.558844][ T1430] ret_from_fork_asm (arch/x86/entry/entry_64.S:257) [ 125.566487][ T1430] </TASK> [ 125.566488][ T1430] ---[ end trace 0000000000000000 ]--- (CVE-2024-47696)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-47696
https://ubuntu.com/security/CVE-2024-47696

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.4
EPSS Score
0.0004
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-47696

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228935 - Linux Distros Unpatched Vulnerability : CVE-2024-47701
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: avoid OOB when system.data xattr changes underneath the filesystem When looking up for an entry in an inlined directory, if e_value_offs is changed underneath the filesystem by some change in the block device, it will lead to an out-of-bounds access that KASAN detects as an UAF. EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. loop0: detected capacity change from 2048 to 2047 ================================================================== BUG:
KASAN: use-after-free in ext4_search_dir+0xf2/0x1c0 fs/ext4/namei.c:1500 Read of size 1 at addr ffff88803e91130f by task syz-executor269/5103 CPU: 0 UID: 0 PID: 5103 Comm: syz-executor269 Not tainted 6.11.0-rc4-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 ext4_search_dir+0xf2/0x1c0 fs/ext4/namei.c:1500 ext4_find_inline_entry+0x4be/0x5e0 fs/ext4/inline.c:1697
__ext4_find_entry+0x2b4/0x1b30 fs/ext4/namei.c:1573 ext4_lookup_entry fs/ext4/namei.c:1727 [inline] ext4_lookup+0x15f/0x750 fs/ext4/namei.c:1795 lookup_one_qstr_excl+0x11f/0x260 fs/namei.c:1633 filename_create+0x297/0x540 fs/namei.c:3980 do_symlinkat+0xf9/0x3a0 fs/namei.c:4587 __do_sys_symlinkat fs/namei.c:4610 [inline] __se_sys_symlinkat fs/namei.c:4607 [inline] __x64_sys_symlinkat+0x95/0xb0 fs/namei.c:4607 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3e73ced469 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP:
002b:00007fff4d40c258 EFLAGS: 00000246 ORIG_RAX: 000000000000010a RAX: ffffffffffffffda RBX:
0032656c69662f2e RCX: 00007f3e73ced469 RDX: 0000000020000200 RSI: 00000000ffffff9c RDI: 00000000200001c0 RBP: 0000000000000000 R08: 00007fff4d40c290 R09: 00007fff4d40c290 R10: 0023706f6f6c2f76 R11:
0000000000000246 R12: 00007fff4d40c27c R13: 0000000000000003 R14: 431bde82d7b634db R15: 00007fff4d40c2b0 </TASK> Calling ext4_xattr_ibody_find right after reading the inode with ext4_get_inode_loc will lead to a check of the validity of the xattrs, avoiding this problem. (CVE-2024-47701)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-47701
https://ubuntu.com/security/CVE-2024-47701

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-47701

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230462 - Linux Distros Unpatched Vulnerability : CVE-2024-49855
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nbd: fix race between timeout and normal completion If request timetout is handled by nbd_requeue_cmd(), normal completion has to be stopped for avoiding to complete this requeued request, other use-after-free can be triggered. Fix the race by clearing NBD_CMD_INFLIGHT in nbd_requeue_cmd(), meantime make sure that cmd->lock is grabbed for clearing the flag and the requeue. (CVE-2024-49855)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-49855
https://ubuntu.com/security/CVE-2024-49855

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-49855

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231840 - Linux Distros Unpatched Vulnerability : CVE-2024-49861
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Fix helper writes to read-only maps Lonial found an issue that despite user- and BPF-side frozen BPF map (like in case of .rodata), it was still possible to write into it from a BPF program side through specific helpers having ARG_PTR_TO_{LONG,INT} as arguments. In check_func_arg() when the argument is as mentioned, the meta->raw_mode is never set. Later, check_helper_mem_access(), under the case of PTR_TO_MAP_VALUE as register base type, it assumes BPF_READ for the subsequent call to check_map_access_type() and given the BPF map is read-only it succeeds. The helpers really need to be annotated as ARG_PTR_TO_{LONG,INT} | MEM_UNINIT when results are written into them as opposed to read out of them. The latter indicates that it's okay to pass a pointer to uninitialized memory as the memory is written to anyway. However, ARG_PTR_TO_{LONG,INT} is a special case of ARG_PTR_TO_FIXED_SIZE_MEM just with additional alignment requirement. So it is better to just get rid of the ARG_PTR_TO_{LONG,INT} special cases altogether and reuse the fixed size memory types. For this, add MEM_ALIGNED to additionally ensure alignment given these helpers write directly into the args via *<ptr> = val. The .arg*_size has been initialized reflecting the actual sizeof(*<ptr>). MEM_ALIGNED can only be used in combination with MEM_FIXED_SIZE annotated argument types, since in !MEM_FIXED_SIZE cases the verifier does not know the buffer size a priori and therefore cannot blindly write *<ptr> = val. (CVE-2024-49861)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-49861
https://security-tracker.debian.org/tracker/CVE-2024-49861
https://ubuntu.com/security/CVE-2024-49861

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0004
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-49861

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231874 - Linux Distros Unpatched Vulnerability : CVE-2024-49880
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: fix off by one issue in alloc_flex_gd() Wesley reported an issue:
================================================================== EXT4-fs (dm-5): resizing filesystem from 7168 to 786432 blocks ------------[ cut here ]------------ kernel BUG at fs/ext4/resize.c:324! CPU: 9 UID: 0 PID: 3576 Comm: resize2fs Not tainted 6.11.0+ #27 RIP: 0010:ext4_resize_fs+0x1212/0x12d0 Call Trace: __ext4_ioctl+0x4e0/0x1800 ext4_ioctl+0x12/0x20 __x64_sys_ioctl+0x99/0xd0 x64_sys_call+0x1206/0x20d0 do_syscall_64+0x72/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e ================================================================== While reviewing the patch, Honza found that when adjusting resize_bg in alloc_flex_gd(), it was possible for flex_gd->resize_bg to be bigger than flexbg_size. The reproduction of the problem requires the following: o_group = flexbg_size * 2 * n; o_size = (o_group + 1) * group_size; n_group: [o_group + flexbg_size, o_group + flexbg_size * 2) o_size = (n_group + 1) * group_size; Take n=0,flexbg_size=16 as an example: last:15 |o---------------|--------------n-| o_group:0 resize to n_group:30 The corresponding reproducer is:
img=test.img rm -f $img truncate -s 600M $img mkfs.ext4 -F $img -b 1024 -G 16 8M dev=`losetup -f --show $img` mkdir -p /tmp/test mount $dev /tmp/test resize2fs $dev 248M Delete the problematic plus 1 to fix the issue, and add a WARN_ON_ONCE() to prevent the issue from happening again. [ Note: another reproucer which this commit fixes is: img=test.img rm -f $img truncate -s 25MiB $img mkfs.ext4 -b 4096 -E nodiscard,lazy_itable_init=0,lazy_journal_init=0 $img truncate -s 3GiB $img dev=`losetup -f --show $img` mkdir -p /tmp/test mount $dev /tmp/test resize2fs $dev 3G umount $dev losetup -d $dev -- TYT ] (CVE-2024-49880)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-49880
https://ubuntu.com/security/CVE-2024-49880

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-49880

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231941 - Linux Distros Unpatched Vulnerability : CVE-2024-50007
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: asihpi: Fix potential OOB array access ASIHPI driver stores some values in the static array upon a response from the driver, and its index depends on the firmware. We shouldn't trust it blindly. This patch adds a sanity check of the array index to fit in the array size. (CVE-2024-50007)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50007
https://ubuntu.com/security/CVE-2024-50007

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50007

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231372 - Linux Distros Unpatched Vulnerability : CVE-2024-50036
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: do not delay dst_entries_add() in dst_release() dst_entries_add() uses per-cpu data that might be freed at netns dismantle from ip6_route_net_exit() calling dst_entries_destroy() Before ip6_route_net_exit() can be called, we release all the dsts associated with this netns, via calls to dst_release(), which waits an rcu grace period before calling dst_destroy() dst_entries_add() use in dst_destroy() is racy, because dst_entries_destroy() could have been called already. Decrementing the number of dsts must happen sooner. Notes: 1) in CONFIG_XFRM case, dst_destroy() can call dst_release_immediate(child), this might also cause UAF if the child does not have DST_NOCOUNT set. IPSEC maintainers might take a look and see how to address this. 2) There is also discussion about removing this count of dst, which might happen in future kernels. (CVE-2024-50036)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50036
https://ubuntu.com/security/CVE-2024-50036

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50036

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231475 - Linux Distros Unpatched Vulnerability : CVE-2024-50042
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ice: Fix increasing MSI-X on VF Increasing MSI-X value on a VF leads to invalid memory operations. This is caused by not reallocating some arrays. Reproducer: modprobe ice echo 0 > /sys/bus/pci/devices/$PF_PCI/sriov_drivers_autoprobe echo 1 >
/sys/bus/pci/devices/$PF_PCI/sriov_numvfs echo 17 > /sys/bus/pci/devices/$VF0_PCI/sriov_vf_msix_count Default MSI-X is 16, so 17 and above triggers this issue. KASAN reports: BUG: KASAN: slab-out-of-bounds in ice_vsi_alloc_ring_stats+0x38d/0x4b0 [ice] Read of size 8 at addr ffff8888b937d180 by task bash/28433 (...) Call Trace: (...) ? ice_vsi_alloc_ring_stats+0x38d/0x4b0 [ice] kasan_report+0xed/0x120 ? ice_vsi_alloc_ring_stats+0x38d/0x4b0 [ice] ice_vsi_alloc_ring_stats+0x38d/0x4b0 [ice] ice_vsi_cfg_def+0x3360/0x4770 [ice] ? mutex_unlock+0x83/0xd0 ? __pfx_ice_vsi_cfg_def+0x10/0x10 [ice] ?
__pfx_ice_remove_vsi_lkup_fltr+0x10/0x10 [ice] ice_vsi_cfg+0x7f/0x3b0 [ice] ice_vf_reconfig_vsi+0x114/0x210 [ice] ice_sriov_set_msix_vec_count+0x3d0/0x960 [ice] sriov_vf_msix_count_store+0x21c/0x300 (...) Allocated by task 28201: (...) ice_vsi_cfg_def+0x1c8e/0x4770 [ice] ice_vsi_cfg+0x7f/0x3b0 [ice] ice_vsi_setup+0x179/0xa30 [ice] ice_sriov_configure+0xcaa/0x1520 [ice] sriov_numvfs_store+0x212/0x390 (...) To fix it, use ice_vsi_rebuild() instead of ice_vf_reconfig_vsi().
This causes the required arrays to be reallocated taking the new queue count into account (ice_vsi_realloc_stat_arrays()). Set req_txq and req_rxq before ice_vsi_rebuild(), so that realloc uses the newly set queue count. Additionally, ice_vsi_rebuild() does not remove VSI filters (ice_fltr_remove_all()), so ice_vf_init_host_cfg() is no longer necessary. (CVE-2024-50042)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50042
https://ubuntu.com/security/CVE-2024-50042

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50042

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231593 - Linux Distros Unpatched Vulnerability : CVE-2024-50063
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Prevent tail call between progs attached to different hooks bpf progs can be attached to kernel functions, and the attached functions can take different parameters or return different return values. If prog attached to one kernel function tail calls prog attached to another kernel function, the ctx access or return value verification could be bypassed. For example, if prog1 is attached to func1 which takes only 1 parameter and prog2 is attached to func2 which takes two parameters. Since verifier assumes the bpf ctx passed to prog2 is constructed based on func2's prototype, verifier allows prog2 to access the second parameter from the bpf ctx passed to it. The problem is that verifier does not prevent prog1 from passing its bpf ctx to prog2 via tail call. In this case, the bpf ctx passed to prog2 is constructed from func1 instead of func2, that is, the assumption for ctx access verification is bypassed. Another example, if BPF LSM prog1 is attached to hook file_alloc_security, and BPF LSM prog2 is attached to hook bpf_lsm_audit_rule_known. Verifier knows the return value rules for these two hooks, e.g. it is legal for bpf_lsm_audit_rule_known to return positive number 1, and it is illegal for file_alloc_security to return positive number. So verifier allows prog2 to return positive number 1, but does not allow prog1 to return positive number. The problem is that verifier does not prevent prog1 from calling prog2 via tail call. In this case, prog2's return value 1 will be used as the return value for prog1's hook file_alloc_security.
That is, the return value rule is bypassed. This patch adds restriction for tail call to prevent such bypasses. (CVE-2024-50063)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50063
https://security-tracker.debian.org/tracker/CVE-2024-50063
https://ubuntu.com/security/CVE-2024-50063

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
5.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:P/A:N)
CVSS v2.0 Temporal Score
4.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50063

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231398 - Linux Distros Unpatched Vulnerability : CVE-2024-50083
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tcp: fix mptcp DSS corruption due to large pmtu xmit Syzkaller was able to trigger a DSS corruption: TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. ------------[ cut here ]------------ WARNING: CPU: 0 PID:
5227 at net/mptcp/protocol.c:695 __mptcp_move_skbs_from_subflow+0x20a9/0x21f0 net/mptcp/protocol.c:695 Modules linked in: CPU: 0 UID: 0 PID: 5227 Comm: syz-executor350 Not tainted 6.11.0-syzkaller-08829-gaf9c191ac2a0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:__mptcp_move_skbs_from_subflow+0x20a9/0x21f0 net/mptcp/protocol.c:695 Code: 0f b6 dc 31 ff 89 de e8 b5 dd ea f5 89 d8 48 81 c4 50 01 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc e8 98 da ea f5 90 <0f> 0b 90 e9 47 ff ff ff e8 8a da ea f5 90 0f 0b 90 e9 99 e0 ff ff RSP:
0018:ffffc90000006db8 EFLAGS: 00010246 RAX: ffffffff8ba9df18 RBX: 00000000000055f0 RCX: ffff888030023c00 RDX: 0000000000000100 RSI: 00000000000081e5 RDI: 00000000000055f0 RBP: 1ffff110062bf1ae R08:
ffffffff8ba9cf12 R09: 1ffff110062bf1b8 R10: dffffc0000000000 R11: ffffed10062bf1b9 R12: 0000000000000000 R13: dffffc0000000000 R14: 00000000700cec61 R15: 00000000000081e5 FS: 000055556679c380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
0000000020287000 CR3: 0000000077892000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ>
move_skbs_to_msk net/mptcp/protocol.c:811 [inline] mptcp_data_ready+0x29c/0xa90 net/mptcp/protocol.c:854 subflow_data_ready+0x34a/0x920 net/mptcp/subflow.c:1490 tcp_data_queue+0x20fd/0x76c0 net/ipv4/tcp_input.c:5283 tcp_rcv_established+0xfba/0x2020 net/ipv4/tcp_input.c:6237 tcp_v4_do_rcv+0x96d/0xc70 net/ipv4/tcp_ipv4.c:1915 tcp_v4_rcv+0x2dc0/0x37f0 net/ipv4/tcp_ipv4.c:2350 ip_protocol_deliver_rcu+0x22e/0x440 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x341/0x5f0 net/ipv4/ip_input.c:233 NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314 NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314 __netif_receive_skb_one_core net/core/dev.c:5662 [inline]
__netif_receive_skb+0x2bf/0x650 net/core/dev.c:5775 process_backlog+0x662/0x15b0 net/core/dev.c:6107
__napi_poll+0xcb/0x490 net/core/dev.c:6771 napi_poll net/core/dev.c:6840 [inline] net_rx_action+0x89b/0x1240 net/core/dev.c:6962 handle_softirqs+0x2c5/0x980 kernel/softirq.c:554 do_softirq+0x11b/0x1e0 kernel/softirq.c:455 </IRQ> <TASK> __local_bh_enable_ip+0x1bb/0x200 kernel/softirq.c:382 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:919 [inline] __dev_queue_xmit+0x1764/0x3e80 net/core/dev.c:4451 dev_queue_xmit include/linux/netdevice.h:3094 [inline] neigh_hh_output include/net/neighbour.h:526 [inline] neigh_output include/net/neighbour.h:540 [inline] ip_finish_output2+0xd41/0x1390 net/ipv4/ip_output.c:236 ip_local_out net/ipv4/ip_output.c:130 [inline] __ip_queue_xmit+0x118c/0x1b80 net/ipv4/ip_output.c:536
__tcp_transmit_skb+0x2544/0x3b30 net/ipv4/tcp_output.c:1466 tcp_transmit_skb net/ipv4/tcp_output.c:1484 [inline] tcp_mtu_probe net/ipv4/tcp_output.c:2547 [inline] tcp_write_xmit+0x641d/0x6bf0 net/ipv4/tcp_output.c:2752 __tcp_push_pending_frames+0x9b/0x360 net/ipv4/tcp_output.c:3015 tcp_push_pending_frames include/net/tcp.h:2107 [inline] tcp_data_snd_check net/ipv4/tcp_input.c:5714 [inline] tcp_rcv_established+0x1026/0x2020 net/ipv4/tcp_input.c:6239 tcp_v4_do_rcv+0x96d/0xc70 net/ipv4/tcp_ipv4.c:1915 sk_backlog_rcv include/net/sock.h:1113 [inline] __release_sock+0x214/0x350 net/core/sock.c:3072 release_sock+0x61/0x1f0 net/core/sock.c:3626 mptcp_push_ ---truncated--- (CVE-2024-50083)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50083
https://ubuntu.com/security/CVE-2024-50083

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0022
CVSS v2.0 Base Score
8.5 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
7.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50083

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230326 - Linux Distros Unpatched Vulnerability : CVE-2024-50114
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Unregister redistributor for failed vCPU creation Alex reports that syzkaller has managed to trigger a use-after-free when tearing down a VM: BUG: KASAN: slab-use-after-free in kvm_put_kvm+0x300/0xe68 virt/kvm/kvm_main.c:5769 Read of size 8 at addr ffffff801c6890d0 by task syz.3.2219/10758 CPU: 3 UID: 0 PID: 10758 Comm: syz.3.2219 Not tainted 6.11.0-rc6-dirty #64 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x17c/0x1a8 arch/arm64/kernel/stacktrace.c:317 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x94/0xc0 lib/dump_stack.c:119 print_report+0x144/0x7a4 mm/kasan/report.c:377 kasan_report+0xcc/0x128 mm/kasan/report.c:601 __asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381 kvm_put_kvm+0x300/0xe68 virt/kvm/kvm_main.c:5769 kvm_vm_release+0x4c/0x60 virt/kvm/kvm_main.c:1409 __fput+0x198/0x71c fs/file_table.c:422 ____fput+0x20/0x30 fs/file_table.c:450 task_work_run+0x1cc/0x23c kernel/task_work.c:228 do_notify_resume+0x144/0x1a0 include/linux/resume_user_mode.h:50 el0_svc+0x64/0x68 arch/arm64/kernel/entry-common.c:169 el0t_64_sync_handler+0x90/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 Upon closer inspection, it appears that we do not properly tear down the MMIO registration for a vCPU that fails creation late in the game, e.g. a vCPU w/ the same ID already exists in the VM. It is important to consider the context of commit that introduced this bug by moving the unregistration out of __kvm_vgic_vcpu_destroy(). That change correctly sought to avoid an srcu v.
config_lock inversion by breaking up the vCPU teardown into two parts, one guarded by the config_lock. Fix the use-after-free while avoiding lock inversion by adding a special-cased unregistration to
__kvm_vgic_vcpu_destroy(). This is safe because failed vCPUs are torn down outside of the config_lock.
(CVE-2024-50114)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50114
https://ubuntu.com/security/CVE-2024-50114

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-50114

Plugin Information
Published: 2025/03/06, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231640 - Linux Distros Unpatched Vulnerability : CVE-2024-50131
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tracing: Consider the NULL character when validating the event length strlen() returns a string length excluding the null byte. If the string length equals to the maximum buffer length, the buffer will have no space for the NULL terminating character. This commit checks this condition and returns failure for it. (CVE-2024-50131)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50131
https://ubuntu.com/security/CVE-2024-50131

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50131

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231550 - Linux Distros Unpatched Vulnerability : CVE-2024-50155
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: netdevsim: use cond_resched() in nsim_dev_trap_report_work() I am still seeing many syzbot reports hinting that syzbot might fool nsim_dev_trap_report_work() with hundreds of ports [1] Lets use cond_resched(), and system_unbound_wq instead of implicit system_wq. [1] INFO: task syz-executor:20633 blocked for more than 143 seconds. Not tainted 6.12.0-rc2-syzkaller-00205-g1d227fcc7222 #0 echo 0 > /proc/sys/kernel/hung_task_timeout_secs disables this message. task:syz-executor state:D stack:25856 pid:20633 tgid:20633 ppid:1 flags:0x00004006 ... NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 16760 Comm: kworker/1:0 Not tainted 6.12.0-rc2-syzkaller-00205-g1d227fcc7222 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: events nsim_dev_trap_report_work RIP:
0010:__sanitizer_cov_trace_pc+0x0/0x70 kernel/kcov.c:210 Code: 89 fb e8 23 00 00 00 48 8b 3d 04 fb 9c 0c 48 89 de 5b e9 c3 c7 5d 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 48 8b 04 24 65 48 8b 0c 25 c0 d7 03 00 65 8b 15 60 f0 RSP: 0018:ffffc90000a187e8 EFLAGS: 00000246 RAX:
0000000000000100 RBX: ffffc90000a188e0 RCX: ffff888027d3bc00 RDX: ffff888027d3bc00 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff88804a2e6000 R08: ffffffff8a4bc495 R09: ffffffff89da3577 R10:
0000000000000004 R11: ffffffff8a4bc2b0 R12: dffffc0000000000 R13: ffff88806573b503 R14: dffffc0000000000 R15: ffff8880663cca00 FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc90a747f98 CR3: 000000000e734000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 000000000000002b DR2: 0000000000000000 DR3: 0000000000000000 DR6:
00000000ffff0ff0 DR7: 0000000000000400 Call Trace: <NMI> </NMI> <TASK> __local_bh_enable_ip+0x1bb/0x200 kernel/softirq.c:382 spin_unlock_bh include/linux/spinlock.h:396 [inline] nsim_dev_trap_report drivers/net/netdevsim/dev.c:820 [inline] nsim_dev_trap_report_work+0x75d/0xaa0 drivers/net/netdevsim/dev.c:850 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>
(CVE-2024-50155)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50155
https://ubuntu.com/security/CVE-2024-50155

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50155

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231234 - Linux Distros Unpatched Vulnerability : CVE-2024-50158
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix out of bound check Driver exports pacing stats only on GenP5 and P7 adapters. But while parsing the pacing stats, driver has a check for rdev->dbr_pacing. This caused a trace when KASAN is enabled. BUG: KASAN: slab-out-of-bounds in bnxt_re_get_hw_stats+0x2b6a/0x2e00 [bnxt_re] Write of size 8 at addr ffff8885942a6340 by task modprobe/4809 (CVE-2024-50158)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50158
https://ubuntu.com/security/CVE-2024-50158

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50158

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231387 - Linux Distros Unpatched Vulnerability : CVE-2024-50164
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Fix overloading of MEM_UNINIT's meaning Lonial reported an issue in the BPF verifier where check_mem_size_reg() has the following code: if (!tnum_is_const(reg->var_off)) /* For unprivileged variable accesses, disable raw * mode so that the program is required to * initialize all the memory that the helper could * just partially fill up. */ meta = NULL; This means that writes are not checked when the register containing the size of the passed buffer has not a fixed size. Through this bug, a BPF program can write to a map which is marked as read-only, for example, .rodata global maps. The problem is that MEM_UNINIT's initial meaning that the passed buffer to the BPF helper does not need to be initialized which was added back in commit 435faee1aae9 (bpf, verifier: add ARG_PTR_TO_RAW_STACK type) got overloaded over time with the passed buffer is being written to. The problem however is that checks such as the above which were added later via 06c1c049721a (bpf: allow helpers access to variable memory) set meta to NULL in order force the user to always initialize the passed buffer to the helper. Due to the current double meaning of MEM_UNINIT, this bypasses verifier write checks to the memory (not boundary checks though) and only assumes the latter memory is read instead. Fix this by reverting MEM_UNINIT back to its original meaning, and having MEM_WRITE as an annotation to BPF helpers in order to then trigger the BPF verifier checks for writing to memory. Some notes: check_arg_pair_ok() ensures that for ARG_CONST_SIZE{,_OR_ZERO} we can access fn->arg_type[arg - 1] since it must contain a preceding ARG_PTR_TO_MEM. For check_mem_reg() the meta argument can be removed altogether since we do check both BPF_READ and BPF_WRITE. Same for the equivalent check_kfunc_mem_size_reg(). (CVE-2024-50164)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50164
https://ubuntu.com/security/CVE-2024-50164

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0004
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50164

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231403 - Linux Distros Unpatched Vulnerability : CVE-2024-50209
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Add a check for memory allocation __alloc_pbl() can return error when memory allocation fails. Driver is not checking the status on one of the instances. (CVE-2024-50209)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50209
https://ubuntu.com/security/CVE-2024-50209

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50209

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230429 - Linux Distros Unpatched Vulnerability : CVE-2024-50250
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: fsdax: dax_unshare_iter needs to copy entire blocks The code that copies data from srcmap to iomap in dax_unshare_iter is very very broken, which bfoster's recent fsx changes have exposed. If the pos and len passed to dax_file_unshare are not aligned to an fsblock boundary, the iter pos and length in the _iter function will reflect this unalignment. dax_iomap_direct_access always returns a pointer to the start of the kmapped fsdax page, even if its pos argument is in the middle of that page. This is catastrophic for data integrity when iter->pos is not aligned to a page, because daddr/saddr do not point to the same byte in the file as iter->pos.
Hence we corrupt user data by copying it to the wrong place. If iter->pos + iomap_length() in the _iter function not aligned to a page, then we fail to copy a full block, and only partially populate the destination block. This is catastrophic for data confidentiality because we expose stale pmem contents.
Fix both of these issues by aligning copy_pos/copy_len to a page boundary (remember, this is fsdax so 1 fsblock == 1 base page) so that we always copy full blocks. We're not done yet -- there's no call to invalidate_inode_pages2_range, so programs that have the file range mmap'd will continue accessing the old memory mapping after the file metadata updates have completed. Be careful with the return value -- if the unshare succeeds, we still need to return the number of bytes that the iomap iter thinks we're operating on. (CVE-2024-50250)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50250
https://ubuntu.com/security/CVE-2024-50250

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:N)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50250

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231688 - Linux Distros Unpatched Vulnerability : CVE-2024-50267
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- USB: serial: io_edgeport: fix use after free in debug printk The dev_dbg(&urb->dev->dev, ... which happens after usb_free_urb(urb) is a use after free of the urb pointer. Store the dev pointer at the start of the function to avoid this issue. (CVE-2024-50267)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50267
https://ubuntu.com/security/CVE-2024-50267

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50267

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231743 - Linux Distros Unpatched Vulnerability : CVE-2024-50268
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() The *cmd variable can be controlled by the user via debugfs.
That means new_cam can be as high as 255 while the size of the uc->updated[] array is UCSI_MAX_ALTMODES (30). The call tree is: ucsi_cmd() // val comes from simple_attr_write_xsigned() -> ucsi_send_command() ->
ucsi_send_command_common() -> ucsi_run_command() // calls ucsi->ops->sync_control() ->
ucsi_ccg_sync_control() (CVE-2024-50268)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50268
https://ubuntu.com/security/CVE-2024-50268

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0004
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50268

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231170 - Linux Distros Unpatched Vulnerability : CVE-2024-50274
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: idpf: avoid vport access in idpf_get_link_ksettings When the device control plane is removed or the platform running device control plane is rebooted, a reset is detected on the driver. On driver reset, it releases the resources and waits for the reset to complete. If the reset fails, it takes the error path and releases the vport lock. At this time if the monitoring tools tries to access link settings, it call traces for accessing released vport pointer. To avoid it, move link_speed_mbps to netdev_priv structure which removes the dependency on vport pointer and the vport lock in idpf_get_link_ksettings. Also use netif_carrier_ok() to check the link status and adjust the offsetof to use link_up instead of link_speed_mbps. (CVE-2024-50274)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50274
https://ubuntu.com/security/CVE-2024-50274

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50274

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231857 - Linux Distros Unpatched Vulnerability : CVE-2024-50279
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dm cache: fix out-of-bounds access to the dirty bitset when resizing dm-cache checks the dirty bits of the cache blocks to be dropped when shrinking the fast device, but an index bug in bitset iteration causes out-of-bounds access. Reproduce steps: 1. create a cache device of 1024 cache blocks (128 bytes dirty bitset) dmsetup create cmeta --table 0 8192 linear /dev/sdc 0 dmsetup create cdata --table 0 131072 linear /dev/sdc 8192 dmsetup create corig --table 0 524288 linear /dev/sdc 262144 dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table 0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0 2. shrink the fast device to 512 cache blocks, triggering out-of-bounds access to the dirty bitset (offset 0x80) dmsetup suspend cache dmsetup reload cdata --table 0 65536 linear /dev/sdc 8192 dmsetup resume cdata dmsetup resume cache KASAN reports: BUG: KASAN: vmalloc-out-of-bounds in cache_preresume+0x269/0x7b0 Read of size 8 at addr ffffc900000f3080 by task dmsetup/131 (...snip...) The buggy address belongs to the virtual mapping at [ffffc900000f3000, ffffc900000f5000) created by: cache_ctr+0x176a/0x35f0 (...snip...) Memory state around the buggy address: ffffc900000f2f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900000f3000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc900000f3080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc900000f3100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900000f3180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 Fix by making the index post- incremented. (CVE-2024-50279)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50279
https://ubuntu.com/security/CVE-2024-50279

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0004
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50279

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231362 - Linux Distros Unpatched Vulnerability : CVE-2024-50280
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dm cache: fix flushing uninitialized delayed_work on cache_ctr error An unexpected WARN_ON from flush_work() may occur when cache creation fails, caused by destroying the uninitialized delayed_work waker in the error path of cache_create(). For example, the warning appears on the superblock checksum error. Reproduce steps: dmsetup create cmeta --table 0 8192 linear /dev/sdc 0 dmsetup create cdata
--table 0 65536 linear /dev/sdc 8192 dmsetup create corig --table 0 524288 linear /dev/sdc 262144 dd if=/dev/urandom of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table 0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0 Kernel logs: (snip) WARNING: CPU: 0 PID: 84 at kernel/workqueue.c:4178 __flush_work+0x5d4/0x890 Fix by pulling out the cancel_delayed_work_sync() from the constructor's error path. This patch doesn't affect the use- after-free fix for concurrent dm_resume and dm_destroy (commit 6a459d8edbdb (dm cache: Fix UAF in destroy())) as cache_dtr is not changed. (CVE-2024-50280)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50280
https://ubuntu.com/security/CVE-2024-50280

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50280

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230523 - Linux Distros Unpatched Vulnerability : CVE-2024-5290
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user that wpa_supplicant runs as (usually root). Membership in the netdev group or access to the dbus interface of wpa_supplicant allow an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa_supplicant process;
other escalation paths might exist. (CVE-2024-5290)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-5290

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0005
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-5290

Plugin Information
Published: 2025/03/06, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- wpa_supplicant
231853 - Linux Distros Unpatched Vulnerability : CVE-2024-53099
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Check validity of link->type in bpf_link_show_fdinfo() If a newly-added link type doesn't invoke BPF_LINK_TYPE(), accessing bpf_link_type_strs[link->type] may result in an out-of-bounds access. To spot such missed invocations early in the future, checking the validity of link->type in bpf_link_show_fdinfo() and emitting a warning when such invocations are missed. (CVE-2024-53099)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53099
https://ubuntu.com/security/CVE-2024-53099

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53099

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231831 - Linux Distros Unpatched Vulnerability : CVE-2024-53147
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- exfat: fix out-of-bounds access of directory entries In the case of the directory size is greater than or equal to the cluster size, if start_clu becomes an EOF cluster(an invalid cluster) due to file system corruption, then the directory entry where ei->hint_femp.eidx hint is outside the directory, resulting in an out-of-bounds access, which may cause further file system corruption. This commit adds a check for start_clu, if it is an invalid cluster, the file or directory will be treated as empty. (CVE-2024-53147)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53147
https://security-tracker.debian.org/tracker/CVE-2024-53147
https://ubuntu.com/security/CVE-2024-53147

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53147

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230648 - Linux Distros Unpatched Vulnerability : CVE-2024-53168
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket BUG: KASAN: slab-use-after-free in tcp_write_timer_handler+0x156/0x3e0 Read of size 1 at addr ffff888111f322cd by task swapper/0/0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc4-dirty #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 Call Trace: <IRQ> dump_stack_lvl+0x68/0xa0 print_address_description.constprop.0+0x2c/0x3d0 print_report+0xb4/0x270 kasan_report+0xbd/0xf0 tcp_write_timer_handler+0x156/0x3e0 tcp_write_timer+0x66/0x170 call_timer_fn+0xfb/0x1d0
__run_timers+0x3f8/0x480 run_timer_softirq+0x9b/0x100 handle_softirqs+0x153/0x390
__irq_exit_rcu+0x103/0x120 irq_exit_rcu+0xe/0x20 sysvec_apic_timer_interrupt+0x76/0x90 </IRQ> <TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:default_idle+0xf/0x20 Code: 4c 01 c7 4c 29 c2 e9 72 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 f8 25 00 fb f4 <fa> c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 RSP: 0018:ffffffffa2007e28 EFLAGS: 00000242 RAX: 00000000000f3b31 RBX: 1ffffffff4400fc7 RCX: ffffffffa09c3196 RDX: 0000000000000000 RSI:
0000000000000000 RDI: ffffffff9f00590f RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed102360835d R10: ffff88811b041aeb R11: 0000000000000001 R12: 0000000000000000 R13: ffffffffa202d7c0 R14:
0000000000000000 R15: 00000000000147d0 default_idle_call+0x6b/0xa0 cpuidle_idle_call+0x1af/0x1f0 do_idle+0xbc/0x130 cpu_startup_entry+0x33/0x40 rest_init+0x11f/0x210 start_kernel+0x39a/0x420 x86_64_start_reservations+0x18/0x30 x86_64_start_kernel+0x97/0xa0 common_startup_64+0x13e/0x141 </TASK>
Allocated by task 595: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x87/0x90 kmem_cache_alloc_noprof+0x12b/0x3f0 copy_net_ns+0x94/0x380 create_new_namespaces+0x24c/0x500 unshare_nsproxy_namespaces+0x75/0xf0 ksys_unshare+0x24e/0x4f0 __x64_sys_unshare+0x1f/0x30 do_syscall_64+0x70/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 100:
kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x54/0x70 kmem_cache_free+0x156/0x5d0 cleanup_net+0x5d3/0x670 process_one_work+0x776/0xa90 worker_thread+0x2e2/0x560 kthread+0x1a8/0x1f0 ret_from_fork+0x34/0x60 ret_from_fork_asm+0x1a/0x30 Reproduction script: mkdir -p /mnt/nfsshare mkdir -p /mnt/nfs/netns_1 mkfs.ext4 /dev/sdb mount /dev/sdb /mnt/nfsshare systemctl restart nfs-server chmod 777 /mnt/nfsshare exportfs -i -o rw,no_root_squash *:/mnt/nfsshare ip netns add netns_1 ip link add name veth_1_peer type veth peer veth_1 ifconfig veth_1_peer 11.11.0.254 up ip link set veth_1 netns netns_1 ip netns exec netns_1 ifconfig veth_1 11.11.0.1 ip netns exec netns_1 /root/iptables -A OUTPUT -d 11.11.0.254 -p tcp \
--tcp-flags FIN FIN -j DROP (note: In my environment, a DESTROY_CLIENTID operation is always sent immediately, breaking the nfs tcp connection.) ip netns exec netns_1 timeout -s 9 300 mount -t nfs -o proto=tcp,vers=4.1 \ 11.11.0.254:/mnt/nfsshare /mnt/nfs/netns_1 ip netns del netns_1 The reason here is that the tcp socket in netns_1 (nfs side) has been shutdown and closed (done in xs_destroy), but the FIN message (with ack) is discarded, and the nfsd side keeps sending retransmission messages. As a result, when the tcp sock in netns_1 processes the received message, it sends the message (FIN message) in the sending queue, and the tcp timer is re-established. When the network namespace is deleted, the net structure accessed by tcp's timer handler function causes problems. To fix this problem, let's hold netns refcnt for the tcp kernel socket as done in other modules. This is an ugly hack which can easily be backported to earlier kernels. A proper fix which cleans up the interfaces will follow, but may not be so easy to backport. (CVE-2024-53168)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53168
https://security-tracker.debian.org/tracker/CVE-2024-53168
https://ubuntu.com/security/CVE-2024-53168

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53168

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230968 - Linux Distros Unpatched Vulnerability : CVE-2024-53177
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smb: prevent use-after-free due to open_cached_dir error paths If open_cached_dir() encounters an error parsing the lease from the server, the error handling may race with receiving a lease break, resulting in open_cached_dir() freeing the cfid while the queued work is pending. Update open_cached_dir() to drop refs rather than directly freeing the cfid. Have cached_dir_lease_break(), cfids_laundromat_worker(), and invalidate_all_cached_dirs() clear has_lease immediately while still holding cfids->cfid_list_lock, and then use this to also simplify the reference counting in cfids_laundromat_worker() and invalidate_all_cached_dirs(). Fixes this KASAN splat (which manually injects an error and lease break in open_cached_dir()): ================================================================== BUG: KASAN: slab- use-after-free in smb2_cached_lease_break+0x27/0xb0 Read of size 8 at addr ffff88811cc24c10 by task kworker/3:1/65 CPU: 3 UID: 0 PID: 65 Comm: kworker/3:1 Not tainted 6.12.0-rc6-g255cf264e6e5-dirty #87 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 Workqueue: cifsiod smb2_cached_lease_break Call Trace: <TASK> dump_stack_lvl+0x77/0xb0 print_report+0xce/0x660 kasan_report+0xd3/0x110 smb2_cached_lease_break+0x27/0xb0 process_one_work+0x50a/0xc50 worker_thread+0x2ba/0x530 kthread+0x17c/0x1c0 ret_from_fork+0x34/0x60 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 2464: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 open_cached_dir+0xa7d/0x1fb0 smb2_query_path_info+0x43c/0x6e0 cifs_get_fattr+0x346/0xf10 cifs_get_inode_info+0x157/0x210 cifs_revalidate_dentry_attr+0x2d1/0x460 cifs_getattr+0x173/0x470 vfs_statx_path+0x10f/0x160 vfs_statx+0xe9/0x150 vfs_fstatat+0x5e/0xc0 __do_sys_newfstatat+0x91/0xf0 do_syscall_64+0x95/0x1a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 2464: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x51/0x70 kfree+0x174/0x520 open_cached_dir+0x97f/0x1fb0 smb2_query_path_info+0x43c/0x6e0 cifs_get_fattr+0x346/0xf10 cifs_get_inode_info+0x157/0x210 cifs_revalidate_dentry_attr+0x2d1/0x460 cifs_getattr+0x173/0x470 vfs_statx_path+0x10f/0x160 vfs_statx+0xe9/0x150 vfs_fstatat+0x5e/0xc0 __do_sys_newfstatat+0x91/0xf0 do_syscall_64+0x95/0x1a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Last potentially related work creation:
kasan_save_stack+0x33/0x60 __kasan_record_aux_stack+0xad/0xc0 insert_work+0x32/0x100
__queue_work+0x5c9/0x870 queue_work_on+0x82/0x90 open_cached_dir+0x1369/0x1fb0 smb2_query_path_info+0x43c/0x6e0 cifs_get_fattr+0x346/0xf10 cifs_get_inode_info+0x157/0x210 cifs_revalidate_dentry_attr+0x2d1/0x460 cifs_getattr+0x173/0x470 vfs_statx_path+0x10f/0x160 vfs_statx+0xe9/0x150 vfs_fstatat+0x5e/0xc0 __do_sys_newfstatat+0x91/0xf0 do_syscall_64+0x95/0x1a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The buggy address belongs to the object at ffff88811cc24c00 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 16 bytes inside of freed 1024-byte region [ffff88811cc24c00, ffff88811cc25000) (CVE-2024-53177)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53177
https://security-tracker.debian.org/tracker/CVE-2024-53177
https://ubuntu.com/security/CVE-2024-53177

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53177

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230583 - Linux Distros Unpatched Vulnerability : CVE-2024-53179
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smb: client: fix use-after-free of signing key Customers have reported use-after-free in @ses->auth_key.response with SMB2.1 + sign mounts which occurs due to following race: task A task B cifs_mount() dfs_mount_share() get_session() cifs_mount_get_session() cifs_send_recv() cifs_get_smb_ses() compound_send_recv() cifs_setup_session() smb2_setup_request() kfree_sensitive() smb2_calc_signature() crypto_shash_setkey() *UAF* Fix this by ensuring that we have a valid @ses->auth_key.response by checking whether @ses->ses_status is SES_GOOD or SES_EXITING with @ses->ses_lock held. After commit 24a9799aa8ef (smb: client: fix UAF in smb2_reconnect_server()), we made sure to call ->logoff() only when @ses was known to be good (e.g. valid ->auth_key.response), so it's safe to access signing key when @ses->ses_status == SES_EXITING. (CVE-2024-53179)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53179
https://security-tracker.debian.org/tracker/CVE-2024-53179
https://ubuntu.com/security/CVE-2024-53179

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53179

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230745 - Linux Distros Unpatched Vulnerability : CVE-2024-53206
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tcp: Fix use-after-free of nreq in reqsk_timer_handler(). The cited commit replaced inet_csk_reqsk_queue_drop_and_put() with
__inet_csk_reqsk_queue_drop() and reqsk_put() in reqsk_timer_handler(). Then, oreq should be passed to reqsk_put() instead of req; otherwise use-after-free of nreq could happen when reqsk is migrated but the retry attempt failed (e.g. due to timeout). Let's pass oreq to reqsk_put(). (CVE-2024-53206)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53206
https://ubuntu.com/security/CVE-2024-53206

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53206

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231815 - Linux Distros Unpatched Vulnerability : CVE-2024-53214
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vfio/pci: Properly hide first-in-list PCIe extended capability There are cases where a PCIe extended capability should be hidden from the user. For example, an unknown capability (i.e., capability with ID greater than PCI_EXT_CAP_ID_MAX) or a capability that is intentionally chosen to be hidden from the user.
Hiding a capability is done by virtualizing and modifying the 'Next Capability Offset' field of the previous capability so it points to the capability after the one that should be hidden. The special case where the first capability in the list should be hidden is handled differently because there is no previous capability that can be modified. In this case, the capability ID and version are zeroed while leaving the next pointer intact. This hides the capability and leaves an anchor for the rest of the capability list. However, today, hiding the first capability in the list is not done properly if the capability is unknown, as struct vfio_pci_core_device->pci_config_map is set to the capability ID during initialization but the capability ID is not properly checked later when used in vfio_config_do_rw(). This leads to the following warning [1] and to an out-of-bounds access to ecap_perms array. Fix it by checking cap_id in vfio_config_do_rw(), and if it is greater than PCI_EXT_CAP_ID_MAX, use an alternative struct perm_bits for direct read only access instead of the ecap_perms array. Note that this is safe since the above is the only case where cap_id can exceed PCI_EXT_CAP_ID_MAX (except for the special capabilities, which are already checked before). [1] WARNING: CPU: 118 PID: 5329 at drivers/vfio/pci/vfio_pci_config.c:1900 vfio_pci_config_rw+0x395/0x430 [vfio_pci_core] CPU: 118 UID: 0 PID: 5329 Comm: simx-qemu-syste Not tainted 6.12.0+ #1 (snip) Call Trace: <TASK> ? show_regs+0x69/0x80 ?
__warn+0x8d/0x140 ? vfio_pci_config_rw+0x395/0x430 [vfio_pci_core] ? report_bug+0x18f/0x1a0 ? handle_bug+0x63/0xa0 ? exc_invalid_op+0x19/0x70 ? asm_exc_invalid_op+0x1b/0x20 ? vfio_pci_config_rw+0x395/0x430 [vfio_pci_core] ? vfio_pci_config_rw+0x244/0x430 [vfio_pci_core] vfio_pci_rw+0x101/0x1b0 [vfio_pci_core] vfio_pci_core_read+0x1d/0x30 [vfio_pci_core] vfio_device_fops_read+0x27/0x40 [vfio] vfs_read+0xbd/0x340 ? vfio_device_fops_unl_ioctl+0xbb/0x740 [vfio] ? __rseq_handle_notify_resume+0xa4/0x4b0 __x64_sys_pread64+0x96/0xc0 x64_sys_call+0x1c3d/0x20d0 do_syscall_64+0x4d/0x120 entry_SYSCALL_64_after_hwframe+0x76/0x7e (CVE-2024-53214)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53214
https://ubuntu.com/security/CVE-2024-53214

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0005
CVSS v2.0 Base Score
3.2 (CVSS2#AV:L/AC:L/Au:S/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
2.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53214

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247715 - Linux Distros Unpatched Vulnerability : CVE-2024-53225
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix alignment failure at max_n_shift When configuring a kernel with PAGE_SIZE=4KB, depending on its setting of CONFIG_CMA_ALIGNMENT, VCMDQ_LOG2SIZE_MAX=19 could fail the alignment test and trigger a WARN_ON: WARNING:
at drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c:3646 Call trace: arm_smmu_init_one_queue+0x15c/0x210 tegra241_cmdqv_init_structures+0x114/0x338 arm_smmu_device_probe+0xb48/0x1d90 Fix it by capping max_n_shift to CMDQ_MAX_SZ_SHIFT as SMMUv3 CMDQ does. (CVE-2024-53225)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53225
https://ubuntu.com/security/CVE-2024-53225

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-53225

Plugin Information
Published: 2025/08/10, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231360 - Linux Distros Unpatched Vulnerability : CVE-2024-53239
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: 6fire: Release resources at card release The current 6fire code tries to release the resources right after the call of usb6fire_chip_abort(). But at this moment, the card object might be still in use (as we're calling snd_card_free_when_closed()). For avoid potential UAFs, move the release of resources to the card's private_free instead of the manual call of usb6fire_chip_destroy() at the USB disconnect callback.
(CVE-2024-53239)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53239
https://ubuntu.com/security/CVE-2024-53239

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53239

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230951 - Linux Distros Unpatched Vulnerability : CVE-2024-56609
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb When removing kernel modules by: rmmod rtw88_8723cs rtw88_8703b rtw88_8723x rtw88_sdio rtw88_core Driver uses skb_queue_purge() to purge TX skb, but not report tx status causing Have pending ack frames! warning. Use ieee80211_purge_tx_queue() to correct this. Since ieee80211_purge_tx_queue() doesn't take locks, to prevent racing between TX work and purge TX queue, flush and destroy TX work in advance. wlan0: deauthenticating from aa:f5:fd:60:4c:a8 by local choice (Reason: 3=DEAUTH_LEAVING) ------------[ cut here ]------------ Have pending ack frames! WARNING: CPU: 3 PID: 9232 at net/mac80211/main.c:1691 ieee80211_free_ack_frame+0x5c/0x90 [mac80211] CPU: 3 PID: 9232 Comm: rmmod Tainted: G C 6.10.1-200.fc40.aarch64 #1 Hardware name: pine64 Pine64 PinePhone Braveheart (1.1)/Pine64 PinePhone Braveheart (1.1), BIOS 2024.01 01/01/2024 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ieee80211_free_ack_frame+0x5c/0x90 [mac80211] lr :
ieee80211_free_ack_frame+0x5c/0x90 [mac80211] sp : ffff80008c1b37b0 x29: ffff80008c1b37b0 x28:
ffff000003be8000 x27: 0000000000000000 x26: 0000000000000000 x25: ffff000003dc14b8 x24: ffff80008c1b37d0 x23: ffff000000ff9f80 x22: 0000000000000000 x21: 000000007fffffff x20: ffff80007c7e93d8 x19:
ffff00006e66f400 x18: 0000000000000000 x17: ffff7ffffd2b3000 x16: ffff800083fc0000 x15: 0000000000000000 x14: 0000000000000000 x13: 2173656d61726620 x12: 6b636120676e6964 x11: 0000000000000000 x10:
000000000000005d x9 : ffff8000802af2b0 x8 : ffff80008c1b3430 x7 : 0000000000000001 x6 : 0000000000000001 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 :
0000000000000000 x0 : ffff000003be8000 Call trace: ieee80211_free_ack_frame+0x5c/0x90 [mac80211] idr_for_each+0x74/0x110 ieee80211_free_hw+0x44/0xe8 [mac80211] rtw_sdio_remove+0x9c/0xc0 [rtw88_sdio] sdio_bus_remove+0x44/0x180 device_remove+0x54/0x90 device_release_driver_internal+0x1d4/0x238 driver_detach+0x54/0xc0 bus_remove_driver+0x78/0x108 driver_unregister+0x38/0x78 sdio_unregister_driver+0x2c/0x40 rtw_8723cs_driver_exit+0x18/0x1000 [rtw88_8723cs]
__do_sys_delete_module.isra.0+0x190/0x338 __arm64_sys_delete_module+0x1c/0x30 invoke_syscall+0x74/0x100 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x3c/0x158 el0t_64_sync_handler+0x120/0x138 el0t_64_sync+0x194/0x198 ---[ end trace 0000000000000000 ]--- (CVE-2024-56609)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56609
https://security-tracker.debian.org/tracker/CVE-2024-56609
https://ubuntu.com/security/CVE-2024-56609

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56609

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230557 - Linux Distros Unpatched Vulnerability : CVE-2024-56615
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf: fix OOB devmap writes when deleting elements Jordy reported issue against XSKMAP which also applies to DEVMAP - the index used for accessing map entry, due to being a signed integer, causes the OOB writes. Fix is simple as changing the type from int to u32, however, when compared to XSKMAP case, one more thing needs to be addressed. When map is released from system via dev_map_free(), we iterate through all of the entries and an iterator variable is also an int, which implies OOB accesses. Again, change it to be u32. Example splat below: [ 160.724676] BUG: unable to handle page fault for address: ffffc8fc2c001000 [ 160.731662] #PF: supervisor read access in kernel mode [ 160.736876] #PF: error_code(0x0000) - not-present page [ 160.742095] PGD 0 P4D 0 [ 160.744678] Oops: Oops: 0000 [#1] PREEMPT SMP [ 160.749106] CPU: 1 UID: 0 PID: 520 Comm:
kworker/u145:12 Not tainted 6.12.0-rc1+ #487 [ 160.757050] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [ 160.767642] Workqueue:
events_unbound bpf_map_free_deferred [ 160.773308] RIP: 0010:dev_map_free+0x77/0x170 [ 160.777735] Code:
00 e8 fd 91 ed ff e8 b8 73 ed ff 41 83 7d 18 19 74 6e 41 8b 45 24 49 8b bd f8 00 00 00 31 db 85 c0 74 48 48 63 c3 48 8d 04 c7 <48> 8b 28 48 85 ed 74 30 48 8b 7d 18 48 85 ff 74 05 e8 b3 52 fa ff [ 160.796777] RSP: 0018:ffffc9000ee1fe38 EFLAGS: 00010202 [ 160.802086] RAX: ffffc8fc2c001000 RBX: 0000000080000000 RCX:
0000000000000024 [ 160.809331] RDX: 0000000000000000 RSI: 0000000000000024 RDI: ffffc9002c001000 [ 160.816576] RBP: 0000000000000000 R08: 0000000000000023 R09: 0000000000000001 [ 160.823823] R10:
0000000000000001 R11: 00000000000ee6b2 R12: dead000000000122 [ 160.831066] R13: ffff88810c928e00 R14:
ffff8881002df405 R15: 0000000000000000 [ 160.838310] FS: 0000000000000000(0000) GS:ffff8897e0c40000(0000) knlGS:0000000000000000 [ 160.846528] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 160.852357] CR2:
ffffc8fc2c001000 CR3: 0000000005c32006 CR4: 00000000007726f0 [ 160.859604] DR0: 0000000000000000 DR1:
0000000000000000 DR2: 0000000000000000 [ 160.866847] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400 [ 160.874092] PKRU: 55555554 [ 160.876847] Call Trace: [ 160.879338] <TASK> [ 160.881477] ? __die+0x20/0x60 [ 160.884586] ? page_fault_oops+0x15a/0x450 [ 160.888746] ? search_extable+0x22/0x30 [ 160.892647] ? search_bpf_extables+0x5f/0x80 [ 160.896988] ? exc_page_fault+0xa9/0x140 [ 160.900973] ? asm_exc_page_fault+0x22/0x30 [ 160.905232] ? dev_map_free+0x77/0x170 [ 160.909043] ? dev_map_free+0x58/0x170 [ 160.912857] bpf_map_free_deferred+0x51/0x90 [ 160.917196] process_one_work+0x142/0x370 [ 160.921272] worker_thread+0x29e/0x3b0 [ 160.925082] ? rescuer_thread+0x4b0/0x4b0 [ 160.929157] kthread+0xd4/0x110 [ 160.932355] ? kthread_park+0x80/0x80 [ 160.936079] ret_from_fork+0x2d/0x50 [ 160.943396] ? kthread_park+0x80/0x80 [ 160.950803] ret_from_fork_asm+0x11/0x20 [ 160.958482] </TASK> (CVE-2024-56615)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56615
https://ubuntu.com/security/CVE-2024-56615

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.4
EPSS Score
0.0003
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56615

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231185 - Linux Distros Unpatched Vulnerability : CVE-2024-56633
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg The current sk memory accounting logic in
__SK_REDIRECT is pre-uncharging tosend bytes, which is either msg->sg.size or a smaller value apply_bytes.
Potential problems with this strategy are as follows: - If the actual sent bytes are smaller than tosend, we need to charge some bytes back, as in line 487, which is okay but seems not clean. - When tosend is set to apply_bytes, as in line 417, and (ret < 0), we may miss uncharging (msg->sg.size - apply_bytes) bytes.
[...] 415 tosend = msg->sg.size; 416 if (psock->apply_bytes && psock->apply_bytes < tosend) 417 tosend = psock->apply_bytes; [...] 443 sk_msg_return(sk, msg, tosend); 444 release_sock(sk); 446 origsize = msg->sg.size; 447 ret = tcp_bpf_sendmsg_redir(sk_redir, redir_ingress, 448 msg, tosend, flags); 449 sent = origsize - msg->sg.size; [...] 454 lock_sock(sk); 455 if (unlikely(ret < 0)) { 456 int free = sk_msg_free_nocharge(sk, msg); 458 if (!cork) 459 *copied -= free; 460 } [...] 487 if (eval ==
__SK_REDIRECT) 488 sk_mem_charge(sk, tosend - sent); [...] When running the selftest test_txmsg_redir_wait_sndmem with txmsg_apply, the following warning will be reported: ------------[ cut here ]------------ WARNING: CPU: 6 PID: 57 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x190/0x1a0 Modules linked in: CPU: 6 UID: 0 PID: 57 Comm: kworker/6:0 Not tainted 6.12.0-rc1.bm.1-amd64+ #43 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Workqueue: events sk_psock_destroy RIP: 0010:inet_sock_destruct+0x190/0x1a0 RSP: 0018:ffffad0a8021fe08 EFLAGS: 00010206 RAX: 0000000000000011 RBX: ffff9aab4475b900 RCX: ffff9aab481a0800 RDX: 0000000000000303 RSI: 0000000000000011 RDI:
ffff9aab4475b900 RBP: ffff9aab4475b990 R08: 0000000000000000 R09: ffff9aab40050ec0 R10: 0000000000000000 R11: ffff9aae6fdb1d01 R12: ffff9aab49c60400 R13: ffff9aab49c60598 R14: ffff9aab49c60598 R15:
dead000000000100 FS: 0000000000000000(0000) GS:ffff9aae6fd80000(0000) knlGS:0000000000000000 CS: 0010 DS:
0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffec7e47bd8 CR3: 00000001a1a1c004 CR4: 0000000000770ef0 DR0:
0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __warn+0x89/0x130 ? inet_sock_destruct+0x190/0x1a0 ? report_bug+0xfc/0x1e0 ? handle_bug+0x5c/0xa0 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? inet_sock_destruct+0x190/0x1a0 __sk_destruct+0x25/0x220 sk_psock_destroy+0x2b2/0x310 process_scheduled_works+0xa3/0x3e0 worker_thread+0x117/0x240 ?
__pfx_worker_thread+0x10/0x10 kthread+0xcf/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x40 ?
__pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> ---[ end trace 0000000000000000 ]--- In
__SK_REDIRECT, a more concise way is delaying the uncharging after sent bytes are finalized, and uncharge this value. When (ret < 0), we shall invoke sk_msg_free. Same thing happens in case __SK_DROP, when tosend is set to apply_bytes, we may miss uncharging (msg->sg.size - apply_bytes) bytes. The same warning will be reported in selftest. [...] 468 case __SK_DROP: 469 default: 470 sk_msg_free_partial(sk, msg, tosend); 471 sk_msg_apply_bytes(psock, tosend); 472 *copied -= (tosend + delta); 473 return -EACCES; [...] So instead of sk_msg_free_partial we can do sk_msg_free here. (CVE-2024-56633)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56633
https://ubuntu.com/security/CVE-2024-56633

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56633

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231280 - Linux Distros Unpatched Vulnerability : CVE-2024-56638
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: incorrect percpu area handling under softirq Softirq can interrupt ongoing packet from process context that is walking over the percpu area that contains inner header offsets. Disable bh and perform three checks before restoring the percpu inner header offsets to validate that the percpu area is valid for this skbuff: 1) If the NFT_PKTINFO_INNER_FULL flag is set on, then this skbuff has already been parsed before for inner header fetching to register. 2) Validate that the percpu area refers to this skbuff using the skbuff pointer as a cookie. If there is a cookie mismatch, then this skbuff needs to be parsed again. 3) Finally, validate if the percpu area refers to this tunnel type. Only after these three checks the percpu area is restored to a on-stack copy and bh is enabled again. After inner header fetching, the on-stack copy is stored back to the percpu area. (CVE-2024-56638)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56638
https://ubuntu.com/security/CVE-2024-56638

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.3 (CVSS2#AV:A/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
6.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56638

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231830 - Linux Distros Unpatched Vulnerability : CVE-2024-56640
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/smc: fix LGR and link use-after-free issue We encountered a LGR/link use-after-free issue, which manifested as the LGR/link refcnt reaching 0 early and entering the clear process, making resource access unsafe. refcount_t: addition on 0; use-after-free. WARNING: CPU: 14 PID: 107447 at lib/refcount.c:25 refcount_warn_saturate+0x9c/0x140 Workqueue: events smc_lgr_terminate_work [smc] Call trace:
refcount_warn_saturate+0x9c/0x140 __smc_lgr_terminate.part.45+0x2a8/0x370 [smc] smc_lgr_terminate_work+0x28/0x30 [smc] process_one_work+0x1b8/0x420 worker_thread+0x158/0x510 kthread+0x114/0x118 or refcount_t: underflow; use-after-free. WARNING: CPU: 6 PID: 93140 at lib/refcount.c:28 refcount_warn_saturate+0xf0/0x140 Workqueue: smc_hs_wq smc_listen_work [smc] Call trace:
refcount_warn_saturate+0xf0/0x140 smcr_link_put+0x1cc/0x1d8 [smc] smc_conn_free+0x110/0x1b0 [smc] smc_conn_abort+0x50/0x60 [smc] smc_listen_find_device+0x75c/0x790 [smc] smc_listen_work+0x368/0x8a0 [smc] process_one_work+0x1b8/0x420 worker_thread+0x158/0x510 kthread+0x114/0x118 It is caused by repeated release of LGR/link refcnt. One suspect is that smc_conn_free() is called repeatedly because some smc_conn_free() from server listening path are not protected by sock lock. e.g. Calls under socklock | smc_listen_work ------------------------------------------------------- lock_sock(sk) | smc_conn_abort smc_conn_free | \- smc_conn_free \- smcr_link_put | \- smcr_link_put (duplicated) release_sock(sk) So here add sock lock protection in smc_listen_work() path, making it exclusive with other connection operations.
(CVE-2024-56640)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56640
https://security-tracker.debian.org/tracker/CVE-2024-56640
https://ubuntu.com/security/CVE-2024-56640

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56640

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231478 - Linux Distros Unpatched Vulnerability : CVE-2024-56658
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: defer final 'struct net' free in netns dismantle Ilya reported a slab-use-after-free in dst_destroy [1] Issue is in xfrm6_net_init() and xfrm4_net_init() : They copy xfrm[46]_dst_ops_template into net->xfrm.xfrm[46]_dst_ops. But net structure might be freed before all the dst callbacks are called. So when dst_destroy() calls later : if (dst->ops->destroy) dst->ops->destroy(dst); dst->ops points to the old net->xfrm.xfrm[46]_dst_ops, which has been freed. See a relevant issue fixed in : ac888d58869b (net: do not delay dst_entries_add() in dst_release()) A fix is to queue the 'struct net' to be freed after one another cleanup_net() round (and existing rcu_barrier()) [1] BUG: KASAN: slab-use-after-free in dst_destroy (net/core/dst.c:112) Read of size 8 at addr ffff8882137ccab0 by task swapper/37/0 Dec 03 05:46:18 kernel: CPU: 37 UID: 0 PID: 0 Comm:
swapper/37 Kdump: loaded Not tainted 6.12.0 #67 Hardware name: Red Hat KVM/RHEL, BIOS 1.16.1-1.el9 04/01/2014 Call Trace: <IRQ> dump_stack_lvl (lib/dump_stack.c:124) print_address_description.constprop.0 (mm/kasan/report.c:378) ? dst_destroy (net/core/dst.c:112) print_report (mm/kasan/report.c:489) ? dst_destroy (net/core/dst.c:112) ? kasan_addr_to_slab (mm/kasan/common.c:37) kasan_report (mm/kasan/report.c:603) ? dst_destroy (net/core/dst.c:112) ? rcu_do_batch (kernel/rcu/tree.c:2567) dst_destroy (net/core/dst.c:112) rcu_do_batch (kernel/rcu/tree.c:2567) ? __pfx_rcu_do_batch (kernel/rcu/tree.c:2491) ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4339 kernel/locking/lockdep.c:4406) rcu_core (kernel/rcu/tree.c:2825) handle_softirqs (kernel/softirq.c:554)
__irq_exit_rcu (kernel/softirq.c:589 kernel/softirq.c:428 kernel/softirq.c:637) irq_exit_rcu (kernel/softirq.c:651) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1049 arch/x86/kernel/apic/apic.c:1049) </IRQ> <TASK> asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:702) RIP: 0010:default_idle (./arch/x86/include/asm/irqflags.h:37 ./arch/x86/include/asm/irqflags.h:92 arch/x86/kernel/process.c:743) Code: 00 4d 29 c8 4c 01 c7 4c 29 c2 e9 6e ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 90 0f 00 2d c7 c9 27 00 fb f4 <fa> c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 RSP: 0018:ffff888100d2fe00 EFLAGS: 00000246 RAX:
00000000001870ed RBX: 1ffff110201a5fc2 RCX: ffffffffb61a3e46 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffb3d4d123 RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed11c7e1835d R10:
ffff888e3f0c1aeb R11: 0000000000000000 R12: 0000000000000000 R13: ffff888100d20000 R14: dffffc0000000000 R15: 0000000000000000 ? ct_kernel_exit.constprop.0 (kernel/context_tracking.c:148) ? cpuidle_idle_call (kernel/sched/idle.c:186) default_idle_call (./include/linux/cpuidle.h:143 kernel/sched/idle.c:118) cpuidle_idle_call (kernel/sched/idle.c:186) ? __pfx_cpuidle_idle_call (kernel/sched/idle.c:168) ? lock_release (kernel/locking/lockdep.c:467 kernel/locking/lockdep.c:5848) ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406) ? tsc_verify_tsc_adjust (arch/x86/kernel/tsc_sync.c:59) do_idle (kernel/sched/idle.c:326) cpu_startup_entry (kernel/sched/idle.c:423 (discriminator 1)) start_secondary (arch/x86/kernel/smpboot.c:202 arch/x86/kernel/smpboot.c:282) ? __pfx_start_secondary (arch/x86/kernel/smpboot.c:232) ? soft_restart_cpu (arch/x86/kernel/head_64.S:452) common_startup_64 (arch/x86/kernel/head_64.S:414) </TASK> Dec 03 05:46:18 kernel: Allocated by task 12184: kasan_save_stack (mm/kasan/common.c:48) kasan_save_track (./arch/x86/include/asm/current.h:49 mm/kasan/common.c:60 mm/kasan/common.c:69) __kasan_slab_alloc (mm/kasan/common.c:319 mm/kasan/common.c:345) kmem_cache_alloc_noprof (mm/slub.c:4085 mm/slub.c:4134 mm/slub.c:4141) copy_net_ns (net/core/net_namespace.c:421 net/core/net_namespace.c:480) create_new_namespaces ---truncated--- (CVE-2024-56658)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56658
https://ubuntu.com/security/CVE-2024-56658

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56658

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230490 - Linux Distros Unpatched Vulnerability : CVE-2024-56669
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Remove cache tags before disabling ATS The current implementation removes cache tags after disabling ATS, leading to potential memory leaks and kernel crashes. Specifically, CACHE_TAG_DEVTLB type cache tags may still remain in the list even after the domain is freed, causing a use-after-free condition. This issue really shows up when multiple VFs from different PFs passed through to a single user-space process via vfio-pci. In such cases, the kernel may crash with kernel messages like: BUG: kernel NULL pointer dereference, address:
0000000000000014 PGD 19036a067 P4D 1940a3067 PUD 136c9b067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 74 UID: 0 PID: 3183 Comm: testCli Not tainted 6.11.9 #2 RIP: 0010:cache_tag_flush_range+0x9b/0x250 Call Trace: <TASK> ? __die+0x1f/0x60 ? page_fault_oops+0x163/0x590 ? exc_page_fault+0x72/0x190 ? asm_exc_page_fault+0x22/0x30 ? cache_tag_flush_range+0x9b/0x250 ? cache_tag_flush_range+0x5d/0x250 intel_iommu_tlb_sync+0x29/0x40 intel_iommu_unmap_pages+0xfe/0x160 __iommu_unmap+0xd8/0x1a0 vfio_unmap_unpin+0x182/0x340 [vfio_iommu_type1] vfio_remove_dma+0x2a/0xb0 [vfio_iommu_type1] vfio_iommu_type1_ioctl+0xafa/0x18e0 [vfio_iommu_type1] Move cache_tag_unassign_domain() before iommu_disable_pci_caps() to fix it. (CVE-2024-56669)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56669
https://ubuntu.com/security/CVE-2024-56669

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56669

Plugin Information
Published: 2025/03/06, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231528 - Linux Distros Unpatched Vulnerability : CVE-2024-56678
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: powerpc/mm/fault: Fix kfence page fault reporting copy_from_kernel_nofault() can be called when doing read of /proc/kcore. /proc/kcore can have some unmapped kfence objects which when read via copy_from_kernel_nofault() can cause page faults.
Since *_nofault() functions define their own fixup table for handling fault, use that instead of asking kfence to handle such faults. Hence we search the exception tables for the nip which generated the fault.
If there is an entry then we let the fixup table handler handle the page fault by returning an error from within ___do_page_fault(). This can be easily triggered if someone tries to do dd from /proc/kcore. eg. dd if=/proc/kcore of=/dev/null bs=1M Some example false negatives: =============================== BUG:
KFENCE: invalid read in copy_from_kernel_nofault+0x9c/0x1a0 Invalid read at 0xc0000000fdff0000:
copy_from_kernel_nofault+0x9c/0x1a0 0xc00000000665f950 read_kcore_iter+0x57c/0xa04 proc_reg_read_iter+0xe4/0x16c vfs_read+0x320/0x3ec ksys_read+0x90/0x154 system_call_exception+0x120/0x310 system_call_vectored_common+0x15c/0x2ec BUG: KFENCE: use-after-free read in copy_from_kernel_nofault+0x9c/0x1a0 Use-after-free read at 0xc0000000fe050000 (in kfence-#2):
copy_from_kernel_nofault+0x9c/0x1a0 0xc00000000665f950 read_kcore_iter+0x57c/0xa04 proc_reg_read_iter+0xe4/0x16c vfs_read+0x320/0x3ec ksys_read+0x90/0x154 system_call_exception+0x120/0x310 system_call_vectored_common+0x15c/0x2ec (CVE-2024-56678)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56678
https://ubuntu.com/security/CVE-2024-56678

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56678

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230807 - Linux Distros Unpatched Vulnerability : CVE-2024-56708
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: EDAC/igen6: Avoid segmentation fault on module unload The segmentation fault happens because: During modprobe: 1. In igen6_probe(), igen6_pvt will be allocated with kzalloc() 2. In igen6_register_mci(), mci->pvt_info will point to &igen6_pvt->imc[mc] During rmmod: 1. In mci_release() in edac_mc.c, it will kfree(mci->pvt_info) 2. In igen6_remove(), it will kfree(igen6_pvt); Fix this issue by setting mci->pvt_info to NULL to avoid the double kfree. (CVE-2024-56708)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56708
https://ubuntu.com/security/CVE-2024-56708

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56708

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231467 - Linux Distros Unpatched Vulnerability : CVE-2024-56765
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/vas: Add close() callback in vas_vm_ops struct The mapping VMA address is saved in VAS window struct when the paste address is mapped. This VMA address is used during migration to unmap the paste address if the window is active.
The paste address mapping will be removed when the window is closed or with the munmap(). But the VMA address in the VAS window is not updated with munmap() which is causing invalid access during migration.
The KASAN report shows: [16386.254991] BUG: KASAN: slab-use-after-free in reconfig_close_windows+0x1a0/0x4e8 [16386.255043] Read of size 8 at addr c00000014a819670 by task drmgr/696928 [16386.255096] CPU: 29 UID: 0 PID: 696928 Comm: drmgr Kdump: loaded Tainted: G B 6.11.0-rc5-nxgzip #2 [16386.255128] Tainted: [B]=BAD_PAGE [16386.255148] Hardware name: IBM,9080-HEX Power11 (architected) 0x820200 0xf000007 of:IBM,FW1110.00 (NH1110_016) hv:phyp pSeries [16386.255181] Call Trace: [16386.255202] [c00000016b297660] [c0000000018ad0ac] dump_stack_lvl+0x84/0xe8 (unreliable) [16386.255246] [c00000016b297690] [c0000000006e8a90] print_report+0x19c/0x764 [16386.255285] [c00000016b297760] [c0000000006e9490] kasan_report+0x128/0x1f8 [16386.255309] [c00000016b297880] [c0000000006eb5c8] __asan_load8+0xac/0xe0 [16386.255326] [c00000016b2978a0] [c00000000013f898] reconfig_close_windows+0x1a0/0x4e8 [16386.255343] [c00000016b297990] [c000000000140e58] vas_migration_handler+0x3a4/0x3fc [16386.255368] [c00000016b297a90] [c000000000128848] pseries_migrate_partition+0x4c/0x4c4 ... [16386.256136] Allocated by task 696554 on cpu 31 at 16377.277618s: [16386.256149] kasan_save_stack+0x34/0x68 [16386.256163] kasan_save_track+0x34/0x80 [16386.256175] kasan_save_alloc_info+0x58/0x74 [16386.256196] __kasan_slab_alloc+0xb8/0xdc [16386.256209] kmem_cache_alloc_noprof+0x200/0x3d0 [16386.256225] vm_area_alloc+0x44/0x150 [16386.256245] mmap_region+0x214/0x10c4 [16386.256265] do_mmap+0x5fc/0x750 [16386.256277] vm_mmap_pgoff+0x14c/0x24c [16386.256292] ksys_mmap_pgoff+0x20c/0x348 [16386.256303] sys_mmap+0xd0/0x160 ... [16386.256350] Freed by task 0 on cpu 31 at 16386.204848s: [16386.256363] kasan_save_stack+0x34/0x68 [16386.256374] kasan_save_track+0x34/0x80 [16386.256384] kasan_save_free_info+0x64/0x10c [16386.256396]
__kasan_slab_free+0x120/0x204 [16386.256415] kmem_cache_free+0x128/0x450 [16386.256428] vm_area_free_rcu_cb+0xa8/0xd8 [16386.256441] rcu_do_batch+0x2c8/0xcf0 [16386.256458] rcu_core+0x378/0x3c4 [16386.256473] handle_softirqs+0x20c/0x60c [16386.256495] do_softirq_own_stack+0x6c/0x88 [16386.256509] do_softirq_own_stack+0x58/0x88 [16386.256521] __irq_exit_rcu+0x1a4/0x20c [16386.256533] irq_exit+0x20/0x38 [16386.256544] interrupt_async_exit_prepare.constprop.0+0x18/0x2c ... [16386.256717] Last potentially related work creation: [16386.256729] kasan_save_stack+0x34/0x68 [16386.256741]
__kasan_record_aux_stack+0xcc/0x12c [16386.256753] __call_rcu_common.constprop.0+0x94/0xd04 [16386.256766] vm_area_free+0x28/0x3c [16386.256778] remove_vma+0xf4/0x114 [16386.256797] do_vmi_align_munmap.constprop.0+0x684/0x870 [16386.256811] __vm_munmap+0xe0/0x1f8 [16386.256821] sys_munmap+0x54/0x6c [16386.256830] system_call_exception+0x1a0/0x4a0 [16386.256841] system_call_vectored_common+0x15c/0x2ec [16386.256868] The buggy address belongs to the object at c00000014a819670 which belongs to the cache vm_area_struct of size 168 [16386.256887] The buggy address is located 0 bytes inside of freed 168-byte region [c00000014a819670, c00000014a819718) [16386.256915] The buggy address belongs to the physical page: [16386.256928] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14a81 [16386.256950] memcg:c0000000ba430001 [16386.256961] anon flags: 0x43ffff800000000(node=4|zone=0|lastcpupid=0x7ffff) [16386.256975] page_type: 0xfdffffff(slab) [16386 ---truncated--- (CVE-2024-56765)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56765
https://ubuntu.com/security/CVE-2024-56765

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56765

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230642 - Linux Distros Unpatched Vulnerability : CVE-2024-56772
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: kunit: string-stream: Fix a UAF bug in kunit_init_suite() In kunit_debugfs_create_suite(), if alloc_string_stream() fails in the kunit_suite_for_each_test_case() loop, the suite->log = stream has assigned before, and the error path only free the suite->log's stream memory but not set it to NULL, so the later string_stream_clear() of suite->log in kunit_init_suite() will cause below UAF bug. Set stream pointer to NULL after free to fix it. Unable to handle kernel paging request at virtual address 006440150000030d Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [006440150000030d] address between user and kernel address ranges Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: iio_test_gts industrialio_gts_helper cfg80211 rfkill ipv6 [last unloaded: iio_test_gts] CPU: 5 UID: 0 PID: 6253 Comm: modprobe Tainted: G B W N 6.12.0-rc4+ #458 Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST Hardware name: linux,dummy-virt (DT) pstate: 40000005 (nZcv daif
-PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : string_stream_clear+0x54/0x1ac lr :
string_stream_clear+0x1a8/0x1ac sp : ffffffc080b47410 x29: ffffffc080b47410 x28: 006440550000030d x27:
ffffff80c96b5e98 x26: ffffff80c96b5e80 x25: ffffffe461b3f6c0 x24: 0000000000000003 x23: ffffff80c96b5e88 x22: 1ffffff019cdf4fc x21: dfffffc000000000 x20: ffffff80ce6fa7e0 x19: 032202a80000186d x18:
0000000000001840 x17: 0000000000000000 x16: 0000000000000000 x15: ffffffe45c355cb4 x14: ffffffe45c35589c x13: ffffffe45c03da78 x12: ffffffb810168e75 x11: 1ffffff810168e74 x10: ffffffb810168e74 x9 :
dfffffc000000000 x8 : 0000000000000004 x7 : 0000000000000003 x6 : 0000000000000001 x5 : ffffffc080b473a0 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000001 x1 : ffffffe462fbf620 x0 :
dfffffc000000000 Call trace: string_stream_clear+0x54/0x1ac __kunit_test_suites_init+0x108/0x1d8 kunit_exec_run_tests+0xb8/0x100 kunit_module_notify+0x400/0x55c notifier_call_chain+0xfc/0x3b4 blocking_notifier_call_chain+0x68/0x9c do_init_module+0x24c/0x5c8 load_module+0x4acc/0x4e90 init_module_from_file+0xd4/0x128 idempotent_init_module+0x2d4/0x57c __arm64_sys_finit_module+0xac/0x100 invoke_syscall+0x6c/0x258 el0_svc_common.constprop.0+0x160/0x22c do_el0_svc+0x44/0x5c el0_svc+0x48/0xb8 el0t_64_sync_handler+0x13c/0x158 el0t_64_sync+0x190/0x194 Code: f9400753 d2dff800 f2fbffe0 d343fe7c (38e06b80) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Oops: Fatal exception (CVE-2024-56772)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56772
https://ubuntu.com/security/CVE-2024-56772

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56772

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230384 - Linux Distros Unpatched Vulnerability : CVE-2024-57791
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/smc: check return value of sock_recvmsg when draining clc data When receiving clc msg, the field length in smc_clc_msg_hdr indicates the length of msg should be received from network and the value should not be fully trusted as it is from the network. Once the value of length exceeds the value of buflen in function smc_clc_wait_msg it may run into deadloop when trying to drain the remaining data exceeding buflen. This patch checks the return value of sock_recvmsg when draining data in case of deadloop in draining. (CVE-2024-57791)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57791
https://ubuntu.com/security/CVE-2024-57791

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57791

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230665 - Linux Distros Unpatched Vulnerability : CVE-2024-57795
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA/rxe: Remove the direct link to net_device The similar patch in siw is in the link:
https://git.kernel.org/rdma/rdma/c/16b87037b48889 This problem also occurred in RXE. The following analyze this problem. In the following Call Traces: BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0 net/core/dev.c:8782 Read of size 4 at addr ffff8880554640b0 by task kworker/1:4/5295 CPU: 1 UID: 0 PID:
5295 Comm: kworker/1:4 Not tainted 6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: infiniband ib_cache_event_task Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 dev_get_flags+0x188/0x1d0 net/core/dev.c:8782 rxe_query_port+0x12d/0x260 drivers/infiniband/sw/rxe/rxe_verbs.c:60 __ib_query_port drivers/infiniband/core/device.c:2111 [inline] ib_query_port+0x168/0x7d0 drivers/infiniband/core/device.c:2143 ib_cache_update+0x1a9/0xb80 drivers/infiniband/core/cache.c:1494 ib_cache_event_task+0xf3/0x1e0 drivers/infiniband/core/cache.c:1568 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f2/0x390 kernel/kthread.c:389 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> 1). In the link [1], infiniband syz2: set down This means that on 839.350575, the event ib_cache_event_task was sent andi queued in ib_wq. 2). In the link [1], team0 (unregistering): Port device team_slave_0 removed It indicates that before 843.251853, the net device should be freed. 3). In the link [1], BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0 This means that on 850.559070, this slab-use-after-free problem occurred. In all, on 839.350575, the event ib_cache_event_task was sent and queued in ib_wq, before 843.251853, the net device veth was freed. on 850.559070, this event was executed, and the mentioned freed net device was called. Thus, the above call trace occurred. [1] https://syzkaller.appspot.com/x/log.txt?x=12e7025f980000 (CVE-2024-57795)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57795
https://security-tracker.debian.org/tracker/CVE-2024-57795
https://ubuntu.com/security/CVE-2024-57795

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57795

Plugin Information
Published: 2025/03/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231978 - Linux Distros Unpatched Vulnerability : CVE-2024-57838
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- s390/entry: Mark IRQ entries to fix stack depot warnings The stack depot filters out everything outside of the top interrupt context as an uninteresting or irrelevant part of the stack traces. This helps with stack trace de-duplication, avoiding an explosion of saved stack traces that share the same IRQ context code path but originate from different randomly interrupted points, eventually exhausting the stack depot.
Filtering uses in_irqentry_text() to identify functions within the .irqentry.text and .softirqentry.text sections, which then become the last stack trace entries being saved. While __do_softirq() is placed into the .softirqentry.text section by common code, populating .irqentry.text is architecture-specific.
Currently, the .irqentry.text section on s390 is empty, which prevents stack depot filtering and de- duplication and could result in warnings like: Stack depot reached limit capacity WARNING: CPU: 0 PID:
286113 at lib/stackdepot.c:252 depot_alloc_stack+0x39a/0x3c8 with PREEMPT and KASAN enabled. Fix this by moving the IO/EXT interrupt handlers from .kprobes.text into the .irqentry.text section and updating the kprobes blacklist to include the .irqentry.text section. This is done only for asynchronous interrupts and explicitly not for program checks, which are synchronous and where the context beyond the program check is important to preserve. Despite machine checks being somewhat in between, they are extremely rare, and preserving context when possible is also of value. SVCs and Restart Interrupts are not relevant, one being always at the boundary to user space and the other being a one-time thing. IRQ entries filtering is also optionally used in ftrace function graph, where the same logic applies. (CVE-2024-57838)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57838
https://security-tracker.debian.org/tracker/CVE-2024-57838
https://ubuntu.com/security/CVE-2024-57838

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57838

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230945 - Linux Distros Unpatched Vulnerability : CVE-2024-57849
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- s390/cpum_sf: Handle CPU hotplug remove during sampling CPU hotplug remove handling triggers the following function call sequence: CPUHP_AP_PERF_S390_SF_ONLINE --> s390_pmu_sf_offline_cpu() ...
CPUHP_AP_PERF_ONLINE --> perf_event_exit_cpu() The s390 CPUMF sampling CPU hotplug handler invokes:
s390_pmu_sf_offline_cpu() +--> cpusf_pmu_setup() +--> setup_pmc_cpu() +--> deallocate_buffers() This function de-allocates all sampling data buffers (SDBs) allocated for that CPU at event initialization. It also clears the PMU_F_RESERVED bit. The CPU is gone and can not be sampled. With the event still being active on the removed CPU, the CPU event hotplug support in kernel performance subsystem triggers the following function calls on the removed CPU: perf_event_exit_cpu() +--> perf_event_exit_cpu_context() +-->
__perf_event_exit_context() +--> __perf_remove_from_context() +--> event_sched_out() +--> cpumsf_pmu_del() +--> cpumsf_pmu_stop() +--> hw_perf_event_update() to stop and remove the event. During removal of the event, the sampling device driver tries to read out the remaining samples from the sample data buffers (SDBs). But they have already been freed (and may have been re-assigned). This may lead to a use after free situation in which case the samples are most likely invalid. In the best case the memory has not been reassigned and still contains valid data. Remedy this situation and check if the CPU is still in reserved state (bit PMU_F_RESERVED set). In this case the SDBs have not been released an contain valid data. This is always the case when the event is removed (and no CPU hotplug off occured). If the PMU_F_RESERVED bit is not set, the SDB buffers are gone. (CVE-2024-57849)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57849
https://security-tracker.debian.org/tracker/CVE-2024-57849
https://ubuntu.com/security/CVE-2024-57849

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57849

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231634 - Linux Distros Unpatched Vulnerability : CVE-2024-57917
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: topology: Keep the cpumask unchanged when printing cpumap During fuzz testing, the following warning was discovered: different return values (15 and 11) from vsnprintf(%*pbl , ...) test:keyward is WARNING in kvasprintf WARNING: CPU: 55 PID:
1168477 at lib/kasprintf.c:30 kvasprintf+0x121/0x130 Call Trace: kvasprintf+0x121/0x130 kasprintf+0xa6/0xe0 bitmap_print_to_buf+0x89/0x100 core_siblings_list_read+0x7e/0xb0 kernfs_file_read_iter+0x15b/0x270 new_sync_read+0x153/0x260 vfs_read+0x215/0x290 ksys_read+0xb9/0x160 do_syscall_64+0x56/0x100 entry_SYSCALL_64_after_hwframe+0x78/0xe2 The call trace shows that kvasprintf() reported this warning during the printing of core_siblings_list. kvasprintf() has several steps: (1) First, calculate the length of the resulting formatted string. (2) Allocate a buffer based on the returned length. (3) Then, perform the actual string formatting. (4) Check whether the lengths of the formatted strings returned in steps (1) and (2) are consistent. If the core_cpumask is modified between steps (1) and (3), the lengths obtained in these two steps may not match. Indeed our test includes cpu hotplugging, which should modify core_cpumask while printing. To fix this issue, cache the cpumask into a temporary variable before calling cpumap_print_{list, cpumask}_to_buf(), to keep it unchanged during the printing process. (CVE-2024-57917)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57917
https://ubuntu.com/security/CVE-2024-57917

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57917

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231659 - Linux Distros Unpatched Vulnerability : CVE-2024-57951
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: hrtimers: Handle CPU state correctly on hotplug Consider a scenario where a CPU transitions from CPUHP_ONLINE to halfway through a CPU hotunplug down to CPUHP_HRTIMERS_PREPARE, and then back to CPUHP_ONLINE: Since hrtimers_prepare_cpu() does not run, cpu_base.hres_active remains set to 1 throughout. However, during a CPU unplug operation, the tick and the clockevents are shut down at CPUHP_AP_TICK_DYING. On return to the online state, for instance CFS incorrectly assumes that the hrtick is already active, and the chance of the clockevent device to transition to oneshot mode is also lost forever for the CPU, unless it goes back to a lower state than CPUHP_HRTIMERS_PREPARE once. This round-trip reveals another issue; cpu_base.online is not set to 1 after the transition, which appears as a WARN_ON_ONCE in enqueue_hrtimer(). Aside of that, the bulk of the per CPU state is not reset either, which means there are dangling pointers in the worst case. Address this by adding a corresponding startup() callback, which resets the stale per CPU state and sets the online flag.
[ tglx: Make the new callback unconditionally available, remove the online modification in the prepare() callback and clear the remaining state in the starting callback instead of the prepare callback ] (CVE-2024-57951)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57951
https://ubuntu.com/security/CVE-2024-57951

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57951

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231079 - Linux Distros Unpatched Vulnerability : CVE-2024-57979
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- pps: Fix a use-after-free On a board running ntpd and gpsd, I'm seeing a consistent use-after-free in sys_exit() from gpsd when rebooting: pps pps1: removed ------------[ cut here ]------------ kobject:
'(null)' (00000000db4bec24): is not initialized, yet kobject_put() is being called. WARNING: CPU: 2 PID:
440 at lib/kobject.c:734 kobject_put+0x120/0x150 CPU: 2 UID: 299 PID: 440 Comm: gpsd Not tainted 6.11.0-rc6-00308-gb31c44928842 #1 Hardware name: Raspberry Pi 4 Model B Rev 1.1 (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : kobject_put+0x120/0x150 lr : kobject_put+0x120/0x150 sp : ffffffc0803d3ae0 x29: ffffffc0803d3ae0 x28: ffffff8042dc9738 x27: 0000000000000001 x26:
0000000000000000 x25: ffffff8042dc9040 x24: ffffff8042dc9440 x23: ffffff80402a4620 x22: ffffff8042ef4bd0 x21: ffffff80405cb600 x20: 000000000008001b x19: ffffff8040b3b6e0 x18: 0000000000000000 x17:
0000000000000000 x16: 0000000000000000 x15: 696e6920746f6e20 x14: 7369203a29343263 x13: 205d303434542020 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 :
0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 Call trace:
kobject_put+0x120/0x150 cdev_put+0x20/0x3c __fput+0x2c4/0x2d8 ____fput+0x1c/0x38 task_work_run+0x70/0xfc do_exit+0x2a0/0x924 do_group_exit+0x34/0x90 get_signal+0x7fc/0x8c0 do_signal+0x128/0x13b4 do_notify_resume+0xdc/0x160 el0_svc+0xd4/0xf8 el0t_64_sync_handler+0x140/0x14c el0t_64_sync+0x190/0x194
---[ end trace 0000000000000000 ]--- ...followed by more symptoms of corruption, with similar stacks:
refcount_t: underflow; use-after-free. kernel BUG at lib/list_debug.c:62! Kernel panic - not syncing: Oops
- BUG: Fatal exception This happens because pps_device_destruct() frees the pps_device with the embedded cdev immediately after calling cdev_del(), but, as the comment above cdev_del() notes, fops for previously opened cdevs are still callable even after cdev_del() returns. I think this bug has always been there: I can't explain why it suddenly started happening every time I reboot this particular board. In commit d953e0e837e6 (pps: Fix a use-after free bug when unregistering a source.), George Spelvin suggested removing the embedded cdev. That seems like the simplest way to fix this, so I've implemented his suggestion, using __register_chrdev() with pps_idr becoming the source of truth for which minor corresponds to which device. But now that pps_idr defines userspace visibility instead of cdev_add(), we need to be sure the pps->dev refcount can't reach zero while userspace can still find it again. So, the idr_remove() call moves to pps_unregister_cdev(), and pps_idr now holds a reference to pps->dev. pps_core:
source serial1 got cdev (251:1) <...> pps pps1: removed pps_core: unregistering pps1 pps_core:
deallocating pps1 (CVE-2024-57979)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57979
https://ubuntu.com/security/CVE-2024-57979

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57979

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230746 - Linux Distros Unpatched Vulnerability : CVE-2024-57982
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xfrm: state: fix out-of-bounds read during lookup lookup and resize can run in parallel. The xfrm_state_hash_generation seqlock ensures a retry, but the hash functions can observe a hmask value that is too large for the new hlist array. rehash does: rcu_assign_pointer(net->xfrm.state_bydst, ndst) [..] net->xfrm.state_hmask = nhashmask; While state lookup does: h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family); hlist_for_each_entry_rcu(x, net->xfrm.state_bydst + h, bydst) { This is only safe in case the update to state_bydst is larger than net->xfrm.xfrm_state_hmask (or if the lookup function gets serialized via state spinlock again). Fix this by prefetching state_hmask and the associated pointers. The xfrm_state_hash_generation seqlock retry will ensure that the pointer and the hmask will be consistent. The existing helpers, like xfrm_dst_hash(), are now unsafe for RCU side, add lockdep assertions to document that they are only safe for insert side. xfrm_state_lookup_byaddr() uses the spinlock rather than RCU. AFAICS this is an oversight from back when state lookup was converted to RCU, this lock should be replaced with RCU in a future patch. (CVE-2024-57982)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57982
https://security-tracker.debian.org/tracker/CVE-2024-57982
https://ubuntu.com/security/CVE-2024-57982

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
3.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
3.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57982

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231129 - Linux Distros Unpatched Vulnerability : CVE-2024-58013
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync This fixes the following crash: ================================================================== BUG: KASAN: slab-use-after-free in mgmt_remove_adv_monitor_sync+0x3a/0xd0 net/bluetooth/mgmt.c:5543 Read of size 8 at addr ffff88814128f898 by task kworker/u9:4/5961 CPU: 1 UID: 0 PID: 5961 Comm: kworker/u9:4 Not tainted 6.12.0-syzkaller-10684-gf1cd565ce577 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: hci0 hci_cmd_sync_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 mgmt_remove_adv_monitor_sync+0x3a/0xd0 net/bluetooth/mgmt.c:5543 hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated by task 16026: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4314 kmalloc_noprof include/linux/slab.h:901 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269 mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296 remove_adv_monitor+0x102/0x1b0 net/bluetooth/mgmt.c:5568 hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712 hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:726 sock_write_iter+0x2d7/0x3f0 net/socket.c:1147 new_sync_write fs/read_write.c:586 [inline] vfs_write+0xaeb/0xd30 fs/read_write.c:679 ksys_write+0x18f/0x2b0 fs/read_write.c:731 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 16022: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2338 [inline] slab_free mm/slub.c:4598 [inline] kfree+0x196/0x420 mm/slub.c:4746 mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259 __mgmt_power_off+0x183/0x430 net/bluetooth/mgmt.c:9550 hci_dev_close_sync+0x6c4/0x11c0 net/bluetooth/hci_sync.c:5208 hci_dev_do_close net/bluetooth/hci_core.c:483 [inline] hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508 sock_do_ioctl+0x158/0x460 net/socket.c:1209 sock_ioctl+0x626/0x8e0 net/socket.c:1328 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f (CVE-2024-58013)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-58013
https://ubuntu.com/security/CVE-2024-58013

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:A/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-58013

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249873 - Linux Distros Unpatched Vulnerability : CVE-2024-58093
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- PCI/ASPM: Fix link state exit during switch upstream function removal Before 456d8aa37d0f (PCI/ASPM:
Disable ASPM on MFD function removal to avoid use-after-free), we would free the ASPM link only after the last function on the bus pertaining to the given link was removed. That was too late. If function 0 is removed before sibling function, link->downstream would point to free'd memory after. After above change, we freed the ASPM parent link state upon any function removal on the bus pertaining to a given link. That is too early. If the link is to a PCIe switch with MFD on the upstream port, then removing functions other than 0 first would free a link which still remains parent_link to the remaining downstream ports. The resulting GPFs are especially frequent during hot-unplug, because pciehp removes devices on the link bus in reverse order. On that switch, function 0 is the virtual P2P bridge to the internal bus. Free exactly when function 0 is removed -- before the parent link is obsolete, but after all subordinate links are gone. [kwilczynski: commit log] (CVE-2024-58093)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-58093
https://security-tracker.debian.org/tracker/CVE-2024-58093
https://ubuntu.com/security/CVE-2024-58093

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:M/Au:N/C:C/I:P/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-58093

Plugin Information
Published: 2025/08/15, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260889 - Linux Distros Unpatched Vulnerability : CVE-2024-58240
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tls: separate no-async decryption request handling from async If we're not doing async, the handling is much simpler. There's no reference counting, we just need to wait for the completion to wake us up and return its result. We should preferably also use a separate crypto_wait. I'm not seeing a UAF as I did in the past, I think aec7961916f3 (tls: fix race between async notify and socket close) took care of it.
This will make the next fix easier. (CVE-2024-58240)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-58240
https://security-tracker.debian.org/tracker/CVE-2024-58240
https://ubuntu.com/security/CVE-2024-58240

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.2
EPSS Score
0.0002
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-58240

Plugin Information
Published: 2025/09/03, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230841 - Linux Distros Unpatched Vulnerability : CVE-2024-6239
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input files, an attacker could cause the utility to crash, leading to a denial of service. (CVE-2024-6239)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-6239
https://security-tracker.debian.org/tracker/CVE-2024-6239
https://ubuntu.com/security/CVE-2024-6239

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0046
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-6239

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- poppler
- poppler-cpp
- poppler-glib
- poppler-utils
230962 - Linux Distros Unpatched Vulnerability : CVE-2024-6655
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory. (CVE-2024-6655)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-6655
https://ubuntu.com/security/CVE-2024-6655

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0007
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-6655

Plugin Information
Published: 2025/03/06, Modified: 2025/08/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gtk2
243875 - Linux Distros Unpatched Vulnerability : CVE-2024-8176
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage. (CVE-2024-8176)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-8176
https://security-tracker.debian.org/tracker/CVE-2024-8176
https://ubuntu.com/security/CVE-2024-8176

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0069
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-8176

Plugin Information
Published: 2025/08/05, Modified: 2025/11/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
230872 - Linux Distros Unpatched Vulnerability : CVE-2024-8383
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support. It did not ask before doing so for the Usenet-related schemes news: and snews:. Since most operating systems don't have a trusted newsreader installed by default, an unscrupulous program that the user downloaded could register itself as a handler. The website that served the application download could then launch that application at will. This vulnerability affects Firefox <
130, Firefox ESR < 128.2, and Firefox ESR < 115.15. (CVE-2024-8383)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-8383
https://ubuntu.com/security/CVE-2024-8383

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0011
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-8383

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
231247 - Linux Distros Unpatched Vulnerability : CVE-2024-8900
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An attacker could write data to the user's clipboard, bypassing the user prompt, during a certain sequence of navigational events. This vulnerability affects Firefox < 129, Firefox ESR < 128.3, and Thunderbird <
128.3. (CVE-2024-8900)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-8900

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0011
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-8900

Plugin Information
Published: 2025/03/06, Modified: 2025/08/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
231183 - Linux Distros Unpatched Vulnerability : CVE-2024-9396
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- It is currently unknown if this issue is exploitable but a condition may arise where the structured clone of certain objects could lead to memory corruption. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131. (CVE-2024-9396)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-9396
https://ubuntu.com/security/CVE-2024-9396

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0011
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-9396

Plugin Information
Published: 2025/03/06, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
230374 - Linux Distros Unpatched Vulnerability : CVE-2024-9399
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A website configured to initiate a specially crafted WebTransport session could crash the Firefox process leading to a denial of service condition. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131. (CVE-2024-9399)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-9399
https://ubuntu.com/security/CVE-2024-9399

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0076
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-9399

Plugin Information
Published: 2025/03/06, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
231058 - Linux Distros Unpatched Vulnerability : CVE-2024-9400
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A potential memory corruption vulnerability could be triggered if an attacker had the ability to trigger an OOM at a specific moment during JIT compilation. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131. (CVE-2024-9400)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-9400
https://ubuntu.com/security/CVE-2024-9400

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0011
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-9400

Plugin Information
Published: 2025/03/06, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
231083 - Linux Distros Unpatched Vulnerability : CVE-2025-0241
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird < 128.6. (CVE-2025-0241)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-0241
https://ubuntu.com/security/CVE-2025-0241

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.3
EPSS Score
0.0011
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-0241

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
266086 - Linux Distros Unpatched Vulnerability : CVE-2025-11082
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow.
The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ea1a0737c7692737a644af0486b71e4a392cbca8. A patch should be applied to remediate this issue. The code maintainer replied with [f]ixed for 2.46. (CVE-2025-11082)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-11082
https://security-tracker.debian.org/tracker/CVE-2025-11082

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.4 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-11082

Plugin Information
Published: 2025/09/29, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-13-binutils
- gcc-toolset-13-binutils-devel
- gcc-toolset-13-binutils-gold
- gcc-toolset-13-gdb
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
266084 - Linux Distros Unpatched Vulnerability : CVE-2025-11083
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended to deploy a patch. The code maintainer replied with [f]ixed for 2.46. (CVE-2025-11083)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-11083
https://security-tracker.debian.org/tracker/CVE-2025-11083
https://ubuntu.com/security/CVE-2025-11083

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.4 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
4.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-11083

Plugin Information
Published: 2025/09/29, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gcc-toolset-13-gdb
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
269461 - Linux Distros Unpatched Vulnerability : CVE-2025-11234
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after- free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication. (CVE-2025-11234)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-11234
https://security-tracker.debian.org/tracker/CVE-2025-11234
https://ubuntu.com/security/CVE-2025-11234

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-11234

Plugin Information
Published: 2025/10/08, Modified: 2025/10/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- qemu-guest-agent
277446 - Linux Distros Unpatched Vulnerability : CVE-2025-12084
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents. (CVE-2025-12084)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-12084
https://security-tracker.debian.org/tracker/CVE-2025-12084
https://ubuntu.com/security/CVE-2025-12084

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
6.3 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.0004
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-12084

Plugin Information
Published: 2025/12/04, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- python-unversioned-command
- python3
- python3-libs
230987 - Linux Distros Unpatched Vulnerability : CVE-2025-1215
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade the affected component. (CVE-2025-1215)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-1215
https://security-tracker.debian.org/tracker/CVE-2025-1215

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
2.4 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.4 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-1215

Plugin Information
Published: 2025/03/06, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
276681 - Linux Distros Unpatched Vulnerability : CVE-2025-13466
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic. This issue is addressed in version 2.2.1. (CVE-2025-13466)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-13466
https://ubuntu.com/security/CVE-2025-13466

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
6.9 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L)
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-13466

Plugin Information
Published: 2025/11/24, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gjs
- polkit
- polkit-libs
276961 - Linux Distros Unpatched Vulnerability : CVE-2025-13601
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string. (CVE-2025-13601)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-13601
https://security-tracker.debian.org/tracker/CVE-2025-13601
https://ubuntu.com/security/CVE-2025-13601

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.7 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0001
CVSS v2.0 Base Score
9.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:P/A:P)
CVSS v2.0 Temporal Score
7.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-13601

Plugin Information
Published: 2025/12/01, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- glib2
- glib2-devel
277959 - Linux Distros Unpatched Vulnerability : CVE-2025-14087
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings. (CVE-2025-14087)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-14087
https://security-tracker.debian.org/tracker/CVE-2025-14087
https://ubuntu.com/security/CVE-2025-14087

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
8.4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.002
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-14087

Plugin Information
Published: 2025/12/09, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- glib2
- glib2-devel
- librsvg2
- librsvg2-tools
277594 - Linux Distros Unpatched Vulnerability : CVE-2025-14104
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database. (CVE-2025-14104)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-14104
https://security-tracker.debian.org/tracker/CVE-2025-14104
https://ubuntu.com/security/CVE-2025-14104

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.2
EPSS Score
0.0001
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-14104

Plugin Information
Published: 2025/12/05, Modified: 2025/12/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libblkid
- libblkid-devel
- libfdisk
- libmount
- libmount-devel
- libsmartcols
- libuuid
- util-linux
- util-linux-core
- util-linux-user
280190 - Linux Distros Unpatched Vulnerability : CVE-2025-15284
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: <
6.14.1. SummaryThe arrayLimit option in qs does not enforce limits for bracket notation (a[]=1&a[]=2), allowing attackers to cause denial-of-service via memory exhaustion. Applications using arrayLimit for DoS protection are vulnerable. DetailsThe arrayLimit option only checks limits for indexed notation (a[0]=1&a[1]=2) but completely bypasses it for bracket notation (a[]=1&a[]=2). Vulnerable code (lib/parse.js:159-162): if (root === '[]' && options.parseArrays) { obj = utils.combine([], leaf); // No arrayLimit check } Working code (lib/parse.js:175): else if (index <= options.arrayLimit) { // Limit checked here obj = []; obj[index] = leaf; } The bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index <= options.arrayLimit before creating arrays. PoCTest 1 - Basic bypass: npm install qs const qs = require('qs'); const result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 });
console.log(result.a.length); // Output: 6 (should be max 5) Test 2 - DoS demonstration: const qs = require('qs'); const attack = 'a[]=' + Array(10000).fill('x').join('&a[]='); const result = qs.parse(attack, { arrayLimit: 100 }); console.log(result.a.length); // Output: 10000 (should be max 100) Configuration: * arrayLimit: 5 (test 1) or arrayLimit: 100 (test 2) * Use bracket notation: a[]=value (not indexed a[0]=value) ImpactDenial of Service via memory exhaustion. Affects applications using qs.parse() with user-controlled input and arrayLimit for protection. Attack scenario: * Attacker sends HTTP request:
GET /api/search?filters[]=x&filters[]=x&...&filters[]=x (100,000+ times) * Application parses with qs.parse(query, { arrayLimit: 100 }) * qs ignores limit, parses all 100,000 elements into array * Server memory exhausted application crashes or becomes unresponsive * Service unavailable for all users Real- world impact: * Single malicious request can crash server * No authentication required * Easy to automate and scale * Affects any endpoint parsing query strings with bracket notation (CVE-2025-15284)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-15284
https://security-tracker.debian.org/tracker/CVE-2025-15284

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0014
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-15284

Plugin Information
Published: 2025/12/30, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
- gjs
- polkit
- polkit-libs
245636 - Linux Distros Unpatched Vulnerability : CVE-2025-1943
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Memory safety bugs present in Firefox 135 and Thunderbird 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 136 and Thunderbird < 136. (CVE-2025-1943)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-1943
https://ubuntu.com/security/CVE-2025-1943

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
8.2 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
CVSS v3.0 Temporal Score
7.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.0
EPSS Score
0.0006
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-1943

Plugin Information
Published: 2025/08/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
231150 - Linux Distros Unpatched Vulnerability : CVE-2025-21692
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ets qdisc OOB Indexing Haowei Yan <g1042620637@gmail.com> found that ets_class_from_arg() can index an Out-Of-Bound class in ets_class_from_arg() when passed clid of 0. The overflow may cause local privilege escalation. [ 18.852298] ------------[ cut here ]------------ [ 18.853271] UBSAN: array-index-out-of-bounds in net/sched/sch_ets.c:93:20 [ 18.853743] index 18446744073709551615 is out of range for type 'ets_class [16]' [ 18.854254] CPU: 0 UID: 0 PID: 1275 Comm: poc Not tainted 6.12.6-dirty #17 [ 18.854821] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [ 18.856532] Call Trace: [ 18.857441] <TASK> [ 18.858227] dump_stack_lvl+0xc2/0xf0 [ 18.859607] dump_stack+0x10/0x20 [ 18.860908]
__ubsan_handle_out_of_bounds+0xa7/0xf0 [ 18.864022] ets_class_change+0x3d6/0x3f0 [ 18.864322] tc_ctl_tclass+0x251/0x910 [ 18.864587] ? lock_acquire+0x5e/0x140 [ 18.865113] ? __mutex_lock+0x9c/0xe70 [ 18.866009] ? __mutex_lock+0xa34/0xe70 [ 18.866401] rtnetlink_rcv_msg+0x170/0x6f0 [ 18.866806] ?
__lock_acquire+0x578/0xc10 [ 18.867184] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 18.867503] netlink_rcv_skb+0x59/0x110 [ 18.867776] rtnetlink_rcv+0x15/0x30 [ 18.868159] netlink_unicast+0x1c3/0x2b0 [ 18.868440] netlink_sendmsg+0x239/0x4b0 [ 18.868721] ____sys_sendmsg+0x3e2/0x410 [ 18.869012]
___sys_sendmsg+0x88/0xe0 [ 18.869276] ? rseq_ip_fixup+0x198/0x260 [ 18.869563] ? rseq_update_cpu_node_id+0x10a/0x190 [ 18.869900] ? trace_hardirqs_off+0x5a/0xd0 [ 18.870196] ? syscall_exit_to_user_mode+0xcc/0x220 [ 18.870547] ? do_syscall_64+0x93/0x150 [ 18.870821] ?
__memcg_slab_free_hook+0x69/0x290 [ 18.871157] __sys_sendmsg+0x69/0xd0 [ 18.871416]
__x64_sys_sendmsg+0x1d/0x30 [ 18.871699] x64_sys_call+0x9e2/0x2670 [ 18.871979] do_syscall_64+0x87/0x150 [ 18.873280] ? do_syscall_64+0x93/0x150 [ 18.874742] ? lock_release+0x7b/0x160 [ 18.876157] ? do_user_addr_fault+0x5ce/0x8f0 [ 18.877833] ? irqentry_exit_to_user_mode+0xc2/0x210 [ 18.879608] ? irqentry_exit+0x77/0xb0 [ 18.879808] ? clear_bhb_loop+0x15/0x70 [ 18.880023] ? clear_bhb_loop+0x15/0x70 [ 18.880223] ? clear_bhb_loop+0x15/0x70 [ 18.880426] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 18.880683] RIP: 0033:0x44a957 [ 18.880851] Code: ff ff e8 fc 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 8974 24 10 [ 18.881766] RSP: 002b:00007ffcdd00fad8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 18.882149] RAX: ffffffffffffffda RBX: 00007ffcdd010db8 RCX: 000000000044a957 [ 18.882507] RDX:
0000000000000000 RSI: 00007ffcdd00fb70 RDI: 0000000000000003 [ 18.885037] RBP: 00007ffcdd010bc0 R08:
000000000703c770 R09: 000000000703c7c0 [ 18.887203] R10: 0000000000000080 R11: 0000000000000246 R12:
0000000000000001 [ 18.888026] R13: 00007ffcdd010da8 R14: 00000000004ca7d0 R15: 0000000000000001 [ 18.888395] </TASK> [ 18.888610] ---[ end trace ]--- (CVE-2025-21692)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21692
https://ubuntu.com/security/CVE-2025-21692

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21692

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231755 - Linux Distros Unpatched Vulnerability : CVE-2025-21700
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: sched: Disallow replacing of child qdisc from one parent to another Lion Ackermann was able to create a UAF which can be abused for privilege escalation with the following script Step 1. create root qdisc tc qdisc add dev lo root handle 1:0 drr step2. a class for packet aggregation do demonstrate uaf tc class add dev lo classid 1:1 drr step3. a class for nesting tc class add dev lo classid 1:2 drr step4. a class to graft qdisc to tc class add dev lo classid 1:3 drr step5. tc qdisc add dev lo parent 1:1 handle 2:0 plug limit 1024 step6. tc qdisc add dev lo parent 1:2 handle 3:0 drr step7. tc class add dev lo classid 3:1 drr step 8. tc qdisc add dev lo parent 3:1 handle 4:0 pfifo step 9. Display the class/qdisc layout tc class ls dev lo class drr 1:1 root leaf 2: quantum 64Kb class drr 1:2 root leaf 3: quantum 64Kb class drr 3:1 root leaf 4: quantum 64Kb tc qdisc ls qdisc drr 1: dev lo root refcnt 2 qdisc plug 2: dev lo parent 1:1 qdisc pfifo 4: dev lo parent 3:1 limit 1000p qdisc drr 3: dev lo parent 1:2 step10. trigger the bug <=== prevented by this patch tc qdisc replace dev lo parent 1:3 handle 4:0 step 11. Redisplay again the qdiscs/classes tc class ls dev lo class drr 1:1 root leaf 2: quantum 64Kb class drr 1:2 root leaf 3:
quantum 64Kb class drr 1:3 root leaf 4: quantum 64Kb class drr 3:1 root leaf 4: quantum 64Kb tc qdisc ls qdisc drr 1: dev lo root refcnt 2 qdisc plug 2: dev lo parent 1:1 qdisc pfifo 4: dev lo parent 3:1 refcnt 2 limit 1000p qdisc drr 3: dev lo parent 1:2 Observe that a) parent for 4:0 does not change despite the replace request. There can only be one parent. b) refcount has gone up by two for 4:0 and c) both class 1:3 and 3:1 are pointing to it. Step 12. send one packet to plug echo | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10001)) step13. send one packet to the grafted fifo echo | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10003)) step14. lets trigger the uaf tc class delete dev lo classid 1:3 tc class delete dev lo classid 1:1 The semantics of replace is for a del/add
_on the same node_ and not a delete from one node(3:1) and add to another node (1:3) as in step10. While we could fix with a more complex approach there could be consequences to expectations so the patch takes the preventive approach of disallow such config. Joint work with Lion Ackermann <nnamrec@gmail.com>
(CVE-2025-21700)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21700
https://ubuntu.com/security/CVE-2025-21700

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21700

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231732 - Linux Distros Unpatched Vulnerability : CVE-2025-21719
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ipmr: do not call mr_mfc_uses_dev() for unres entries syzbot found that calling mr_mfc_uses_dev() for unres entries would crash [1], because c->mfc_un.res.minvif / c->mfc_un.res.maxvif alias to struct sk_buff_head unresolved, which contain two pointers. This code never worked, lets remove it. [1] Unable to handle kernel paging request at virtual address ffff5fff2d536613 KASAN: maybe wild-memory-access in range [0xfffefff96a9b3098-0xfffefff96a9b309f] Modules linked in: CPU: 1 UID: 0 PID: 7321 Comm: syz.0.16 Not tainted 6.13.0-rc7-syzkaller-g1950a0af2d55 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 pstate:
80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline] pc : mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334 lr : mr_mfc_uses_dev net/ipv4/ipmr_base.c:289 [inline] lr : mr_table_dump+0x694/0x8b0 net/ipv4/ipmr_base.c:334 Call trace:
mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline] (P) mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334 (P) mr_rtm_dumproute+0x254/0x454 net/ipv4/ipmr_base.c:382 ipmr_rtm_dumproute+0x248/0x4b4 net/ipv4/ipmr.c:2648 rtnl_dump_all+0x2e4/0x4e8 net/core/rtnetlink.c:4327 rtnl_dumpit+0x98/0x1d0 net/core/rtnetlink.c:6791 netlink_dump+0x4f0/0xbc0 net/netlink/af_netlink.c:2317 netlink_recvmsg+0x56c/0xe64 net/netlink/af_netlink.c:1973 sock_recvmsg_nosec net/socket.c:1033 [inline] sock_recvmsg net/socket.c:1055 [inline] sock_read_iter+0x2d8/0x40c net/socket.c:1125 new_sync_read fs/read_write.c:484 [inline] vfs_read+0x740/0x970 fs/read_write.c:565 ksys_read+0x15c/0x26c fs/read_write.c:708 (CVE-2025-21719)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21719
https://ubuntu.com/security/CVE-2025-21719

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0004
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21719

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230695 - Linux Distros Unpatched Vulnerability : CVE-2025-21724
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: iommufd/iova_bitmap: Fix shift-out-of- bounds in iova_bitmap_offset_to_index() Resolve a UBSAN shift-out-of-bounds issue in iova_bitmap_offset_to_index() where shifting the constant 1 (of type int) by bitmap->mapped.pgshift (an unsigned long value) could result in undefined behavior. The constant 1 defaults to a 32-bit int, and when pgshift exceeds 31 (e.g., pgshift = 63) the shift operation overflows, as the result cannot be represented in a 32-bit type. To resolve this, the constant is updated to 1UL, promoting it to an unsigned long type to match the operand's type. (CVE-2025-21724)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21724
https://ubuntu.com/security/CVE-2025-21724

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21724

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231353 - Linux Distros Unpatched Vulnerability : CVE-2025-21731
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nbd: don't allow reconnect after disconnect Following process can cause nbd_config UAF: 1) grab nbd_config temporarily; 2) nbd_genl_disconnect() flush all recv_work() and release the initial reference:
nbd_genl_disconnect nbd_disconnect_and_put nbd_disconnect flush_workqueue(nbd->recv_workq) if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, ...)) nbd_config_put -> due to step 1), reference is still not zero 3) nbd_genl_reconfigure() queue recv_work() again; nbd_genl_reconfigure config = nbd_get_config_unlocked(nbd) if (!config) -> succeed if (!test_bit(NBD_RT_BOUND, ...)) -> succeed nbd_reconnect_socket queue_work(nbd->recv_workq, &args->work) 4) step 1) release the reference; 5) Finially, recv_work() will trigger UAF: recv_work nbd_config_put(nbd) -> nbd_config is freed atomic_dec(&config->recv_threads) -> UAF Fix the problem by clearing NBD_RT_BOUND in nbd_genl_disconnect(), so that nbd_genl_reconfigure() will fail. (CVE-2025-21731)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21731
https://ubuntu.com/security/CVE-2025-21731

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21731

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230782 - Linux Distros Unpatched Vulnerability : CVE-2025-21760
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ndisc: extend RCU protection in ndisc_send_skb() ndisc_send_skb() can be called without RTNL or RCU held.
Acquire rcu_read_lock() earlier, so that we can use dev_net_rcu() and avoid a potential UAF.
(CVE-2025-21760)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21760
https://ubuntu.com/security/CVE-2025-21760

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21760

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230858 - Linux Distros Unpatched Vulnerability : CVE-2025-21761
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: openvswitch: use RCU protection in ovs_vport_cmd_fill_info() ovs_vport_cmd_fill_info() can be called without RTNL or RCU. Use RCU protection and dev_net_rcu() to avoid potential UAF. (CVE-2025-21761)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21761
https://ubuntu.com/security/CVE-2025-21761

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21761

Plugin Information
Published: 2025/03/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231418 - Linux Distros Unpatched Vulnerability : CVE-2025-21762
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- arp: use RCU protection in arp_xmit() arp_xmit() can be called without RTNL or RCU protection. Use RCU protection to avoid potential UAF. (CVE-2025-21762)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21762
https://ubuntu.com/security/CVE-2025-21762

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21762

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230479 - Linux Distros Unpatched Vulnerability : CVE-2025-21763
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- neighbour: use RCU protection in __neigh_notify() __neigh_notify() can be called without RTNL or RCU protection. Use RCU protection to avoid potential UAF. (CVE-2025-21763)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21763
https://ubuntu.com/security/CVE-2025-21763

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21763

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230870 - Linux Distros Unpatched Vulnerability : CVE-2025-21772
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- partitions: mac: fix handling of bogus partition table Fix several issues in partition probing: - The bailout for a bad partoffset must use put_dev_sector(), since the preceding read_part_sector() succeeded.
- If the partition table claims a silly sector size like 0xfff bytes (which results in partition table entries straddling sector boundaries), bail out instead of accessing out-of-bounds memory. - We must not assume that the partition table contains proper NUL termination - use strnlen() and strncmp() instead of strlen() and strcmp(). (CVE-2025-21772)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21772
https://ubuntu.com/security/CVE-2025-21772

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21772

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246258 - Linux Distros Unpatched Vulnerability : CVE-2025-21856
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: s390/ism: add release function for struct device According to device_release() in /drivers/base/core.c, a device without a release function is a broken device and must be fixed. The current code directly frees the device after calling device_add() without waiting for other kernel parts to release their references. Thus, a reference could still be held to a struct device, e.g., by sysfs, leading to potential use-after-free issues if a proper release function is not set. (CVE-2025-21856)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21856
https://ubuntu.com/security/CVE-2025-21856

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21856

Plugin Information
Published: 2025/08/08, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248402 - Linux Distros Unpatched Vulnerability : CVE-2025-21858
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- geneve: Fix use-after-free in geneve_find_dev(). syzkaller reported a use-after-free in geneve_find_dev() [0] without repro. geneve_configure() links struct geneve_dev.next to net_generic(net, geneve_net_id)->geneve_list. The net here could differ from dev_net(dev) if IFLA_NET_NS_PID, IFLA_NET_NS_FD, or IFLA_TARGET_NETNSID is set. When dev_net(dev) is dismantled, geneve_exit_batch_rtnl() finally calls unregister_netdevice_queue() for each dev in the netns, and later the dev is freed. However, its geneve_dev.next is still linked to the backend UDP socket netns. Then, use-after-free will occur when another geneve dev is created in the netns. Let's call geneve_dellink() instead in geneve_destroy_tunnels(). [0]: BUG: KASAN: slab-use-after-free in geneve_find_dev drivers/net/geneve.c:1295 [inline] BUG: KASAN: slab-use-after-free in geneve_configure+0x234/0x858 drivers/net/geneve.c:1343 Read of size 2 at addr ffff000054d6ee24 by task syz.1.4029/13441 CPU: 1 UID: 0 PID: 13441 Comm: syz.1.4029 Not tainted 6.13.0-g0ad9617c78ac #24 dc35ca22c79fb82e8e7bc5c9c9adafea898b1e3d Hardware name: linux,dummy-virt (DT) Call trace: show_stack+0x38/0x50 arch/arm64/kernel/stacktrace.c:466 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xbc/0x108 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x16c/0x6f0 mm/kasan/report.c:489 kasan_report+0xc0/0x120 mm/kasan/report.c:602 __asan_report_load2_noabort+0x20/0x30 mm/kasan/report_generic.c:379 geneve_find_dev drivers/net/geneve.c:1295 [inline] geneve_configure+0x234/0x858 drivers/net/geneve.c:1343 geneve_newlink+0xb8/0x128 drivers/net/geneve.c:1634 rtnl_newlink_create+0x23c/0x868 net/core/rtnetlink.c:3795 __rtnl_newlink net/core/rtnetlink.c:3906 [inline] rtnl_newlink+0x1054/0x1630 net/core/rtnetlink.c:4021 rtnetlink_rcv_msg+0x61c/0x918 net/core/rtnetlink.c:6911 netlink_rcv_skb+0x1dc/0x398 net/netlink/af_netlink.c:2543 rtnetlink_rcv+0x34/0x50 net/core/rtnetlink.c:6938 netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline] netlink_unicast+0x618/0x838 net/netlink/af_netlink.c:1348 netlink_sendmsg+0x5fc/0x8b0 net/netlink/af_netlink.c:1892 sock_sendmsg_nosec net/socket.c:713 [inline] __sock_sendmsg net/socket.c:728 [inline] ____sys_sendmsg+0x410/0x6f8 net/socket.c:2568 ___sys_sendmsg+0x178/0x1d8 net/socket.c:2622
__sys_sendmsg net/socket.c:2654 [inline] __do_sys_sendmsg net/socket.c:2659 [inline] __se_sys_sendmsg net/socket.c:2657 [inline] __arm64_sys_sendmsg+0x12c/0x1c8 net/socket.c:2657 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x90/0x278 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x13c/0x250 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x54/0x70 arch/arm64/kernel/syscall.c:151 el0_svc+0x4c/0xa8 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x1a0 arch/arm64/kernel/entry.S:600 Allocated by task 13247: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x30/0x68 mm/kasan/common.c:68 kasan_save_alloc_info+0x44/0x58 mm/kasan/generic.c:568 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x84/0xa0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4298 [inline]
__kmalloc_node_noprof+0x2a0/0x560 mm/slub.c:4304 __kvmalloc_node_noprof+0x9c/0x230 mm/util.c:645 alloc_netdev_mqs+0xb8/0x11a0 net/core/dev.c:11470 rtnl_create_link+0x2b8/0xb50 net/core/rtnetlink.c:3604 rtnl_newlink_create+0x19c/0x868 net/core/rtnetlink.c:3780 __rtnl_newlink net/core/rtnetlink.c:3906 [inline] rtnl_newlink+0x1054/0x1630 net/core/rtnetlink.c:4021 rtnetlink_rcv_msg+0x61c/0x918 net/core/rtnetlink.c:6911 netlink_rcv_skb+0x1dc/0x398 net/netlink/af_netlink.c:2543 rtnetlink_rcv+0x34/0x50 net/core/rtnetlink.c:6938 netlink_unicast_kernel net/netlink/af_n ---truncated--- (CVE-2025-21858)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21858
https://ubuntu.com/security/CVE-2025-21858

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21858

Plugin Information
Published: 2025/08/11, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245199 - Linux Distros Unpatched Vulnerability : CVE-2025-21869
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: powerpc/code-patching: Disable KASAN report during patching via temporary mm Erhard reports the following KASAN hit on Talos II (power9) with kernel 6.13: [ 12.028126] ================================================================== [ 12.028198] BUG: KASAN: user-memory-access in copy_to_kernel_nofault+0x8c/0x1a0 [ 12.028260] Write of size 8 at addr 0000187e458f2000 by task systemd/1 [ 12.028346] CPU: 87 UID: 0 PID: 1 Comm: systemd Tainted: G T 6.13.0-P9-dirty #3 [ 12.028408] Tainted: [T]=RANDSTRUCT [ 12.028446] Hardware name: T2P9D01 REV 1.01 POWER9 0x4e1202 opal:skiboot-bc106a0 PowerNV [ 12.028500] Call Trace: [ 12.028536] [c000000008dbf3b0] [c000000001656a48] dump_stack_lvl+0xbc/0x110 (unreliable) [ 12.028609] [c000000008dbf3f0] [c0000000006e2fc8] print_report+0x6b0/0x708 [ 12.028666] [c000000008dbf4e0] [c0000000006e2454] kasan_report+0x164/0x300 [ 12.028725] [c000000008dbf600] [c0000000006e54d4] kasan_check_range+0x314/0x370 [ 12.028784] [c000000008dbf640] [c0000000006e6310] __kasan_check_write+0x20/0x40 [ 12.028842] [c000000008dbf660] [c000000000578e8c] copy_to_kernel_nofault+0x8c/0x1a0 [ 12.028902] [c000000008dbf6a0] [c0000000000acfe4] __patch_instructions+0x194/0x210 [ 12.028965] [c000000008dbf6e0] [c0000000000ade80] patch_instructions+0x150/0x590 [ 12.029026] [c000000008dbf7c0] [c0000000001159bc] bpf_arch_text_copy+0x6c/0xe0 [ 12.029085] [c000000008dbf800] [c000000000424250] bpf_jit_binary_pack_finalize+0x40/0xc0 [ 12.029147] [c000000008dbf830] [c000000000115dec] bpf_int_jit_compile+0x3bc/0x930 [ 12.029206] [c000000008dbf990] [c000000000423720] bpf_prog_select_runtime+0x1f0/0x280 [ 12.029266] [c000000008dbfa00] [c000000000434b18] bpf_prog_load+0xbb8/0x1370 [ 12.029324] [c000000008dbfb70] [c000000000436ebc] __sys_bpf+0x5ac/0x2e00 [ 12.029379] [c000000008dbfd00] [c00000000043a228] sys_bpf+0x28/0x40 [ 12.029435] [c000000008dbfd20] [c000000000038eb4] system_call_exception+0x334/0x610 [ 12.029497] [c000000008dbfe50] [c00000000000c270] system_call_vectored_common+0xf0/0x280 [ 12.029561] --- interrupt: 3000 at 0x3fff82f5cfa8 [ 12.029608] NIP: 00003fff82f5cfa8 LR: 00003fff82f5cfa8 CTR: 0000000000000000 [ 12.029660] REGS: c000000008dbfe80 TRAP:
3000 Tainted: G T (6.13.0-P9-dirty) [ 12.029735] MSR: 900000000280f032 <SF,HV,VEC,VSX,EE,PR,FP,ME,IR,DR,RI> CR: 42004848 XER: 00000000 [ 12.029855] IRQMASK: 0 GPR00:
0000000000000169 00003fffdcf789a0 00003fff83067100 0000000000000005 GPR04: 00003fffdcf78a98 0000000000000090 0000000000000000 0000000000000008 GPR08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR12: 0000000000000000 00003fff836ff7e0 c000000000010678 0000000000000000 GPR16: 0000000000000000 0000000000000000 00003fffdcf78f28 00003fffdcf78f90 GPR20:
0000000000000000 0000000000000000 0000000000000000 00003fffdcf78f80 GPR24: 00003fffdcf78f70 00003fffdcf78d10 00003fff835c7239 00003fffdcf78bd8 GPR28: 00003fffdcf78a98 0000000000000000 0000000000000000 000000011f547580 [ 12.030316] NIP [00003fff82f5cfa8] 0x3fff82f5cfa8 [ 12.030361] LR [00003fff82f5cfa8] 0x3fff82f5cfa8 [ 12.030405] --- interrupt: 3000 [ 12.030444] ================================================================== Commit c28c15b6d28a (powerpc/code- patching: Use temporary mm for Radix MMU) is inspired from x86 but unlike x86 is doesn't disable KASAN reports during patching. This wasn't a problem at the begining because __patch_mem() is not instrumented.
Commit 465cabc97b42 (powerpc/code-patching: introduce patch_instructions()) use copy_to_kernel_nofault() to copy several instructions at once. But when using temporary mm the destination is not regular kernel memory but a kind of kernel-like memory located in user address space. ---truncated--- (CVE-2025-21869)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21869
https://ubuntu.com/security/CVE-2025-21869

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21869

Plugin Information
Published: 2025/08/07, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248069 - Linux Distros Unpatched Vulnerability : CVE-2025-23133
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath11k: update channel list in reg notifier instead reg worker Currently when ath11k gets a new channel list, it will be processed according to the following steps: 1. update new channel list to cfg80211 and queue reg_work. 2. cfg80211 handles new channel list during reg_work. 3. update cfg80211's handled channel list to firmware by ath11k_reg_update_chan_list(). But ath11k will immediately execute step 3 after reg_work is just queued. Since step 2 is asynchronous, cfg80211 may not have completed handling the new channel list, which may leading to an out-of-bounds write error: BUG: KASAN: slab-out-of- bounds in ath11k_reg_update_chan_list Call Trace: ath11k_reg_update_chan_list+0xbfe/0xfe0 [ath11k] kfree+0x109/0x3a0 ath11k_regd_update+0x1cf/0x350 [ath11k] ath11k_regd_update_work+0x14/0x20 [ath11k] process_one_work+0xe35/0x14c0 Should ensure step 2 is completely done before executing step 3. Thus Wen raised patch[1]. When flag NL80211_REGDOM_SET_BY_DRIVER is set, cfg80211 will notify ath11k after step 2 is done. So enable the flag NL80211_REGDOM_SET_BY_DRIVER then cfg80211 will notify ath11k after step 2 is done. At this time, there will be no KASAN bug during the execution of the step 3. [1] https://patchwork.kernel.org/project/linux-wireless/patch/20230201065313.27203-1-quic_wgong@quicinc.com/ Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3 (CVE-2025-23133)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-23133
https://security-tracker.debian.org/tracker/CVE-2025-23133
https://ubuntu.com/security/CVE-2025-23133

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-23133

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247711 - Linux Distros Unpatched Vulnerability : CVE-2025-23142
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sctp: detect and prevent references to a freed transport in sendmsg sctp_sendmsg() re-uses associations and transports when possible by doing a lookup based on the socket endpoint and the message destination address, and then sctp_sendmsg_to_asoc() sets the selected transport in all the message chunks to be sent.
There's a possible race condition if another thread triggers the removal of that selected transport, for instance, by explicitly unbinding an address with setsockopt(SCTP_SOCKOPT_BINDX_REM), after the chunks have been set up and before the message is sent. This can happen if the send buffer is full, during the period when the sender thread temporarily releases the socket lock in sctp_wait_for_sndbuf(). This causes the access to the transport data in sctp_outq_select_transport(), when the association outqueue is flushed, to result in a use-after-free read. This change avoids this scenario by having sctp_transport_free() signal the freeing of the transport, tagging it as dead. In order to do this, the patch restores the dead bit in struct sctp_transport, which was removed in commit 47faa1e4c50e (sctp:
remove the dead field of sctp_transport). Then, in the scenario where the sender thread has released the socket lock in sctp_wait_for_sndbuf(), the bit is checked again after re-acquiring the socket lock to detect the deletion. This is done while holding a reference to the transport to prevent it from being freed in the process. If the transport was deleted while the socket lock was relinquished, sctp_sendmsg_to_asoc() will return -EAGAIN to let userspace retry the send. The bug was found by a private syzbot instance (see the error report [1] and the C reproducer that triggers it [2]). (CVE-2025-23142)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-23142
https://ubuntu.com/security/CVE-2025-23142

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-23142

Plugin Information
Published: 2025/08/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271186 - Linux Distros Unpatched Vulnerability : CVE-2025-23282
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NVIDIA Display Driver for Linux contains a vulnerability where an attacker might be able to use a race condition to escalate privileges. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure. (CVE-2025-23282)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-23282
https://security-tracker.debian.org/tracker/CVE-2025-23282
https://ubuntu.com/security/CVE-2025-23282

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-23282

Plugin Information
Published: 2025/10/22, Modified: 2025/12/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- qemu-guest-agent
230320 - Linux Distros Unpatched Vulnerability : CVE-2025-24150
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A privacy issue was addressed with improved handling of files. This issue is fixed in macOS Sequoia 15.3, Safari 18.3, iOS 18.3 and iPadOS 18.3. Copying a URL from Web Inspector may lead to command injection.
(CVE-2025-24150)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-24150
https://security-tracker.debian.org/tracker/CVE-2025-24150
https://ubuntu.com/security/CVE-2025-24150

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0022
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-24150

Plugin Information
Published: 2025/03/06, Modified: 2025/08/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- webkit2gtk3
- webkit2gtk3-jsc
260205 - Linux Distros Unpatched Vulnerability : CVE-2025-27113
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c. (CVE-2025-27113)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-27113

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-27113

Plugin Information
Published: 2025/09/01, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libxml2
- libxml2-devel
- python3-libxml2
260215 - Linux Distros Unpatched Vulnerability : CVE-2025-27830
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs during serialization of DollarBlend in a font, for base/write_t1.c and psi/zfapi.c. (CVE-2025-27830)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-27830

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0001
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-27830

Plugin Information
Published: 2025/09/01, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- ghostscript
- ghostscript-tools-fonts
- ghostscript-tools-printing
- libgs
260295 - Linux Distros Unpatched Vulnerability : CVE-2025-27833
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a long TTF font name to pdf/pdf_fmap.c. (CVE-2025-27833)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-27833

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0001
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-27833

Plugin Information
Published: 2025/09/02, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- ghostscript
- ghostscript-tools-fonts
- ghostscript-tools-printing
- libgs
260291 - Linux Distros Unpatched Vulnerability : CVE-2025-27834
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs via an oversized Type 4 function in a PDF document to pdf/pdf_func.c. (CVE-2025-27834)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-27834

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0001
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-27834

Plugin Information
Published: 2025/09/02, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- ghostscript
- ghostscript-tools-fonts
- ghostscript-tools-printing
- libgs
260289 - Linux Distros Unpatched Vulnerability : CVE-2025-27835
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs when converting glyphs to Unicode in psi/zbfont.c. (CVE-2025-27835)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-27835

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0001
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-27835

Plugin Information
Published: 2025/09/02, Modified: 2025/09/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- ghostscript
- ghostscript-tools-fonts
- ghostscript-tools-printing
- libgs
260220 - Linux Distros Unpatched Vulnerability : CVE-2025-30218
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persisted across multiple incoming requests. However, this subrequest ID is sent to all requests, even if the destination is not the same host as the Next.js application. Initiating a fetch request to a third-party within Middleware will send the x-middleware- subrequest-id to that third party. This vulnerability is fixed in 12.3.6, 13.5.10, 14.2.26, and 15.2.4.
(CVE-2025-30218)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-30218

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-30218

Plugin Information
Published: 2025/09/01, Modified: 2025/09/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- dotnet-host
- firefox
- netstandard-targeting-pack-2.1
244515 - Linux Distros Unpatched Vulnerability : CVE-2025-3032
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Leaking of file descriptors from the fork server to web content processes could allow for privilege escalation attacks. This vulnerability affects Firefox < 137 and Thunderbird < 137. (CVE-2025-3032)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-3032
https://ubuntu.com/security/CVE-2025-3032

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.4 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-3032

Plugin Information
Published: 2025/08/06, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
234198 - Linux Distros Unpatched Vulnerability : CVE-2025-31344
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C. This issue affects giflib: through 5.2.2. (CVE-2025-31344)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-31344
https://security-tracker.debian.org/tracker/CVE-2025-31344
https://ubuntu.com/security/CVE-2025-31344

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.5
EPSS Score
0.0001
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-31344

Plugin Information
Published: 2025/04/11, Modified: 2025/10/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- giflib
251303 - Linux Distros Unpatched Vulnerability : CVE-2025-32365
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check. (CVE-2025-32365)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-32365

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0001
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-32365

Plugin Information
Published: 2025/08/18, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- poppler
- poppler-cpp
- poppler-glib
- poppler-utils
248684 - Linux Distros Unpatched Vulnerability : CVE-2025-37761
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/xe: Fix an out-of-bounds shift when invalidating TLB When the size of the range invalidated is larger than rounddown_pow_of_two(ULONG_MAX), The function macro roundup_pow_of_two(length) will hit an out-of- bounds shift [1]. Use a full TLB invalidation for such cases. v2: - Use a define for the range size limit over which we use a full TLB invalidation. (Lucas) - Use a better calculation of the limit. [1]: [ 39.202421] ------------[ cut here ]------------ [ 39.202657] UBSAN: shift-out-of-bounds in ./include/linux/log2.h:57:13 [ 39.202673] shift exponent 64 is too large for 64-bit type 'long unsigned int' [ 39.202688] CPU: 8 UID: 0 PID: 3129 Comm: xe_exec_system_ Tainted: G U 6.14.0+ #10 [ 39.202690] Tainted: [U]=USER [ 39.202690] Hardware name: ASUS System Product Name/PRIME B560M-A AC, BIOS 2001 02/01/2023 [ 39.202691] Call Trace: [ 39.202692] <TASK> [ 39.202695] dump_stack_lvl+0x6e/0xa0 [ 39.202699] ubsan_epilogue+0x5/0x30 [ 39.202701] __ubsan_handle_shift_out_of_bounds.cold+0x61/0xe6 [ 39.202705] xe_gt_tlb_invalidation_range.cold+0x1d/0x3a [xe] [ 39.202800] ? find_held_lock+0x2b/0x80 [ 39.202803] ? mark_held_locks+0x40/0x70 [ 39.202806] xe_svm_invalidate+0x459/0x700 [xe] [ 39.202897] drm_gpusvm_notifier_invalidate+0x4d/0x70 [drm_gpusvm] [ 39.202900] __mmu_notifier_release+0x1f5/0x270 [ 39.202905] exit_mmap+0x40e/0x450 [ 39.202912] __mmput+0x45/0x110 [ 39.202914] exit_mm+0xc5/0x130 [ 39.202916] do_exit+0x21c/0x500 [ 39.202918] ? lockdep_hardirqs_on_prepare+0xdb/0x190 [ 39.202920] do_group_exit+0x36/0xa0 [ 39.202922] get_signal+0x8f8/0x900 [ 39.202926] arch_do_signal_or_restart+0x35/0x100 [ 39.202930] syscall_exit_to_user_mode+0x1fc/0x290 [ 39.202932] do_syscall_64+0xa1/0x180 [ 39.202934] ? do_user_addr_fault+0x59f/0x8a0 [ 39.202937] ? lock_release+0xd2/0x2a0 [ 39.202939] ? do_user_addr_fault+0x5a9/0x8a0 [ 39.202942] ? trace_hardirqs_off+0x4b/0xc0 [ 39.202944] ? clear_bhb_loop+0x25/0x80 [ 39.202946] ? clear_bhb_loop+0x25/0x80 [ 39.202947] ? clear_bhb_loop+0x25/0x80 [ 39.202950] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 39.202952] RIP: 0033:0x7fa945e543e1 [ 39.202961] Code: Unable to access opcode bytes at 0x7fa945e543b7. [ 39.202962] RSP: 002b:00007ffca8fb4170 EFLAGS: 00000293 [ 39.202963] RAX: 000000000000003d RBX: 0000000000000000 RCX: 00007fa945e543e3 [ 39.202964] RDX:
0000000000000000 RSI: 00007ffca8fb41ac RDI: 00000000ffffffff [ 39.202964] RBP: 00007ffca8fb4190 R08:
0000000000000000 R09: 00007fa945f600a0 [ 39.202965] R10: 0000000000000000 R11: 0000000000000293 R12:
0000000000000000 [ 39.202966] R13: 00007fa9460dd310 R14: 00007ffca8fb41ac R15: 0000000000000000 [ 39.202970] </TASK> [ 39.202970] ---[ end trace ]--- (cherry picked from commit b88f48f86500bc0b44b4f73ac66d500a40d320ad) (CVE-2025-37761)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37761
https://ubuntu.com/security/CVE-2025-37761

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37761

Plugin Information
Published: 2025/08/12, Modified: 2026/01/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245766 - Linux Distros Unpatched Vulnerability : CVE-2025-37789
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: openvswitch: fix nested key length validation in the set() action It's not safe to access nla_len(ovs_key) if the data is smaller than the netlink header. Check that the attribute is OK first.
(CVE-2025-37789)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37789
https://ubuntu.com/security/CVE-2025-37789

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37789

Plugin Information
Published: 2025/08/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247051 - Linux Distros Unpatched Vulnerability : CVE-2025-37798
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() After making all ->qlen_notify() callbacks idempotent, now it is safe to remove the check of qlen!=0 from both fq_codel_dequeue() and codel_qdisc_dequeue(). (CVE-2025-37798)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37798
https://ubuntu.com/security/CVE-2025-37798

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37798

Plugin Information
Published: 2025/08/09, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
253034 - Linux Distros Unpatched Vulnerability : CVE-2025-37819
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() With ACPI in place, gicv2m_get_fwnode() is registered with the pci subsystem as pci_msi_get_fwnode_cb(), which may get invoked at runtime during a PCI host bridge probe. But, the call back is wrongly marked as __init, causing it to be freed, while being registered with the PCI subsystem and could trigger: Unable to handle kernel paging request at virtual address ffff8000816c0400 gicv2m_get_fwnode+0x0/0x58 (P) pci_set_bus_msi_domain+0x74/0x88 pci_register_host_bridge+0x194/0x548 This is easily reproducible on a Juno board with ACPI boot. Retain the function for later use. (CVE-2025-37819)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37819
https://ubuntu.com/security/CVE-2025-37819

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37819

Plugin Information
Published: 2025/08/20, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244566 - Linux Distros Unpatched Vulnerability : CVE-2025-37825
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: nvmet: fix out-of-bounds access in nvmet_enable_port When trying to enable a port that has no transport configured yet, nvmet_enable_port() uses NVMF_TRTYPE_MAX (255) to query the transports array, causing an out-of-bounds access: [ 106.058694] BUG: KASAN: global-out-of-bounds in nvmet_enable_port+0x42/0x1da [ 106.058719] Read of size 8 at addr ffffffff89dafa58 by task ln/632 [...] [ 106.076026] nvmet: transport type 255 not supported Since commit 200adac75888, NVMF_TRTYPE_MAX is the default state as configured by nvmet_ports_make(). Avoid this by checking for NVMF_TRTYPE_MAX before proceeding. (CVE-2025-37825)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37825
https://ubuntu.com/security/CVE-2025-37825

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37825

Plugin Information
Published: 2025/08/07, Modified: 2025/12/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245274 - Linux Distros Unpatched Vulnerability : CVE-2025-37839
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- jbd2: remove wrong sb->s_sequence check Journal emptiness is not determined by sb->s_sequence == 0 but rather by sb->s_start == 0 (which is set a few lines above). Furthermore 0 is a valid transaction ID so the check can spuriously trigger. Remove the invalid WARN_ON. (CVE-2025-37839)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37839
https://ubuntu.com/security/CVE-2025-37839

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37839

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248024 - Linux Distros Unpatched Vulnerability : CVE-2025-37846
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- arm64: mops: Do not dereference src reg for a set operation The source register is not used for SET* and reading it can result in a UBSAN out-of-bounds array access error, specifically when the MOPS exception is taken from a SET* sequence with XZR (reg 31) as the source. Architecturally this is the only case where a src/dst/size field in the ESR can be reported as 31. Prior to 2de451a329cf662b the code in do_el0_mops() was benign as the use of pt_regs_read_reg() prevented the out-of-bounds access. (CVE-2025-37846)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37846
https://ubuntu.com/security/CVE-2025-37846

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37846

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246999 - Linux Distros Unpatched Vulnerability : CVE-2025-37849
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- KVM: arm64: Tear down vGIC on failed vCPU creation If kvm_arch_vcpu_create() fails to share the vCPU page with the hypervisor, we propagate the error back to the ioctl but leave the vGIC vCPU data initialised.
Note only does this leak the corresponding memory when the vCPU is destroyed but it can also lead to use- after-free if the redistributor device handling tries to walk into the vCPU. Add the missing cleanup to kvm_arch_vcpu_create(), ensuring that the vGIC vCPU structures are destroyed on error. (CVE-2025-37849)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37849
https://security-tracker.debian.org/tracker/CVE-2025-37849
https://ubuntu.com/security/CVE-2025-37849

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37849

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246525 - Linux Distros Unpatched Vulnerability : CVE-2025-37861
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue When the task management thread processes reply queues while the reset thread resets them, the task management thread accesses an invalid queue ID (0xFFFF), set by the reset thread, which points to unallocated memory, causing a crash. Add flag 'io_admin_reset_sync' to synchronize access between the reset, I/O, and admin threads. Before a reset, the reset handler sets this flag to block I/O and admin processing threads. If any thread bypasses the initial check, the reset thread waits up to 10 seconds for processing to finish. If the wait exceeds 10 seconds, the controller is marked as unrecoverable. (CVE-2025-37861)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37861
https://security-tracker.debian.org/tracker/CVE-2025-37861
https://ubuntu.com/security/CVE-2025-37861

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37861

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246565 - Linux Distros Unpatched Vulnerability : CVE-2025-37869
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/xe: Use local fence in error path of xe_migrate_clear The intent of the error path in xe_migrate_clear is to wait on locally generated fence and then return. The code is waiting on m->fence which could be the local fence but this is only stable under the job mutex leading to a possible UAF. Fix code to wait on local fence. (cherry picked from commit 762b7e95362170b3e13a8704f38d5e47eca4ba74) (CVE-2025-37869)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37869
https://ubuntu.com/security/CVE-2025-37869

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37869

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247323 - Linux Distros Unpatched Vulnerability : CVE-2025-37882
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: xhci: Fix isochronous Ring Underrun/Overrun event handling The TRB pointer of these events points at enqueue at the time of error occurrence on xHCI 1.1+ HCs or it's NULL on older ones. By the time we are handling the event, a new TD may be queued at this ring position. I can trigger this race by rising interrupt moderation to increase IRQ handling delay. Similar delay may occur naturally due to system load.
If this ever happens after a Missed Service Error, missed TDs will be skipped and the new TD processed as if it matched the event. It could be given back prematurely, risking data loss or buffer UAF by the xHC.
Don't complete TDs on xrun events and don't warn if queued TDs don't match the event's TRB pointer, which can be NULL or a link/no-op TRB. Don't warn if there are no queued TDs at all. Now that it's safe, also handle xrun events if the skip flag is clear. This ensures completion of any TD stuck in 'error mid TD'
state right before the xrun event, which could happen if a driver submits a finite number of URBs to a buggy HC and then an error occurs on the last TD. (CVE-2025-37882)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37882
https://ubuntu.com/security/CVE-2025-37882

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37882

Plugin Information
Published: 2025/08/10, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249642 - Linux Distros Unpatched Vulnerability : CVE-2025-37885
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- KVM: x86: Reset IRTE to host control if *new* route isn't postable Restore an IRTE back to host control (remapped or posted MSI mode) if the *new* GSI route prevents posting the IRQ directly to a vCPU, regardless of the GSI routing type. Updating the IRTE if and only if the new GSI is an MSI results in KVM leaving an IRTE posting to a vCPU. The dangling IRTE can result in interrupts being incorrectly delivered to the guest, and in the worst case scenario can result in use-after-free, e.g. if the VM is torn down, but the underlying host IRQ isn't freed. (CVE-2025-37885)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37885
https://ubuntu.com/security/CVE-2025-37885

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37885

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246473 - Linux Distros Unpatched Vulnerability : CVE-2025-37891
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion The conversion function from MIDI 1.0 to UMP packet contains an internal buffer to keep the incoming MIDI bytes, and its size is 4, as it was supposed to be the max size for a MIDI1 UMP packet data. However, the implementation overlooked that SysEx is handled in a different format, and it can be up to 6 bytes, as found in do_convert_to_ump(). It leads eventually to a buffer overflow, and may corrupt the memory when a longer SysEx message is received. The fix is simply to extend the buffer size to 6 to fit with the SysEx UMP message. (CVE-2025-37891)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37891
https://ubuntu.com/security/CVE-2025-37891

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37891

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250151 - Linux Distros Unpatched Vulnerability : CVE-2025-37921
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry When a VNI is deleted from a VXLAN device in 'vnifilter' mode, the FDB entry associated with the default remote (assuming one was configured) is deleted without holding the hash lock. This is wrong and will result in a warning [1] being generated by the lockdep annotation that was added by commit ebe642067455 (vxlan: Create wrappers for FDB lookup).
Reproducer: # ip link add vx0 up type vxlan dstport 4789 external vnifilter local 192.0.2.1 # bridge vni add vni 10010 remote 198.51.100.1 dev vx0 # bridge vni del vni 10010 dev vx0 Fix by acquiring the hash lock before the deletion and releasing it afterwards. Blame the original commit that introduced the issue rather than the one that exposed it. [1] WARNING: CPU: 3 PID: 392 at drivers/net/vxlan/vxlan_core.c:417 vxlan_find_mac+0x17f/0x1a0 [...] RIP: 0010:vxlan_find_mac+0x17f/0x1a0 [...] Call Trace: <TASK>
__vxlan_fdb_delete+0xbe/0x560 vxlan_vni_delete_group+0x2ba/0x940 vxlan_vni_del.isra.0+0x15f/0x580 vxlan_process_vni_filter+0x38b/0x7b0 vxlan_vnifilter_process+0x3bb/0x510 rtnetlink_rcv_msg+0x2f7/0xb70 netlink_rcv_skb+0x131/0x360 netlink_unicast+0x426/0x710 netlink_sendmsg+0x75a/0xc20
__sock_sendmsg+0xc1/0x150 ____sys_sendmsg+0x5aa/0x7b0 ___sys_sendmsg+0xfc/0x180 __sys_sendmsg+0x121/0x1b0 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 (CVE-2025-37921)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37921
https://ubuntu.com/security/CVE-2025-37921

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37921

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244758 - Linux Distros Unpatched Vulnerability : CVE-2025-37928
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dm-bufio: don't schedule in atomic context A BUG was reported as below when CONFIG_DEBUG_ATOMIC_SLEEP and try_verify_in_tasklet are enabled. [ 129.444685][ T934] BUG: sleeping function called from invalid context at drivers/md/dm-bufio.c:2421 [ 129.444723][ T934] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid:
934, name: kworker/1:4 [ 129.444740][ T934] preempt_count: 201, expected: 0 [ 129.444756][ T934] RCU nest depth: 0, expected: 0 [ 129.444781][ T934] Preemption disabled at: [ 129.444789][ T934] [<ffffffd816231900>] shrink_work+0x21c/0x248 [ 129.445167][ T934] kernel BUG at kernel/sched/walt/walt_debug.c:16! [ 129.445183][ T934] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP [ 129.445204][ T934] Skip md ftrace buffer dump for: 0x1609e0 [ 129.447348][ T934] CPU: 1 PID:
934 Comm: kworker/1:4 Tainted: G W OE 6.6.56-android15-8-o-g6f82312b30b9-debug #1 1400000003000000474e5500b3187743670464e8 [ 129.447362][ T934] Hardware name: Qualcomm Technologies, Inc.
Parrot QRD, Alpha-M (DT) [ 129.447373][ T934] Workqueue: dm_bufio_cache shrink_work [ 129.447394][ T934] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 129.447406][ T934] pc :
android_rvh_schedule_bug+0x0/0x8 [sched_walt_debug] [ 129.447435][ T934] lr :
__traceiter_android_rvh_schedule_bug+0x44/0x6c [ 129.447451][ T934] sp : ffffffc0843dbc90 [ 129.447459][ T934] x29: ffffffc0843dbc90 x28: ffffffffffffffff x27: 0000000000000c8b [ 129.447479][ T934] x26:
0000000000000040 x25: ffffff804b3d6260 x24: ffffffd816232b68 [ 129.447497][ T934] x23: ffffff805171c5b4 x22: 0000000000000000 x21: ffffffd816231900 [ 129.447517][ T934] x20: ffffff80306ba898 x19:
0000000000000000 x18: ffffffc084159030 [ 129.447535][ T934] x17: 00000000d2b5dd1f x16: 00000000d2b5dd1f x15: ffffffd816720358 [ 129.447554][ T934] x14: 0000000000000004 x13: ffffff89ef978000 x12:
0000000000000003 [ 129.447572][ T934] x11: ffffffd817a823c4 x10: 0000000000000202 x9 : 7e779c5735de9400 [ 129.447591][ T934] x8 : ffffffd81560d004 x7 : 205b5d3938373434 x6 : ffffffd8167397c8 [ 129.447610][ T934] x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffffffc0843db9e0 [ 129.447629][ T934] x2 :
0000000000002f15 x1 : 0000000000000000 x0 : 0000000000000000 [ 129.447647][ T934] Call trace: [ 129.447655][ T934] android_rvh_schedule_bug+0x0/0x8 [sched_walt_debug 1400000003000000474e550080cce8a8a78606b6] [ 129.447681][ T934] __might_resched+0x190/0x1a8 [ 129.447694][ T934] shrink_work+0x180/0x248 [ 129.447706][ T934] process_one_work+0x260/0x624 [ 129.447718][ T934] worker_thread+0x28c/0x454 [ 129.447729][ T934] kthread+0x118/0x158 [ 129.447742][ T934] ret_from_fork+0x10/0x20 [ 129.447761][ T934] Code: ???????? ???????? ???????? d2b5dd1f (d4210000) [ 129.447772][ T934] ---[ end trace 0000000000000000 ]--- dm_bufio_lock will call spin_lock_bh when try_verify_in_tasklet is enabled, and __scan will be called in atomic context. (CVE-2025-37928)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37928
https://security-tracker.debian.org/tracker/CVE-2025-37928
https://ubuntu.com/security/CVE-2025-37928

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.4 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
7.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:H/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-37928

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245368 - Linux Distros Unpatched Vulnerability : CVE-2025-37938
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tracing: Verify event formats that have %*p.. The trace event verifier checks the formats of trace events to make sure that they do not point at memory that is not in the trace event itself or in data that will never be freed. If an event references data that was allocated when the event triggered and that same data is freed before the event is read, then the kernel can crash by reading freed memory. The verifier runs at boot up (or module load) and scans the print formats of the events and checks their arguments to make sure that dereferenced pointers are safe. If the format uses %*p.. the verifier will ignore it, and that could be dangerous. Cover this case as well. Also add to the sample code a use case of %*pbl.
(CVE-2025-37938)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37938
https://ubuntu.com/security/CVE-2025-37938

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37938

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248910 - Linux Distros Unpatched Vulnerability : CVE-2025-37940
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ftrace: Add cond_resched() to ftrace_graph_set_hash() When the kernel contains a large number of functions that can be traced, the loop in ftrace_graph_set_hash() may take a lot of time to execute. This may trigger the softlockup watchdog. Add cond_resched() within the loop to allow the kernel to remain responsive even when processing a large number of functions. This matches the cond_resched() that is used in other locations of the code that iterates over all functions that can be traced. (CVE-2025-37940)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37940
https://ubuntu.com/security/CVE-2025-37940

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37940

Plugin Information
Published: 2025/08/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245428 - Linux Distros Unpatched Vulnerability : CVE-2025-37944
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process Currently, ath12k_dp_mon_srng_process uses ath12k_hal_srng_src_get_next_entry to fetch the next entry from the destination ring. This is incorrect because ath12k_hal_srng_src_get_next_entry is intended for source rings, not destination rings.
This leads to invalid entry fetches, causing potential data corruption or crashes due to accessing incorrect memory locations. This happens because the source ring and destination ring have different handling mechanisms and using the wrong function results in incorrect pointer arithmetic and ring management. To fix this issue, replace the call to ath12k_hal_srng_src_get_next_entry with ath12k_hal_srng_dst_get_next_entry in ath12k_dp_mon_srng_process. This ensures that the correct function is used for fetching entries from the destination ring, preventing invalid memory accesses. Tested-on:
QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 (CVE-2025-37944)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37944
https://ubuntu.com/security/CVE-2025-37944

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37944

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248461 - Linux Distros Unpatched Vulnerability : CVE-2025-37948
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs A malicious BPF program may manipulate the branch history to influence what the hardware speculates will happen next. On exit from a BPF program, emit the BHB mititgation sequence. This is only applied for 'classic' cBPF programs that are loaded by seccomp. (CVE-2025-37948)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37948
https://ubuntu.com/security/CVE-2025-37948

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37948

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249935 - Linux Distros Unpatched Vulnerability : CVE-2025-37957
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception Previously, commit ed129ec9057f (KVM: x86:
forcibly leave nested mode on vCPU reset) addressed an issue where a triple fault occurring in nested mode could lead to use-after-free scenarios. However, the commit did not handle the analogous situation for System Management Mode (SMM). This omission results in triggering a WARN when KVM forces a vCPU INIT after SHUTDOWN interception while the vCPU is in SMM. This situation was reprodused using Syzkaller by: 1) Creating a KVM VM and vCPU 2) Sending a KVM_SMI ioctl to explicitly enter SMM 3) Executing invalid instructions causing consecutive exceptions and eventually a triple fault The issue manifests as follows:
WARNING: CPU: 0 PID: 25506 at arch/x86/kvm/x86.c:12112 kvm_vcpu_reset+0x1d2/0x1530 arch/x86/kvm/x86.c:12112 Modules linked in: CPU: 0 PID: 25506 Comm: syz-executor.0 Not tainted 6.1.130-syzkaller-00157-g164fe5dde9b6 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:kvm_vcpu_reset+0x1d2/0x1530 arch/x86/kvm/x86.c:12112 Call Trace: <TASK>
shutdown_interception+0x66/0xb0 arch/x86/kvm/svm/svm.c:2136 svm_invoke_exit_handler+0x110/0x530 arch/x86/kvm/svm/svm.c:3395 svm_handle_exit+0x424/0x920 arch/x86/kvm/svm/svm.c:3457 vcpu_enter_guest arch/x86/kvm/x86.c:10959 [inline] vcpu_run+0x2c43/0x5a90 arch/x86/kvm/x86.c:11062 kvm_arch_vcpu_ioctl_run+0x50f/0x1cf0 arch/x86/kvm/x86.c:11283 kvm_vcpu_ioctl+0x570/0xf00 arch/x86/kvm/../../../virt/kvm/kvm_main.c:4122 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Architecturally, INIT is blocked when the CPU is in SMM, hence KVM's WARN() in kvm_vcpu_reset() to guard against KVM bugs, e.g. to detect improper emulation of INIT.
SHUTDOWN on SVM is a weird edge case where KVM needs to do _something_ sane with the VMCB, since it's technically undefined, and INIT is the least awful choice given KVM's ABI. So, double down on stuffing INIT on SHUTDOWN, and force the vCPU out of SMM to avoid any weirdness (and the WARN). Found by Linux Verification Center (linuxtesting.org) with Syzkaller. [sean: massage changelog, make it clear this isn't architectural behavior] (CVE-2025-37957)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37957
https://security-tracker.debian.org/tracker/CVE-2025-37957
https://ubuntu.com/security/CVE-2025-37957

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37957

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246323 - Linux Distros Unpatched Vulnerability : CVE-2025-37959
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Scrub packet on bpf_redirect_peer When bpf_redirect_peer is used to redirect packets to a device in another network namespace, the skb isn't scrubbed. That can lead skb information from one namespace to be misused in another namespace. As one example, this is causing Cilium to drop traffic when using bpf_redirect_peer to redirect packets that just went through IPsec decryption to a container namespace.
The following pwru trace shows (1) the packet path from the host's XFRM layer to the container's XFRM layer where it's dropped and (2) the number of active skb extensions at each function. NETNS MARK IFACE TUPLE FUNC 4026533547 d00 eth0 10.244.3.124:35473->10.244.2.158:53 xfrm_rcv_cb .active_extensions = (__u8)2, 4026533547 d00 eth0 10.244.3.124:35473->10.244.2.158:53 xfrm4_rcv_cb .active_extensions = (__u8)2, 4026533547 d00 eth0 10.244.3.124:35473->10.244.2.158:53 gro_cells_receive .active_extensions = (__u8)2, [...] 4026533547 0 eth0 10.244.3.124:35473->10.244.2.158:53 skb_do_redirect .active_extensions = (__u8)2, 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 ip_rcv .active_extensions = (__u8)2, 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 ip_rcv_core .active_extensions = (__u8)2, [...] 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 udp_queue_rcv_one_skb .active_extensions = (__u8)2, 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 __xfrm_policy_check .active_extensions = (__u8)2, 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 __xfrm_decode_session .active_extensions = (__u8)2, 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 security_xfrm_decode_session .active_extensions = (__u8)2, 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 kfree_skb_reason(SKB_DROP_REASON_XFRM_POLICY) .active_extensions = (__u8)2, In this case, there are no XFRM policies in the container's network namespace so the drop is unexpected. When we decrypt the IPsec packet, the XFRM state used for decryption is set in the skb extensions. This information is preserved across the netns switch. When we reach the XFRM policy check in the container's netns, __xfrm_policy_check drops the packet with LINUX_MIB_XFRMINNOPOLS because a (container-side) XFRM policy can't be found that matches the (host-side) XFRM state used for decryption. This patch fixes this by scrubbing the packet when using bpf_redirect_peer, as is done on typical netns switches via veth devices except skb->mark and skb->tstamp are not zeroed. (CVE-2025-37959)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37959
https://security-tracker.debian.org/tracker/CVE-2025-37959
https://ubuntu.com/security/CVE-2025-37959

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.3 (CVSS2#AV:A/AC:M/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
6.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37959

Plugin Information
Published: 2025/08/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246839 - Linux Distros Unpatched Vulnerability : CVE-2025-37963
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users Support for eBPF programs loaded by unprivileged users is typically disabled. This means only cBPF programs need to be mitigated for BHB. In addition, only mitigate cBPF programs that were loaded by an unprivileged user. Privileged users can also load the same program via eBPF, making the mitigation pointless. (CVE-2025-37963)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37963
https://ubuntu.com/security/CVE-2025-37963

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37963

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245995 - Linux Distros Unpatched Vulnerability : CVE-2025-37973
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation Currently during the multi-link element defragmentation process, the multi-link element length added to the total IEs length when calculating the length of remaining IEs after the multi-link element in cfg80211_defrag_mle(). This could lead to out-of-bounds access if the multi-link element or its corresponding fragment elements are the last elements in the IEs buffer. To address this issue, correctly calculate the remaining IEs length by deducting the multi-link element end offset from total IEs end offset. (CVE-2025-37973)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37973
https://ubuntu.com/security/CVE-2025-37973

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37973

Plugin Information
Published: 2025/08/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247205 - Linux Distros Unpatched Vulnerability : CVE-2025-37981
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Use is_kdump_kernel() to check for kdump The smartpqi driver checks the reset_devices variable to determine whether special adjustments need to be made for kdump. This has the effect that after a regular kexec reboot, some driver parameters such as max_transfer_size are much lower than usual. More importantly, kexec reboot tests have revealed memory corruption caused by the driver log being written to system memory after a kexec. Fix this by testing is_kdump_kernel() rather than reset_devices where appropriate. (CVE-2025-37981)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37981
https://ubuntu.com/security/CVE-2025-37981

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37981

Plugin Information
Published: 2025/08/10, Modified: 2025/11/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247667 - Linux Distros Unpatched Vulnerability : CVE-2025-37998
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- openvswitch: Fix unsafe attribute parsing in output_userspace() This patch replaces the manual Netlink attribute iteration in output_userspace() with nla_for_each_nested(), which ensures that only well-formed attributes are processed. (CVE-2025-37998)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37998
https://ubuntu.com/security/CVE-2025-37998

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37998

Plugin Information
Published: 2025/08/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248598 - Linux Distros Unpatched Vulnerability : CVE-2025-38000
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() When enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the child qdisc's peek() operation before incrementing sch->q.qlen and sch->qstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this may trigger an immediate dequeue and potential packet drop. In such cases, qdisc_tree_reduce_backlog() is called, but the HFSC qdisc's qlen and backlog have not yet been updated, leading to inconsistent queue accounting. This can leave an empty HFSC class in the active list, causing further consequences like use-after-free. This patch fixes the bug by moving the increment of sch->q.qlen and sch->qstats.backlog before the call to the child qdisc's peek() operation. This ensures that queue length and backlog are always accurate when packet drops or dequeues are triggered during the peek. (CVE-2025-38000)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38000
https://ubuntu.com/security/CVE-2025-38000

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38000

Plugin Information
Published: 2025/08/12, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249384 - Linux Distros Unpatched Vulnerability : CVE-2025-38001
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice Savino says: We are writing to report that this recent patch (141d34391abbb315d68556b7c67ad97885407547) [1] can be bypassed, and a UAF can still occur when HFSC is utilized with NETEM. The patch only checks the cl->cl_nactive field to determine whether it is the first insertion or not [2], but this field is only incremented by init_vf [3]. By using HFSC_RSC (which uses init_ed) [4], it is possible to bypass the check and insert the class twice in the eltree. Under normal conditions, this would lead to an infinite loop in hfsc_dequeue for the reasons we already explained in this report [5]. However, if TBF is added as root qdisc and it is configured with a very low rate, it can be utilized to prevent packets from being dequeued. This behavior can be exploited to perform subsequent insertions in the HFSC eltree and cause a UAF. To fix both the UAF and the infinite loop, with netem as an hfsc child, check explicitly in hfsc_enqueue whether the class is already in the eltree whenever the HFSC_RSC flag is set. [1] https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i d=141d34391abbb315d68556b7c67ad97885407547 [2] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1572 [3] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L677 [4] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1574 [5] https://lore.kernel.org/n etdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis
_0G7VEk=@willsroot.io/T/#u (CVE-2025-38001)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38001
https://ubuntu.com/security/CVE-2025-38001

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.6 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.1
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.4 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-38001

Plugin Information
Published: 2025/08/15, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244115 - Linux Distros Unpatched Vulnerability : CVE-2025-38009
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: mt76: disable napi on driver removal A warning on driver removal started occurring after commit 9dd05df8403b (net: warn if NAPI instance wasn't shut down). Disable tx napi before deleting it in mt76_dma_cleanup(). WARNING: CPU: 4 PID: 18828 at net/core/dev.c:7288 __netif_napi_del_locked+0xf0/0x100 CPU: 4 UID: 0 PID: 18828 Comm: modprobe Not tainted 6.15.0-rc4 #4 PREEMPT(lazy) Hardware name: ASUS System Product Name/PRIME X670E-PRO WIFI, BIOS 3035 09/05/2024 RIP: 0010:__netif_napi_del_locked+0xf0/0x100 Call Trace: <TASK> mt76_dma_cleanup+0x54/0x2f0 [mt76] mt7921_pci_remove+0xd5/0x190 [mt7921e] pci_device_remove+0x47/0xc0 device_release_driver_internal+0x19e/0x200 driver_detach+0x48/0x90 bus_remove_driver+0x6d/0xf0 pci_unregister_driver+0x2e/0xb0 __do_sys_delete_module.isra.0+0x197/0x2e0 do_syscall_64+0x7b/0x160 entry_SYSCALL_64_after_hwframe+0x76/0x7e Tested with mt7921e but the same pattern can be actually applied to other mt76 drivers calling mt76_dma_cleanup() during removal. Tx napi is enabled in their *_dma_init() functions and only toggled off and on again inside their suspend/resume/reset paths. So it should be okay to disable tx napi in such a generic way. Found by Linux Verification Center (linuxtesting.org). (CVE-2025-38009)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38009
https://ubuntu.com/security/CVE-2025-38009

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38009

Plugin Information
Published: 2025/08/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249613 - Linux Distros Unpatched Vulnerability : CVE-2025-38013
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request Make sure that n_channels is set after allocating the struct cfg80211_registered_device::int_scan_req member. Seen with syzkaller:
UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:1208:5 index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]') This was missed in the initial conversions because I failed to locate the allocation likely due to the sizeof(void *) not matching the channels array type. (CVE-2025-38013)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38013
https://ubuntu.com/security/CVE-2025-38013

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38013

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249031 - Linux Distros Unpatched Vulnerability : CVE-2025-38022
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA/core: Fix KASAN: slab-use-after-free Read in ib_register_device problem Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc3/0x670 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634 strlen+0x93/0xa0 lib/string.c:420 __fortify_strlen include/linux/fortify- string.h:268 [inline] get_kobj_path_length lib/kobject.c:118 [inline] kobject_get_path+0x3f/0x2a0 lib/kobject.c:158 kobject_uevent_env+0x289/0x1870 lib/kobject_uevent.c:545 ib_register_device drivers/infiniband/core/device.c:1472 [inline] ib_register_device+0x8cf/0xe00 drivers/infiniband/core/device.c:1393 rxe_register_device+0x275/0x320 drivers/infiniband/sw/rxe/rxe_verbs.c:1552 rxe_net_add+0x8e/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:550 rxe_newlink+0x70/0x190 drivers/infiniband/sw/rxe/rxe.c:225 nldev_newlink+0x3a3/0x680 drivers/infiniband/core/nldev.c:1796 rdma_nl_rcv_msg+0x387/0x6e0 drivers/infiniband/core/netlink.c:195 rdma_nl_rcv_skb.constprop.0.isra.0+0x2e5/0x450 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] netlink_unicast+0x53a/0x7f0 net/netlink/af_netlink.c:1339 netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1883 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg net/socket.c:727 [inline] ____sys_sendmsg+0xa95/0xc70 net/socket.c:2566 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2620
__sys_sendmsg+0x16d/0x220 net/socket.c:2652 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f This problem is similar to the problem that the commit 1d6a9e7449e2 (RDMA/core: Fix use-after-free when rename device name) fixes. The root cause is: the function ib_device_rename() renames the name with lock. But in the function kobject_uevent(), this name is accessed without lock protection at the same time. The solution is to add the lock protection when this name is accessed in the function kobject_uevent().
(CVE-2025-38022)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38022
https://security-tracker.debian.org/tracker/CVE-2025-38022
https://ubuntu.com/security/CVE-2025-38022

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38022

Plugin Information
Published: 2025/08/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243650 - Linux Distros Unpatched Vulnerability : CVE-2025-38024
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x7d/0xa0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcf/0x610 mm/kasan/report.c:489 kasan_report+0xb5/0xe0 mm/kasan/report.c:602 rxe_queue_cleanup+0xd0/0xe0 drivers/infiniband/sw/rxe/rxe_queue.c:195 rxe_cq_cleanup+0x3f/0x50 drivers/infiniband/sw/rxe/rxe_cq.c:132 __rxe_cleanup+0x168/0x300 drivers/infiniband/sw/rxe/rxe_pool.c:232 rxe_create_cq+0x22e/0x3a0 drivers/infiniband/sw/rxe/rxe_verbs.c:1109 create_cq+0x658/0xb90 drivers/infiniband/core/uverbs_cmd.c:1052 ib_uverbs_create_cq+0xc7/0x120 drivers/infiniband/core/uverbs_cmd.c:1095 ib_uverbs_write+0x969/0xc90 drivers/infiniband/core/uverbs_main.c:679 vfs_write fs/read_write.c:677 [inline] vfs_write+0x26a/0xcc0 fs/read_write.c:659 ksys_write+0x1b8/0x200 fs/read_write.c:731 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f In the function rxe_create_cq, when rxe_cq_from_init fails, the function rxe_cleanup will be called to handle the allocated resources. In fact, some memory resources have already been freed in the function rxe_cq_from_init. Thus, this problem will occur. The solution is to let rxe_cleanup do all the work.
(CVE-2025-38024)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38024
https://ubuntu.com/security/CVE-2025-38024

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38024

Plugin Information
Published: 2025/08/05, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248362 - Linux Distros Unpatched Vulnerability : CVE-2025-38037
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vxlan: Annotate FDB data races The 'used' and 'updated' fields in the FDB entry structure can be accessed concurrently by multiple threads, leading to reports such as [1]. Can be reproduced using [2]. Suppress these reports by annotating these accesses using READ_ONCE() / WRITE_ONCE(). [1] BUG: KCSAN: data-race in vxlan_xmit / vxlan_xmit write to 0xffff942604d263a8 of 8 bytes by task 286 on cpu 0:
vxlan_xmit+0xb29/0x2380 dev_hard_start_xmit+0x84/0x2f0 __dev_queue_xmit+0x45a/0x1650 packet_xmit+0x100/0x150 packet_sendmsg+0x2114/0x2ac0 __sys_sendto+0x318/0x330 __x64_sys_sendto+0x76/0x90 x64_sys_call+0x14e8/0x1c00 do_syscall_64+0x9e/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffff942604d263a8 of 8 bytes by task 287 on cpu 2: vxlan_xmit+0xadf/0x2380 dev_hard_start_xmit+0x84/0x2f0
__dev_queue_xmit+0x45a/0x1650 packet_xmit+0x100/0x150 packet_sendmsg+0x2114/0x2ac0
__sys_sendto+0x318/0x330 __x64_sys_sendto+0x76/0x90 x64_sys_call+0x14e8/0x1c00 do_syscall_64+0x9e/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x00000000fffbac6e -> 0x00000000fffbac6f Reported by Kernel Concurrency Sanitizer on: CPU: 2 UID: 0 PID: 287 Comm: mausezahn Not tainted 6.13.0-rc7-01544-gb4b270f11a02 #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 [2] #!/bin/bash set +H echo whitelist > /sys/kernel/debug/kcsan echo !vxlan_xmit > /sys/kernel/debug/kcsan ip link add name vx0 up type vxlan id 10010 dstport 4789 local 192.0.2.1 bridge fdb add 00:11:22:33:44:55 dev vx0 self static dst 198.51.100.1 taskset -c 0 mausezahn vx0 -a own -b 00:11:22:33:44:55 -c 0 -q & taskset -c 2 mausezahn vx0 -a own -b 00:11:22:33:44:55 -c 0 -q &
(CVE-2025-38037)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38037
https://ubuntu.com/security/CVE-2025-38037

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38037

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247528 - Linux Distros Unpatched Vulnerability : CVE-2025-38044
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- media: cx231xx: set device_caps for 417 The video_device for the MPEG encoder did not set device_caps. Add this, otherwise the video device can't be registered (you get a WARN_ON instead). Not seen before since currently 417 support is disabled, but I found this while experimenting with it. (CVE-2025-38044)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38044
https://ubuntu.com/security/CVE-2025-38044

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38044

Plugin Information
Published: 2025/08/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245154 - Linux Distros Unpatched Vulnerability : CVE-2025-38051
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smb: client: Fix use-after-free in cifs_fill_dirent There is a race condition in the readdir concurrency process, which may access the rsp buffer after it has been released, triggering the following KASAN warning. ================================================================== BUG: KASAN: slab-use-after- free in cifs_fill_dirent+0xb03/0xb60 [cifs] Read of size 4 at addr ffff8880099b819c by task a.out/342975 CPU: 2 UID: 0 PID: 342975 Comm: a.out Not tainted 6.15.0-rc6+ #240 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: <TASK>
dump_stack_lvl+0x53/0x70 print_report+0xce/0x640 kasan_report+0xb8/0xf0 cifs_fill_dirent+0xb03/0xb60 [cifs] cifs_readdir+0x12cb/0x3190 [cifs] iterate_dir+0x1a1/0x520 __x64_sys_getdents+0x134/0x220 do_syscall_64+0x4b/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f996f64b9f9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0d f7 c3 0c 00 f7 d8 64 89 8 RSP: 002b:00007f996f53de78 EFLAGS: 00000207 ORIG_RAX: 000000000000004e RAX: ffffffffffffffda RBX: 00007f996f53ecdc RCX: 00007f996f64b9f9 RDX:
0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007f996f53dea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000207 R12: ffffffffffffff88 R13:
0000000000000000 R14: 00007ffc8cd9a500 R15: 00007f996f51e000 </TASK> Allocated by task 408:
kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x6e/0x70 kmem_cache_alloc_noprof+0x117/0x3d0 mempool_alloc_noprof+0xf2/0x2c0 cifs_buf_get+0x36/0x80 [cifs] allocate_buffers+0x1d2/0x330 [cifs] cifs_demultiplex_thread+0x22b/0x2690 [cifs] kthread+0x394/0x720 ret_from_fork+0x34/0x70 ret_from_fork_asm+0x1a/0x30 Freed by task 342979: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x37/0x50 kmem_cache_free+0x2b8/0x500 cifs_buf_release+0x3c/0x70 [cifs] cifs_readdir+0x1c97/0x3190 [cifs] iterate_dir+0x1a1/0x520 __x64_sys_getdents64+0x134/0x220 do_syscall_64+0x4b/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e The buggy address belongs to the object at ffff8880099b8000 which belongs to the cache cifs_request of size 16588 The buggy address is located 412 bytes inside of freed 16588-byte region [ffff8880099b8000, ffff8880099bc0cc) The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x99b8 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 anon flags: 0x80000000000040(head|node=0|zone=1) page_type:
f5(slab) raw: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000 head: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001 head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000 head: 0080000000000003 ffffea0000266e01 00000000ffffffff 00000000ffffffff head:
ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880099b8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880099b8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880099b8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880099b8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880099b8280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== POC is available in the link [1]. The problem triggering process is as follows: Process 1 Process 2 -----------------------------------
---truncated--- (CVE-2025-38051)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38051
https://ubuntu.com/security/CVE-2025-38051

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38051

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244857 - Linux Distros Unpatched Vulnerability : CVE-2025-38061
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: pktgen: fix access outside of user given buffer in pktgen_thread_write() Honour the user given buffer size for the strn_len() calls (otherwise strn_len() will access memory outside of the user given buffer).
(CVE-2025-38061)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38061
https://ubuntu.com/security/CVE-2025-38061

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38061

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247326 - Linux Distros Unpatched Vulnerability : CVE-2025-38066
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dm cache: prevent BUG_ON by blocking retries on failed device resumes A cache device failing to resume due to mapping errors should not be retried, as the failure leaves a partially initialized policy object.
Repeating the resume operation risks triggering BUG_ON when reloading cache mappings into the incomplete policy object. Reproduce steps: 1. create a cache metadata consisting of 512 or more cache blocks, with some mappings stored in the first array block of the mapping array. Here we use cache_restore v1.0 to build the metadata. cat <<EOF >> cmeta.xml <superblock uuid= block_size=128 nr_cache_blocks=512 \ policy=smq hint_width=4> <mappings> <mapping cache_block=0 origin_block=0 dirty=false/>
</mappings> </superblock> EOF dmsetup create cmeta --table 0 8192 linear /dev/sdc 0 cache_restore -i cmeta.xml -o /dev/mapper/cmeta --metadata-version=2 dmsetup remove cmeta 2. wipe the second array block of the mapping array to simulate data degradations. mapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192 \ 2>/dev/null | hexdump -e '1/8 %u ') ablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056)) \ 2>/dev/null | hexdump -e '1/8 %u ') dd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock 3. try bringing up the cache device. The resume is expected to fail due to the broken array block. dmsetup create cmeta --table 0 8192 linear /dev/sdc 0 dmsetup create cdata --table 0 65536 linear /dev/sdc 8192 dmsetup create corig --table 0 524288 linear /dev/sdc 262144 dmsetup create cache --notable dmsetup load cache --table 0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0 dmsetup resume cache 4. try resuming the cache again. An unexpected BUG_ON is triggered while loading cache mappings. dmsetup resume cache Kernel logs:
(snip) ------------[ cut here ]------------ kernel BUG at drivers/md/dm-cache-policy-smq.c:752! Oops:
invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 UID: 0 PID: 332 Comm: dmsetup Not tainted 6.13.4 #3 RIP: 0010:smq_load_mapping+0x3e5/0x570 Fix by disallowing resume operations for devices that failed the initial attempt. (CVE-2025-38066)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38066
https://ubuntu.com/security/CVE-2025-38066

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38066

Plugin Information
Published: 2025/08/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244081 - Linux Distros Unpatched Vulnerability : CVE-2025-38068
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- crypto: lzo - Fix compression buffer overrun Unlike the decompression code, the compression code in LZO never checked for output overruns. It instead assumes that the caller always provides enough buffer space, disregarding the buffer length provided by the caller. Add a safe compression interface that checks for the end of buffer before each write. Use the safe interface in crypto/lzo. (CVE-2025-38068)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38068
https://security-tracker.debian.org/tracker/CVE-2025-38068
https://ubuntu.com/security/CVE-2025-38068

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:C/I:P/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38068

Plugin Information
Published: 2025/08/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246468 - Linux Distros Unpatched Vulnerability : CVE-2025-38078
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: pcm: Fix race of buffer access at PCM OSS layer The PCM OSS layer tries to clear the buffer with the silence data at initialization (or reconfiguration) of a stream with the explicit call of snd_pcm_format_set_silence() with runtime->dma_area. But this may lead to a UAF because the accessed runtime->dma_area might be freed concurrently, as it's performed outside the PCM ops. For avoiding it, move the code into the PCM core and perform it inside the buffer access lock, so that it won't be changed during the operation. (CVE-2025-38078)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38078
https://ubuntu.com/security/CVE-2025-38078

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.1
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38078

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246317 - Linux Distros Unpatched Vulnerability : CVE-2025-38083
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net_sched: prio: fix a race in prio_tune() Gerrard Tai reported a race condition in PRIO, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put() This can be abused to underflow a parent's qlen. Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock. (CVE-2025-38083)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38083
https://ubuntu.com/security/CVE-2025-38083

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.1
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38083

Plugin Information
Published: 2025/08/08, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250239 - Linux Distros Unpatched Vulnerability : CVE-2025-38103
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() Update struct hid_descriptor to better reflect the mandatory and optional parts of the HID Descriptor as per USB HID 1.11 specification.
Note: the kernel currently does not parse any optional HID class descriptors, only the mandatory report descriptor. Update all references to member element desc[0] to rpt_desc. Add test to verify bLength and bNumDescriptors values are valid. Replace the for loop with direct access to the mandatory HID class descriptor member for the report descriptor. This eliminates the possibility of getting an out-of-bounds fault. Add a warning message if the HID descriptor contains any unsupported optional HID class descriptors. (CVE-2025-38103)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38103
https://ubuntu.com/security/CVE-2025-38103

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38103

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248562 - Linux Distros Unpatched Vulnerability : CVE-2025-38106
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo() syzbot reports: BUG: KASAN: slab-use-after-free in getrusage+0x1109/0x1a60 Read of size 8 at addr ffff88810de2d2c8 by task a.out/304 CPU: 0 UID: 0 PID: 304 Comm: a.out Not tainted 6.16.0-rc1 #1 PREEMPT(voluntary) Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xd0/0x670 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? getrusage+0x1109/0x1a60 kasan_report+0xce/0x100 ? getrusage+0x1109/0x1a60 getrusage+0x1109/0x1a60 ? __pfx_getrusage+0x10/0x10
__io_uring_show_fdinfo+0x9fe/0x1790 ? ksys_read+0xf7/0x1c0 ? do_syscall_64+0xa4/0x260 ? vsnprintf+0x591/0x1100 ? __pfx___io_uring_show_fdinfo+0x10/0x10 ? __pfx_vsnprintf+0x10/0x10 ? mutex_trylock+0xcf/0x130 ? __pfx_mutex_trylock+0x10/0x10 ? __pfx_show_fd_locks+0x10/0x10 ? io_uring_show_fdinfo+0x57/0x80 io_uring_show_fdinfo+0x57/0x80 seq_show+0x38c/0x690 seq_read_iter+0x3f7/0x1180 ? inode_set_ctime_current+0x160/0x4b0 seq_read+0x271/0x3e0 ?
__pfx_seq_read+0x10/0x10 ? __pfx__raw_spin_lock+0x10/0x10 ? __mark_inode_dirty+0x402/0x810 ? selinux_file_permission+0x368/0x500 ? file_update_time+0x10f/0x160 vfs_read+0x177/0xa40 ?
__pfx___handle_mm_fault+0x10/0x10 ? __pfx_vfs_read+0x10/0x10 ? mutex_lock+0x81/0xe0 ?
__pfx_mutex_lock+0x10/0x10 ? fdget_pos+0x24d/0x4b0 ksys_read+0xf7/0x1c0 ? __pfx_ksys_read+0x10/0x10 ? do_user_addr_fault+0x43b/0x9c0 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP:
0033:0x7f0f74170fc9 Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 8 RSP:
002b:00007fffece049e8 EFLAGS: 00000206 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX:
0000000000000000 RCX: 00007f0f74170fc9 RDX: 0000000000001000 RSI: 00007fffece049f0 RDI: 0000000000000004 RBP: 00007fffece05ad0 R08: 0000000000000000 R09: 00007fffece04d90 R10: 0000000000000000 R11:
0000000000000206 R12: 00005651720a1100 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> Allocated by task 298: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30
__kasan_slab_alloc+0x6e/0x70 kmem_cache_alloc_node_noprof+0xe8/0x330 copy_process+0x376/0x5e00 create_io_thread+0xab/0xf0 io_sq_offload_create+0x9ed/0xf20 io_uring_setup+0x12b0/0x1cc0 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 22:
kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x37/0x50 kmem_cache_free+0xc4/0x360 rcu_core+0x5ff/0x19f0 handle_softirqs+0x18c/0x530 run_ksoftirqd+0x20/0x30 smpboot_thread_fn+0x287/0x6c0 kthread+0x30d/0x630 ret_from_fork+0xef/0x1a0 ret_from_fork_asm+0x1a/0x30 Last potentially related work creation: kasan_save_stack+0x33/0x60 kasan_record_aux_stack+0x8c/0xa0 __call_rcu_common.constprop.0+0x68/0x940 __schedule+0xff2/0x2930
__cond_resched+0x4c/0x80 mutex_lock+0x5c/0xe0 io_uring_del_tctx_node+0xe1/0x2b0 io_uring_clean_tctx+0xb7/0x160 io_uring_cancel_generic+0x34e/0x760 do_exit+0x240/0x2350 do_group_exit+0xab/0x220 __x64_sys_exit_group+0x39/0x40 x64_sys_call+0x1243/0x1840 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88810de2cb00 which belongs to the cache task_struct of size 3712 The buggy address is located 1992 bytes inside of freed 3712-byte region [ffff88810de2cb00, ffff88810de2d980) which is caused by the task_struct pointed to by sq->thread being released while it is being used in the function
__io_uring_show_fdinfo(). Holding ctx->uring_lock does not prevent ehre relase or exit of sq->thread. Fix this by assigning and looking up ->thread under RCU, and grabbing a reference to the task_struct. This e
---truncated--- (CVE-2025-38106)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38106
https://ubuntu.com/security/CVE-2025-38106

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38106

Plugin Information
Published: 2025/08/12, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246895 - Linux Distros Unpatched Vulnerability : CVE-2025-38107
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net_sched: ets: fix a race in ets_qdisc_change() Gerrard Tai reported a race condition in ETS, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]:
qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]:
qdisc_tree_reduce_backlog() | [4]: qdisc_put() This can be abused to underflow a parent's qlen. Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock. (CVE-2025-38107)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38107
https://ubuntu.com/security/CVE-2025-38107

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38107

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
253743 - Linux Distros Unpatched Vulnerability : CVE-2025-38108
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net_sched: red: fix a race in __red_change() Gerrard Tai reported a race condition in RED, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]:
qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]:
qdisc_tree_reduce_backlog() | [4]: qdisc_put() This can be abused to underflow a parent's qlen. Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock. (CVE-2025-38108)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38108
https://ubuntu.com/security/CVE-2025-38108

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38108

Plugin Information
Published: 2025/08/24, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247931 - Linux Distros Unpatched Vulnerability : CVE-2025-38109
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mlx5: Fix ECVF vports unload on shutdown flow Fix shutdown flow UAF when a virtual function is created on the embedded chip (ECVF) of a BlueField device. In such case the vport acl ingress table is not properly destroyed. ECVF functionality is independent of ecpf_vport_exists capability and thus functions mlx5_eswitch_(enable|disable)_pf_vf_vports() should not test it when enabling/disabling ECVF vports.
kernel log: [] refcount_t: underflow; use-after-free. [] WARNING: CPU: 3 PID: 1 at lib/refcount.c:28 refcount_warn_saturate+0x124/0x220 ---------------- [] Call trace: [] refcount_warn_saturate+0x124/0x220 [] tree_put_node+0x164/0x1e0 [mlx5_core] [] mlx5_destroy_flow_table+0x98/0x2c0 [mlx5_core] [] esw_acl_ingress_table_destroy+0x28/0x40 [mlx5_core] [] esw_acl_ingress_lgcy_cleanup+0x80/0xf4 [mlx5_core] [] esw_legacy_vport_acl_cleanup+0x44/0x60 [mlx5_core] [] esw_vport_cleanup+0x64/0x90 [mlx5_core] [] mlx5_esw_vport_disable+0xc0/0x1d0 [mlx5_core] [] mlx5_eswitch_unload_ec_vf_vports+0xcc/0x150 [mlx5_core] [] mlx5_eswitch_disable_sriov+0x198/0x2a0 [mlx5_core] [] mlx5_device_disable_sriov+0xb8/0x1e0 [mlx5_core] [] mlx5_sriov_detach+0x40/0x50 [mlx5_core] [] mlx5_unload+0x40/0xc4 [mlx5_core] [] mlx5_unload_one_devl_locked+0x6c/0xe4 [mlx5_core] [] mlx5_unload_one+0x3c/0x60 [mlx5_core] [] shutdown+0x7c/0xa4 [mlx5_core] [] pci_device_shutdown+0x3c/0xa0 [] device_shutdown+0x170/0x340 []
__do_sys_reboot+0x1f4/0x2a0 [] __arm64_sys_reboot+0x2c/0x40 [] invoke_syscall+0x78/0x100 [] el0_svc_common.constprop.0+0x54/0x184 [] do_el0_svc+0x30/0xac [] el0_svc+0x48/0x160 [] el0t_64_sync_handler+0xa4/0x12c [] el0t_64_sync+0x1a4/0x1a8 [] --[ end trace 9c4601d68c70030e ]--- (CVE-2025-38109)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38109
https://ubuntu.com/security/CVE-2025-38109

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38109

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244762 - Linux Distros Unpatched Vulnerability : CVE-2025-38111
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mdiobus: Fix potential out-of-bounds read/write access When using publicly available tools like 'mdio- tools' to read/write data from/to network interface and its PHY via mdiobus, there is no verification of parameters passed to the ioctl and it accepts any mdio address. Currently there is support for 32 addresses in kernel via PHY_MAX_ADDR define, but it is possible to pass higher value than that via ioctl.
While read/write operation should generally fail in this case, mdiobus provides stats array, where wrong address may allow out-of-bounds read/write. Fix that by adding address verification before read/write operation. While this excludes this access from any statistics, it improves security of read/write operation. (CVE-2025-38111)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38111
https://ubuntu.com/security/CVE-2025-38111

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38111

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250054 - Linux Distros Unpatched Vulnerability : CVE-2025-38117
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock This uses a mutex to protect from concurrent access of mgmt_pending list which can cause crashes like:
================================================================== BUG: KASAN: slab-use-after-free in hci_sock_get_channel+0x60/0x68 net/bluetooth/hci_sock.c:91 Read of size 2 at addr ffff0000c48885b2 by task syz.4.334/7318 CPU: 0 UID: 0 PID: 7318 Comm: syz.4.334 Not tainted 6.15.0-rc7-syzkaller-g187899f4124a #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 print_address_description+0xa8/0x254 mm/kasan/report.c:408 print_report+0x68/0x84 mm/kasan/report.c:521 kasan_report+0xb0/0x110 mm/kasan/report.c:634 __asan_report_load2_noabort+0x20/0x2c mm/kasan/report_generic.c:379 hci_sock_get_channel+0x60/0x68 net/bluetooth/hci_sock.c:91 mgmt_pending_find+0x7c/0x140 net/bluetooth/mgmt_util.c:223 pending_find net/bluetooth/mgmt.c:947 [inline] remove_adv_monitor+0x44/0x1a4 net/bluetooth/mgmt.c:5445 hci_mgmt_cmd+0x780/0xc00 net/bluetooth/hci_sock.c:1712 hci_sock_sendmsg+0x544/0xbb0 net/bluetooth/hci_sock.c:1832 sock_sendmsg_nosec net/socket.c:712 [inline]
__sock_sendmsg net/socket.c:727 [inline] sock_write_iter+0x25c/0x378 net/socket.c:1131 new_sync_write fs/read_write.c:591 [inline] vfs_write+0x62c/0x97c fs/read_write.c:684 ksys_write+0x120/0x210 fs/read_write.c:736 __do_sys_write fs/read_write.c:747 [inline] __se_sys_write fs/read_write.c:744 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:744 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 Allocated by task 7037: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:562 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4327 [inline] __kmalloc_noprof+0x2fc/0x4c8 mm/slub.c:4339 kmalloc_noprof include/linux/slab.h:909 [inline] sk_prot_alloc+0xc4/0x1f0 net/core/sock.c:2198 sk_alloc+0x44/0x3ac net/core/sock.c:2254 bt_sock_alloc+0x4c/0x300 net/bluetooth/af_bluetooth.c:148 hci_sock_create+0xa8/0x194 net/bluetooth/hci_sock.c:2202 bt_sock_create+0x14c/0x24c net/bluetooth/af_bluetooth.c:132
__sock_create+0x43c/0x91c net/socket.c:1541 sock_create net/socket.c:1599 [inline] __sys_socket_create net/socket.c:1636 [inline] __sys_socket+0xd4/0x1c0 net/socket.c:1683 __do_sys_socket net/socket.c:1697 [inline] __se_sys_socket net/socket.c:1695 [inline] __arm64_sys_socket+0x7c/0x94 net/socket.c:1695
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x17c arch/arm64/kernel/entry- common.c:767 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 Freed by task 6607: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_free_info+0x58/0x70 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x68/0x88 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline ---truncated--- (CVE-2025-38117)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38117
https://security-tracker.debian.org/tracker/CVE-2025-38117
https://ubuntu.com/security/CVE-2025-38117

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38117

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243819 - Linux Distros Unpatched Vulnerability : CVE-2025-38118
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete This reworks MGMT_OP_REMOVE_ADV_MONITOR to not use mgmt_pending_add to avoid crashes like bellow:
================================================================== BUG: KASAN: slab-use-after-free in mgmt_remove_adv_monitor_complete+0xe5/0x540 net/bluetooth/mgmt.c:5406 Read of size 8 at addr ffff88801c53f318 by task kworker/u5:5/5341 CPU: 0 UID: 0 PID: 5341 Comm: kworker/u5:5 Not tainted 6.15.0-syzkaller-10402-g4cb6c8af8591 #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: hci0 hci_cmd_sync_work Call Trace: <TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xd2/0x2b0 mm/kasan/report.c:521 kasan_report+0x118/0x150 mm/kasan/report.c:634 mgmt_remove_adv_monitor_complete+0xe5/0x540 net/bluetooth/mgmt.c:5406 hci_cmd_sync_work+0x261/0x3a0 net/bluetooth/hci_sync.c:334 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3321 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402 kthread+0x711/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Allocated by task 5987: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4358 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] mgmt_pending_new+0x65/0x240 net/bluetooth/mgmt_util.c:252 mgmt_pending_add+0x34/0x120 net/bluetooth/mgmt_util.c:279 remove_adv_monitor+0x103/0x1b0 net/bluetooth/mgmt.c:5454 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:727 sock_write_iter+0x258/0x330 net/socket.c:1131 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x548/0xa90 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5989: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2380 [inline] slab_free mm/slub.c:4642 [inline] kfree+0x18e/0x440 mm/slub.c:4841 mgmt_pending_foreach+0xc9/0x120 net/bluetooth/mgmt_util.c:242 mgmt_index_removed+0x10d/0x2f0 net/bluetooth/mgmt.c:9366 hci_sock_bind+0xbe9/0x1000 net/bluetooth/hci_sock.c:1314 __sys_bind_socket net/socket.c:1810 [inline] __sys_bind+0x2c3/0x3e0 net/socket.c:1841 __do_sys_bind net/socket.c:1846 [inline] __se_sys_bind net/socket.c:1844 [inline] __x64_sys_bind+0x7a/0x90 net/socket.c:1844 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f (CVE-2025-38118)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38118
https://ubuntu.com/security/CVE-2025-38118

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38118

Plugin Information
Published: 2025/08/05, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244590 - Linux Distros Unpatched Vulnerability : CVE-2025-38120
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfilter: nf_set_pipapo_avx2: fix initial map fill If the first field doesn't cover the entire start map, then we must zero out the remainder, else we leak those bits into the next match round map. The early fix was incomplete and did only fix up the generic C implementation. A followup patch adds a test case to nft_concat_range.sh. (CVE-2025-38120)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38120
https://ubuntu.com/security/CVE-2025-38120

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38120

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246157 - Linux Distros Unpatched Vulnerability : CVE-2025-38129
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- page_pool: Fix use-after-free in page_pool_recycle_in_ring syzbot reported a uaf in page_pool_recycle_in_ring: BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862 Read of size 8 at addr ffff8880286045a0 by task syz.0.284/6943 CPU: 0 UID: 0 PID: 6943 Comm: syz.0.284 Not tainted 6.13.0-rc3-syzkaller-gdfa94ce54f41 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:165 [inline] _raw_spin_unlock_bh+0x1b/0x40 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] ptr_ring_produce_bh include/linux/ptr_ring.h:164 [inline] page_pool_recycle_in_ring net/core/page_pool.c:707 [inline] page_pool_put_unrefed_netmem+0x748/0xb00 net/core/page_pool.c:826 page_pool_put_netmem include/net/page_pool/helpers.h:323 [inline] page_pool_put_full_netmem include/net/page_pool/helpers.h:353 [inline] napi_pp_put_page+0x149/0x2b0 net/core/skbuff.c:1036 skb_pp_recycle net/core/skbuff.c:1047 [inline] skb_free_head net/core/skbuff.c:1094 [inline] skb_release_data+0x6c4/0x8a0 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x1c9/0x380 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1263 [inline] __skb_queue_purge_reason include/linux/skbuff.h:3343 [inline] root cause is:
page_pool_recycle_in_ring ptr_ring_produce spin_lock(&r->producer_lock);
WRITE_ONCE(r->queue[r->producer++], ptr) //recycle last page to pool page_pool_release page_pool_scrub page_pool_empty_ring ptr_ring_consume page_pool_return_page //release all page __page_pool_destroy free_percpu(pool->recycle_stats); free(pool) //free spin_unlock(&r->producer_lock); //pool->ring uaf read recycle_stat_inc(pool, ring); page_pool can be free while page pool recycle the last page in ring. Add producer-lock barrier to page_pool_release to prevent the page pool from being free before all pages have been recycled. recycle_stat_inc() is empty when CONFIG_PAGE_POOL_STATS is not enabled, which will trigger Wempty-body build warning. Add definition for pool stat macro to fix warning. (CVE-2025-38129)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38129
https://security-tracker.debian.org/tracker/CVE-2025-38129
https://ubuntu.com/security/CVE-2025-38129

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38129

Plugin Information
Published: 2025/08/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243789 - Linux Distros Unpatched Vulnerability : CVE-2025-38141
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: dm: fix dm_blk_report_zones If dm_get_live_table() returned NULL, dm_put_live_table() was never called. Also, it is possible that md->zone_revalidate_map will change while calling this function. Only read it once, so that we are always using the same value. Otherwise we might miss a call to dm_put_live_table(). Finally, while md->zone_revalidate_map is set and a process is calling blk_revalidate_disk_zones() to set up the zone append emulation resources, it is possible that another process, perhaps triggered by blkdev_report_zones_ioctl(), will call dm_blk_report_zones(). If blk_revalidate_disk_zones() fails, these resources can be freed while the other process is still using them, causing a use-after-free error.
blk_revalidate_disk_zones() will only ever be called when initially setting up the zone append emulation resources, such as when setting up a zoned dm-crypt table for the first time. Further table swaps will not set md->zone_revalidate_map or call blk_revalidate_disk_zones(). However it must be called using the new table (referenced by md->zone_revalidate_map) and the new queue limits while the DM device is suspended.
dm_blk_report_zones() needs some way to distinguish between a call from blk_revalidate_disk_zones(), which must be allowed to use md->zone_revalidate_map to access this not yet activated table, and all other calls to dm_blk_report_zones(), which should not be allowed while the device is suspended and cannot use md->zone_revalidate_map, since the zone resources might be freed by the process currently calling blk_revalidate_disk_zones(). Solve this by tracking the process that sets md->zone_revalidate_map in dm_revalidate_zones() and only allowing that process to make use of it in dm_blk_report_zones().
(CVE-2025-38141)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38141
https://ubuntu.com/security/CVE-2025-38141

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38141

Plugin Information
Published: 2025/08/05, Modified: 2025/11/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244453 - Linux Distros Unpatched Vulnerability : CVE-2025-38161
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction Upon RQ destruction if the firmware command fails which is the last resource to be destroyed some SW resources were already cleaned regardless of the failure. Now properly rollback the object to its original state upon such failure. In order to avoid a use-after free in case someone tries to destroy the object again, which results in the following kernel trace: refcount_t: underflow; use-after-free. WARNING: CPU: 0 PID: 37589 at lib/refcount.c:28 refcount_warn_saturate+0xf4/0x148 Modules linked in: rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) rfkill mlx5_core(OE) mlxdevm(OE) ib_uverbs(OE) ib_core(OE) psample mlxfw(OE) mlx_compat(OE) macsec tls pci_hyperv_intf sunrpc vfat fat virtio_net net_failover failover fuse loop nfnetlink vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs crct10dif_ce ghash_ce sha2_ce sha256_arm64 sha1_ce virtio_console virtio_gpu virtio_blk virtio_dma_buf virtio_mmio dm_mirror dm_region_hash dm_log dm_mod xpmem(OE) CPU: 0 UID: 0 PID: 37589 Comm: python3 Kdump:
loaded Tainted: G OE ------- --- 6.12.0-54.el10.aarch64 #1 Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 60400005 (nZCv daif +PAN -UAO -TCO
-DIT -SSBS BTYPE=--) pc : refcount_warn_saturate+0xf4/0x148 lr : refcount_warn_saturate+0xf4/0x148 sp :
ffff80008b81b7e0 x29: ffff80008b81b7e0 x28: ffff000133d51600 x27: 0000000000000001 x26: 0000000000000000 x25: 00000000ffffffea x24: ffff00010ae80f00 x23: ffff00010ae80f80 x22: ffff0000c66e5d08 x21:
0000000000000000 x20: ffff0000c66e0000 x19: ffff00010ae80340 x18: 0000000000000006 x17: 0000000000000000 x16: 0000000000000020 x15: ffff80008b81b37f x14: 0000000000000000 x13: 2e656572662d7265 x12:
ffff80008283ef78 x11: ffff80008257efd0 x10: ffff80008283efd0 x9 : ffff80008021ed90 x8 : 0000000000000001 x7 : 00000000000bffe8 x6 : c0000000ffff7fff x5 : ffff0001fb8e3408 x4 : 0000000000000000 x3 :
ffff800179993000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000133d51600 Call trace:
refcount_warn_saturate+0xf4/0x148 mlx5_core_put_rsc+0x88/0xa0 [mlx5_ib] mlx5_core_destroy_rq_tracked+0x64/0x98 [mlx5_ib] mlx5_ib_destroy_wq+0x34/0x80 [mlx5_ib] ib_destroy_wq_user+0x30/0xc0 [ib_core] uverbs_free_wq+0x28/0x58 [ib_uverbs] destroy_hw_idr_uobject+0x34/0x78 [ib_uverbs] uverbs_destroy_uobject+0x48/0x240 [ib_uverbs]
__uverbs_cleanup_ufile+0xd4/0x1a8 [ib_uverbs] uverbs_destroy_ufile_hw+0x48/0x120 [ib_uverbs] ib_uverbs_close+0x2c/0x100 [ib_uverbs] __fput+0xd8/0x2f0 __fput_sync+0x50/0x70 __arm64_sys_close+0x40/0x90 invoke_syscall.constprop.0+0x74/0xd0 do_el0_svc+0x48/0xe8 el0_svc+0x44/0x1d0 el0t_64_sync_handler+0x120/0x130 el0t_64_sync+0x1a4/0x1a8 (CVE-2025-38161)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38161
https://ubuntu.com/security/CVE-2025-38161

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38161

Plugin Information
Published: 2025/08/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248452 - Linux Distros Unpatched Vulnerability : CVE-2025-38177
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sch_hfsc: make hfsc_qlen_notify() idempotent hfsc_qlen_notify() is not idempotent either and not friendly to its callers, like fq_codel_dequeue(). Let's make it idempotent to ease qdisc_tree_reduce_backlog() callers' life: 1. update_vf() decreases cl->cl_nactive, so we can check whether it is non-zero before calling it. 2. eltree_remove() always removes RB node cl->el_node, but we can use RB_EMPTY_NODE() + RB_CLEAR_NODE() to make it safe. (CVE-2025-38177)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38177
https://ubuntu.com/security/CVE-2025-38177

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38177

Plugin Information
Published: 2025/08/11, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247338 - Linux Distros Unpatched Vulnerability : CVE-2025-38193
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net_sched: sch_sfq: reject invalid perturb period Gerrard Tai reported that SFQ perturb_period has no range check yet, and this can be used to trigger a race condition fixed in a separate patch. We want to make sure ctl->perturb_period * HZ will not overflow and is positive. tc qd add dev lo root sfq perturb
-10 # negative value : error Error: sch_sfq: invalid perturb period. tc qd add dev lo root sfq perturb 1000000000 # too big : error Error: sch_sfq: invalid perturb period. tc qd add dev lo root sfq perturb 2000000 # acceptable value tc -s -d qd sh dev lo qdisc sfq 8005: root refcnt 2 limit 127p quantum 64Kb depth 127 flows 128 divisor 1024 perturb 2000000sec Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) backlog 0b 0p requeues 0 (CVE-2025-38193)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38193
https://ubuntu.com/security/CVE-2025-38193

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38193

Plugin Information
Published: 2025/08/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245618 - Linux Distros Unpatched Vulnerability : CVE-2025-38198
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fbcon: Make sure modelist not set on unregistered console It looks like attempting to write to the store_modes sysfs node will run afoul of unregistered consoles: UBSAN: array-index-out-of-bounds in drivers/video/fbdev/core/fbcon.c:122:28 index -1 is out of range for type 'fb_info *[32]' ...
fbcon_info_from_console+0x192/0x1a0 drivers/video/fbdev/core/fbcon.c:122 fbcon_new_modelist+0xbf/0x2d0 drivers/video/fbdev/core/fbcon.c:3048 fb_new_modelist+0x328/0x440 drivers/video/fbdev/core/fbmem.c:673 store_modes+0x1c9/0x3e0 drivers/video/fbdev/core/fbsysfs.c:113 dev_attr_store+0x55/0x80 drivers/base/core.c:2439 static struct fb_info *fbcon_registered_fb[FB_MAX]; ... static signed char con2fb_map[MAX_NR_CONSOLES]; ... static struct fb_info *fbcon_info_from_console(int console) ... return fbcon_registered_fb[con2fb_map[console]]; If con2fb_map contains a -1 things go wrong here. Instead, return NULL, as callers of fbcon_info_from_console() are trying to compare against existing info pointers, so error handling should kick in correctly. (CVE-2025-38198)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38198
https://ubuntu.com/security/CVE-2025-38198

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38198

Plugin Information
Published: 2025/08/08, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246945 - Linux Distros Unpatched Vulnerability : CVE-2025-38201
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is unset. Similar to: b541ba7d1f5a (netfilter: conntrack: clamp maximum hashtable size to INT_MAX) (CVE-2025-38201)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38201
https://security-tracker.debian.org/tracker/CVE-2025-38201
https://ubuntu.com/security/CVE-2025-38201

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38201

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245667 - Linux Distros Unpatched Vulnerability : CVE-2025-38206
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- exfat: fix double free in delayed_free The double free could happen in the following path.
exfat_create_upcase_table() exfat_create_upcase_table() : return error exfat_free_upcase_table() : free
->vol_utbl exfat_load_default_upcase_table : return error exfat_kill_sb() delayed_free() exfat_free_upcase_table() <--------- double free This patch set ->vol_util as NULL after freeing it.
(CVE-2025-38206)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38206
https://security-tracker.debian.org/tracker/CVE-2025-38206
https://ubuntu.com/security/CVE-2025-38206

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38206

Plugin Information
Published: 2025/08/08, Modified: 2025/12/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243760 - Linux Distros Unpatched Vulnerability : CVE-2025-38209
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: remove tag set when second admin queue config fails Commit 104d0e2f6222 (nvme-fabrics: reset admin connection for secure concatenation) modified nvme_tcp_setup_ctrl() to call nvme_tcp_configure_admin_queue() twice. The first call prepares for DH-CHAP negotitation, and the second call is required for secure concatenation. However, this change triggered BUG KASAN slab-use-after- free in blk_mq_queue_tag_busy_iter(). This BUG can be recreated by repeating the blktests test case nvme/063 a few times [1]. When the BUG happens, nvme_tcp_create_ctrl() fails in the call chain below: nvme_tcp_create_ctrl() nvme_tcp_alloc_ctrl() new=true ... Alloc nvme_tcp_ctrl and admin_tag_set nvme_tcp_setup_ctrl() new=true nvme_tcp_configure_admin_queue() new=true ... Succeed nvme_alloc_admin_tag_set() ... Alloc the tag set for admin_tag_set nvme_stop_keep_alive() nvme_tcp_teardown_admin_queue() remove=false nvme_tcp_configure_admin_queue() new=false nvme_tcp_alloc_admin_queue() ... Fail, but do not call nvme_remove_admin_tag_set() nvme_uninit_ctrl() nvme_put_ctrl() ... Free up the nvme_tcp_ctrl and admin_tag_set The first call of nvme_tcp_configure_admin_queue() succeeds with new=true argument. The second call fails with new=false argument. This second call does not call nvme_remove_admin_tag_set() on failure, due to the new=false argument. Then the admin tag set is not removed. However, nvme_tcp_create_ctrl() assumes that nvme_tcp_setup_ctrl() would call nvme_remove_admin_tag_set(). Then it frees up struct nvme_tcp_ctrl which has admin_tag_set field. Later on, the timeout handler accesses the admin_tag_set field and causes the BUG KASAN slab-use-after-free. To not leave the admin tag set, call nvme_remove_admin_tag_set() when the second nvme_tcp_configure_admin_queue() call fails. Do not return from nvme_tcp_setup_ctrl() on failure. Instead, jump to destroy_admin go-to label to call nvme_tcp_teardown_admin_queue() which calls nvme_remove_admin_tag_set(). (CVE-2025-38209)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38209
https://ubuntu.com/security/CVE-2025-38209

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
8.5 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
6.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-38209

Plugin Information
Published: 2025/08/05, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244121 - Linux Distros Unpatched Vulnerability : CVE-2025-38212
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipc: fix to protect IPCS lookups using RCU syzbot reported that it discovered a use-after-free vulnerability, [0] [0]: https://lore.kernel.org/all/67af13f8.050a0220.21dd3.0038.GAE@google.com/ idr_for_each() is protected by rwsem, but this is not enough. If it is not protected by RCU read-critical region, when idr_for_each() calls radix_tree_node_free() through call_rcu() to free the radix_tree_node structure, the node will be freed immediately, and when reading the next node in radix_tree_for_each_slot(), the already freed memory may be read. Therefore, we need to add code to make sure that idr_for_each() is protected within the RCU read-critical region when we call it in shm_destroy_orphaned(). (CVE-2025-38212)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38212
https://ubuntu.com/security/CVE-2025-38212

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38212

Plugin Information
Published: 2025/08/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248519 - Linux Distros Unpatched Vulnerability : CVE-2025-38216
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Restore context entry setup order for aliased devices Commit 2031c469f816 (iommu/vt-d: Add support for static identity domain) changed the context entry setup during domain attachment from a set-and-check policy to a clear-and-reset approach. This inadvertently introduced a regression affecting PCI aliased devices behind PCIe-to-PCI bridges. Specifically, keyboard and touchpad stopped working on several Apple Macbooks with below messages: kernel: platform pxa2xx-spi.3: Adding to iommu group 20 kernel: input: Apple SPI Keyboard as /devices/pci0000:00/0000:00:1e.3/pxa2xx-spi.3/spi_master/spi2/spi-APP000D:00/input/input0 kernel: DMAR:
DRHD: handling fault status reg 3 kernel: DMAR: [DMA Read NO_PASID] Request device [00:1e.3] fault addr 0xffffa000 [fault reason 0x06] PTE Read access is not set kernel: DMAR: DRHD: handling fault status reg 3 kernel: DMAR: [DMA Read NO_PASID] Request device [00:1e.3] fault addr 0xffffa000 [fault reason 0x06] PTE Read access is not set kernel: applespi spi-APP000D:00: Error writing to device: 01 0e 00 00 kernel: DMAR:
DRHD: handling fault status reg 3 kernel: DMAR: [DMA Read NO_PASID] Request device [00:1e.3] fault addr 0xffffa000 [fault reason 0x06] PTE Read access is not set kernel: DMAR: DRHD: handling fault status reg 3 kernel: applespi spi-APP000D:00: Error writing to device: 01 0e 00 00 Fix this by restoring the previous context setup order. (CVE-2025-38216)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38216
https://ubuntu.com/security/CVE-2025-38216

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38216

Plugin Information
Published: 2025/08/12, Modified: 2025/11/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249487 - Linux Distros Unpatched Vulnerability : CVE-2025-38222
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: inline: fix len overflow in ext4_prepare_inline_data When running the following code on an ext4 filesystem with inline_data feature enabled, it will lead to the bug below. fd = open(file1, O_RDWR | O_CREAT | O_TRUNC, 0666); ftruncate(fd, 30); pwrite(fd, a, 1, (1UL << 40) + 5UL); That happens because write_begin will succeed as when ext4_generic_write_inline_data calls ext4_prepare_inline_data, pos + len will be truncated, leading to ext4_prepare_inline_data parameter to be 6 instead of 0x10000000006. Then, later when write_end is called, we hit: BUG_ON(pos + len > EXT4_I(inode)->i_inline_size); at ext4_write_inline_data. Fix it by using a loff_t type for the len parameter in ext4_prepare_inline_data instead of an unsigned int. [ 44.545164] ------------[ cut here ]------------ [ 44.545530] kernel BUG at fs/ext4/inline.c:240! [ 44.545834] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 44.546172] CPU: 3 UID: 0 PID: 343 Comm: test Not tainted 6.15.0-rc2-00003-g9080916f4863 #45 PREEMPT(full) 112853fcebfdb93254270a7959841d2c6aa2c8bb [ 44.546523] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 44.546523] RIP: 0010:ext4_write_inline_data+0xfe/0x100 [ 44.546523] Code: 3c 0e 48 83 c7 48 48 89 de 5b 41 5c 41 5d 41 5e 41 5f 5d e9 e4 fa 43 01 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 0f 0b <0f> 0b 0f 1f 44 00 00 55 41 57 41 56 41 55 41 54 53 48 83 ec 20 49 [ 44.546523] RSP: 0018:ffffb342008b79a8 EFLAGS: 00010216 [ 44.546523] RAX: 0000000000000001 RBX:
ffff9329c579c000 RCX: 0000010000000006 [ 44.546523] RDX: 000000000000003c RSI: ffffb342008b79f0 RDI:
ffff9329c158e738 [ 44.546523] RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000 [ 44.546523] R10: 00007ffffffff000 R11: ffffffff9bd0d910 R12: 0000006210000000 [ 44.546523] R13:
fffffc7e4015e700 R14: 0000010000000005 R15: ffff9329c158e738 [ 44.546523] FS: 00007f4299934740(0000) GS:ffff932a60179000(0000) knlGS:0000000000000000 [ 44.546523] CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 [ 44.546523] CR2: 00007f4299a1ec90 CR3: 0000000002886002 CR4: 0000000000770eb0 [ 44.546523] PKRU: 55555554 [ 44.546523] Call Trace: [ 44.546523] <TASK> [ 44.546523] ext4_write_inline_data_end+0x126/0x2d0 [ 44.546523] generic_perform_write+0x17e/0x270 [ 44.546523] ext4_buffered_write_iter+0xc8/0x170 [ 44.546523] vfs_write+0x2be/0x3e0 [ 44.546523]
__x64_sys_pwrite64+0x6d/0xc0 [ 44.546523] do_syscall_64+0x6a/0xf0 [ 44.546523] ? __wake_up+0x89/0xb0 [ 44.546523] ? xas_find+0x72/0x1c0 [ 44.546523] ? next_uptodate_folio+0x317/0x330 [ 44.546523] ? set_pte_range+0x1a6/0x270 [ 44.546523] ? filemap_map_pages+0x6ee/0x840 [ 44.546523] ? ext4_setattr+0x2fa/0x750 [ 44.546523] ? do_pte_missing+0x128/0xf70 [ 44.546523] ? security_inode_post_setattr+0x3e/0xd0 [ 44.546523] ? ___pte_offset_map+0x19/0x100 [ 44.546523] ? handle_mm_fault+0x721/0xa10 [ 44.546523] ? do_user_addr_fault+0x197/0x730 [ 44.546523] ? do_syscall_64+0x76/0xf0 [ 44.546523] ? arch_exit_to_user_mode_prepare+0x1e/0x60 [ 44.546523] ? irqentry_exit_to_user_mode+0x79/0x90 [ 44.546523] entry_SYSCALL_64_after_hwframe+0x55/0x5d [ 44.546523] RIP: 0033:0x7f42999c6687 [ 44.546523] Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 44.546523] RSP: 002b:00007ffeae4a7930 EFLAGS: 00000202 ORIG_RAX:
0000000000000012 [ 44.546523] RAX: ffffffffffffffda RBX: 00007f4299934740 RCX: 00007f42999c6687 [ 44.546523] RDX: 0000000000000001 RSI: 000055ea6149200f RDI: 0000000000000003 [ 44.546523] RBP:
00007ffeae4a79a0 R08: 0000000000000000 R09: 0000000000000000 [ 44.546523] R10: 0000010000000005 R11:
0000000000000202 R12: 0000 ---truncated--- (CVE-2025-38222)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38222
https://ubuntu.com/security/CVE-2025-38222

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38222

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245348 - Linux Distros Unpatched Vulnerability : CVE-2025-38239
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: megaraid_sas: Fix invalid node index On a system with DRAM interleave enabled, out-of-bound access is detected: megaraid_sas 0000:3f:00.0: requested/available msix 128/128 poll_queue 0 ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in ./arch/x86/include/asm/topology.h:72:28 index -1 is out of range for type 'cpumask *[1024]' dump_stack_lvl+0x5d/0x80 ubsan_epilogue+0x5/0x2b
__ubsan_handle_out_of_bounds.cold+0x46/0x4b megasas_alloc_irq_vectors+0x149/0x190 [megaraid_sas] megasas_probe_one.cold+0xa4d/0x189c [megaraid_sas] local_pci_probe+0x42/0x90 pci_device_probe+0xdc/0x290 really_probe+0xdb/0x340 __driver_probe_device+0x78/0x110 driver_probe_device+0x1f/0xa0
__driver_attach+0xba/0x1c0 bus_for_each_dev+0x8b/0xe0 bus_add_driver+0x142/0x220 driver_register+0x72/0xd0 megasas_init+0xdf/0xff0 [megaraid_sas] do_one_initcall+0x57/0x310 do_init_module+0x90/0x250 init_module_from_file+0x85/0xc0 idempotent_init_module+0x114/0x310 __x64_sys_finit_module+0x65/0xc0 do_syscall_64+0x82/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Fix it accordingly. (CVE-2025-38239)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38239
https://ubuntu.com/security/CVE-2025-38239

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38239

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249677 - Linux Distros Unpatched Vulnerability : CVE-2025-38248
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bridge: mcast: Fix use-after-free during router port configuration The bridge maintains a global list of ports behind which a multicast router resides. The list is consulted during forwarding to ensure multicast packets are forwarded to these ports even if the ports are not member in the matching MDB entry. When per- VLAN multicast snooping is enabled, the per-port multicast context is disabled on each port and the port is removed from the global router port list: # ip link add name br1 up type bridge vlan_filtering 1 mcast_snooping 1 # ip link add name dummy1 up master br1 type dummy # ip link set dev dummy1 type bridge_slave mcast_router 2 $ bridge -d mdb show | grep router router ports on br1: dummy1 # ip link set dev br1 type bridge mcast_vlan_snooping 1 $ bridge -d mdb show | grep router However, the port can be re- added to the global list even when per-VLAN multicast snooping is enabled: # ip link set dev dummy1 type bridge_slave mcast_router 0 # ip link set dev dummy1 type bridge_slave mcast_router 2 $ bridge -d mdb show | grep router router ports on br1: dummy1 Since commit 4b30ae9adb04 (net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions), when per-VLAN multicast snooping is enabled, multicast disablement on a port will disable the per-{port, VLAN} multicast contexts and not the per-port one. As a result, a port will remain in the global router port list even after it is deleted. This will lead to a use-after-free [1] when the list is traversed (when adding a new port to the list, for example): # ip link del dev dummy1 # ip link add name dummy2 up master br1 type dummy # ip link set dev dummy2 type bridge_slave mcast_router 2 Similarly, stale entries can also be found in the per-VLAN router port list.
When per-VLAN multicast snooping is disabled, the per-{port, VLAN} contexts are disabled on each port and the port is removed from the per-VLAN router port list: # ip link add name br1 up type bridge vlan_filtering 1 mcast_snooping 1 mcast_vlan_snooping 1 # ip link add name dummy1 up master br1 type dummy # bridge vlan add vid 2 dev dummy1 # bridge vlan global set vid 2 dev br1 mcast_snooping 1 # bridge vlan set vid 2 dev dummy1 mcast_router 2 $ bridge vlan global show dev br1 vid 2 | grep router router ports:
dummy1 # ip link set dev br1 type bridge mcast_vlan_snooping 0 $ bridge vlan global show dev br1 vid 2 | grep router However, the port can be re-added to the per-VLAN list even when per-VLAN multicast snooping is disabled: # bridge vlan set vid 2 dev dummy1 mcast_router 0 # bridge vlan set vid 2 dev dummy1 mcast_router 2 $ bridge vlan global show dev br1 vid 2 | grep router router ports: dummy1 When the VLAN is deleted from the port, the per-{port, VLAN} multicast context will not be disabled since multicast snooping is not enabled on the VLAN. As a result, the port will remain in the per-VLAN router port list even after it is no longer member in the VLAN. This will lead to a use-after-free [2] when the list is traversed (when adding a new port to the list, for example): # ip link add name dummy2 up master br1 type dummy # bridge vlan add vid 2 dev dummy2 # bridge vlan del vid 2 dev dummy1 # bridge vlan set vid 2 dev dummy2 mcast_router 2 Fix these issues by removing the port from the relevant (global or per-VLAN) router port list in br_multicast_port_ctx_deinit(). The function is invoked during port deletion with the per- port multicast context and during VLAN deletion with the per-{port, VLAN} multicast context. Note that deleting the multicast router timer is not enough as it only takes care of the temporary multicast router states (1 or 3) and not the permanent one (2). [1] BUG: KASAN: slab-out-of-bounds in br_multicast_add_router.part.0+0x3f1/0x560 Write of size 8 at addr ffff888004a67328 by task ip/384 [...] Call Trace: <TASK> dump_stack ---truncated--- (CVE-2025-38248)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38248
https://security-tracker.debian.org/tracker/CVE-2025-38248
https://ubuntu.com/security/CVE-2025-38248

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.9 (CVSS2#AV:A/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38248

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246132 - Linux Distros Unpatched Vulnerability : CVE-2025-38249
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() In snd_usb_get_audioformat_uac3(), the length value returned from snd_usb_ctl_msg() is used directly for memory allocation without validation. This length is controlled by the USB device. The allocated buffer is cast to a uac3_cluster_header_descriptor and its fields are accessed without verifying that the buffer is large enough. If the device returns a smaller than expected length, this leads to an out-of-bounds read.
Add a length check to ensure the buffer is large enough for uac3_cluster_header_descriptor.
(CVE-2025-38249)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38249
https://ubuntu.com/security/CVE-2025-38249

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38249

Plugin Information
Published: 2025/08/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246080 - Linux Distros Unpatched Vulnerability : CVE-2025-38257
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- s390/pkey: Prevent overflow in size calculation for memdup_user() Number of apqn target list entries contained in 'nr_apqns' variable is determined by userspace via an ioctl call so the result of the product in calculation of size passed to memdup_user() may overflow. In this case the actual size of the allocated area and the value describing it won't be in sync leading to various types of unpredictable behaviour later. Use a proper memdup_array_user() helper which returns an error if an overflow is detected. Note that it is different from when nr_apqns is initially zero - that case is considered valid and should be handled in subsequent pkey_handler implementations. Found by Linux Verification Center (linuxtesting.org).
(CVE-2025-38257)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38257
https://security-tracker.debian.org/tracker/CVE-2025-38257
https://ubuntu.com/security/CVE-2025-38257

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38257

Plugin Information
Published: 2025/08/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246490 - Linux Distros Unpatched Vulnerability : CVE-2025-38270
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: drv: netdevsim: don't napi_complete() from netpoll netdevsim supports netpoll. Make sure we don't call napi_complete() from it, since it may not be scheduled. Breno reports hitting a warning in napi_complete_done(): WARNING: CPU: 14 PID: 104 at net/core/dev.c:6592 napi_complete_done+0x2cc/0x560 __napi_poll+0x2d8/0x3a0 handle_softirqs+0x1fe/0x710 This is presumably after netpoll stole the SCHED bit prematurely.
(CVE-2025-38270)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38270
https://ubuntu.com/security/CVE-2025-38270

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38270

Plugin Information
Published: 2025/08/09, Modified: 2025/11/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244408 - Linux Distros Unpatched Vulnerability : CVE-2025-38279
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Do not include stack ptr register in precision backtracking bookkeeping Yi Lai reported an issue ([1]) where the following warning appears in kernel dmesg: [ 60.643604] verifier backtracking bug [ 60.643635] WARNING: CPU: 10 PID: 2315 at kernel/bpf/verifier.c:4302 __mark_chain_precision+0x3a6c/0x3e10 [ 60.648428] Modules linked in: bpf_testmod(OE) [ 60.650471] CPU: 10 UID: 0 PID: 2315 Comm: test_progs Tainted: G OE 6.15.0-rc4-gef11287f8289-dirty #327 PREEMPT(full) [ 60.654385] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE [ 60.656682] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 60.660475] RIP:
0010:__mark_chain_precision+0x3a6c/0x3e10 [ 60.662814] Code: 5a 30 84 89 ea e8 c4 d9 01 00 80 3d 3e 7d d8 04 00 0f 85 60 fa ff ff c6 05 31 7d d8 04 01 48 c7 c7 00 58 30 84 e8 c4 06 a5 ff <0f> 0b e9 46 fa ff ff 48 ... [ 60.668720] RSP: 0018:ffff888116cc7298 EFLAGS: 00010246 [ 60.671075] RAX: 54d70e82dfd31900 RBX:
ffff888115b65e20 RCX: 0000000000000000 [ 60.673659] RDX: 0000000000000001 RSI: 0000000000000004 RDI:
00000000ffffffff [ 60.676241] RBP: 0000000000000400 R08: ffff8881f6f23bd3 R09: 1ffff1103ede477a [ 60.678787] R10: dffffc0000000000 R11: ffffed103ede477b R12: ffff888115b60ae8 [ 60.681420] R13:
1ffff11022b6cbc4 R14: 00000000fffffff2 R15: 0000000000000001 [ 60.684030] FS: 00007fc2aedd80c0(0000) GS:ffff88826fa8a000(0000) knlGS:0000000000000000 [ 60.686837] CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 [ 60.689027] CR2: 000056325369e000 CR3: 000000011088b002 CR4: 0000000000370ef0 [ 60.691623] Call Trace: [ 60.692821] <TASK> [ 60.693960] ? __pfx_verbose+0x10/0x10 [ 60.695656] ?
__pfx_disasm_kfunc_name+0x10/0x10 [ 60.697495] check_cond_jmp_op+0x16f7/0x39b0 [ 60.699237] do_check+0x58fa/0xab10 ... Further analysis shows the warning is at line 4302 as below: 4294 /* static subprog call instruction, which 4295 * means that we are exiting current subprog, 4296 * so only r1-r5 could be still requested as 4297 * precise, r0 and r6-r10 or any stack slot in 4298 * the current frame should be zero by now 4299 */ 4300 if (bt_reg_mask(bt) & ~BPF_REGMASK_ARGS) { 4301 verbose(env, BUG regs %x , bt_reg_mask(bt)); 4302 WARN_ONCE(1, verifier backtracking bug); 4303 return -EFAULT; 4304 } With the below test (also in the next patch): __used __naked static void __bpf_jmp_r10(void) { asm volatile ( r2 = 2314885393468386424 ll; goto +0; if r2 <= r10 goto +3; if r1 >= -1835016 goto +0; if r2 <= 8 goto +0; if r3 <= 0 goto +0; exit; ::: __clobber_all); } SEC(?raw_tp) __naked void bpf_jmp_r10(void) { asm volatile ( r3 = 0 ll; call __bpf_jmp_r10; r0 = 0; exit; :::
__clobber_all); } The following is the verifier failure log: 0: (18) r3 = 0x0 ; R3_w=0 2: (85) call pc+2 caller: R10=fp0 callee: frame1: R1=ctx() R3_w=0 R10=fp0 5: frame1: R1=ctx() R3_w=0 R10=fp0 ; asm volatile ( \ @ verifier_precision.c:184 5: (18) r2 = 0x20202000256c6c78 ; frame1: R2_w=0x20202000256c6c78 7: (05) goto pc+0 8: (bd) if r2 <= r10 goto pc+3 ; frame1: R2_w=0x20202000256c6c78 R10=fp0 9: (35) if r1 >= 0xffe3fff8 goto pc+0 ; frame1: R1=ctx() 10: (b5) if r2 <= 0x8 goto pc+0 mark_precise: frame1: last_idx 10 first_idx 0 subseq_idx -1 mark_precise: frame1: regs=r2 stack= before 9: (35) if r1 >= 0xffe3fff8 goto pc+0 mark_precise: frame1: regs=r2 stack= before 8: (bd) if r2 <= r10 goto pc+3 mark_preci ---truncated--- (CVE-2025-38279)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38279
https://ubuntu.com/security/CVE-2025-38279

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38279

Plugin Information
Published: 2025/08/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243888 - Linux Distros Unpatched Vulnerability : CVE-2025-38285
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Fix WARN() in get_bpf_raw_tp_regs syzkaller reported an issue: WARNING: CPU: 3 PID: 5971 at kernel/trace/bpf_trace.c:1861 get_bpf_raw_tp_regs+0xa4/0x100 kernel/trace/bpf_trace.c:1861 Modules linked in: CPU: 3 UID: 0 PID: 5971 Comm: syz-executor205 Not tainted 6.15.0-rc5-syzkaller-00038-g707df3375124 #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:get_bpf_raw_tp_regs+0xa4/0x100 kernel/trace/bpf_trace.c:1861 RSP:
0018:ffffc90003636fa8 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000003 RCX: ffffffff81c6bc4c RDX: ffff888032efc880 RSI: ffffffff81c6bc83 RDI: 0000000000000005 RBP: ffff88806a730860 R08:
0000000000000005 R09: 0000000000000003 R10: 0000000000000004 R11: 0000000000000000 R12: 0000000000000004 R13: 0000000000000001 R14: ffffc90003637008 R15: 0000000000000900 FS: 0000000000000000(0000) GS:ffff8880d6cdf000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
00007f7baee09130 CR3: 0000000029f5a000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK>
____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1934 [inline] bpf_get_stack_raw_tp+0x24/0x160 kernel/trace/bpf_trace.c:1931 bpf_prog_ec3b2eefa702d8d3+0x43/0x47 bpf_dispatcher_nop_func include/linux/bpf.h:1316 [inline] __bpf_prog_run include/linux/filter.h:718 [inline] bpf_prog_run include/linux/filter.h:725 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2363 [inline] bpf_trace_run3+0x23f/0x5a0 kernel/trace/bpf_trace.c:2405 __bpf_trace_mmap_lock_acquire_returned+0xfc/0x140 include/trace/events/mmap_lock.h:47 __traceiter_mmap_lock_acquire_returned+0x79/0xc0 include/trace/events/mmap_lock.h:47 __do_trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:47 [inline] trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:47 [inline] __mmap_lock_do_trace_acquire_returned+0x138/0x1f0 mm/mmap_lock.c:35 __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline] mmap_read_trylock include/linux/mmap_lock.h:204 [inline] stack_map_get_build_id_offset+0x535/0x6f0 kernel/bpf/stackmap.c:157 __bpf_get_stack+0x307/0xa10 kernel/bpf/stackmap.c:483 ____bpf_get_stack kernel/bpf/stackmap.c:499 [inline] bpf_get_stack+0x32/0x40 kernel/bpf/stackmap.c:496
____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1941 [inline] bpf_get_stack_raw_tp+0x124/0x160 kernel/trace/bpf_trace.c:1931 bpf_prog_ec3b2eefa702d8d3+0x43/0x47 Tracepoint like trace_mmap_lock_acquire_returned may cause nested call as the corner case show above, which will be resolved with more general method in the future. As a result, WARN_ON_ONCE will be triggered. As Alexei suggested, remove the WARN_ON_ONCE first. (CVE-2025-38285)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38285
https://ubuntu.com/security/CVE-2025-38285

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38285

Plugin Information
Published: 2025/08/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248348 - Linux Distros Unpatched Vulnerability : CVE-2025-38288
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels Correct kernel call trace when calling smp_processor_id() when called in preemptible kernels by using raw_smp_processor_id(). smp_processor_id() checks to see if preemption is disabled and if not, issue an error message followed by a call to dump_stack(). Brief example of call trace: kernel: check_preemption_disabled: 436 callbacks suppressed kernel: BUG: using smp_processor_id() in preemptible [00000000] code: kworker/u1025:0/2354 kernel: caller is pqi_scsi_queue_command+0x183/0x310 [smartpqi] kernel: CPU: 129 PID: 2354 Comm: kworker/u1025:0 kernel: ... kernel: Workqueue: writeback wb_workfn (flush-253:0) kernel: Call Trace: kernel: <TASK> kernel: dump_stack_lvl+0x34/0x48 kernel:
check_preemption_disabled+0xdd/0xe0 kernel: pqi_scsi_queue_command+0x183/0x310 [smartpqi] kernel: ...
(CVE-2025-38288)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38288
https://ubuntu.com/security/CVE-2025-38288

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38288

Plugin Information
Published: 2025/08/11, Modified: 2025/11/21
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248171 - Linux Distros Unpatched Vulnerability : CVE-2025-38289
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk Smatch detected a potential use- after-free of an ndlp oject in dev_loss_tmo_callbk during driver unload or fatal error handling. Fix by reordering code to avoid potential use-after-free if initial nodelist reference has been previously removed. (CVE-2025-38289)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38289
https://ubuntu.com/security/CVE-2025-38289

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38289

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246092 - Linux Distros Unpatched Vulnerability : CVE-2025-38293
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath11k: fix node corruption in ar->arvifs list In current WLAN recovery code flow, ath11k_core_halt() only reinitializes the arvifs list head. This will cause the list node immediately following the list head to become an invalid list node. Because the prev of that node still points to the list head arvifs, but the next of the list head arvifs no longer points to that list node. When a WLAN recovery occurs during the execution of a vif removal, and it happens before the spin_lock_bh(&ar->data_lock) in ath11k_mac_op_remove_interface(), list_del() will detect the previously mentioned situation, thereby triggering a kernel panic. The fix is to remove and reinitialize all vif list nodes from the list head arvifs during WLAN halt. The reinitialization is to make the list nodes valid, ensuring that the list_del() in ath11k_mac_op_remove_interface() can execute normally. Call trace:
__list_del_entry_valid_or_report+0xb8/0xd0 ath11k_mac_op_remove_interface+0xb0/0x27c [ath11k] drv_remove_interface+0x48/0x194 [mac80211] ieee80211_do_stop+0x6e0/0x844 [mac80211] ieee80211_stop+0x44/0x17c [mac80211] __dev_close_many+0xac/0x150 __dev_change_flags+0x194/0x234 dev_change_flags+0x24/0x6c devinet_ioctl+0x3a0/0x670 inet_ioctl+0x200/0x248 sock_do_ioctl+0x60/0x118 sock_ioctl+0x274/0x35c __arm64_sys_ioctl+0xac/0xf0 invoke_syscall+0x48/0x114 ... Tested-on: QCA6698AQ hw2.1 PCI WLAN.HSP.1.1-04591-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 (CVE-2025-38293)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38293
https://ubuntu.com/security/CVE-2025-38293

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38293

Plugin Information
Published: 2025/08/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248618 - Linux Distros Unpatched Vulnerability : CVE-2025-38310
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- seg6: Fix validation of nexthop addresses The kernel currently validates that the length of the provided nexthop address does not exceed the specified length. This can lead to the kernel reading uninitialized memory if user space provided a shorter length than the specified one. Fix by validating that the provided length exactly matches the specified one. (CVE-2025-38310)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38310
https://security-tracker.debian.org/tracker/CVE-2025-38310
https://ubuntu.com/security/CVE-2025-38310

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38310

Plugin Information
Published: 2025/08/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244085 - Linux Distros Unpatched Vulnerability : CVE-2025-38312
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() In fb_find_mode_cvt(), iff mode->refresh somehow happens to be 0x80000000, cvt.f_refresh will become 0 when multiplying it by 2 due to overflow.
It's then passed to fb_cvt_hperiod(), where it's used as a divider -- division by 0 will result in kernel oops. Add a sanity check for cvt.f_refresh to avoid such overflow... Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool. (CVE-2025-38312)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38312
https://ubuntu.com/security/CVE-2025-38312

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38312

Plugin Information
Published: 2025/08/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243776 - Linux Distros Unpatched Vulnerability : CVE-2025-38317
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix buffer overflow in debugfs If the user tries to write more than 32 bytes then it results in memory corruption. Fortunately, this is debugfs so it's limited to root users. (CVE-2025-38317)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38317
https://ubuntu.com/security/CVE-2025-38317

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38317

Plugin Information
Published: 2025/08/05, Modified: 2025/11/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248081 - Linux Distros Unpatched Vulnerability : CVE-2025-38323
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: atm: add lec_mutex syzbot found its way in net/atm/lec.c, and found an error path in lecd_attach() could leave a dangling pointer in dev_lec[]. Add a mutex to protect dev_lecp[] uses from lecd_attach(), lec_vcc_attach() and lec_mcast_attach(). Following patch will use this mutex for /proc/net/atm/lec. BUG:
KASAN: slab-use-after-free in lecd_attach net/atm/lec.c:751 [inline] BUG: KASAN: slab-use-after-free in lane_ioctl+0x2224/0x23e0 net/atm/lec.c:1008 Read of size 8 at addr ffff88807c7b8e68 by task syz.1.17/6142 CPU: 1 UID: 0 PID: 6142 Comm: syz.1.17 Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xcd/0x680 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634 lecd_attach net/atm/lec.c:751 [inline] lane_ioctl+0x2224/0x23e0 net/atm/lec.c:1008 do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159 sock_do_ioctl+0x118/0x280 net/socket.c:1190 sock_ioctl+0x227/0x6b0 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK>
Allocated by task 6132: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4328 [inline] __kvmalloc_node_noprof+0x27b/0x620 mm/slub.c:5015 alloc_netdev_mqs+0xd2/0x1570 net/core/dev.c:11711 lecd_attach net/atm/lec.c:737 [inline] lane_ioctl+0x17db/0x23e0 net/atm/lec.c:1008 do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159 sock_do_ioctl+0x118/0x280 net/socket.c:1190 sock_ioctl+0x227/0x6b0 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6132: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2381 [inline] slab_free mm/slub.c:4643 [inline] kfree+0x2b4/0x4d0 mm/slub.c:4842 free_netdev+0x6c5/0x910 net/core/dev.c:11892 lecd_attach net/atm/lec.c:744 [inline] lane_ioctl+0x1ce8/0x23e0 net/atm/lec.c:1008 do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159 sock_do_ioctl+0x118/0x280 net/socket.c:1190 sock_ioctl+0x227/0x6b0 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893 (CVE-2025-38323)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38323
https://ubuntu.com/security/CVE-2025-38323

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38323

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244677 - Linux Distros Unpatched Vulnerability : CVE-2025-38338
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() Sometimes, when a file was read while it was being truncated by another NFS client, the kernel could deadlock because folio_unlock() was called twice, and the second call would XOR back the `PG_locked` flag. Most of the time (depending on the timing of the truncation), nobody notices the problem because folio_unlock() gets called three times, which flips `PG_locked` back off: 1. vfs_read, nfs_read_folio, ... nfs_read_add_folio, nfs_return_empty_folio 2.
vfs_read, nfs_read_folio, ... netfs_read_collection, netfs_unlock_abandoned_read_pages 3. vfs_read, ...
nfs_do_read_folio, nfs_read_add_folio, nfs_return_empty_folio The problem is that nfs_read_add_folio() is not supposed to unlock the folio if fscache is enabled, and a nfs_netfs_folio_unlock() check is missing in nfs_return_empty_folio(). Rarely this leads to a warning in netfs_read_collection(): ------------[ cut here ]------------ R=0000031c: folio 10 is not locked WARNING: CPU: 0 PID: 29 at fs/netfs/read_collect.c:133 netfs_read_collection+0x7c0/0xf00 [...] Workqueue: events_unbound netfs_read_collection_worker RIP: 0010:netfs_read_collection+0x7c0/0xf00 [...] Call Trace: <TASK>
netfs_read_collection_worker+0x67/0x80 process_one_work+0x12e/0x2c0 worker_thread+0x295/0x3a0 Most of the time, however, processes just get stuck forever in folio_wait_bit_common(), waiting for `PG_locked` to disappear, which never happens because nobody is really holding the folio lock. (CVE-2025-38338)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38338
https://ubuntu.com/security/CVE-2025-38338

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38338

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244743 - Linux Distros Unpatched Vulnerability : CVE-2025-38349
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- eventpoll: don't decrement ep refcount while still holding the ep mutex Jann Horn points out that epoll is decrementing the ep refcount and then doing a mutex_unlock(&ep->mtx); afterwards. That's very wrong, because it can lead to a use-after-free. That pattern is actually fine for the very last reference, because the code in question will delay the actual call to ep_free(ep) until after it has unlocked the mutex. But it's wrong for the much subtler next to last case when somebody *else* may also be dropping their reference and free the ep while we're still using the mutex. Note that this is true even if that other user is also using the same ep mutex: mutexes, unlike spinlocks, can not be used for object ownership, even if they guarantee mutual exclusion. A mutex unlock operation is not atomic, and as one user is still accessing the mutex as part of unlocking it, another user can come in and get the now released mutex and free the data structure while the first user is still cleaning up. See our mutex documentation in Documentation/locking/mutex-design.rst, in particular the section [1] about semantics:
mutex_unlock() may access the mutex structure even after it has internally released the lock already - so it's not safe for another context to acquire the mutex and assume that the mutex_unlock() context is not using the structure anymore So if we drop our ep ref before the mutex unlock, but we weren't the last one, we may then unlock the mutex, another user comes in, drops _their_ reference and releases the 'ep' as it now has no users - all while the mutex_unlock() is still accessing it. Fix this by simply moving the ep refcount dropping to outside the mutex: the refcount itself is atomic, and doesn't need mutex protection (that's the whole _point_ of refcounts: unlike mutexes, they are inherently about object lifetimes).
(CVE-2025-38349)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38349
https://ubuntu.com/security/CVE-2025-38349

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38349

Plugin Information
Published: 2025/08/07, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248087 - Linux Distros Unpatched Vulnerability : CVE-2025-38369
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using Running IDXD workloads in a container with the /dev directory mounted can trigger a call trace or even a kernel panic when the parent process of the container is terminated. This issue occurs because, under certain configurations, Docker does not properly propagate the mount replica back to the original mount point. In this case, when the user driver detaches, the WQ is destroyed but it still calls destroy_workqueue() attempting to completes all pending work. It's necessary to check wq->wq and skip the drain if it no longer exists. (CVE-2025-38369)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38369
https://security-tracker.debian.org/tracker/CVE-2025-38369
https://ubuntu.com/security/CVE-2025-38369

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38369

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245988 - Linux Distros Unpatched Vulnerability : CVE-2025-38375
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- virtio-net: ensure the received length does not exceed allocated size In xdp_linearize_page, when reading the following buffers from the ring, we forget to check the received length with the true allocate size.
This can lead to an out-of-bound read. This commit adds that missing check. (CVE-2025-38375)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38375
https://ubuntu.com/security/CVE-2025-38375

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38375

Plugin Information
Published: 2025/08/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245031 - Linux Distros Unpatched Vulnerability : CVE-2025-38400
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. syzbot reported a warning below [1] following a fault injection in nfs_fs_proc_net_init(). [0] When nfs_fs_proc_net_init() fails, /proc/net/rpc/nfs is not removed. Later, rpc_proc_exit() tries to remove /proc/net/rpc, and the warning is logged as the directory is not empty. Let's handle the error of nfs_fs_proc_net_init() properly. [0]:
FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 UID:
0 PID: 6120 Comm: syz.2.27 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: <TASK>
dump_stack_lvl (lib/dump_stack.c:123) should_fail_ex (lib/fault-inject.c:73 lib/fault-inject.c:174) should_failslab (mm/failslab.c:46) kmem_cache_alloc_noprof (mm/slub.c:4178 mm/slub.c:4204) __proc_create (fs/proc/generic.c:427) proc_create_reg (fs/proc/generic.c:554) proc_create_net_data (fs/proc/proc_net.c:120) nfs_fs_proc_net_init (fs/nfs/client.c:1409) nfs_net_init (fs/nfs/inode.c:2600) ops_init (net/core/net_namespace.c:138) setup_net (net/core/net_namespace.c:443) copy_net_ns (net/core/net_namespace.c:576) create_new_namespaces (kernel/nsproxy.c:110) unshare_nsproxy_namespaces (kernel/nsproxy.c:218 (discriminator 4)) ksys_unshare (kernel/fork.c:3123) __x64_sys_unshare (kernel/fork.c:3190) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> [1]: remove_proc_entry: removing non-empty directory 'net/rpc', leaking at least 'nfs' WARNING: CPU: 1 PID: 6120 at fs/proc/generic.c:727 remove_proc_entry+0x45e/0x530 fs/proc/generic.c:727 Modules linked in: CPU: 1 UID: 0 PID: 6120 Comm:
syz.2.27 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP:
0010:remove_proc_entry+0x45e/0x530 fs/proc/generic.c:727 Code: 3c 02 00 0f 85 85 00 00 00 48 8b 93 d8 00 00 00 4d 89 f0 4c 89 e9 48 c7 c6 40 ba a2 8b 48 c7 c7 60 b9 a2 8b e8 33 81 1d ff 90 <0f> 0b 90 90 e9 5f fe ff ff e8 04 69 5e ff 90 48 b8 00 00 00 00 00 RSP: 0018:ffffc90003637b08 EFLAGS: 00010282 RAX:
0000000000000000 RBX: ffff88805f534140 RCX: ffffffff817a92c8 RDX: ffff88807da99e00 RSI: ffffffff817a92d5 RDI: 0000000000000001 RBP: ffff888033431ac0 R08: 0000000000000001 R09: 0000000000000000 R10:
0000000000000001 R11: 0000000000000001 R12: ffff888033431a00 R13: ffff888033431ae4 R14: ffff888033184724 R15: dffffc0000000000 FS: 0000555580328500(0000) GS:ffff888124a62000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f71733743e0 CR3: 000000007f618000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6:
00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> sunrpc_exit_net+0x46/0x90 net/sunrpc/sunrpc_syms.c:76 ops_exit_list net/core/net_namespace.c:200 [inline] ops_undo_list+0x2eb/0xab0 net/core/net_namespace.c:253 setup_net+0x2e1/0x510 net/core/net_namespace.c:457 copy_net_ns+0x2a6/0x5f0 net/core/net_namespace.c:574 create_new_namespaces+0x3ea/0xa90 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:218 ksys_unshare+0x45b/0xa40 kernel/fork.c:3121
__do_sys_unshare kernel/fork.c:3192 [inline] __se_sys_unshare kernel/fork.c:3190 [inline]
__x64_sys_unshare+0x31/0x40 kernel/fork.c:3190 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP:
0033:0x7fa1a6b8e929 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c ---truncated--- (CVE-2025-38400)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38400
https://ubuntu.com/security/CVE-2025-38400

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38400

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248216 - Linux Distros Unpatched Vulnerability : CVE-2025-38403
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vsock/vmci: Clear the vmci transport packet properly when initializing it In vmci_transport_packet_init memset the vmci_transport_packet before populating the fields to avoid any uninitialised data being left in the structure. (CVE-2025-38403)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38403
https://ubuntu.com/security/CVE-2025-38403

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38403

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247292 - Linux Distros Unpatched Vulnerability : CVE-2025-38425
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- i2c: tegra: check msg length in SMBUS block read For SMBUS block read, do not continue to read if the message length passed from the device is '0' or greater than the maximum allowed bytes. (CVE-2025-38425)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38425
https://ubuntu.com/security/CVE-2025-38425

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38425

Plugin Information
Published: 2025/08/10, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243700 - Linux Distros Unpatched Vulnerability : CVE-2025-38430
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request If the request being processed is not a v4 compound request, then examining the cstate can have undefined results. This patch adds a check that the rpc procedure being executed (rq_procinfo) is the NFSPROC4_COMPOUND procedure. (CVE-2025-38430)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38430
https://ubuntu.com/security/CVE-2025-38430

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38430

Plugin Information
Published: 2025/08/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245320 - Linux Distros Unpatched Vulnerability : CVE-2025-38439
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT When transmitting an XDP_REDIRECT packet, call dma_unmap_len_set() with the proper length instead of 0. This bug triggers this warning on a system with IOMMU enabled: WARNING: CPU: 36 PID: 0 at drivers/iommu/dma-iommu.c:842 __iommu_dma_unmap+0x159/0x170 RIP:
0010:__iommu_dma_unmap+0x159/0x170 Code: a8 00 00 00 00 48 c7 45 b0 00 00 00 00 48 c7 45 c8 00 00 00 00 48 c7 45 a0 ff ff ff ff 4c 89 45 b8 4c 89 45 c0 e9 77 ff ff ff <0f> 0b e9 60 ff ff ff e8 8b bf 6a 00 66 66 2e 0f 1f 84 00 00 00 00 RSP: 0018:ff22d31181150c88 EFLAGS: 00010206 RAX: 0000000000002000 RBX:
00000000e13a0000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ff22d31181150cf0 R08: ff22d31181150ca8 R09: 0000000000000000 R10: 0000000000000000 R11:
ff22d311d36c9d80 R12: 0000000000001000 R13: ff13544d10645010 R14: ff22d31181150c90 R15: ff13544d0b2bac00 FS: 0000000000000000(0000) GS:ff13550908a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005be909dacff8 CR3: 0008000173408003 CR4: 0000000000f71ef0 PKRU: 55555554 Call Trace: <IRQ> ? show_regs+0x6d/0x80 ? __warn+0x89/0x160 ? __iommu_dma_unmap+0x159/0x170 ? report_bug+0x17e/0x1b0 ? handle_bug+0x46/0x90 ? exc_invalid_op+0x18/0x80 ? asm_exc_invalid_op+0x1b/0x20 ?
__iommu_dma_unmap+0x159/0x170 ? __iommu_dma_unmap+0xb3/0x170 iommu_dma_unmap_page+0x4f/0x100 dma_unmap_page_attrs+0x52/0x220 ? srso_alias_return_thunk+0x5/0xfbef5 ? xdp_return_frame+0x2e/0xd0 bnxt_tx_int_xdp+0xdf/0x440 [bnxt_en] __bnxt_poll_work_done+0x81/0x1e0 [bnxt_en] bnxt_poll+0xd3/0x1e0 [bnxt_en] (CVE-2025-38439)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38439
https://ubuntu.com/security/CVE-2025-38439

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38439

Plugin Information
Published: 2025/08/07, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245398 - Linux Distros Unpatched Vulnerability : CVE-2025-38443
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nbd: fix uaf in nbd_genl_connect() error path There is a use-after-free issue in nbd: block nbd6: Receive control failed (result -104) block nbd6: shutting down sockets ================================================================== BUG: KASAN: slab-use-after-free in recv_work+0x694/0xa80 drivers/block/nbd.c:1022 Write of size 4 at addr ffff8880295de478 by task kworker/u33:0/67 CPU: 2 UID: 0 PID: 67 Comm: kworker/u33:0 Not tainted 6.15.0-rc5-syzkaller-00123-g2c89c1b655c0 #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: nbd6-recv recv_work Call Trace: <TASK>
__dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc3/0x670 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline] recv_work+0x694/0xa80 drivers/block/nbd.c:1022 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c2/0x780 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK>
nbd_genl_connect() does not properly stop the device on certain error paths after nbd_start_device() has been called. This causes the error path to put nbd->config while recv_work continue to use the config after putting it, leading to use-after-free in recv_work. This patch moves nbd_start_device() after the backend file creation. (CVE-2025-38443)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38443
https://ubuntu.com/security/CVE-2025-38443

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38443

Plugin Information
Published: 2025/08/07, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247542 - Linux Distros Unpatched Vulnerability : CVE-2025-38445
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- md/raid1: Fix stack memory use after return in raid1_reshape In the raid1_reshape function, newpool is allocated on the stack and assigned to conf->r1bio_pool. This results in conf->r1bio_pool.wait.head pointing to a stack address. Accessing this address later can lead to a kernel panic. Example access path:
raid1_reshape() { // newpool is on the stack mempool_t newpool, oldpool; // initialize newpool.wait.head to stack address mempool_init(&newpool, ...); conf->r1bio_pool = newpool; } raid1_read_request() or raid1_write_request() { alloc_r1bio() { mempool_alloc() { // if pool->alloc fails remove_element() {
--pool->curr_nr; } } } } mempool_free() { if (pool->curr_nr < pool->min_nr) { // pool->wait.head is a stack address // wake_up() will try to access this invalid address // which leads to a kernel panic return; wake_up(&pool->wait); } } Fix: reinit conf->r1bio_pool.wait after assigning newpool.
(CVE-2025-38445)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38445
https://ubuntu.com/security/CVE-2025-38445

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38445

Plugin Information
Published: 2025/08/10, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244849 - Linux Distros Unpatched Vulnerability : CVE-2025-38455
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight Reject migration of SEV{-ES} state if either the source or destination VM is actively creating a vCPU, i.e. if kvm_vm_ioctl_create_vcpu() is in the section between incrementing created_vcpus and online_vcpus. The bulk of vCPU creation runs _outside_ of kvm->lock to allow creating multiple vCPUs in parallel, and so sev_info.es_active can get toggled from false=>true in the destination VM after (or during) svm_vcpu_create(), resulting in an SEV{-ES} VM effectively having a non-SEV{-ES} vCPU. The issue manifests most visibly as a crash when trying to free a vCPU's NULL VMSA page in an SEV-ES VM, but any number of things can go wrong. BUG: unable to handle page fault for address: ffffebde00000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP KASAN NOPTI CPU: 227 UID: 0 PID: 64063 Comm: syz.5.60023 Tainted: G U O 6.15.0-smp-DEV #2 NONE Tainted:
[U]=USER, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.52.0-0 10/28/2024 RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:206 [inline] RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:238 [inline] RIP: 0010:_test_bit include/asm-generic/bitops/instrumented- non-atomic.h:142 [inline] RIP: 0010:PageHead include/linux/page-flags.h:866 [inline] RIP:
0010:___free_pages+0x3e/0x120 mm/page_alloc.c:5067 Code: <49> f7 06 40 00 00 00 75 05 45 31 ff eb 0c 66 90 4c 89 f0 4c 39 f0 RSP: 0018:ffff8984551978d0 EFLAGS: 00010246 RAX: 0000777f80000001 RBX: 0000000000000000 RCX: ffffffff918aeb98 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffebde00000000 RBP:
0000000000000000 R08: ffffebde00000007 R09: 1ffffd7bc0000000 R10: dffffc0000000000 R11: fffff97bc0000001 R12: dffffc0000000000 R13: ffff8983e19751a8 R14: ffffebde00000000 R15: 1ffffd7bc0000000 FS:
0000000000000000(0000) GS:ffff89ee661d3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 CR2: ffffebde00000000 CR3: 000000793ceaa000 CR4: 0000000000350ef0 DR0: 0000000000000000 DR1: 0000000000000b5f DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7:
0000000000000400 Call Trace: <TASK> sev_free_vcpu+0x413/0x630 arch/x86/kvm/svm/sev.c:3169 svm_vcpu_free+0x13a/0x2a0 arch/x86/kvm/svm/svm.c:1515 kvm_arch_vcpu_destroy+0x6a/0x1d0 arch/x86/kvm/x86.c:12396 kvm_vcpu_destroy virt/kvm/kvm_main.c:470 [inline] kvm_destroy_vcpus+0xd1/0x300 virt/kvm/kvm_main.c:490 kvm_arch_destroy_vm+0x636/0x820 arch/x86/kvm/x86.c:12895 kvm_put_kvm+0xb8e/0xfb0 virt/kvm/kvm_main.c:1310 kvm_vm_release+0x48/0x60 virt/kvm/kvm_main.c:1369 __fput+0x3e4/0x9e0 fs/file_table.c:465 task_work_run+0x1a9/0x220 kernel/task_work.c:227 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x7f0/0x25b0 kernel/exit.c:953 do_group_exit+0x203/0x2d0 kernel/exit.c:1102 get_signal+0x1357/0x1480 kernel/signal.c:3034 arch_do_signal_or_restart+0x40/0x690 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x67/0xb0 kernel/entry/common.c:218 do_syscall_64+0x7c/0x150 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP:
0033:0x7f87a898e969 </TASK> Modules linked in: gq(O) gsmi: Log Shutdown Reason 0x03 CR2: ffffebde00000000
---[ end trace 0000000000000000 ]--- Deliberately don't check for a NULL VMSA when freeing the vCPU, as crashing the host is likely desirable due to the VMSA being consumed by hardware. E.g. if KVM manages to allow VMRUN on the vCPU, hardware may read/write a bogus VMSA page. Accessing P ---truncated--- (CVE-2025-38455)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38455
https://ubuntu.com/security/CVE-2025-38455

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38455

Plugin Information
Published: 2025/08/07, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247718 - Linux Distros Unpatched Vulnerability : CVE-2025-38457
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/sched: Abort __tc_modify_qdisc if parent class does not exist Lion's patch [1] revealed an ancient bug in the qdisc API. Whenever a user creates/modifies a qdisc specifying as a parent another qdisc, the qdisc API will, during grafting, detect that the user is not trying to attach to a class and reject. However grafting is performed after qdisc_create (and thus the qdiscs' init callback) is executed. In qdiscs that eventually call qdisc_tree_reduce_backlog during init or change (such as fq, hhf, choke, etc), an issue arises. For example, executing the following commands: sudo tc qdisc add dev lo root handle a: htb default 2 sudo tc qdisc add dev lo parent a: handle beef fq Qdiscs such as fq, hhf, choke, etc unconditionally invoke qdisc_tree_reduce_backlog() in their control path init() or change() which then causes a failure to find the child class; however, that does not stop the unconditional invocation of the assumed child qdisc's qlen_notify with a null class. All these qdiscs make the assumption that class is non-null. The solution is ensure that qdisc_leaf() which looks up the parent class, and is invoked prior to qdisc_create(), should return failure on not finding the class. In this patch, we leverage qdisc_leaf to return ERR_PTRs whenever the parentid doesn't correspond to a class, so that we can detect it earlier on and abort before qdisc_create is called. [1] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com/ (CVE-2025-38457)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38457
https://ubuntu.com/security/CVE-2025-38457

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38457

Plugin Information
Published: 2025/08/10, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250157 - Linux Distros Unpatched Vulnerability : CVE-2025-38465
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netlink: Fix wraparounds of sk->sk_rmem_alloc. Netlink has this pattern in some places if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf) atomic_add(skb->truesize, &sk->sk_rmem_alloc); , which has the same problem fixed by commit 5a465a0da13e (udp: Fix multiple wraparounds of sk->sk_rmem_alloc.).
For example, if we set INT_MAX to SO_RCVBUFFORCE, the condition is always false as the two operands are of int. Then, a single socket can eat as many skb as possible until OOM happens, and we can see multiple wraparounds of sk->sk_rmem_alloc. Let's fix it by using atomic_add_return() and comparing the two variables as unsigned int. Before: [root@fedora ~]# ss -f netlink Recv-Q Send-Q Local Address:Port Peer Address:Port -1668710080 0 rtnl:nl_wraparound/293 * After: [root@fedora ~]# ss -f netlink Recv-Q Send-Q Local Address:Port Peer Address:Port 2147483072 0 rtnl:nl_wraparound/290 * ^ `--- INT_MAX - 576 (CVE-2025-38465)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38465
https://ubuntu.com/security/CVE-2025-38465

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38465

Plugin Information
Published: 2025/08/15, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244152 - Linux Distros Unpatched Vulnerability : CVE-2025-38466
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes Jann reports that uprobes can be used destructively when used in the middle of an instruction. The kernel only verifies there is a valid instruction at the requested offset, but due to variable instruction length cannot determine if this is an instruction as seen by the intended execution stream. Additionally, Mark Rutland notes that on architectures that mix data in the text segment (like arm64), a similar things can be done if the data word is 'mistaken' for an instruction. As such, require CAP_SYS_ADMIN for uprobes. (CVE-2025-38466)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38466
https://ubuntu.com/security/CVE-2025-38466

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38466

Plugin Information
Published: 2025/08/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
251361 - Linux Distros Unpatched Vulnerability : CVE-2025-38470
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime Assuming the rx-vlan- filter feature is enabled on a net device, the 8021q module will automatically add or remove VLAN 0 when the net device is put administratively up or down, respectively. There are a couple of problems with the above scheme. The first problem is a memory leak that can happen if the rx-vlan-filter feature is disabled while the device is running: # ip link add bond1 up type bond mode 0 # ethtool -K bond1 rx-vlan- filter off # ip link del dev bond1 When the device is put administratively down the rx-vlan-filter feature is disabled, so the 8021q module will not remove VLAN 0 and the memory will be leaked [1]. Another problem that can happen is that the kernel can automatically delete VLAN 0 when the device is put administratively down despite not adding it when the device was put administratively up since during that time the rx-vlan-filter feature was disabled. null-ptr-unref or bug_on[2] will be triggered by unregister_vlan_dev() for refcount imbalance if toggling filtering during runtime: $ ip link add bond0 type bond mode 0 $ ip link add link bond0 name vlan0 type vlan id 0 protocol 802.1q $ ethtool -K bond0 rx- vlan-filter off $ ifconfig bond0 up $ ethtool -K bond0 rx-vlan-filter on $ ifconfig bond0 down $ ip link del vlan0 Root cause is as below: step1: add vlan0 for real_dev, such as bond, team. register_vlan_dev vlan_vid_add(real_dev,htons(ETH_P_8021Q),0) //refcnt=1 step2: disable vlan filter feature and enable real_dev step3: change filter from 0 to 1 vlan_device_event vlan_filter_push_vids ndo_vlan_rx_add_vid //No refcnt added to real_dev vlan0 step4: real_dev down vlan_device_event vlan_vid_del(dev, htons(ETH_P_8021Q), 0); //refcnt=0 vlan_info_rcu_free //free vlan0 step5: delete vlan0 unregister_vlan_dev BUG_ON(!vlan_info); //vlan_info is null Fix both problems by noting in the VLAN info whether VLAN 0 was automatically added upon NETDEV_UP and based on that decide whether it should be deleted upon NETDEV_DOWN, regardless of the state of the rx-vlan-filter feature. [1] unreferenced object 0xffff8880068e3100 (size 256): comm ip, pid 384, jiffies 4296130254 hex dump (first 32 bytes): 00 20 30 0d 80 88 ff ff 00 00 00 00 00 00 00 00 . 0............. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 81ce31fa): __kmalloc_cache_noprof+0x2b5/0x340 vlan_vid_add+0x434/0x940 vlan_device_event.cold+0x75/0xa8 notifier_call_chain+0xca/0x150 __dev_notify_flags+0xe3/0x250 rtnl_configure_link+0x193/0x260 rtnl_newlink_create+0x383/0x8e0 __rtnl_newlink+0x22c/0xa40 rtnl_newlink+0x627/0xb00 rtnetlink_rcv_msg+0x6fb/0xb70 netlink_rcv_skb+0x11f/0x350 netlink_unicast+0x426/0x710 netlink_sendmsg+0x75a/0xc20 __sock_sendmsg+0xc1/0x150
____sys_sendmsg+0x5aa/0x7b0 ___sys_sendmsg+0xfc/0x180 [2] kernel BUG at net/8021q/vlan.c:99! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 382 Comm: ip Not tainted 6.16.0-rc3 #61 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:unregister_vlan_dev (net/8021q/vlan.c:99 (discriminator 1)) RSP: 0018:ffff88810badf310 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88810da84000 RCX: ffffffffb47ceb9a RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88810e8b43c8 RBP:
0000000000000000 R08: 0000000000000000 R09: fffffbfff6cefe80 R10: ffffffffb677f407 R11: ffff88810badf3c0 R12: ffff88810e8b4000 R13: 0000000000000000 R14: ffff88810642a5c0 R15: 000000000000017e FS:
00007f1ff68c20c0(0000) GS:ffff888163a24000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 CR2: 00007f1ff5dad240 CR3: 0000000107e56000 CR4: 00000000000006f0 Call Trace: <TASK
---truncated--- (CVE-2025-38470)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38470
https://ubuntu.com/security/CVE-2025-38470

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38470

Plugin Information
Published: 2025/08/18, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
251317 - Linux Distros Unpatched Vulnerability : CVE-2025-38477
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/sched: sch_qfq: Fix race condition on qfq_aggregate A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurrently. For example, qfq_dump_class may trigger a NULL dereference, and qfq_delete_class may cause a use-after-free. This patch addresses the issue by: 1. Moved qfq_destroy_class into the critical section. 2. Added sch_tree_lock protection to qfq_dump_class and qfq_dump_class_stats. (CVE-2025-38477)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38477
https://ubuntu.com/security/CVE-2025-38477

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.1
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38477

Plugin Information
Published: 2025/08/18, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
252186 - Linux Distros Unpatched Vulnerability : CVE-2025-38478
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- comedi: Fix initialization of data for instructions that write to subdevice Some Comedi subdevice instruction handlers are known to access instruction data elements beyond the first `insn->n` elements in some cases. The `do_insn_ioctl()` and `do_insnlist_ioctl()` functions allocate at least `MIN_SAMPLES` (16) data elements to deal with this, but they do not initialize all of that. For Comedi instruction codes that write to the subdevice, the first `insn->n` data elements are copied from user-space, but the remaining elements are left uninitialized. That could be a problem if the subdevice instruction handler reads the uninitialized data. Ensure that the first `MIN_SAMPLES` elements are initialized before calling these instruction handlers, filling the uncopied elements with 0. For `do_insnlist_ioctl()`, the same data buffer elements are used for handling a list of instructions, so ensure the first `MIN_SAMPLES` elements are initialized for each instruction that writes to the subdevice. (CVE-2025-38478)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38478
https://ubuntu.com/security/CVE-2025-38478

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38478

Plugin Information
Published: 2025/08/19, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
259993 - Linux Distros Unpatched Vulnerability : CVE-2025-38502
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Fix oob access in cgroup local storage Lonial reported that an out-of-bounds access in cgroup local storage can be crafted via tail calls. Given two programs each utilizing a cgroup local storage with a different value size, and one program doing a tail call into the other. The verifier will validate each of the indivial programs just fine. However, in the runtime context the bpf_cg_run_ctx holds an bpf_prog_array_item which contains the BPF program as well as any cgroup local storage flavor the program uses. Helpers such as bpf_get_local_storage() pick this up from the runtime context: ctx = container_of(current->bpf_ctx, struct bpf_cg_run_ctx, run_ctx); storage = ctx->prog_item->cgroup_storage[stype]; if (stype == BPF_CGROUP_STORAGE_SHARED) ptr = &READ_ONCE(storage->buf)->data[0]; else ptr = this_cpu_ptr(storage->percpu_buf); For the second program which was called from the originally attached one, this means bpf_get_local_storage() will pick up the former program's map, not its own. With mismatching sizes, this can result in an unintended out-of-bounds access. To fix this issue, we need to extend bpf_map_owner with an array of storage_cookie[] to match on i) the exact maps from the original program if the second program was using bpf_get_local_storage(), or ii) allow the tail call combination if the second program was not using any of the cgroup local storage maps. (CVE-2025-38502)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38502
https://security-tracker.debian.org/tracker/CVE-2025-38502
https://ubuntu.com/security/CVE-2025-38502

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38502

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
259976 - Linux Distros Unpatched Vulnerability : CVE-2025-38535
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode When transitioning from USB_ROLE_DEVICE to USB_ROLE_NONE, the code assumed that the regulator should be disabled. However, if the regulator is marked as always-on, regulator_is_enabled() continues to return true, leading to an incorrect attempt to disable a regulator which is not enabled. This can result in warnings such as: [ 250.155624] WARNING: CPU: 1 PID: 7326 at drivers/regulator/core.c:3004 _regulator_disable+0xe4/0x1a0 [ 250.155652] unbalanced disables for VIN_SYS_5V0 To fix this, we move the regulator control logic into tegra186_xusb_padctl_id_override() function since it's directly related to the ID override state. The regulator is now only disabled when the role transitions from USB_ROLE_HOST to USB_ROLE_NONE, by checking the VBUS_ID register. This ensures that regulator enable/disable operations are properly balanced and only occur when actually transitioning to/from host mode. (CVE-2025-38535)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38535
https://ubuntu.com/security/CVE-2025-38535

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:H/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38535

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
259990 - Linux Distros Unpatched Vulnerability : CVE-2025-38539
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tracing: Add down_write(trace_event_sem) when adding trace event When a module is loaded, it adds trace events defined by the module. It may also need to modify the modules trace printk formats to replace enum names with their values. If two modules are loaded at the same time, the adding of the event to the ftrace_events list can corrupt the walking of the list in the code that is modifying the printk format strings and crash the kernel. The addition of the event should take the trace_event_sem for write while it adds the new event. Also add a lockdep_assert_held() on that semaphore in __trace_add_event_dirs() as it iterates the list. (CVE-2025-38539)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38539
https://ubuntu.com/security/CVE-2025-38539

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38539

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
259978 - Linux Distros Unpatched Vulnerability : CVE-2025-38540
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras The Chicony Electronics HP 5MP Cameras (USB ID 04F2:B824 & 04F2:B82C) report a HID sensor interface that is not actually implemented. Attempting to access this non-functional sensor via iio_info causes system hangs as runtime PM tries to wake up an unresponsive sensor. Add these 2 devices to the HID ignore list since the sensor interface is non- functional by design and should not be exposed to userspace. (CVE-2025-38540)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38540
https://ubuntu.com/security/CVE-2025-38540

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38540

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
259955 - Linux Distros Unpatched Vulnerability : CVE-2025-38552
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mptcp: plug races between subflow fail and subflow creation We have races similar to the one addressed by the previous patch between subflow failing and additional subflow creation. They are just harder to trigger. The solution is similar. Use a separate flag to track the condition 'socket state prevent any additional subflow creation' protected by the fallback lock. The socket fallback makes such flag true, and also receiving or sending an MP_FAIL option. The field 'allow_infinite_fallback' is now always touched under the relevant lock, we can drop the ONCE annotation on write. (CVE-2025-38552)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38552
https://ubuntu.com/security/CVE-2025-38552

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38552

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260131 - Linux Distros Unpatched Vulnerability : CVE-2025-38563
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- perf/core: Prevent VMA split of buffer mappings The perf mmap code is careful about mmap()'ing the user page with the ringbuffer and additionally the auxiliary buffer, when the event supports it. Once the first mapping is established, subsequent mapping have to use the same offset and the same size in both cases.
The reference counting for the ringbuffer and the auxiliary buffer depends on this being correct. Though perf does not prevent that a related mapping is split via mmap(2), munmap(2) or mremap(2). A split of a VMA results in perf_mmap_open() calls, which take reference counts, but then the subsequent perf_mmap_close() calls are not longer fulfilling the offset and size checks. This leads to reference count leaks. As perf already has the requirement for subsequent mappings to match the initial mapping, the obvious consequence is that VMA splits, caused by resizing of a mapping or partial unmapping, have to be prevented. Implement the vm_operations_struct::may_split() callback and return unconditionally -EINVAL.
That ensures that the mapping offsets and sizes cannot be changed after the fact. Remapping to a different fixed address with the same size is still possible as it takes the references for the new mapping and drops those of the old mapping. (CVE-2025-38563)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38563
https://ubuntu.com/security/CVE-2025-38563

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38563

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260092 - Linux Distros Unpatched Vulnerability : CVE-2025-38568
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing TCA_MQPRIO_TC_ENTRY_INDEX is validated using NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value TC_QOPT_MAX_QUEUE (16).
This leads to a 4-byte out-of-bounds stack write in the fp[] array, which only has room for 16 elements (015). Fix this by changing the policy to allow only up to TC_QOPT_MAX_QUEUE - 1. (CVE-2025-38568)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38568
https://ubuntu.com/security/CVE-2025-38568

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38568

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260129 - Linux Distros Unpatched Vulnerability : CVE-2025-38574
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- pptp: ensure minimal skb length in pptp_xmit() Commit aabc6596ffb3 (net: ppp: Add bound checking for skb data on ppp_sync_txmung) fixed ppp_sync_txmunge() We need a similar fix in pptp_xmit(), otherwise we might read uninit data as reported by syzbot. BUG: KMSAN: uninit-value in pptp_xmit+0xc34/0x2720 drivers/net/ppp/pptp.c:193 pptp_xmit+0xc34/0x2720 drivers/net/ppp/pptp.c:193 ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2290 [inline] ppp_input+0x1d6/0xe60 drivers/net/ppp/ppp_generic.c:2314 pppoe_rcv_core+0x1e8/0x760 drivers/net/ppp/pppoe.c:379 sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148
__release_sock+0x1d3/0x330 net/core/sock.c:3213 release_sock+0x6b/0x270 net/core/sock.c:3767 pppoe_sendmsg+0x15d/0xcb0 drivers/net/ppp/pppoe.c:904 sock_sendmsg_nosec net/socket.c:712 [inline]
__sock_sendmsg+0x330/0x3d0 net/socket.c:727 ____sys_sendmsg+0x893/0xd80 net/socket.c:2566
___sys_sendmsg+0x271/0x3b0 net/socket.c:2620 __sys_sendmmsg+0x2d9/0x7c0 net/socket.c:2709 (CVE-2025-38574)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38574
https://ubuntu.com/security/CVE-2025-38574

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38574

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260086 - Linux Distros Unpatched Vulnerability : CVE-2025-38584
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- padata: Fix pd UAF once and for all There is a race condition/UAF in padata_reorder that goes back to the initial commit. A reference count is taken at the start of the process in padata_do_parallel, and released at the end in padata_serial_worker. This reference count is (and only is) required for padata_replace to function correctly. If padata_replace is never called then there is no issue. In the function padata_reorder which serves as the core of padata, as soon as padata is added to queue->serial.list, and the associated spin lock released, that padata may be processed and the reference count on pd would go away. Fix this by getting the next padata before the squeue->serial lock is released. In order to make this possible, simplify padata_reorder by only calling it once the next padata arrives. (CVE-2025-38584)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38584
https://security-tracker.debian.org/tracker/CVE-2025-38584
https://ubuntu.com/security/CVE-2025-38584

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38584

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260142 - Linux Distros Unpatched Vulnerability : CVE-2025-38592
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_devcd_dump: fix out-of- bounds via dev_coredumpv Currently both dev_coredumpv and skb_put_data in hci_devcd_dump use hdev->dump.head. However, dev_coredumpv can free the buffer. From dev_coredumpm_timeout documentation, which is used by dev_coredumpv: > Creates a new device coredump for the given device. If a previous one hasn't > been read yet, the new coredump is discarded. The data lifetime is determined > by the device coredump framework and when it is no longer needed the @free > function will be called to free the data.
If the data has not been read by the userspace yet, dev_coredumpv will discard new buffer, freeing hdev->dump.head. This leads to vmalloc-out-of-bounds error when skb_put_data tries to access hdev->dump.head. A crash report from syzbot illustrates this:
================================================================== BUG: KASAN: vmalloc-out-of-bounds in skb_put_data include/linux/skbuff.h:2752 [inline] BUG: KASAN: vmalloc-out-of-bounds in hci_devcd_dump+0x142/0x240 net/bluetooth/coredump.c:258 Read of size 140 at addr ffffc90004ed5000 by task kworker/u9:2/5844 CPU: 1 UID: 0 PID: 5844 Comm: kworker/u9:2 Not tainted 6.14.0-syzkaller-10892-g4e82c87058f4 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Workqueue: hci0 hci_devcd_timeout Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc3/0x670 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189 __asan_memcpy+0x23/0x60 mm/kasan/shadow.c:105 skb_put_data include/linux/skbuff.h:2752 [inline] hci_devcd_dump+0x142/0x240 net/bluetooth/coredump.c:258 hci_devcd_timeout+0xb5/0x2e0 net/bluetooth/coredump.c:413 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c2/0x780 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> The buggy address ffffc90004ed5000 belongs to a vmalloc virtual mapping Memory state around the buggy address:
ffffc90004ed4f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc90004ed4f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 >ffffc90004ed5000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc90004ed5080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc90004ed5100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ================================================================== To avoid this issue, reorder dev_coredumpv to be called after skb_put_data that does not free the data.
(CVE-2025-38592)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38592
https://ubuntu.com/security/CVE-2025-38592

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38592

Plugin Information
Published: 2025/09/01, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260099 - Linux Distros Unpatched Vulnerability : CVE-2025-38593
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' Function 'hci_discovery_filter_clear()' frees 'uuids' array and then sets it to NULL. There is a tiny chance of the following race: 'hci_cmd_sync_work()' 'update_passive_scan_sync()' 'hci_update_passive_scan_sync()'
'hci_discovery_filter_clear()' kfree(uuids);
<-------------------------preempted--------------------------------> 'start_service_discovery()'
'hci_discovery_filter_clear()' kfree(uuids); // DOUBLE FREE <-------------------------preempted--------------------------------> uuids = NULL; To fix it let's add locking around 'kfree()' call and NULL pointer assignment. Otherwise the following backtrace fires: [ ]
------------[ cut here ]------------ [ ] kernel BUG at mm/slub.c:547! [ ] Internal error: Oops - BUG:
00000000f2000800 [#1] PREEMPT SMP [ ] CPU: 3 UID: 0 PID: 246 Comm: bluetoothd Tainted: G O 6.12.19-kernel #1 [ ] Tainted: [O]=OOT_MODULE [ ] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ ] pc : __slab_free+0xf8/0x348 [ ] lr : __slab_free+0x48/0x348 ... [ ] Call trace: [ ] __slab_free+0xf8/0x348 [ ] kfree+0x164/0x27c [ ] start_service_discovery+0x1d0/0x2c0 [ ] hci_sock_sendmsg+0x518/0x924 [ ]
__sock_sendmsg+0x54/0x60 [ ] sock_write_iter+0x98/0xf8 [ ] do_iter_readv_writev+0xe4/0x1c8 [ ] vfs_writev+0x128/0x2b0 [ ] do_writev+0xfc/0x118 [ ] __arm64_sys_writev+0x20/0x2c [ ] invoke_syscall+0x68/0xf0 [ ] el0_svc_common.constprop.0+0x40/0xe0 [ ] do_el0_svc+0x1c/0x28 [ ] el0_svc+0x30/0xd0 [ ] el0t_64_sync_handler+0x100/0x12c [ ] el0t_64_sync+0x194/0x198 [ ] Code: 8b0002e6 eb17031f 54fffbe1 d503201f (d4210000) [ ] ---[ end trace 0000000000000000 ]--- (CVE-2025-38593)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38593
https://security-tracker.debian.org/tracker/CVE-2025-38593
https://ubuntu.com/security/CVE-2025-38593

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38593

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260082 - Linux Distros Unpatched Vulnerability : CVE-2025-38608
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls When sending plaintext data, we initially calculated the corresponding ciphertext length. However, if we later reduced the plaintext data length via socket policy, we failed to recalculate the ciphertext length. This results in transmitting buffers containing uninitialized data during ciphertext transmission. This causes uninitialized bytes to be appended after a complete Application Data packet, leading to errors on the receiving end when parsing TLS record. (CVE-2025-38608)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38608
https://ubuntu.com/security/CVE-2025-38608

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38608

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260242 - Linux Distros Unpatched Vulnerability : CVE-2025-38616
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tls: handle data disappearing from under the TLS ULP TLS expects that it owns the receive queue of the TCP socket. This cannot be guaranteed in case the reader of the TCP socket entered before the TLS ULP was installed, or uses some non-standard read API (eg. zerocopy ones). Replace the WARN_ON() and a buggy early exit (which leaves anchor pointing to a freed skb) with real error handling. Wipe the parsing state and tell the reader to retry. We already reload the anchor every time we (re)acquire the socket lock, so the only condition we need to avoid is an out of bounds read (not having enough bytes in the socket for previously parsed record len). If some data was read from under TLS but there's enough in the queue we'll reload and decrypt what is most likely not a valid TLS record. Leading to some undefined behavior from TLS perspective (corrupting a stream? missing an alert? missing an attack?) but no kernel crash should take place. (CVE-2025-38616)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38616
https://security-tracker.debian.org/tracker/CVE-2025-38616
https://ubuntu.com/security/CVE-2025-38616

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0001
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38616

Plugin Information
Published: 2025/09/02, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260273 - Linux Distros Unpatched Vulnerability : CVE-2025-38618
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vsock: Do not allow binding to VMADDR_PORT_ANY It is possible for a vsock to autobind to VMADDR_PORT_ANY.
This can cause a use-after-free when a connection is made to the bound socket. The socket returned by accept() also has port VMADDR_PORT_ANY but is not on the list of unbound sockets. Binding it will result in an extra refcount decrement similar to the one fixed in fcdd2242c023 (vsock: Keep the binding until socket destruction). Modify the check in __vsock_bind_connectible() to also prevent binding to VMADDR_PORT_ANY. (CVE-2025-38618)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38618
https://ubuntu.com/security/CVE-2025-38618

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38618

Plugin Information
Published: 2025/09/02, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260281 - Linux Distros Unpatched Vulnerability : CVE-2025-38636
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- rv: Use strings in da monitors tracepoints Using DA monitors tracepoints with KASAN enabled triggers the following warning: BUG: KASAN: global-out-of-bounds in do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0 Read of size 32 at addr ffffffffaada8980 by task ...
Call Trace: <TASK> [...] do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0 ?
__pfx_do_trace_event_raw_event_event_da_monitor+0x10/0x10 ? trace_event_sncid+0x83/0x200 trace_event_sncid+0x163/0x200 [...] The buggy address belongs to the variable: automaton_snep+0x4e0/0x5e0 This is caused by the tracepoints reading 32 bytes __array instead of __string from the automata definition. Such strings are literals and reading 32 bytes ends up in out of bound memory accesses (e.g.
the next automaton's data in this case). The error is harmless as, while printing the string, we stop at the null terminator, but it should still be fixed. Use the __string facilities while defining the tracepoints to avoid reading out of bound memory. (CVE-2025-38636)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38636
https://security-tracker.debian.org/tracker/CVE-2025-38636
https://ubuntu.com/security/CVE-2025-38636

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38636

Plugin Information
Published: 2025/09/02, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260247 - Linux Distros Unpatched Vulnerability : CVE-2025-38653
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al Check pde->proc_ops->proc_lseek directly may cause UAF in rmmod scenario. It's a gap in proc_reg_open() after commit 654b33ada4ab(proc: fix UAF in proc_get_inode()). Followed by AI Viro's suggestion, fix it in same manner. (CVE-2025-38653)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38653
https://ubuntu.com/security/CVE-2025-38653

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38653

Plugin Information
Published: 2025/09/02, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260525 - Linux Distros Unpatched Vulnerability : CVE-2025-38676
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- iommu/amd: Avoid stack buffer overflow from kernel cmdline While the kernel command line is considered trusted in most environments, avoid writing 1 byte past the end of acpiid if the str argument is maximum length. (CVE-2025-38676)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38676
https://ubuntu.com/security/CVE-2025-38676

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.4 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.5 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-38676

Plugin Information
Published: 2025/09/02, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261577 - Linux Distros Unpatched Vulnerability : CVE-2025-38688
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- iommufd: Prevent ALIGN() overflow When allocating IOVA the candidate range gets aligned to the target alignment. If the range is close to ULONG_MAX then the ALIGN() can wrap resulting in a corrupted iova.
Open code the ALIGN() using get_add_overflow() to prevent this. This simplifies the checks as we don't need to check for length earlier either. Consolidate the two copies of this code under a single helper.
This bug would allow userspace to create a mapping that overlaps with some other mapping or a reserved range. (CVE-2025-38688)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38688
https://ubuntu.com/security/CVE-2025-38688

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38688

Plugin Information
Published: 2025/09/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261581 - Linux Distros Unpatched Vulnerability : CVE-2025-38695
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure If a call to lpfc_sli4_read_rev() from lpfc_sli4_hba_setup() fails, the resultant cleanup routine lpfc_sli4_vport_delete_fcp_xri_aborted() may occur before sli4_hba.hdwqs are allocated. This may result in a null pointer dereference when attempting to take the abts_io_buf_list_lock for the first hardware queue.
Fix by adding a null ptr check on phba->sli4_hba.hdwq and early return because this situation means there must have been an error during port initialization. (CVE-2025-38695)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38695
https://ubuntu.com/security/CVE-2025-38695

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38695

Plugin Information
Published: 2025/09/06, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261549 - Linux Distros Unpatched Vulnerability : CVE-2025-38701
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr A syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data() when an inode had the INLINE_DATA_FL flag set but was missing the system.data extended attribute. Since this can happen due to a maiciouly fuzzed file system, we shouldn't BUG, but rather, report it as a corrupted file system. Add similar replacements of BUG_ON with EXT4_ERROR_INODE() ii ext4_create_inline_data() and ext4_inline_data_truncate(). (CVE-2025-38701)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38701
https://ubuntu.com/security/CVE-2025-38701

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38701

Plugin Information
Published: 2025/09/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261573 - Linux Distros Unpatched Vulnerability : CVE-2025-38703
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/xe: Make dma-fences compliant with the safe access rules Xe can free some of the data pointed to by the dma-fences it exports. Most notably the timeline name can get freed if userspace closes the associated submit queue. At the same time the fence could have been exported to a third party (for example a sync_fence fd) which will then cause an use- after-free on subsequent access. To make this safe we need to make the driver compliant with the newly documented dma-fence rules. Driver has to ensure a RCU grace period between signalling a fence and freeing any data pointed to by said fence. For the timeline name we simply make the queue be freed via kfree_rcu and for the shared lock associated with multiple queues we add a RCU grace period before freeing the per GT structure holding the lock. (CVE-2025-38703)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38703
https://ubuntu.com/security/CVE-2025-38703

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38703

Plugin Information
Published: 2025/09/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261560 - Linux Distros Unpatched Vulnerability : CVE-2025-38729
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious firmware, too.
(CVE-2025-38729)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38729
https://ubuntu.com/security/CVE-2025-38729

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38729

Plugin Information
Published: 2025/09/06, Modified: 2025/12/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261591 - Linux Distros Unpatched Vulnerability : CVE-2025-38730
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- io_uring/net: commit partial buffers on retry Ring provided buffers are potentially only valid within the single execution context in which they were acquired. io_uring deals with this and invalidates them on retry. But on the networking side, if MSG_WAITALL is set, or if the socket is of the streaming type and too little was processed, then it will hang on to the buffer rather than recycle or commit it. This is problematic for two reasons: 1) If someone unregisters the provided buffer ring before a later retry, then the req->buf_list will no longer be valid. 2) If multiple sockers are using the same buffer group, then multiple receives can consume the same memory. This can cause data corruption in the application, as either receive could land in the same userspace buffer. Fix this by disallowing partial retries from pinning a provided buffer across multiple executions, if ring provided buffers are used. (CVE-2025-38730)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38730
https://ubuntu.com/security/CVE-2025-38730

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38730

Plugin Information
Published: 2025/09/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261601 - Linux Distros Unpatched Vulnerability : CVE-2025-38731
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix vm_bind_ioctl double free bug If the argument check during an array bind fails, the bind_ops are freed twice as seen below. Fix this by setting bind_ops to NULL after freeing.
================================================================== BUG: KASAN: double-free in xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] Free of addr ffff88813bb9b800 by task xe_vm/14198 CPU: 5 UID: 0 PID:
14198 Comm: xe_vm Not tainted 6.16.0-xe-eudebug-cmanszew+ #520 PREEMPT(full) Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR5 RVP, BIOS ADLPFWI1.R00.2411.A02.2110081023 10/08/2021 Call Trace: <TASK> dump_stack_lvl+0x82/0xd0 print_report+0xcb/0x610 ?
__virt_addr_valid+0x19a/0x300 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] kasan_report_invalid_free+0xc8/0xf0 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] check_slab_allocation+0x102/0x130 kfree+0x10d/0x440 ? should_fail_ex+0x57/0x2f0 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] ? __lock_acquire+0xab9/0x27f0 ? lock_acquire+0x165/0x300 ? drm_dev_enter+0x53/0xe0 [drm] ? find_held_lock+0x2b/0x80 ? drm_dev_exit+0x30/0x50 [drm] ? drm_ioctl_kernel+0x128/0x1c0 [drm] drm_ioctl_kernel+0x128/0x1c0 [drm] ?
__pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] ? find_held_lock+0x2b/0x80 ? __pfx_drm_ioctl_kernel+0x10/0x10 [drm] ? should_fail_ex+0x57/0x2f0 ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] drm_ioctl+0x352/0x620 [drm] ?
__pfx_drm_ioctl+0x10/0x10 [drm] ? __pfx_rpm_resume+0x10/0x10 ? do_raw_spin_lock+0x11a/0x1b0 ? find_held_lock+0x2b/0x80 ? __pm_runtime_resume+0x61/0xc0 ? rcu_is_watching+0x20/0x50 ? trace_irq_enable.constprop.0+0xac/0xe0 xe_drm_ioctl+0x91/0xc0 [xe] __x64_sys_ioctl+0xb2/0x100 ? rcu_is_watching+0x20/0x50 do_syscall_64+0x68/0x2e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP:
0033:0x7fa9acb24ded (cherry picked from commit a01b704527c28a2fd43a17a85f8996b75ec8492a) (CVE-2025-38731)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38731
https://ubuntu.com/security/CVE-2025-38731

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38731

Plugin Information
Published: 2025/09/06, Modified: 2025/11/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261640 - Linux Distros Unpatched Vulnerability : CVE-2025-38732
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfilter: nf_reject: don't leak dst refcount for loopback packets recent patches to add a WARN() when replacing skb dst entry found an old bug: WARNING: include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline] WARNING: include/linux/skbuff.h:1165 skb_dst_set include/linux/skbuff.h:1210 [inline] WARNING: include/linux/skbuff.h:1165 nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234 [..] Call Trace:
nf_send_unreach+0x17b/0x6e0 net/ipv4/netfilter/nf_reject_ipv4.c:325 nft_reject_inet_eval+0x4bc/0x690 net/netfilter/nft_reject_inet.c:27 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] .. This is because blamed commit forgot about loopback packets. Such packets already have a dst_entry attached, even at PRE_ROUTING stage. Instead of checking hook just check if the skb already has a route attached to it. (CVE-2025-38732)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38732
https://ubuntu.com/security/CVE-2025-38732

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38732

Plugin Information
Published: 2025/09/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261638 - Linux Distros Unpatched Vulnerability : CVE-2025-38735
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- gve: prevent ethtool ops after shutdown A crash can occur if an ethtool operation is invoked after shutdown() is called. shutdown() is invoked during system shutdown to stop DMA operations without performing expensive deallocations. It is discouraged to unregister the netdev in this path, so the device may still be visible to userspace and kernel helpers. In gve, shutdown() tears down most internal data structures. If an ethtool operation is dispatched after shutdown(), it will dereference freed or NULL pointers, leading to a kernel panic. While graceful shutdown normally quiesces userspace before invoking the reboot syscall, forced shutdowns (as observed on GCP VMs) can still trigger this path. Fix by calling netif_device_detach() in shutdown(). This marks the device as detached so the ethtool ioctl handler will skip dispatching operations to the driver. (CVE-2025-38735)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38735
https://ubuntu.com/security/CVE-2025-38735

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38735

Plugin Information
Published: 2025/09/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261645 - Linux Distros Unpatched Vulnerability : CVE-2025-39673
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ppp: fix race conditions in ppp_fill_forward_path ppp_fill_forward_path() has two race conditions: 1. The ppp->channels list can change between list_empty() and list_first_entry(), as ppp_lock() is not held. If the only channel is deleted in ppp_disconnect_channel(), list_first_entry() may access an empty head or a freed entry, and trigger a panic. 2. pch->chan can be NULL. When ppp_unregister_channel() is called, pch->chan is set to NULL before pch is removed from ppp->channels. Fix these by using a lockless RCU approach: - Use list_first_or_null_rcu() to safely test and access the first list entry. - Convert list modifications on ppp->channels to their RCU variants and add synchronize_net() after removal. - Check for a NULL pch->chan before dereferencing it. (CVE-2025-39673)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39673
https://ubuntu.com/security/CVE-2025-39673

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39673

Plugin Information
Published: 2025/09/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261621 - Linux Distros Unpatched Vulnerability : CVE-2025-39683
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tracing: Limit access to parser->buffer when trace_get_user failed When the length of the string written to set_ftrace_filter exceeds FTRACE_BUFF_MAX, the following KASAN alarm will be triggered: BUG: KASAN:
slab-out-of-bounds in strsep+0x18c/0x1b0 Read of size 1 at addr ffff0000d00bd5ba by task ash/165 CPU: 1 UID: 0 PID: 165 Comm: ash Not tainted 6.16.0-g6bcdbd62bd56-dirty Hardware name: linux,dummy-virt (DT) Call trace: show_stack+0x34/0x50 (C) dump_stack_lvl+0xa0/0x158 print_address_description.constprop.0+0x88/0x398 print_report+0xb0/0x280 kasan_report+0xa4/0xf0 __asan_report_load1_noabort+0x20/0x30 strsep+0x18c/0x1b0 ftrace_process_regex.isra.0+0x100/0x2d8 ftrace_regex_release+0x484/0x618 __fput+0x364/0xa58
____fput+0x28/0x40 task_work_run+0x154/0x278 do_notify_resume+0x1f0/0x220 el0_svc+0xec/0xf0 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1ac/0x1b0 The reason is that trace_get_user will fail when processing a string longer than FTRACE_BUFF_MAX, but not set the end of parser->buffer to 0. Then an OOB access will be triggered in ftrace_regex_release-> ftrace_process_regex->strsep->strpbrk. We can solve this problem by limiting access to parser->buffer when trace_get_user failed. (CVE-2025-39683)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39683
https://ubuntu.com/security/CVE-2025-39683

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39683

Plugin Information
Published: 2025/09/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261619 - Linux Distros Unpatched Vulnerability : CVE-2025-39689
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ftrace: Also allocate and copy hash for reading of filter files Currently the reader of set_ftrace_filter and set_ftrace_notrace just adds the pointer to the global tracer hash to its iterator. Unlike the writer that allocates a copy of the hash, the reader keeps the pointer to the filter hashes. This is problematic because this pointer is static across function calls that release the locks that can update the global tracer hashes. This can cause UAF and similar bugs. Allocate and copy the hash for reading the filter files like it is done for the writers. This not only fixes UAF bugs, but also makes the code a bit simpler as it doesn't have to differentiate when to free the iterator's hash between writers and readers.
(CVE-2025-39689)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39689
https://ubuntu.com/security/CVE-2025-39689

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39689

Plugin Information
Published: 2025/09/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261595 - Linux Distros Unpatched Vulnerability : CVE-2025-39691
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fs/buffer: fix use-after-free when call bh_read() helper There's issue as follows: BUG: KASAN: stack-out- of-bounds in end_buffer_read_sync+0xe3/0x110 Read of size 8 at addr ffffc9000168f7f8 by task swapper/3/0 CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.16.0-862.14.0.6.x86_64 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Call Trace: <IRQ> dump_stack_lvl+0x55/0x70 print_address_description.constprop.0+0x2c/0x390 print_report+0xb4/0x270 kasan_report+0xb8/0xf0 end_buffer_read_sync+0xe3/0x110 end_bio_bh_io_sync+0x56/0x80 blk_update_request+0x30a/0x720 scsi_end_request+0x51/0x2b0 scsi_io_completion+0xe3/0x480 ? scsi_device_unbusy+0x11e/0x160 blk_complete_reqs+0x7b/0x90 handle_softirqs+0xef/0x370 irq_exit_rcu+0xa5/0xd0 sysvec_apic_timer_interrupt+0x6e/0x90 </IRQ> Above issue happens when do ntfs3 filesystem mount, issue may happens as follows: mount IRQ ntfs_fill_super read_cache_page do_read_cache_folio filemap_read_folio mpage_read_folio do_mpage_readpage ntfs_get_block_vbo bh_read submit_bh wait_on_buffer(bh);
blk_complete_reqs scsi_io_completion scsi_end_request blk_update_request end_bio_bh_io_sync end_buffer_read_sync __end_buffer_read_notouch unlock_buffer wait_on_buffer(bh);--> return will return to caller put_bh --> trigger stack-out-of-bounds In the mpage_read_folio() function, the stack variable 'map_bh' is passed to ntfs_get_block_vbo(). Once unlock_buffer() unlocks and wait_on_buffer() returns to continue processing, the stack variable is likely to be reclaimed. Consequently, during the end_buffer_read_sync() process, calling put_bh() may result in stack overrun. If the bh is not allocated on the stack, it belongs to a folio. Freeing a buffer head which belongs to a folio is done by drop_buffers() which will fail to free buffers which are still locked. So it is safe to call put_bh() before __end_buffer_read_notouch(). (CVE-2025-39691)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39691
https://ubuntu.com/security/CVE-2025-39691

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39691

Plugin Information
Published: 2025/09/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261617 - Linux Distros Unpatched Vulnerability : CVE-2025-39701
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ACPI: pfr_update: Fix the driver update version check The security-version-number check should be used rather than the runtime version check for driver updates. Otherwise, the firmware update would fail when the update binary had a lower runtime version number than the current one. [ rjw: Changelog edits ] (CVE-2025-39701)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39701
https://ubuntu.com/security/CVE-2025-39701

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39701

Plugin Information
Published: 2025/09/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261641 - Linux Distros Unpatched Vulnerability : CVE-2025-39703
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net, hsr: reject HSR frame if skb can't hold tag Receiving HSR frame with insufficient space to hold HSR tag in the skb can result in a crash (kernel BUG): [ 45.390915] skbuff: skb_under_panic:
text:ffffffff86f32cac len:26 put:14 head:ffff888042418000 data:ffff888042417ff4 tail:0xe end:0x180 dev:bridge_slave_1 [ 45.392559] ------------[ cut here ]------------ [ 45.392912] kernel BUG at net/core/skbuff.c:211! [ 45.393276] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 45.393809] CPU: 1 UID: 0 PID: 2496 Comm: reproducer Not tainted 6.15.0 #12 PREEMPT(undef) [ 45.394433] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 45.395273] RIP: 0010:skb_panic+0x15b/0x1d0 <snip registers, remove unreliable trace> [ 45.402911] Call Trace: [ 45.403105] <IRQ> [ 45.404470] skb_push+0xcd/0xf0 [ 45.404726] br_dev_queue_push_xmit+0x7c/0x6c0 [ 45.406513] br_forward_finish+0x128/0x260 [ 45.408483]
__br_forward+0x42d/0x590 [ 45.409464] maybe_deliver+0x2eb/0x420 [ 45.409763] br_flood+0x174/0x4a0 [ 45.410030] br_handle_frame_finish+0xc7c/0x1bc0 [ 45.411618] br_handle_frame+0xac3/0x1230 [ 45.413674]
__netif_receive_skb_core.constprop.0+0x808/0x3df0 [ 45.422966] __netif_receive_skb_one_core+0xb4/0x1f0 [ 45.424478] __netif_receive_skb+0x22/0x170 [ 45.424806] process_backlog+0x242/0x6d0 [ 45.425116]
__napi_poll+0xbb/0x630 [ 45.425394] net_rx_action+0x4d1/0xcc0 [ 45.427613] handle_softirqs+0x1a4/0x580 [ 45.427926] do_softirq+0x74/0x90 [ 45.428196] </IRQ> This issue was found by syzkaller. The panic happens in br_dev_queue_push_xmit() once it receives a corrupted skb with ETH header already pushed in linear data. When it attempts the skb_push() call, there's not enough headroom and skb_push() panics. The corrupted skb is put on the queue by HSR layer, which makes a sequence of unintended transformations when it receives a specific corrupted HSR frame (with incomplete TAG). Fix it by dropping and consuming frames that are not long enough to contain both ethernet and hsr headers. Alternative fix would be to check for enough headroom before skb_push() in br_dev_queue_push_xmit(). In the reproducer, this is injected via AF_PACKET, but I don't easily see why it couldn't be sent over the wire from adjacent network. Further Details: In the reproducer, the following network interface chain is set up: veth0_to_hsr hsr_slave0 hsr0 veth1_to_hsr hsr_slave1 bridge ... To trigger the events leading up to crash, reproducer sends a corrupted HSR fr
---truncated--- (CVE-2025-39703)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39703
https://ubuntu.com/security/CVE-2025-39703

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39703

Plugin Information
Published: 2025/09/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261613 - Linux Distros Unpatched Vulnerability : CVE-2025-39713
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() In the interrupt handler rain_interrupt(), the buffer full check on rain->buf_len is performed before acquiring rain->buf_lock.
This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition, as rain->buf_len is concurrently accessed and modified in the work handler rain_irq_work_handler() under the same lock. Multiple interrupt invocations can race, with each reading buf_len before it becomes full and then proceeding. This can lead to both interrupts attempting to write to the buffer, incrementing buf_len beyond its capacity (DATA_SIZE) and causing a buffer overflow. Fix this bug by moving the spin_lock() to before the buffer full check.
This ensures that the check and the subsequent buffer modification are performed atomically, preventing the race condition. An corresponding spin_unlock() is added to the overflow path to correctly release the lock. This possible bug was found by an experimental static analysis tool developed by our team.
(CVE-2025-39713)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39713
https://ubuntu.com/security/CVE-2025-39713

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39713

Plugin Information
Published: 2025/09/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264717 - Linux Distros Unpatched Vulnerability : CVE-2025-39750
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath12k: Correct tid cleanup when tid setup fails Currently, if any error occurs during ath12k_dp_rx_peer_tid_setup(), the tid value is already incremented, even though the corresponding TID is not actually allocated. Proceed to ath12k_dp_rx_peer_tid_delete() starting from unallocated tid, which might leads to freeing unallocated TID and cause potential crash or out-of-bounds access. Hence, fix by correctly decrementing tid before cleanup to match only the successfully allocated TIDs. Also, remove tid-- from failure case of ath12k_dp_rx_peer_frag_setup(), as decrementing the tid before cleanup in loop will take care of this. Compile tested only. (CVE-2025-39750)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39750
https://ubuntu.com/security/CVE-2025-39750

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39750

Plugin Information
Published: 2025/09/14, Modified: 2025/12/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264734 - Linux Distros Unpatched Vulnerability : CVE-2025-39752
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ARM: rockchip: fix kernel hang during smp initialization In order to bring up secondary CPUs main CPU write trampoline code to SRAM. The trampoline code is written while secondary CPUs are powered on (at least that true for RK3188 CPU). Sometimes that leads to kernel hang. Probably because secondary CPU execute trampoline code while kernel doesn't expect. The patch moves SRAM initialization step to the point where all secondary CPUs are powered down. That fixes rarely hangs on RK3188: [ 0.091568] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000 [ 0.091996] rockchip_smp_prepare_cpus: ncores 4 (CVE-2025-39752)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39752
https://ubuntu.com/security/CVE-2025-39752

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39752

Plugin Information
Published: 2025/09/14, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264749 - Linux Distros Unpatched Vulnerability : CVE-2025-39760
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buffer size. Fix this up by checking the size first before looking at any of the fields in the descriptor. (CVE-2025-39760)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39760
https://ubuntu.com/security/CVE-2025-39760

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0005
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39760

Plugin Information
Published: 2025/09/14, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264744 - Linux Distros Unpatched Vulnerability : CVE-2025-39765
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: timer: fix ida_free call while not allocated In the snd_utimer_create() function, if the kasprintf() function return NULL, snd_utimer_put_id() will be called, finally use ida_free() to free the unallocated id 0. the syzkaller reported the following information: ------------[ cut here ]------------ ida_free called for id=0 which is not allocated. WARNING: CPU: 1 PID: 1286 at lib/idr.c:592 ida_free+0x1fd/0x2f0 lib/idr.c:592 Modules linked in: CPU: 1 UID: 0 PID: 1286 Comm: syz-executor164 Not tainted 6.15.8 #3 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-4.fc42 04/01/2014 RIP:
0010:ida_free+0x1fd/0x2f0 lib/idr.c:592 Code: f8 fc 41 83 fc 3e 76 69 e8 70 b2 f8 (...) RSP:
0018:ffffc900007f79c8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 1ffff920000fef3b RCX: ffffffff872176a5 RDX: ffff88800369d200 RSI: 0000000000000000 RDI: ffff88800369d200 RBP: 0000000000000000 R08:
ffffffff87ba60a5 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f6f1abc1740(0000) GS:ffff8880d76a0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
00007f6f1ad7a784 CR3: 000000007a6e2000 CR4: 00000000000006f0 Call Trace: <TASK> snd_utimer_put_id sound/core/timer.c:2043 [inline] [snd_timer] snd_utimer_create+0x59b/0x6a0 sound/core/timer.c:2184 [snd_timer] snd_utimer_ioctl_create sound/core/timer.c:2202 [inline] [snd_timer]
__snd_timer_user_ioctl.isra.0+0x724/0x1340 sound/core/timer.c:2287 [snd_timer] snd_timer_user_ioctl+0x75/0xc0 sound/core/timer.c:2298 [snd_timer] vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __x64_sys_ioctl+0x198/0x200 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x7b/0x160 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] The utimer->id should be set properly before the kasprintf() function, ensures the snd_utimer_put_id() function will free the allocated id. (CVE-2025-39765)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39765
https://ubuntu.com/security/CVE-2025-39765

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39765

Plugin Information
Published: 2025/09/14, Modified: 2025/11/21
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264762 - Linux Distros Unpatched Vulnerability : CVE-2025-39790
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bus: mhi: host: Detect events pointing to unexpected TREs When a remote device sends a completion event to the host, it contains a pointer to the consumed TRE. The host uses this pointer to process all of the TREs between it and the host's local copy of the ring's read pointer. This works when processing completion for chained transactions, but can lead to nasty results if the device sends an event for a single-element transaction with a read pointer that is multiple elements ahead of the host's read pointer. For instance, if the host accesses an event ring while the device is updating it, the pointer inside of the event might still point to an old TRE. If the host uses the channel's xfer_cb() to directly free the buffer pointed to by the TRE, the buffer will be double-freed. This behavior was observed on an ep that used upstream EP stack without 'commit 6f18d174b73d (bus: mhi: ep: Update read pointer only after buffer is written)'.
Where the device updated the events ring pointer before updating the event contents, so it left a window where the host was able to access the stale data the event pointed to, before the device had the chance to update them. The usual pattern was that the host received an event pointing to a TRE that is not immediately after the last processed one, so it got treated as if it was a chained transaction, processing all of the TREs in between the two read pointers. This commit aims to harden the host by ensuring transactions where the event points to a TRE that isn't local_rp + 1 are chained. [mani: added stable tag and reworded commit message] (CVE-2025-39790)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39790
https://security-tracker.debian.org/tracker/CVE-2025-39790
https://ubuntu.com/security/CVE-2025-39790

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
8.4 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.1
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39790

Plugin Information
Published: 2025/09/14, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264740 - Linux Distros Unpatched Vulnerability : CVE-2025-39791
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets Read and write operations issued to a dm-crypt target may be split according to the dm-crypt internal limits defined by the max_read_size and max_write_size module parameters (default is 128 KB). The intent is to improve processing time of large BIOs by splitting them into smaller operations that can be parallelized on different CPUs. For zoned dm- crypt targets, this BIO splitting is still done but without the parallel execution to ensure that the issuing order of write operations to the underlying devices remains sequential. However, the splitting itself causes other problems: 1) Since dm-crypt relies on the block layer zone write plugging to handle zone append emulation using regular write operations, the reminder of a split write BIO will always be plugged into the target zone write plugged. Once the on-going write BIO finishes, this reminder BIO is unplugged and issued from the zone write plug work. If this reminder BIO itself needs to be split, the reminder will be re-issued and plugged again, but that causes a call to a blk_queue_enter(), which may block if a queue freeze operation was initiated. This results in a deadlock as DM submission still holds BIOs that the queue freeze side is waiting for. 2) dm-crypt relies on the emulation done by the block layer using regular write operations for processing zone append operations. This still requires to properly return the written sector as the BIO sector of the original BIO. However, this can be done correctly only and only if there is a single clone BIO used for processing the original zone append operation issued by the user. If the size of a zone append operation is larger than dm-crypt max_write_size, then the orginal BIO will be split and processed as a chain of regular write operations.
Such chaining result in an incorrect written sector being returned to the zone append issuer using the original BIO sector. This in turn results in file system data corruptions using xfs or btrfs. Fix this by modifying get_max_request_size() to always return the size of the BIO to avoid it being split with dm_accpet_partial_bio() in crypt_map(). get_max_request_size() is renamed to get_max_request_sectors() to clarify the unit of the value returned and its interface is changed to take a struct dm_target pointer and a pointer to the struct bio being processed. In addition to this change, to ensure that crypt_alloc_buffer() works correctly, set the dm-crypt device max_hw_sectors limit to be at most BIO_MAX_VECS << PAGE_SECTORS_SHIFT (1 MB with a 4KB page architecture). This forces DM core to split write BIOs before passing them to crypt_map(), and thus guaranteeing that dm-crypt can always accept an entire write BIO without needing to split it. This change does not have any effect on the read path of dm-crypt.
Read operations can still be split and the BIO fragments processed in parallel. There is also no impact on the performance of the write path given that all zone write BIOs were already processed inline instead of in parallel. This change also does not affect in any way regular dm-crypt block devices. (CVE-2025-39791)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39791
https://ubuntu.com/security/CVE-2025-39791

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39791

Plugin Information
Published: 2025/09/14, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264712 - Linux Distros Unpatched Vulnerability : CVE-2025-39794
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ARM: tegra: Use I/O memcpy to write to IRAM Kasan crashes the kernel trying to check boundaries when using the normal memcpy. (CVE-2025-39794)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39794
https://ubuntu.com/security/CVE-2025-39794

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39794

Plugin Information
Published: 2025/09/14, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264709 - Linux Distros Unpatched Vulnerability : CVE-2025-39795
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() In blk_stack_limits(), we check that the t->chunk_sectors value is a multiple of the t->physical_block_size value. However, by finding the chunk_sectors value in bytes, we may overflow the unsigned int which holds chunk_sectors, so change the check to be based on sectors. (CVE-2025-39795)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39795
https://ubuntu.com/security/CVE-2025-39795

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39795

Plugin Information
Published: 2025/09/14, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264708 - Linux Distros Unpatched Vulnerability : CVE-2025-39797
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xfrm: Duplicate SPI Handling The issue originates when Strongswan initiates an XFRM_MSG_ALLOCSPI Netlink message, which triggers the kernel function xfrm_alloc_spi(). This function is expected to ensure uniqueness of the Security Parameter Index (SPI) for inbound Security Associations (SAs). However, it can return success even when the requested SPI is already in use, leading to duplicate SPIs assigned to multiple inbound SAs, differentiated only by their destination addresses. This behavior causes inconsistencies during SPI lookups for inbound packets. Since the lookup may return an arbitrary SA among those with the same SPI, packet processing can fail, resulting in packet drops. According to RFC 4301 section 4.4.2 , for inbound processing a unicast SA is uniquely identified by the SPI and optionally protocol. Reproducing the Issue Reliably: To consistently reproduce the problem, restrict the available SPI range in charon.conf : spi_min = 0x10000000 spi_max = 0x10000002 This limits the system to only 2 usable SPI values. Next, create more than 2 Child SA. each using unique pair of src/dst address. As soon as the 3rd Child SA is initiated, it will be assigned a duplicate SPI, since the SPI pool is already exhausted. With a narrow SPI range, the issue is consistently reproducible. With a broader/default range, it becomes rare and unpredictable. Current implementation: xfrm_spi_hash() lookup function computes hash using daddr, proto, and family. So if two SAs have the same SPI but different destination addresses, then they will: a. Hash into different buckets b. Be stored in different linked lists (byspi + h) c. Not be seen in the same hlist_for_each_entry_rcu() iteration. As a result, the lookup will result in NULL and kernel allows that Duplicate SPI Proposed Change: xfrm_state_lookup_spi_proto() does a truly global search
- across all states, regardless of hash bucket and matches SPI and proto. (CVE-2025-39797)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39797
https://security-tracker.debian.org/tracker/CVE-2025-39797
https://ubuntu.com/security/CVE-2025-39797

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39797

Plugin Information
Published: 2025/09/14, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265225 - Linux Distros Unpatched Vulnerability : CVE-2025-39806
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() A malicious HID device can trigger a slab out-of-bounds during mt_report_fixup() by passing in report descriptor smaller than 607 bytes.
mt_report_fixup() attempts to patch byte offset 607 of the descriptor with 0x25 by first checking if byte offset 607 is 0x15 however it lacks bounds checks to verify if the descriptor is big enough before conducting this check. Fix this bug by ensuring the descriptor size is at least 608 bytes before accessing it. Below is the KASAN splat after the out of bounds access happens: [ 13.671954] ================================================================== [ 13.672667] BUG: KASAN: slab-out-of- bounds in mt_report_fixup+0x103/0x110 [ 13.673297] Read of size 1 at addr ffff888103df39df by task kworker/0:1/10 [ 13.673297] [ 13.673297] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.15.0-00005-gec5d573d83f4-dirty #3 [ 13.673297] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/04 [ 13.673297] Call Trace: [ 13.673297] <TASK> [ 13.673297] dump_stack_lvl+0x5f/0x80 [ 13.673297] print_report+0xd1/0x660 [ 13.673297] kasan_report+0xe5/0x120 [ 13.673297] __asan_report_load1_noabort+0x18/0x20 [ 13.673297] mt_report_fixup+0x103/0x110 [ 13.673297] hid_open_report+0x1ef/0x810 [ 13.673297] mt_probe+0x422/0x960 [ 13.673297] hid_device_probe+0x2e2/0x6f0 [ 13.673297] really_probe+0x1c6/0x6b0 [ 13.673297] __driver_probe_device+0x24f/0x310 [ 13.673297] driver_probe_device+0x4e/0x220 [ 13.673297] __device_attach_driver+0x169/0x320 [ 13.673297] bus_for_each_drv+0x11d/0x1b0 [ 13.673297] __device_attach+0x1b8/0x3e0 [ 13.673297] device_initial_probe+0x12/0x20 [ 13.673297] bus_probe_device+0x13d/0x180 [ 13.673297] device_add+0xe3a/0x1670 [ 13.673297] hid_add_device+0x31d/0xa40 [...] (CVE-2025-39806)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39806
https://ubuntu.com/security/CVE-2025-39806

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39806

Plugin Information
Published: 2025/09/17, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265246 - Linux Distros Unpatched Vulnerability : CVE-2025-39809
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quicki2c:
Fix ACPI dsd ICRS/ISUB length The QuickI2C ACPI _DSD methods return ICRS and ISUB data with a trailing byte, making the actual length is one more byte than the structs defined. It caused stack-out-of-bounds and kernel crash: kernel: BUG: KASAN: stack-out-of-bounds in quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: Write of size 12 at addr ffff888106d1f900 by task kworker/u33:2/75 kernel: kernel: CPU: 3 UID: 0 PID: 75 Comm: kworker/u33:2 Not tainted 6.16.0+ #3 PREEMPT(voluntary) kernel: Workqueue: async async_run_entry_fn kernel: Call Trace:
kernel: <TASK> kernel: dump_stack_lvl+0x76/0xa0 kernel: print_report+0xd1/0x660 kernel: ?
__pfx__raw_spin_lock_irqsave+0x10/0x10 kernel: ? __kasan_slab_free+0x5d/0x80 kernel: ? kasan_addr_to_slab+0xd/0xb0 kernel: kasan_report+0xe1/0x120 kernel: ? quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: ? quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel:
kasan_check_range+0x11c/0x200 kernel: __asan_memcpy+0x3b/0x80 kernel:
quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: ?
__pfx_quicki2c_acpi_get_dsd_property.constprop.0+0x10/0x10 [intel_quicki2c] kernel:
quicki2c_get_acpi_resources+0x237/0x730 [intel_quicki2c] [...] kernel: </TASK> kernel: kernel: The buggy address belongs to stack of task kworker/u33:2/75 kernel: and is located at offset 48 in frame: kernel:
quicki2c_get_acpi_resources+0x0/0x730 [intel_quicki2c] kernel: kernel: This frame has 3 objects: kernel:
[32, 36) 'hid_desc_addr' kernel: [48, 59) 'i2c_param' kernel: [80, 224) 'i2c_config' ACPI DSD methods return: \_SB.PC00.THC0.ICRS Buffer 000000003fdc947b 001 Len 0C = 0A 00 80 1A 06 00 00 00 00 00 00 00 \_SB.PC00.THC0.ISUB Buffer 00000000f2fcbdc4 001 Len 91 = 00 00 00 00 00 00 00 00 00 00 00 00 Adding reserved padding to quicki2c_subip_acpi_parameter/config. (CVE-2025-39809)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39809
https://ubuntu.com/security/CVE-2025-39809

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39809

Plugin Information
Published: 2025/09/17, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265195 - Linux Distros Unpatched Vulnerability : CVE-2025-39810
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bnxt_en: Fix memory corruption when FW resources change during ifdown bnxt_set_dflt_rings() assumes that it is always called before any TC has been created. So it doesn't take bp->num_tc into account and assumes that it is always 0 or 1. In the FW resource or capability change scenario, the FW will return flags in bnxt_hwrm_if_change() that will cause the driver to reinitialize and call bnxt_cancel_reservations(). This will lead to bnxt_init_dflt_ring_mode() calling bnxt_set_dflt_rings() and bp->num_tc may be greater than 1. This will cause bp->tx_ring[] to be sized too small and cause memory corruption in bnxt_alloc_cp_rings(). Fix it by properly scaling the TX rings by bp->num_tc in the code paths mentioned above. Add 2 helper functions to determine bp->tx_nr_rings and bp->tx_nr_rings_per_tc. (CVE-2025-39810)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39810
https://security-tracker.debian.org/tracker/CVE-2025-39810
https://ubuntu.com/security/CVE-2025-39810

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39810

Plugin Information
Published: 2025/09/17, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265153 - Linux Distros Unpatched Vulnerability : CVE-2025-39818
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save Improper use of secondary pointer (&dev->i2c_subip_regs) caused kernel crash and out-of-bounds error: BUG: KASAN: slab-out-of-bounds in
_regmap_bulk_read+0x449/0x510 Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107 CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary) Workqueue: async async_run_entry_fn Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 print_report+0xd1/0x660 ?
__pfx__raw_spin_lock_irqsave+0x10/0x10 ? kasan_complete_mode_report_info+0x26/0x200 kasan_report+0xe1/0x120 ? _regmap_bulk_read+0x449/0x510 ? _regmap_bulk_read+0x449/0x510
__asan_report_store4_noabort+0x17/0x30 _regmap_bulk_read+0x449/0x510 ? __pfx__regmap_bulk_read+0x10/0x10 regmap_bulk_read+0x270/0x3d0 pio_complete+0x1ee/0x2c0 [intel_thc] ? __pfx_pio_complete+0x10/0x10 [intel_thc] ? __pfx_pio_wait+0x10/0x10 [intel_thc] ? regmap_update_bits_base+0x13b/0x1f0 thc_i2c_subip_pio_read+0x117/0x270 [intel_thc] thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc] ?
__pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc] [...] The buggy address belongs to the object at ffff888136005d00 which belongs to the cache kmalloc-rnd-12-192 of size 192 The buggy address is located 0 bytes to the right of allocated 192-byte region [ffff888136005d00, ffff888136005dc0) Replaced with direct array indexing (&dev->i2c_subip_regs[i]) to ensure safe memory access. (CVE-2025-39818)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39818
https://ubuntu.com/security/CVE-2025-39818

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39818

Plugin Information
Published: 2025/09/17, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265253 - Linux Distros Unpatched Vulnerability : CVE-2025-39823
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- KVM: x86: use array_index_nospec with indices that come from guest min and dest_id are guest-controlled indices. Using array_index_nospec() after the bounds checks clamps these values to mitigate speculative execution side-channels. (CVE-2025-39823)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39823
https://ubuntu.com/security/CVE-2025-39823

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39823

Plugin Information
Published: 2025/09/17, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265489 - Linux Distros Unpatched Vulnerability : CVE-2025-39840
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- audit: fix out-of-bounds read in audit_compare_dname_path() When a watch on dir=/ is combined with an fsnotify event for a single-character name directly under / (e.g., creating /a), an out-of-bounds read can occur in audit_compare_dname_path(). The helper parent_len() returns 1 for /. In audit_compare_dname_path(), when parentlen equals the full path length (1), the code sets p = path + 1 and pathlen = 1 - 1 = 0. The subsequent loop then dereferences p[pathlen - 1] (i.e., p[-1]), causing an out- of-bounds read. Fix this by adding a pathlen > 0 check to the while loop condition to prevent the out-of- bounds access. [PM: subject tweak, sign-off email fixes] (CVE-2025-39840)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39840
https://ubuntu.com/security/CVE-2025-39840

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39840

Plugin Information
Published: 2025/09/19, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265484 - Linux Distros Unpatched Vulnerability : CVE-2025-39853
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- i40e: Fix potential invalid access when MAC list is empty list_first_entry() never returns NULL - if the list is empty, it still returns a pointer to an invalid object, leading to potential invalid memory access when dereferenced. Fix this by using list_first_entry_or_null instead of list_first_entry.
(CVE-2025-39853)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39853
https://ubuntu.com/security/CVE-2025-39853

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39853

Plugin Information
Published: 2025/09/19, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265462 - Linux Distros Unpatched Vulnerability : CVE-2025-39854
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ice: fix NULL access of tx->in_use in ice_ll_ts_intr Recent versions of the E810 firmware have support for an extra interrupt to handle report of the low latency Tx timestamps coming from the specialized low latency firmware interface. Instead of polling the registers, software can wait until the low latency interrupt is fired. This logic makes use of the Tx timestamp tracking structure, ice_ptp_tx, as it uses the same ready bitmap to track which Tx timestamps complete. Unfortunately, the ice_ll_ts_intr() function does not check if the tracker is initialized before its first access. This results in NULL dereference or use-after-free bugs similar to the issues fixed in the ice_ptp_ts_irq() function. Fix this by only checking the in_use bitmap (and other fields) if the tracker is marked as initialized. The reset flow will clear the init field under lock before it tears the tracker down, thus preventing any use-after- free or NULL access. (CVE-2025-39854)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39854
https://ubuntu.com/security/CVE-2025-39854

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39854

Plugin Information
Published: 2025/09/19, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265854 - Linux Distros Unpatched Vulnerability : CVE-2025-39860
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro. In the splat, a single thread calling bt_accept_dequeue() freed sk and touched it after that. The root cause would be the racy l2cap_sock_cleanup_listen() call added by the cited commit.
bt_accept_dequeue() is called under lock_sock() except for l2cap_sock_release(). Two threads could see the same socket during the list iteration in bt_accept_dequeue(): CPU1 CPU2 (close()) ---- ---- sock_hold(sk) sock_hold(sk); lock_sock(sk) <-- block close() sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- refcnt by bt_accept_enqueue() release_sock(sk) lock_sock(sk) sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- last refcnt bt_accept_unlink(sk) <-- UAF Depending on the timing, the other thread could show up in the Freed by task part. Let's call l2cap_sock_cleanup_listen() under lock_sock() in l2cap_sock_release().
[0]: BUG: KASAN: slab-use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] BUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 Read of size 4 at addr ffff88803b7eb1c4 by task syz.5.3276/16995 CPU: 3 UID: 0 PID: 16995 Comm: syz.5.3276 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcd/0x630 mm/kasan/report.c:482 kasan_report+0xe0/0x110 mm/kasan/report.c:595 debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 spin_lock_bh include/linux/spinlock.h:356 [inline] release_sock+0x21/0x220 net/core/sock.c:3746 bt_accept_dequeue+0x505/0x600 net/bluetooth/af_bluetooth.c:312 l2cap_sock_cleanup_listen+0x5c/0x2a0 net/bluetooth/l2cap_sock.c:1451 l2cap_sock_release+0x5c/0x210 net/bluetooth/l2cap_sock.c:1425 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x3ff/0xb70 fs/file_table.c:468 task_work_run+0x14d/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq- entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2accf8ebe9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP:
002b:00007ffdb6cb1378 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX:
00000000000426fb RCX: 00007f2accf8ebe9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f2acd1b7da0 R08: 0000000000000001 R09: 00000012b6cb166f R10: 0000001b30e20000 R11:
0000000000000246 R12: 00007f2acd1b609c R13: 00007f2acd1b6090 R14: ffffffffffffffff R15: 00007ffdb6cb1490 </TASK> Allocated by task 5326: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4365 [inline] __kmalloc_nopro ---truncated--- (CVE-2025-39860)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39860
https://ubuntu.com/security/CVE-2025-39860

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39860

Plugin Information
Published: 2025/09/25, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265461 - Linux Distros Unpatched Vulnerability : CVE-2025-39861
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early Move the creation of debugfs files into a dedicated function, and ensure they are explicitly removed during vhci_release(), before associated data structures are freed. Previously, debugfs files such as force_suspend, force_wakeup, and others were created under hdev->debugfs but not removed in vhci_release(). Since vhci_release() frees the backing vhci_data structure, any access to these files after release would result in use-after-free errors.
Although hdev->debugfs is later freed in hci_release_dev(), user can access files after vhci_data is freed but before hdev->debugfs is released. (CVE-2025-39861)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39861
https://ubuntu.com/security/CVE-2025-39861

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39861

Plugin Information
Published: 2025/09/19, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265846 - Linux Distros Unpatched Vulnerability : CVE-2025-39862
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: mt76: mt7915: fix list corruption after hardware restart Since stations are recreated from scratch, all lists that wcids are added to must be cleared before calling ieee80211_restart_hw. Set wcid->sta = 0 for each wcid entry in order to ensure that they are not added again before they are ready.
(CVE-2025-39862)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39862
https://security-tracker.debian.org/tracker/CVE-2025-39862
https://ubuntu.com/security/CVE-2025-39862

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39862

Plugin Information
Published: 2025/09/25, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265463 - Linux Distros Unpatched Vulnerability : CVE-2025-39863
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work The brcmf_btcoex_detach() only shuts down the btcoex timer, if the flag timer_on is false. However, the brcmf_btcoex_timerfunc(), which runs as timer handler, sets timer_on to false. This creates critical race conditions: 1.If brcmf_btcoex_detach() is called while brcmf_btcoex_timerfunc() is executing, it may observe timer_on as false and skip the call to timer_shutdown_sync(). 2.The brcmf_btcoex_timerfunc() may then reschedule the brcmf_btcoex_info worker after the cancel_work_sync() has been executed, resulting in use-after-free bugs.
The use-after-free bugs occur in two distinct scenarios, depending on the timing of when the brcmf_btcoex_info struct is freed relative to the execution of its worker thread. Scenario 1: Freed before the worker is scheduled The brcmf_btcoex_info is deallocated before the worker is scheduled. A race condition can occur when schedule_work(&bt_local->work) is called after the target memory has been freed.
The sequence of events is detailed below: CPU0 | CPU1 brcmf_btcoex_detach | brcmf_btcoex_timerfunc | bt_local->timer_on = false; if (cfg->btcoex->timer_on) | ... | cancel_work_sync(); | ... | kfree(cfg->btcoex); // FREE | | schedule_work(&bt_local->work); // USE Scenario 2: Freed after the worker is scheduled The brcmf_btcoex_info is freed after the worker has been scheduled but before or during its execution. In this case, statements within the brcmf_btcoex_handler() such as the container_of macro and subsequent dereferences of the brcmf_btcoex_info object will cause a use-after-free access. The following timeline illustrates this scenario: CPU0 | CPU1 brcmf_btcoex_detach | brcmf_btcoex_timerfunc | bt_local->timer_on = false; if (cfg->btcoex->timer_on) | ... | cancel_work_sync(); | ... | schedule_work(); // Reschedule | kfree(cfg->btcoex); // FREE | brcmf_btcoex_handler() // Worker /* | btci = container_of(....); // USE The kfree() above could | ... also occur at any point | btci-> // USE during the worker's execution| */ | To resolve the race conditions, drop the conditional check and call timer_shutdown_sync() directly. It can deactivate the timer reliably, regardless of its current state.
Once stopped, the timer_on state is then set to false. (CVE-2025-39863)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39863
https://security-tracker.debian.org/tracker/CVE-2025-39863
https://ubuntu.com/security/CVE-2025-39863

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39863

Plugin Information
Published: 2025/09/19, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265477 - Linux Distros Unpatched Vulnerability : CVE-2025-39866
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fs: writeback: fix use-after-free in __mark_inode_dirty() An use-after-free issue occurred when
__mark_inode_dirty() get the bdi_writeback that was in the progress of switching. CPU: 1 PID: 562 Comm:
systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1 ...... pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT
-SSBS BTYPE=--) pc : __mark_inode_dirty+0x124/0x418 lr : __mark_inode_dirty+0x118/0x418 sp :
ffffffc08c9dbbc0 ........ Call trace: __mark_inode_dirty+0x124/0x418 generic_update_time+0x4c/0x60 file_modified+0xcc/0xd0 ext4_buffered_write_iter+0x58/0x124 ext4_file_write_iter+0x54/0x704 vfs_write+0x1c0/0x308 ksys_write+0x74/0x10c __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x114 el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x40/0xe4 el0t_64_sync_handler+0x120/0x12c el0t_64_sync+0x194/0x198 Root cause is: systemd-random-seed kworker
---------------------------------------------------------------------- ___mark_inode_dirty inode_switch_wbs_work_fn spin_lock(&inode->i_lock); inode_attach_wb locked_inode_to_wb_and_lock_list get inode->i_wb spin_unlock(&inode->i_lock); spin_lock(&wb->list_lock) spin_lock(&inode->i_lock) inode_io_list_move_locked spin_unlock(&wb->list_lock) spin_unlock(&inode->i_lock) spin_lock(&old_wb->list_lock) inode_do_switch_wbs spin_lock(&inode->i_lock) inode->i_wb = new_wb spin_unlock(&inode->i_lock) spin_unlock(&old_wb->list_lock) wb_put_many(old_wb, nr_switched) cgwb_release old wb released wb_wakeup_delayed() accesses wb, then trigger the use-after-free issue Fix this race condition by holding inode spinlock until wb_wakeup_delayed() finished. (CVE-2025-39866)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39866
https://ubuntu.com/security/CVE-2025-39866

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.6 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.2 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-39866

Plugin Information
Published: 2025/09/19, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265875 - Linux Distros Unpatched Vulnerability : CVE-2025-39877
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm/damon/sysfs: fix use-after-free in state_show() state_show() reads kdamond->damon_ctx without holding damon_sysfs_lock. This allows a use-after-free race: CPU 0 CPU 1 ----- ----- state_show() damon_sysfs_turn_damon_on() ctx = kdamond->damon_ctx; mutex_lock(&damon_sysfs_lock);
damon_destroy_ctx(kdamond->damon_ctx); kdamond->damon_ctx = NULL; mutex_unlock(&damon_sysfs_lock);
damon_is_running(ctx); /* ctx is freed */ mutex_lock(&ctx->kdamond_lock); /* UAF */ (The race can also occur with damon_sysfs_kdamonds_rm_dirs() and damon_sysfs_kdamond_release(), which free or replace the context under damon_sysfs_lock.) Fix by taking damon_sysfs_lock before dereferencing the context, mirroring the locking used in pid_show(). The bug has existed since state_show() first accessed kdamond->damon_ctx. (CVE-2025-39877)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39877
https://ubuntu.com/security/CVE-2025-39877

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39877

Plugin Information
Published: 2025/09/25, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265882 - Linux Distros Unpatched Vulnerability : CVE-2025-39880
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- libceph: fix invalid accesses to ceph_connection_v1_info There is a place where generic code in messenger.c is reading and another place where it is writing to con->v1 union member without checking that the union member is active (i.e. msgr1 is in use). On 64-bit systems, con->v1.auth_retry overlaps with con->v2.out_iter, so such a read is almost guaranteed to return a bogus value instead of 0 when msgr2 is in use. This ends up being fairly benign because the side effect is just the invalidation of the authorizer and successive fetching of new tickets. con->v1.connect_seq overlaps with con->v2.conn_bufs and the fact that it's being written to can cause more serious consequences, but luckily it's not something that happens often. (CVE-2025-39880)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39880
https://ubuntu.com/security/CVE-2025-39880

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39880

Plugin Information
Published: 2025/09/25, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265881 - Linux Distros Unpatched Vulnerability : CVE-2025-39883
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory When I did memory failure tests, below panic occurs: page dumped because: VM_BUG_ON_PAGE(PagePoisoned(page)) kernel BUG at include/linux/page-flags.h:616! Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 720 Comm:
bash Not tainted 6.10.0-rc1-00195-g148743902568 #40 RIP: 0010:unpoison_memory+0x2f3/0x590 RSP:
0018:ffffa57fc8787d60 EFLAGS: 00000246 RAX: 0000000000000037 RBX: 0000000000000009 RCX: ffff9be25fcdc9c8 RDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff9be25fcdc9c0 RBP: 0000000000300000 R08:
ffffffffb4956f88 R09: 0000000000009ffb R10: 0000000000000284 R11: ffffffffb4926fa0 R12: ffffe6b00c000000 R13: ffff9bdb453dfd00 R14: 0000000000000000 R15: fffffffffffffffe FS: 00007f08f04e4740(0000) GS:ffff9be25fcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
0000564787a30410 CR3: 000000010d4e2000 CR4: 00000000000006f0 Call Trace: <TASK>
unpoison_memory+0x2f3/0x590 simple_attr_write_xsigned.constprop.0.isra.0+0xb3/0x110 debugfs_attr_write+0x42/0x60 full_proxy_write+0x5b/0x80 vfs_write+0xd5/0x540 ksys_write+0x64/0xe0 do_syscall_64+0xb9/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f08f0314887 RSP:
002b:00007ffece710078 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX:
0000000000000009 RCX: 00007f08f0314887 RDX: 0000000000000009 RSI: 0000564787a30410 RDI: 0000000000000001 RBP: 0000564787a30410 R08: 000000000000fefe R09: 000000007fffffff R10: 0000000000000000 R11:
0000000000000246 R12: 0000000000000009 R13: 00007f08f041b780 R14: 00007f08f0417600 R15: 00007f08f0416a00 </TASK> Modules linked in: hwpoison_inject ---[ end trace 0000000000000000 ]--- RIP:
0010:unpoison_memory+0x2f3/0x590 RSP: 0018:ffffa57fc8787d60 EFLAGS: 00000246 RAX: 0000000000000037 RBX:
0000000000000009 RCX: ffff9be25fcdc9c8 RDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff9be25fcdc9c0 RBP: 0000000000300000 R08: ffffffffb4956f88 R09: 0000000000009ffb R10: 0000000000000284 R11:
ffffffffb4926fa0 R12: ffffe6b00c000000 R13: ffff9bdb453dfd00 R14: 0000000000000000 R15: fffffffffffffffe FS: 00007f08f04e4740(0000) GS:ffff9be25fcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000564787a30410 CR3: 000000010d4e2000 CR4: 00000000000006f0 Kernel panic - not syncing: Fatal exception Kernel Offset: 0x31c00000 from 0xffffffff81000000 (relocation range:
0xffffffff80000000-0xffffffffbfffffff) ---[ end Kernel panic - not syncing: Fatal exception ]--- The root cause is that unpoison_memory() tries to check the PG_HWPoison flags of an uninitialized page. So VM_BUG_ON_PAGE(PagePoisoned(page)) is triggered. This can be reproduced by below steps: 1.Offline memory block: echo offline > /sys/devices/system/memory/memory12/state 2.Get offlined memory pfn: page-types -b n
-rlN 3.Write pfn to unpoison-pfn echo <pfn> > /sys/kernel/debug/hwpoison/unpoison-pfn This scenario can be identified by pfn_to_online_page() returning NULL. And ZONE_DEVICE pages are never expected, so we can simply fail if pfn_to_online_page() == NULL to fix the bug. (CVE-2025-39883)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39883
https://ubuntu.com/security/CVE-2025-39883

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39883

Plugin Information
Published: 2025/09/25, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269257 - Linux Distros Unpatched Vulnerability : CVE-2025-39901
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- i40e: remove read access to debugfs files The 'command' and 'netdev_ops' debugfs files are a legacy debugging interface supported by the i40e driver since its early days by commit 02e9c290814c (i40e:
debugfs interface). Both of these debugfs files provide a read handler which is mostly useless, and which is implemented with questionable logic. They both use a static 256 byte buffer which is initialized to the empty string. In the case of the 'command' file this buffer is literally never used and simply wastes space. In the case of the 'netdev_ops' file, the last command written is saved here. On read, the files contents are presented as the name of the device followed by a colon and then the contents of their respective static buffer. For 'command' this will always be <device>: . For 'netdev_ops', this will be <device>: <last command written>. But note the buffer is shared between all devices operated by this module. At best, it is mostly meaningless information, and at worse it could be accessed simultaneously as there doesn't appear to be any locking mechanism. We have also recently received multiple reports for both read functions about their use of snprintf and potential overflow that could result in reading arbitrary kernel memory. For the 'command' file, this is definitely impossible, since the static buffer is always zero and never written to. For the 'netdev_ops' file, it does appear to be possible, if the user carefully crafts the command input, it will be copied into the buffer, which could be large enough to cause snprintf to truncate, which then causes the copy_to_user to read beyond the length of the buffer allocated by kzalloc. A minimal fix would be to replace snprintf() with scnprintf() which would cap the return to the number of bytes written, preventing an overflow. A more involved fix would be to drop the mostly useless static buffers, saving 512 bytes and modifying the read functions to stop needing those as input. Instead, lets just completely drop the read access to these files. These are debug interfaces exposed as part of debugfs, and I don't believe that dropping read access will break any script, as the provided output is pretty useless. You can find the netdev name through other more standard interfaces, and the 'netdev_ops'
interface can easily result in garbage if you issue simultaneous writes to multiple devices at once. In order to properly remove the i40e_dbg_netdev_ops_buf, we need to refactor its write function to avoid using the static buffer. Instead, use the same logic as the i40e_dbg_command_write, with an allocated buffer. Update the code to use this instead of the static buffer, and ensure we free the buffer on exit.
This fixes simultaneous writes to 'netdev_ops' on multiple devices, and allows us to remove the now unused static buffer along with removing the read access. (CVE-2025-39901)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39901
https://security-tracker.debian.org/tracker/CVE-2025-39901
https://ubuntu.com/security/CVE-2025-39901

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39901

Plugin Information
Published: 2025/10/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269255 - Linux Distros Unpatched Vulnerability : CVE-2025-39905
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: phylink: add lock for serializing concurrent pl->phydev writes with resolver Currently phylink_resolve() protects itself against concurrent phylink_bringup_phy() or phylink_disconnect_phy() calls which modify pl->phydev by relying on pl->state_mutex. The problem is that in phylink_resolve(), pl->state_mutex is in a lock inversion state with pl->phydev->lock. So pl->phydev->lock needs to be acquired prior to pl->state_mutex. But that requires dereferencing pl->phydev in the first place, and without pl->state_mutex, that is racy. Hence the reason for the extra lock. Currently it is redundant, but it will serve a functional purpose once mutex_lock(&phy->lock) will be moved outside of the mutex_lock(&pl->state_mutex) section. Another alternative considered would have been to let phylink_resolve() acquire the rtnl_mutex, which is also held when phylink_bringup_phy() and phylink_disconnect_phy() are called. But since phylink_disconnect_phy() runs under rtnl_lock(), it would deadlock with phylink_resolve() when calling flush_work(&pl->resolve). Additionally, it would have been undesirable because it would have unnecessarily blocked many other call paths as well in the entire kernel, so the smaller-scoped lock was preferred. (CVE-2025-39905)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39905
https://ubuntu.com/security/CVE-2025-39905

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39905

Plugin Information
Published: 2025/10/07, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269678 - Linux Distros Unpatched Vulnerability : CVE-2025-39922
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ixgbe: fix incorrect map used in eee linkmode incorrectly used ixgbe_lp_map in loops intended to populate the supported and advertised EEE linkmode bitmaps based on ixgbe_ls_map. This results in incorrect bit setting and potential out-of-bounds access, since ixgbe_lp_map and ixgbe_ls_map have different sizes and purposes. ixgbe_lp_map[i] -> ixgbe_ls_map[i] Use ixgbe_ls_map for supported and advertised linkmodes, and keep ixgbe_lp_map usage only for link partner (lp_advertised) mapping. (CVE-2025-39922)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39922
https://ubuntu.com/security/CVE-2025-39922

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39922

Plugin Information
Published: 2025/10/08, Modified: 2025/11/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269388 - Linux Distros Unpatched Vulnerability : CVE-2025-39939
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: iommu/s390: Fix memory corruption when using identity domain zpci_get_iommu_ctrs() returns counter information to be reported as part of device statistics; these counters are stored as part of the s390_domain. The problem, however, is that the identity domain is not backed by an s390_domain and so the conversion via to_s390_domain() yields a bad address that is zero'd initially and read on-demand later via a sysfs read. These counters aren't necessary for the identity domain; just return NULL in this case. This issue was discovered via KASAN with reports that look like: BUG: KASAN: global-out-of-bounds in zpci_fmb_enable_device when using the identity domain for a device on s390. (CVE-2025-39939)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39939
https://ubuntu.com/security/CVE-2025-39939

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39939

Plugin Information
Published: 2025/10/08, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269451 - Linux Distros Unpatched Vulnerability : CVE-2025-39944
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() The original code relies on cancel_delayed_work() in otx2_ptp_destroy(), which does not ensure that the delayed work item synctstamp_work has fully completed if it was already running. This leads to use-after-free scenarios where otx2_ptp is deallocated by otx2_ptp_destroy(), while synctstamp_work remains active and attempts to dereference otx2_ptp in otx2_sync_tstamp(). Furthermore, the synctstamp_work is cyclic, the likelihood of triggering the bug is nonnegligible. A typical race condition is illustrated below: CPU 0 (cleanup) | CPU 1 (delayed work callback) otx2_remove() | otx2_ptp_destroy() | otx2_sync_tstamp() cancel_delayed_work() | kfree(ptp) | | ptp = container_of(...); //UAF | ptp-> //UAF This is confirmed by a KASAN report: BUG:
KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0 Write of size 8 at addr ffff88800aa09a18 by task bash/136 ... Call Trace: <IRQ> dump_stack_lvl+0x55/0x70 print_report+0xcf/0x610 ?
__run_timer_base.part.0+0x7d7/0x8c0 kasan_report+0xb8/0xf0 ? __run_timer_base.part.0+0x7d7/0x8c0
__run_timer_base.part.0+0x7d7/0x8c0 ? __pfx___run_timer_base.part.0+0x10/0x10 ? __pfx_read_tsc+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x11/0x20 ? clockevents_program_event+0x1d4/0x2a0 run_timer_softirq+0xd1/0x190 handle_softirqs+0x16a/0x550 irq_exit_rcu+0xaf/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 </IRQ> ... Allocated by task 1: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 otx2_ptp_init+0xb1/0x860 otx2_probe+0x4eb/0xc30 local_pci_probe+0xdc/0x190 pci_device_probe+0x2fe/0x470 really_probe+0x1ca/0x5c0
__driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __driver_attach+0xd2/0x310 bus_for_each_dev+0xed/0x170 bus_add_driver+0x208/0x500 driver_register+0x132/0x460 do_one_initcall+0x89/0x300 kernel_init_freeable+0x40d/0x720 kernel_init+0x1a/0x150 ret_from_fork+0x10c/0x1a0 ret_from_fork_asm+0x1a/0x30 Freed by task 136: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3a/0x60 __kasan_slab_free+0x3f/0x50 kfree+0x137/0x370 otx2_ptp_destroy+0x38/0x80 otx2_remove+0x10d/0x4c0 pci_device_remove+0xa6/0x1d0 device_release_driver_internal+0xf8/0x210 pci_stop_bus_device+0x105/0x150 pci_stop_and_remove_bus_device_locked+0x15/0x30 remove_store+0xcc/0xe0 kernfs_fop_write_iter+0x2c3/0x440 vfs_write+0x871/0xd70 ksys_write+0xee/0x1c0 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the delayed work item is properly canceled before the otx2_ptp is deallocated. This bug was initially identified through static analysis. To reproduce and test it, I simulated the OcteonTX2 PCI device in QEMU and introduced artificial delays within the otx2_sync_tstamp() function to increase the likelihood of triggering the bug. (CVE-2025-39944)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39944
https://ubuntu.com/security/CVE-2025-39944

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39944

Plugin Information
Published: 2025/10/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269455 - Linux Distros Unpatched Vulnerability : CVE-2025-39945
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cnic: Fix use-after-free bugs in cnic_delete_task The original code uses cancel_delayed_work() in cnic_cm_stop_bnx2x_hw(), which does not guarantee that the delayed work item 'delete_task' has fully completed if it was already running. Additionally, the delayed work item is cyclic, the flush_workqueue() in cnic_cm_stop_bnx2x_hw() only blocks and waits for work items that were already queued to the workqueue prior to its invocation. Any work items submitted after flush_workqueue() is called are not included in the set of tasks that the flush operation awaits. This means that after the cyclic work items have finished executing, a delayed work item may still exist in the workqueue. This leads to use-after-free scenarios where the cnic_dev is deallocated by cnic_free_dev(), while delete_task remains active and attempt to dereference cnic_dev in cnic_delete_task(). A typical race condition is illustrated below: CPU 0 (cleanup) | CPU 1 (delayed work callback) cnic_netdev_event() | cnic_stop_hw() | cnic_delete_task() cnic_cm_stop_bnx2x_hw() | ... cancel_delayed_work() | /* the queue_delayed_work() flush_workqueue() | executes after flush_workqueue()*/ | queue_delayed_work() cnic_free_dev(dev)//free | cnic_delete_task() //new instance | dev = cp->dev; //use Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the cyclic delayed work item is properly canceled and that any ongoing execution of the work item completes before the cnic_dev is deallocated. Furthermore, since cancel_delayed_work_sync() uses
__flush_work(work, true) to synchronously wait for any currently executing instance of the work item to finish, the flush_workqueue() becomes redundant and should be removed. This bug was identified through static analysis. To reproduce the issue and validate the fix, I simulated the cnic PCI device in QEMU and introduced intentional delays such as inserting calls to ssleep() within the cnic_delete_task() function to increase the likelihood of triggering the bug. (CVE-2025-39945)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39945
https://ubuntu.com/security/CVE-2025-39945

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39945

Plugin Information
Published: 2025/10/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
270222 - Linux Distros Unpatched Vulnerability : CVE-2025-39964
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing. (CVE-2025-39964)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39964
https://ubuntu.com/security/CVE-2025-39964

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39964

Plugin Information
Published: 2025/10/14, Modified: 2025/12/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271548 - Linux Distros Unpatched Vulnerability : CVE-2025-39967
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fbcon: fix integer overflow in fbcon_do_set_font Fix integer overflow vulnerabilities in fbcon_do_set_font() where font size calculations could overflow when handling user-controlled font parameters. The vulnerabilities occur when: 1. CALC_FONTSZ(h, pitch, charcount) performs h * pith * charcount multiplication with user-controlled values that can overflow. 2. FONT_EXTRA_WORDS * sizeof(int) + size addition can also overflow 3. This results in smaller allocations than expected, leading to buffer overflows during font data copying. Add explicit overflow checking using check_mul_overflow() and check_add_overflow() kernel helpers to safety validate all size calculations before allocation.
(CVE-2025-39967)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39967
https://ubuntu.com/security/CVE-2025-39967

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39967

Plugin Information
Published: 2025/10/27, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271550 - Linux Distros Unpatched Vulnerability : CVE-2025-39968
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- i40e: add max boundary check for VF filters There is no check for max filters that VF can request. Add it.
(CVE-2025-39968)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39968
https://ubuntu.com/security/CVE-2025-39968

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39968

Plugin Information
Published: 2025/10/27, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271536 - Linux Distros Unpatched Vulnerability : CVE-2025-39972
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- i40e: fix idx validation in i40e_validate_queue_map Ensure idx is within range of active/initialized TCs when iterating over vf->ch[idx] in i40e_validate_queue_map(). (CVE-2025-39972)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39972
https://ubuntu.com/security/CVE-2025-39972

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39972

Plugin Information
Published: 2025/10/27, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271527 - Linux Distros Unpatched Vulnerability : CVE-2025-39973
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- i40e: add validation for ring_len param The `ring_len` parameter provided by the virtual function (VF) is assigned directly to the hardware memory context (HMC) without any validation. To address this, introduce an upper boundary check for both Tx and Rx queue lengths. The maximum number of descriptors supported by the hardware is 8k-32. Additionally, enforce alignment constraints: Tx rings must be a multiple of 8, and Rx rings must be a multiple of 32. (CVE-2025-39973)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39973
https://ubuntu.com/security/CVE-2025-39973

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39973

Plugin Information
Published: 2025/10/27, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271523 - Linux Distros Unpatched Vulnerability : CVE-2025-39974
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Fix slab-out-of- bounds in _parse_integer_limit() When config osnoise cpus by write() syscall, the following KASAN splat may be observed: BUG: KASAN: slab-out-of-bounds in _parse_integer_limit+0x103/0x130 Read of size 1 at addr ffff88810121e3a1 by task test/447 CPU: 1 UID: 0 PID: 447 Comm: test Not tainted 6.17.0-rc6-dirty #288 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x55/0x70 print_report+0xcb/0x610 kasan_report+0xb8/0xf0
_parse_integer_limit+0x103/0x130 bitmap_parselist+0x16d/0x6f0 osnoise_cpus_write+0x116/0x2d0 vfs_write+0x21e/0xcc0 ksys_write+0xee/0x1c0 do_syscall_64+0xa8/0x2a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> This issue can be reproduced by below code: const char
*cpulist = 1; int fd=open(/sys/kernel/debug/tracing/osnoise/cpus, O_WRONLY); write(fd, cpulist, strlen(cpulist)); Function bitmap_parselist() was called to parse cpulist, it require that the parameter 'buf' must be terminated with a '\0' or '
'. Fix this issue by adding a '\0' to 'buf' in osnoise_cpus_write(). (CVE-2025-39974)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39974
https://ubuntu.com/security/CVE-2025-39974

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39974

Plugin Information
Published: 2025/10/27, Modified: 2025/11/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271546 - Linux Distros Unpatched Vulnerability : CVE-2025-39975
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smb: client: fix wrong index reference in smb2_compound_op() In smb2_compound_op(), the loop that processes each command's response uses wrong indices when accessing response bufferes. This incorrect indexing leads to improper handling of command results. Also, if incorrectly computed index is greather than or equal to MAX_COMPOUND, it can cause out-of-bounds accesses. (CVE-2025-39975)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39975
https://ubuntu.com/security/CVE-2025-39975

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39975

Plugin Information
Published: 2025/10/27, Modified: 2025/11/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271524 - Linux Distros Unpatched Vulnerability : CVE-2025-39977
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- futex: Prevent use-after-free during requeue-PI syzbot managed to trigger the following race: T1 T2 futex_wait_requeue_pi() futex_do_wait() schedule() futex_requeue() futex_proxy_trylock_atomic() futex_requeue_pi_prepare() requeue_pi_wake_futex() futex_requeue_pi_complete() /* preempt */ * timeout/ signal wakes T1 * futex_requeue_pi_wakeup_sync() // Q_REQUEUE_PI_LOCKED futex_hash_put() // back to userland, on stack futex_q is garbage /* back */ wake_up_state(q->task, TASK_NORMAL); In this scenario futex_wait_requeue_pi() is able to leave without using futex_q::lock_ptr for synchronization. This can be prevented by reading futex_q::task before updating the futex_q::requeue_state. A reference on the task_struct is not needed because requeue_pi_wake_futex() is invoked with a spinlock_t held which implies a RCU read section. Even if T1 terminates immediately after, the task_struct will remain valid during T2's wake_up_state(). A READ_ONCE on futex_q::task before futex_requeue_pi_complete() is enough because it ensures that the variable is read before the state is updated. Read futex_q::task before updating the requeue state, use it for the following wakeup. (CVE-2025-39977)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39977
https://ubuntu.com/security/CVE-2025-39977

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39977

Plugin Information
Published: 2025/10/27, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271564 - Linux Distros Unpatched Vulnerability : CVE-2025-39978
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() This code calls kfree_rcu(new_node, rcu) and then dereferences new_node and then dereferences it on the next line. Two lines later, we take a mutex so I don't think this is an RCU safe region. Re-order it to do the dereferences before queuing up the free. (CVE-2025-39978)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39978
https://ubuntu.com/security/CVE-2025-39978

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39978

Plugin Information
Published: 2025/10/27, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271557 - Linux Distros Unpatched Vulnerability : CVE-2025-39998
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow A buffer overflow arises from the usage of snprintf to write into the buffer buf in target_lu_gp_members_show function located in /drivers/target/target_core_configfs.c. This buffer is allocated with size LU_GROUP_NAME_BUF (256 bytes).
snprintf(...) formats multiple strings into buf with the HBA name (hba->hba_group.cg_item), a slash character, a devicename (dev-> dev_group.cg_item) and a newline character, the total formatted string length may exceed the buffer size of 256 bytes. Since snprintf() returns the total number of bytes that would have been written (the length of %s/%sn ), this value may exceed the buffer length (256 bytes) passed to memcpy(), this will ultimately cause function memcpy reporting a buffer overflow error. An additional check of the return value of snprintf() can avoid this buffer overflow. (CVE-2025-39998)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39998
https://ubuntu.com/security/CVE-2025-39998

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39998

Plugin Information
Published: 2025/10/27, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246041 - Linux Distros Unpatched Vulnerability : CVE-2025-40014
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- objtool, spi: amd: Fix out-of-bounds stack access in amd_set_spi_freq() If speed_hz < AMD_SPI_MIN_HZ, amd_set_spi_freq() iterates over the entire amd_spi_freq array without breaking out early, causing 'i' to go beyond the array bounds. Fix that by stopping the loop when it gets to the last entry, so the low speed_hz value gets clamped up to AMD_SPI_MIN_HZ. Fixes the following warning with an UBSAN kernel:
drivers/spi/spi-amd.o: error: objtool: amd_set_spi_freq() falls through to next function amd_spi_set_opcode() (CVE-2025-40014)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40014
https://ubuntu.com/security/CVE-2025-40014

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40014

Plugin Information
Published: 2025/08/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271716 - Linux Distros Unpatched Vulnerability : CVE-2025-40019
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- crypto: essiv - Check ssize for decryption and in-place encryption Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption. (CVE-2025-40019)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40019
https://ubuntu.com/security/CVE-2025-40019

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.9 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-40019

Plugin Information
Published: 2025/10/27, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271712 - Linux Distros Unpatched Vulnerability : CVE-2025-40020
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- can: peak_usb: fix shift-out-of-bounds issue Explicitly uses a 64-bit constant when the number of bits used for its shifting is 32 (which is the case for PC CAN FD interfaces supported by this driver). [mkl:
update subject, apply manually] (CVE-2025-40020)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40020
https://ubuntu.com/security/CVE-2025-40020

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40020

Plugin Information
Published: 2025/10/27, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271714 - Linux Distros Unpatched Vulnerability : CVE-2025-40021
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tracing: dynevent: Add a missing lockdown check on dynevent Since dynamic_events interface on tracefs is compatible with kprobe_events and uprobe_events, it should also check the lockdown status and reject if it is set. (CVE-2025-40021)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40021
https://ubuntu.com/security/CVE-2025-40021

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40021

Plugin Information
Published: 2025/10/27, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271897 - Linux Distros Unpatched Vulnerability : CVE-2025-40026
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instruction execution, i.e. has already committed to allowing L2 to perform I/O. If L1 (or host userspace) modifies the I/O permission bitmaps during the exit to userspace, KVM will treat the access as being intercepted despite already having emulated the I/O access. Pivot on EMULTYPE_NO_DECODE to detect that KVM is completing emulation. Of the three users of EMULTYPE_NO_DECODE, only complete_emulated_io() (the intended recipient) can reach the code in question. gp_interception()'s use is mutually exclusive with is_guest_mode(), and complete_emulated_insn_gp() unconditionally pairs EMULTYPE_NO_DECODE with EMULTYPE_SKIP. The bad behavior was detected by a syzkaller program that toggles port I/O interception during the userspace I/O exit, ultimately resulting in a WARN on vcpu->arch.pio.count being non-zero due to KVM no completing emulation of the I/O instruction. WARNING:
CPU: 23 PID: 1083 at arch/x86/kvm/x86.c:8039 emulator_pio_in_out+0x154/0x170 [kvm] Modules linked in:
kvm_intel kvm irqbypass CPU: 23 UID: 1000 PID: 1083 Comm: repro Not tainted 6.16.0-rc5-c1610d2d66b1-next- vm #74 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP:
0010:emulator_pio_in_out+0x154/0x170 [kvm] PKRU: 55555554 Call Trace: <TASK> kvm_fast_pio+0xd6/0x1d0 [kvm] vmx_handle_exit+0x149/0x610 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xda8/0x1ac0 [kvm] kvm_vcpu_ioctl+0x244/0x8c0 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0x5d/0xc60 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> (CVE-2025-40026)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40026
https://ubuntu.com/security/CVE-2025-40026

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40026

Plugin Information
Published: 2025/10/28, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271891 - Linux Distros Unpatched Vulnerability : CVE-2025-40035
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak Struct ff_effect_compat is embedded twice inside uinput_ff_upload_compat, contains internal padding. In particular, there is a hole after struct ff_replay to satisfy alignment requirements for the following union member. Without clearing the structure, copy_to_user() may leak stack data to userspace. Initialize ff_up_compat to zero before filling valid fields. (CVE-2025-40035)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40035
https://ubuntu.com/security/CVE-2025-40035

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40035

Plugin Information
Published: 2025/10/28, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271881 - Linux Distros Unpatched Vulnerability : CVE-2025-40037
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() The pm_domain cleanup can not be devres managed as it uses struct simplefb_par which is allocated within struct fb_info by framebuffer_alloc().
This allocation is explicitly freed by unregister_framebuffer() in simplefb_remove(). Devres managed cleanup runs after the device remove call and thus can no longer access struct simplefb_par. Call simplefb_detach_genpds() explicitly from simplefb_destroy() like the cleanup functions for clocks and regulators. Fixes an use after free on M2 Mac mini during aperture_remove_conflicting_devices() using the downstream asahi kernel with Debian's kernel config. For unknown reasons this started to consistently dereference an invalid pointer in v6.16.3 based kernels. [ 6.736134] BUG: KASAN: slab-use-after-free in simplefb_detach_genpds+0x58/0x220 [ 6.743545] Read of size 4 at addr ffff8000304743f0 by task (udev- worker)/227 [ 6.750697] [ 6.752182] CPU: 6 UID: 0 PID: 227 Comm: (udev-worker) Tainted: G S 6.16.3-asahi+ #16 PREEMPTLAZY [ 6.752186] Tainted: [S]=CPU_OUT_OF_SPEC [ 6.752187] Hardware name: Apple Mac mini (M2, 2023) (DT) [ 6.752189] Call trace: [ 6.752190] show_stack+0x34/0x98 (C) [ 6.752194] dump_stack_lvl+0x60/0x80 [ 6.752197] print_report+0x17c/0x4d8 [ 6.752201] kasan_report+0xb4/0x100 [ 6.752206] __asan_report_load4_noabort+0x20/0x30 [ 6.752209] simplefb_detach_genpds+0x58/0x220 [ 6.752213] devm_action_release+0x50/0x98 [ 6.752216] release_nodes+0xd0/0x2c8 [ 6.752219] devres_release_all+0xfc/0x178 [ 6.752221] device_unbind_cleanup+0x28/0x168 [ 6.752224] device_release_driver_internal+0x34c/0x470 [ 6.752228] device_release_driver+0x20/0x38 [ 6.752231] bus_remove_device+0x1b0/0x380 [ 6.752234] device_del+0x314/0x820 [ 6.752238] platform_device_del+0x3c/0x1e8 [ 6.752242] platform_device_unregister+0x20/0x50 [ 6.752246] aperture_detach_platform_device+0x1c/0x30 [ 6.752250] aperture_detach_devices+0x16c/0x290 [ 6.752253] aperture_remove_conflicting_devices+0x34/0x50 ... [ 6.752343] [ 6.967409] Allocated by task 62: [ 6.970724] kasan_save_stack+0x3c/0x70 [ 6.974560] kasan_save_track+0x20/0x40 [ 6.978397] kasan_save_alloc_info+0x40/0x58 [ 6.982670] __kasan_kmalloc+0xd4/0xd8 [ 6.986420]
__kmalloc_noprof+0x194/0x540 [ 6.990432] framebuffer_alloc+0xc8/0x130 [ 6.994444] simplefb_probe+0x258/0x2378 ... [ 7.054356] [ 7.055838] Freed by task 227: [ 7.058891] kasan_save_stack+0x3c/0x70 [ 7.062727] kasan_save_track+0x20/0x40 [ 7.066565] kasan_save_free_info+0x4c/0x80 [ 7.070751] __kasan_slab_free+0x6c/0xa0 [ 7.074675] kfree+0x10c/0x380 [ 7.077727] framebuffer_release+0x5c/0x90 [ 7.081826] simplefb_destroy+0x1b4/0x2c0 [ 7.085837] put_fb_info+0x98/0x100 [ 7.089326] unregister_framebuffer+0x178/0x320 [ 7.093861] simplefb_remove+0x3c/0x60 [ 7.097611] platform_remove+0x60/0x98 [ 7.101361] device_remove+0xb8/0x160 [ 7.105024] device_release_driver_internal+0x2fc/0x470 [ 7.110256] device_release_driver+0x20/0x38 [ 7.114529] bus_remove_device+0x1b0/0x380 [ 7.118628] device_del+0x314/0x820 [ 7.122116] platform_device_del+0x3c/0x1e8 [ 7.126302] platform_device_unregister+0x20/0x50 [ 7.131012] aperture_detach_platform_device+0x1c/0x30 [ 7.136157] aperture_detach_devices+0x16c/0x290 [ 7.140779] aperture_remove_conflicting_devices+0x34/0x50 ... (CVE-2025-40037)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40037
https://ubuntu.com/security/CVE-2025-40037

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40037

Plugin Information
Published: 2025/10/28, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271911 - Linux Distros Unpatched Vulnerability : CVE-2025-40044
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fs: udf: fix OOB read in lengthAllocDescs handling When parsing Allocation Extent Descriptor, lengthAllocDescs comes from on-disk data and must be validated against the block size. Crafted or corrupted images may set lengthAllocDescs so that the total descriptor length (sizeof(allocExtDesc) + lengthAllocDescs) exceeds the buffer, leading udf_update_tag() to call crc_itu_t() on out-of-bounds memory and trigger a KASAN use-after-free read. BUG: KASAN: use-after-free in crc_itu_t+0x1d5/0x2b0 lib/crc- itu-t.c:60 Read of size 1 at addr ffff888041e7d000 by task syz-executor317/5309 CPU: 0 UID: 0 PID: 5309 Comm: syz-executor317 Not tainted 6.12.0-rc4-syzkaller-00261-g850925a8133c #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 crc_itu_t+0x1d5/0x2b0 lib/crc-itu-t.c:60 udf_update_tag+0x70/0x6a0 fs/udf/misc.c:261 udf_write_aext+0x4d8/0x7b0 fs/udf/inode.c:2179 extent_trunc+0x2f7/0x4a0 fs/udf/truncate.c:46 udf_truncate_tail_extent+0x527/0x7e0 fs/udf/truncate.c:106 udf_release_file+0xc1/0x120 fs/udf/file.c:185
__fput+0x23f/0x880 fs/file_table.c:431 task_work_run+0x24f/0x310 kernel/task_work.c:239 exit_task_work include/linux/task_work.h:43 [inline] do_exit+0xa2f/0x28e0 kernel/exit.c:939 do_group_exit+0x207/0x2c0 kernel/exit.c:1088 __do_sys_exit_group kernel/exit.c:1099 [inline] __se_sys_exit_group kernel/exit.c:1097 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1097 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK>
Validate the computed total length against epos->bh->b_size. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. (CVE-2025-40044)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40044
https://ubuntu.com/security/CVE-2025-40044

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40044

Plugin Information
Published: 2025/10/28, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271874 - Linux Distros Unpatched Vulnerability : CVE-2025-40048
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- uio_hv_generic: Let userspace take care of interrupt mask Remove the logic to set interrupt mask by default in uio_hv_generic driver as the interrupt mask value is supposed to be controlled completely by the user space. If the mask bit gets changed by the driver, concurrently with user mode operating on the ring, the mask bit may be set when it is supposed to be clear, and the user-mode driver will miss an interrupt which will cause a hang. For eg- when the driver sets inbound ring buffer interrupt mask to 1, the host does not interrupt the guest on the UIO VMBus channel. However, setting the mask does not prevent the host from putting a message in the inbound ring buffer. So let's assume that happens, the host puts a message into the ring buffer but does not interrupt. Subsequently, the user space code in the guest sets the inbound ring buffer interrupt mask to 0, saying Hey, I'm ready for interrupts. User space code then calls pread() to wait for an interrupt. Then one of two things happens: * The host never sends another message. So the pread() waits forever. * The host does send another message. But because there's already a message in the ring buffer, it doesn't generate an interrupt. This is the correct behavior, because the host should only send an interrupt when the inbound ring buffer transitions from empty to not-empty.
Adding an additional message to a ring buffer that is not empty is not supposed to generate an interrupt on the guest. Since the guest is waiting in pread() and not removing messages from the ring buffer, the pread() waits forever. This could be easily reproduced in hv_fcopy_uio_daemon if we delay setting interrupt mask to 0. Similarly if hv_uio_channel_cb() sets the interrupt_mask to 1, there's a race condition. Once user space empties the inbound ring buffer, but before user space sets interrupt_mask to 0, the host could put another message in the ring buffer but it wouldn't interrupt. Then the next pread() would hang. Fix these by removing all instances where interrupt_mask is changed, while keeping the one in set_event() unchanged to enable userspace control the interrupt mask by writing 0/1 to /dev/uioX.
(CVE-2025-40048)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40048
https://ubuntu.com/security/CVE-2025-40048

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
8.4 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.1
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40048

Plugin Information
Published: 2025/10/28, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271910 - Linux Distros Unpatched Vulnerability : CVE-2025-40051
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vhost: vringh: Modify the return value check The return value of copy_from_iter and copy_to_iter can't be negative, check whether the copied lengths are equal. (CVE-2025-40051)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40051
https://ubuntu.com/security/CVE-2025-40051

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40051

Plugin Information
Published: 2025/10/28, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271868 - Linux Distros Unpatched Vulnerability : CVE-2025-40074
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipv4: start using dst_dev_rcu() Change icmpv4_xrlim_allow(), ip_defrag() to prevent possible UAF. Change ipmr_prepare_xmit(), ipmr_queue_fwd_xmit(), ip_mr_output(), ipv4_neigh_lookup() to use lockdep enabled dst_dev_rcu(). (CVE-2025-40074)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40074
https://security-tracker.debian.org/tracker/CVE-2025-40074
https://ubuntu.com/security/CVE-2025-40074

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40074

Plugin Information
Published: 2025/10/28, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271888 - Linux Distros Unpatched Vulnerability : CVE-2025-40075
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tcp_metrics: use dst_dev_net_rcu() Replace three dst_dev() with a lockdep enabled helper. (CVE-2025-40075)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40075
https://security-tracker.debian.org/tracker/CVE-2025-40075
https://ubuntu.com/security/CVE-2025-40075

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40075

Plugin Information
Published: 2025/10/28, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271870 - Linux Distros Unpatched Vulnerability : CVE-2025-40078
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Explicitly check accesses to bpf_sock_addr Syzkaller found a kernel warning on the following sock_addr program: 0: r0 = 0 1: r2 = *(u32 *)(r1 +60) 2: exit which triggers: verifier bug: error during ctx access conversion (0) This is happening because offset 60 in bpf_sock_addr corresponds to an implicit padding of 4 bytes, right after msg_src_ip4. Access to this padding isn't rejected in sock_addr_is_valid_access and it thus later fails to convert the access. This patch fixes it by explicitly checking the various fields of bpf_sock_addr in sock_addr_is_valid_access. I checked the other ctx structures and is_valid_access functions and didn't find any other similar cases. Other cases of (properly handled) padding are covered in new tests in a subsequent patch. (CVE-2025-40078)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40078
https://ubuntu.com/security/CVE-2025-40078

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:N)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40078

Plugin Information
Published: 2025/10/28, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271869 - Linux Distros Unpatched Vulnerability : CVE-2025-40080
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nbd: restrict sockets to TCP and UDP Recently, syzbot started to abuse NBD with all kinds of sockets.
Commit cf1b2326b734 (nbd: verify socket is supported during setup) made sure the socket supported a shutdown() method. Explicitely accept TCP and UNIX stream sockets. (CVE-2025-40080)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40080
https://security-tracker.debian.org/tracker/CVE-2025-40080
https://ubuntu.com/security/CVE-2025-40080

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40080

Plugin Information
Published: 2025/10/28, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271896 - Linux Distros Unpatched Vulnerability : CVE-2025-40081
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() Cast nr_pages to unsigned long to avoid overflow when handling large AUX buffer sizes (>= 2 GiB). (CVE-2025-40081)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40081
https://ubuntu.com/security/CVE-2025-40081

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40081

Plugin Information
Published: 2025/10/28, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
272059 - Linux Distros Unpatched Vulnerability : CVE-2025-40091
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ixgbe: fix too early devlink_free() in ixgbe_remove() Since ixgbe_adapter is embedded in devlink, calling devlink_free() prematurely in the ixgbe_remove() path can lead to UAF. Move devlink_free() to the end.
KASAN report: BUG: KASAN: use-after-free in ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe] Read of size 8 at addr ffff0000adf813e0 by task bash/2095 CPU: 1 UID: 0 PID: 2095 Comm: bash Tainted: G S 6.17.0-rc2-tnguy.net-queue+ #1 PREEMPT(full) [...] Call trace: show_stack+0x30/0x90 (C) dump_stack_lvl+0x9c/0xd0 print_address_description.constprop.0+0x90/0x310 print_report+0x104/0x1f0 kasan_report+0x88/0x180 __asan_report_load8_noabort+0x20/0x30 ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe] ixgbe_clear_interrupt_scheme+0xf8/0x130 [ixgbe] ixgbe_remove+0x2d0/0x8c0 [ixgbe] pci_device_remove+0xa0/0x220 device_remove+0xb8/0x170 device_release_driver_internal+0x318/0x490 device_driver_detach+0x40/0x68 unbind_store+0xec/0x118 drv_attr_store+0x64/0xb8 sysfs_kf_write+0xcc/0x138 kernfs_fop_write_iter+0x294/0x440 new_sync_write+0x1fc/0x588 vfs_write+0x480/0x6a0 ksys_write+0xf0/0x1e0
__arm64_sys_write+0x70/0xc0 invoke_syscall.constprop.0+0xcc/0x280 el0_svc_common.constprop.0+0xa8/0x248 do_el0_svc+0x44/0x68 el0_svc+0x54/0x160 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1b0/0x1b8 (CVE-2025-40091)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40091
https://ubuntu.com/security/CVE-2025-40091

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40091

Plugin Information
Published: 2025/10/30, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
272063 - Linux Distros Unpatched Vulnerability : CVE-2025-40096
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies When adding dependencies with drm_sched_job_add_dependency(), that function consumes the fence reference both on success and failure, so in the latter case the dma_fence_put() on the error path (xarray failed to expand) is a double free.
Interestingly this bug appears to have been present ever since commit ebd5f74255b9 (drm/sched: Add dependency tracking), since the code back then looked like this:
drm_sched_job_add_implicit_dependencies(): ... for (i = 0; i < fence_count; i++) { ret = drm_sched_job_add_dependency(job, fences[i]); if (ret) break; } for (; i < fence_count; i++) dma_fence_put(fences[i]); Which means for the failing 'i' the dma_fence_put was already a double free.
Possibly there were no users at that time, or the test cases were insufficient to hit it. The bug was then only noticed and fixed after commit 9c2ba265352a (drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2) landed, with its fixup of commit 4eaf02d6076c (drm/scheduler: fix drm_sched_job_add_implicit_dependencies). At that point it was a slightly different flavour of a double free, which commit 963d0b356935 (drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder) noticed and attempted to fix. But it only moved the double free from happening inside the drm_sched_job_add_dependency(), when releasing the reference not yet obtained, to the caller, when releasing the reference already released by the former in the failure case.
As such it is not easy to identify the right target for the fixes tag so lets keep it simple and just continue the chain. While fixing we also improve the comment and explain the reason for taking the reference and not dropping it. (CVE-2025-40096)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40096
https://ubuntu.com/security/CVE-2025-40096

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:P)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40096

Plugin Information
Published: 2025/10/30, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
272056 - Linux Distros Unpatched Vulnerability : CVE-2025-40102
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- KVM: arm64: Prevent access to vCPU events before init Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that hasn't been initialized yet, leading to KVM interpreting a bunch of uninitialized garbage for routing / injecting the exception. In one case the injection code and the hyp disagree on whether the vCPU has a 32bit EL1 and put the vCPU into an illegal mode for AArch64, tripping the BUG() in exception_target_el() during the next injection: kernel BUG at arch/arm64/kvm/inject_fault.c:40! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP CPU: 3 UID: 0 PID:
318 Comm: repro Not tainted 6.17.0-rc4-00104-g10fd0285305d #6 PREEMPT Hardware name: linux,dummy-virt (DT) pstate: 21402009 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : exception_target_el+0x88/0x8c lr :
pend_serror_exception+0x18/0x13c sp : ffff800082f03a10 x29: ffff800082f03a10 x28: ffff0000cb132280 x27:
0000000000000000 x26: 0000000000000000 x25: ffff0000c2a99c20 x24: 0000000000000000 x23: 0000000000008000 x22: 0000000000000002 x21: 0000000000000004 x20: 0000000000008000 x19: ffff0000c2a99c20 x18:
0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200000c0 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 :
0000000000000000 x8 : ffff800082f03af8 x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffff800080f621f0 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 000000000040009b x1 : 0000000000000003 x0 :
ffff0000c2a99c20 Call trace: exception_target_el+0x88/0x8c (P) kvm_inject_serror_esr+0x40/0x3b4
__kvm_arm_vcpu_set_events+0xf0/0x100 kvm_arch_vcpu_ioctl+0x180/0x9d4 kvm_vcpu_ioctl+0x60c/0x9f4
__arm64_sys_ioctl+0xac/0x104 invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xf0 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c Code:
f946bc01 b4fffe61 9101e020 17fffff2 (d4210000) Reject the ioctls outright as no sane VMM would call these before KVM_ARM_VCPU_INIT anyway. Even if it did the exception would've been thrown away by the eventual reset of the vCPU's state. (CVE-2025-40102)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40102
https://security-tracker.debian.org/tracker/CVE-2025-40102
https://ubuntu.com/security/CVE-2025-40102

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40102

Plugin Information
Published: 2025/10/30, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275329 - Linux Distros Unpatched Vulnerability : CVE-2025-40110
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper Check that the resource which is converted to a surface exists before trying to use the cursor snooper on it. vmw_cmd_res_check allows explicit invalid (SVGA3D_INVALID_ID) identifiers because some svga commands accept SVGA3D_INVALID_ID to mean no surface, unfortunately functions that accept the actual surfaces as objects might (and in case of the cursor snooper, do not) be able to handle null objects. Make sure that we validate not only the identifier (via the vmw_cmd_res_check) but also check that the actual resource exists before trying to do something with it. Fixes unchecked null-ptr reference in the snooping code. (CVE-2025-40110)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40110
https://security-tracker.debian.org/tracker/CVE-2025-40110
https://ubuntu.com/security/CVE-2025-40110

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40110

Plugin Information
Published: 2025/11/13, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275324 - Linux Distros Unpatched Vulnerability : CVE-2025-40111
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/vmwgfx: Fix Use-after-free in validation Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are expected to be cleared in vmw_validation_drop_ht but this node escaped because its resource was destroyed prematurely.
(CVE-2025-40111)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40111
https://ubuntu.com/security/CVE-2025-40111

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40111

Plugin Information
Published: 2025/11/13, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275234 - Linux Distros Unpatched Vulnerability : CVE-2025-40132
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback In create_sdw_dailink() check that sof_end->codec_info->add_sidecar is not NULL before calling it. The original code assumed that if include_sidecar is true, the codec on that link has an add_sidecar callback. But there could be other codecs on the same link that do not have an add_sidecar callback. (CVE-2025-40132)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40132
https://ubuntu.com/security/CVE-2025-40132

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40132

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275216 - Linux Distros Unpatched Vulnerability : CVE-2025-40135
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipv6: use RCU in ip6_xmit() Use RCU in ip6_xmit() in order to use dst_dev_rcu() to prevent possible UAF.
(CVE-2025-40135)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40135
https://security-tracker.debian.org/tracker/CVE-2025-40135
https://ubuntu.com/security/CVE-2025-40135

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40135

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275182 - Linux Distros Unpatched Vulnerability : CVE-2025-40157
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller When loading the i10nm_edac driver on some Intel Granite Rapids servers, a call trace may appear as follows: UBSAN: shift-out-of-bounds in drivers/edac/skx_common.c:453:16 shift exponent
-66 is negative ... __ubsan_handle_shift_out_of_bounds+0x1e3/0x390 skx_get_dimm_info.cold+0x47/0xd40 [skx_edac_common] i10nm_get_dimm_config+0x23e/0x390 [i10nm_edac] skx_register_mci+0x159/0x220 [skx_edac_common] i10nm_init+0xcb0/0x1ff0 [i10nm_edac] ... This occurs because some BIOS may disable a memory controller if there aren't any memory DIMMs populated on this memory controller. The DIMMMTR register of this disabled memory controller contains the invalid value ~0, resulting in the call trace above. Fix this call trace by skipping DIMM enumeration on a disabled memory controller. (CVE-2025-40157)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40157
https://ubuntu.com/security/CVE-2025-40157

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40157

Plugin Information
Published: 2025/11/12, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275184 - Linux Distros Unpatched Vulnerability : CVE-2025-40158
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipv6: use RCU in ip6_output() Use RCU in ip6_output() in order to use dst_dev_rcu() to prevent possible UAF. We can remove rcu_read_lock()/rcu_read_unlock() pairs from ip6_finish_output2(). (CVE-2025-40158)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40158
https://security-tracker.debian.org/tracker/CVE-2025-40158
https://ubuntu.com/security/CVE-2025-40158

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40158

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275186 - Linux Distros Unpatched Vulnerability : CVE-2025-40159
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xsk: Harden userspace-supplied xdp_desc validation Turned out certain clearly invalid values passed in xdp_desc from userspace can pass xp_{,un}aligned_validate_desc() and then lead to UBs or just invalid frames to be queued for xmit. desc->len close to ``U32_MAX`` with a non-zero pool->tx_metadata_len can cause positive integer overflow and wraparound, the same way low enough desc->addr with a non-zero pool->tx_metadata_len can cause negative integer overflow. Both scenarios can then pass the validation successfully. This doesn't happen with valid XSk applications, but can be used to perform attacks. Always promote desc->len to ``u64`` first to exclude positive overflows of it. Use explicit check_{add,sub}_overflow() when validating desc->addr (which is ``u64`` already). bloat-o-meter reports a little growth of the code size: add/remove: 0/0 grow/shrink: 2/1 up/down: 60/-16 (44) Function old new delta xskq_cons_peek_desc 299 330 +31 xsk_tx_peek_release_desc_batch 973 1002 +29 xsk_generic_xmit 3148 3132 -16 but hopefully this doesn't hurt the performance much. (CVE-2025-40159)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40159
https://ubuntu.com/security/CVE-2025-40159

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40159

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275226 - Linux Distros Unpatched Vulnerability : CVE-2025-40164
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usbnet: Fix using smp_processor_id() in preemptible code warnings Syzbot reported the following warning:
BUG: using smp_processor_id() in preemptible [00000000] code: dhcpcd/2879 caller is usbnet_skb_return+0x74/0x490 drivers/net/usb/usbnet.c:331 CPU: 1 UID: 0 PID: 2879 Comm: dhcpcd Not tainted 6.15.0-rc4-syzkaller-00098-g615dca38c2ea #0 PREEMPT(voluntary) Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 check_preemption_disabled+0xd0/0xe0 lib/smp_processor_id.c:49 usbnet_skb_return+0x74/0x490 drivers/net/usb/usbnet.c:331 usbnet_resume_rx+0x4b/0x170 drivers/net/usb/usbnet.c:708 usbnet_change_mtu+0x1be/0x220 drivers/net/usb/usbnet.c:417 __dev_set_mtu net/core/dev.c:9443 [inline] netif_set_mtu_ext+0x369/0x5c0 net/core/dev.c:9496 netif_set_mtu+0xb0/0x160 net/core/dev.c:9520 dev_set_mtu+0xae/0x170 net/core/dev_api.c:247 dev_ifsioc+0xa31/0x18d0 net/core/dev_ioctl.c:572 dev_ioctl+0x223/0x10e0 net/core/dev_ioctl.c:821 sock_do_ioctl+0x19d/0x280 net/socket.c:1204 sock_ioctl+0x42f/0x6a0 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl fs/ioctl.c:892 [inline] __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f For historical and portability reasons, the netif_rx() is usually run in the softirq or interrupt context, this commit therefore add local_bh_disable/enable() protection in the usbnet_resume_rx(). (CVE-2025-40164)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40164
https://security-tracker.debian.org/tracker/CVE-2025-40164
https://ubuntu.com/security/CVE-2025-40164

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40164

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275183 - Linux Distros Unpatched Vulnerability : CVE-2025-40170
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: use dst_dev_rcu() in sk_setup_caps() Use RCU to protect accesses to dst->dev from sk_setup_caps() and sk_dst_gso_max_size(). Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(), and ip_dst_mtu_maybe_forward(). ip4_dst_hoplimit() can use dst_dev_net_rcu(). (CVE-2025-40170)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40170
https://security-tracker.debian.org/tracker/CVE-2025-40170
https://ubuntu.com/security/CVE-2025-40170

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40170

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275188 - Linux Distros Unpatched Vulnerability : CVE-2025-40171
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op It's possible for more than one async command to be in flight from __nvmet_fc_send_ls_req. For each command, a tgtport reference is taken. In the current code, only one put work item is queued at a time, which results in a leaked reference. To fix this, move the work item to the nvmet_fc_ls_req_op struct, which already tracks all resources related to the command.
(CVE-2025-40171)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40171
https://ubuntu.com/security/CVE-2025-40171

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40171

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275354 - Linux Distros Unpatched Vulnerability : CVE-2025-40181
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP When running as an SNP or TDX guest under KVM, force the legacy PCI hole, i.e. memory between Top of Lower Usable DRAM and 4GiB, to be mapped as UC via a forced variable MTRR range. In most KVM-based setups, legacy devices such as the HPET and TPM are enumerated via ACPI. ACPI enumeration includes a Memory32Fixed entry, and optionally a SystemMemory descriptor for an OperationRegion, e.g. if the device needs to be accessed via a Control Method. If a SystemMemory entry is present, then the kernel's ACPI driver will auto-ioremap the region so that it can be accessed at will. However, the ACPI spec doesn't provide a way to enumerate the memory type of SystemMemory regions, i.e. there's no way to tell software that a region must be mapped as UC vs. WB, etc.
As a result, Linux's ACPI driver always maps SystemMemory regions using ioremap_cache(), i.e. as WB on x86. The dedicated device drivers however, e.g. the HPET driver and TPM driver, want to map their associated memory as UC or WC, as accessing PCI devices using WB is unsupported. On bare metal and non- CoCO, the conflicting requirements work as firmware configures the PCI hole (and other device memory) to be UC in the MTRRs. So even though the ACPI mappings request WB, they are forced to UC- in the kernel's tracking due to the kernel properly handling the MTRR overrides, and thus are compatible with the drivers'
requested WC/UC-. With force WB MTRRs on SNP and TDX guests, the ACPI mappings get their requested WB if the ACPI mappings are established before the dedicated driver code attempts to initialize the device. E.g.
if acpi_init() runs before the corresponding device driver is probed, ACPI's WB mapping will win, and result in the driver's ioremap() failing because the existing WB mapping isn't compatible with the requested WC/UC-. E.g. when a TPM is emulated by the hypervisor (ignoring the security implications of relying on what is allegedly an untrusted entity to store measurements), the TPM driver will request UC and fail: [ 1.730459] ioremap error for 0xfed40000-0xfed45000, requested 0x2, got 0x0 [ 1.732780] tpm_tis MSFT0101:00: probe with driver tpm_tis failed with error -12 Note, the '0x2' and '0x0' values refer to enum page_cache_mode, not x86's memtypes (which frustratingly are an almost pure inversion; 2 == WB, 0 == UC). E.g. tracing mapping requests for TPM TIS yields: Mapping TPM TIS with req_type = 0 WARNING: CPU:
22 PID: 1 at arch/x86/mm/pat/memtype.c:530 memtype_reserve+0x2ab/0x460 Modules linked in: CPU: 22 UID: 0 PID: 1 Comm: swapper/0 Tainted: G W 6.16.0-rc7+ #2 VOLUNTARY Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/29/2025 RIP: 0010:memtype_reserve+0x2ab/0x460
__ioremap_caller+0x16d/0x3d0 ioremap_cache+0x17/0x30 x86_acpi_os_ioremap+0xe/0x20 acpi_os_map_iomem+0x1f3/0x240 acpi_os_map_memory+0xe/0x20 acpi_ex_system_memory_space_handler+0x273/0x440 acpi_ev_address_space_dispatch+0x176/0x4c0 acpi_ex_access_region+0x2ad/0x530 acpi_ex_field_datum_io+0xa2/0x4f0 acpi_ex_extract_from_field+0x296/0x3e0 acpi_ex_read_data_from_field+0xd1/0x460 acpi_ex_resolve_node_to_value+0x2ee/0x530 acpi_ex_resolve_to_value+0x1f2/0x540 acpi_ds_evaluate_name_path+0x11b/0x190 acpi_ds_exec_end_op+0x456/0x960 acpi_ps_parse_loop+0x27a/0xa50 acpi_ps_parse_aml+0x226/0x600 acpi_ps_execute_method+0x172/0x3e0 acpi_ns_evaluate+0x175/0x5f0 acpi_evaluate_object+0x213/0x490 acpi_evaluate_integer+0x6d/0x140 acpi_bus_get_status+0x93/0x150 acpi_add_single_object+0x43a/0x7c0 acpi_bus_check_add+0x149/0x3a0 acpi_bus_check_add_1+0x16/0x30 acpi_ns_walk_namespace+0x22c/0x360 acpi_walk_namespace+0x15c/0x170 acpi_bus_scan+0x1dd/0x200 acpi_scan_init+0xe5/0x2b0 acpi_init+0x264/0x5b0 do_one_i ---truncated--- (CVE-2025-40181)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40181
https://ubuntu.com/security/CVE-2025-40181

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40181

Plugin Information
Published: 2025/11/13, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275333 - Linux Distros Unpatched Vulnerability : CVE-2025-40186
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat below in tcp_conn_request(). [0] If a listener is close()d while a TFO socket is being processed in tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk and calls inet_child_forget(), which calls tcp_disconnect() for the TFO socket. After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), where reqsk_put() is called due to !reqsk->sk. Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the drop_and_free label causes the refcount underflow for the listener and double-free of the reqsk. Let's remove reqsk_fastopen_remove() in tcp_conn_request(). Note that other callers make sure tp->fastopen_rsk is not NULL. [0]: refcount_t: underflow; use-after-free. WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) Modules linked in: CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f>
0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246 RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 RDX: 0000000000000000 RSI:
00000000ffff7fff RDI: ffffffffac78a280 RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280 R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 R13: ffff9f65c7d23c00 R14:
ffff9f65c7d26000 R15: ffff9f65c7a64ef8 FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000180 CR3:
000000000dbbe006 CR4: 0000000000372ef0 Call Trace: <IRQ> tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) tcp_rcv_state_process (net/ipv4/tcp_input.c:6708) tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) ip6_input (net/ipv6/ip6_input.c:500) ipv6_rcv (net/ipv6/ip6_input.c:311) __netif_receive_skb (net/core/dev.c:6104) process_backlog (net/core/dev.c:6456)
__napi_poll (net/core/dev.c:7506) net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) handle_softirqs (kernel/softirq.c:579) do_softirq (kernel/softirq.c:480) </IRQ> (CVE-2025-40186)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40186
https://ubuntu.com/security/CVE-2025-40186

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40186

Plugin Information
Published: 2025/11/13, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275359 - Linux Distros Unpatched Vulnerability : CVE-2025-40190
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: guard against EA inode refcount underflow in xattr update syzkaller found a path where ext4_xattr_inode_update_ref() reads an EA inode refcount that is already <= 0 and then applies ref_change (often -1). That lets the refcount underflow and we proceed with a bogus value, triggering errors like:
EXT4-fs error: EA inode <n> ref underflow: ref_count=-1 ref_change=-1 EXT4-fs warning: ea_inode dec ref err=-117 Make the invariant explicit: if the current refcount is non-positive, treat this as on-disk corruption, emit ext4_error_inode(), and fail the operation with -EFSCORRUPTED instead of updating the refcount. Delete the WARN_ONCE() as negative refcounts are now impossible; keep error reporting in ext4_error_inode(). This prevents the underflow and the follow-on orphan/cleanup churn. (CVE-2025-40190)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40190
https://ubuntu.com/security/CVE-2025-40190

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40190

Plugin Information
Published: 2025/11/13, Modified: 2025/12/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275363 - Linux Distros Unpatched Vulnerability : CVE-2025-40198
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() Unlike other strings in the ext4 superblock, we rely on tune2fs to make sure s_mount_opts is NUL terminated. Harden parse_apply_sb_mount_options() by treating s_mount_opts as a potential __nonstring. (CVE-2025-40198)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40198
https://ubuntu.com/security/CVE-2025-40198

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40198

Plugin Information
Published: 2025/11/13, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275366 - Linux Distros Unpatched Vulnerability : CVE-2025-40204
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sctp: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this. (CVE-2025-40204)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40204
https://ubuntu.com/security/CVE-2025-40204

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40204

Plugin Information
Published: 2025/11/13, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
276576 - Linux Distros Unpatched Vulnerability : CVE-2025-40211
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() The switch_brightness_work delayed work accesses device->brightness and device->backlight, freed by acpi_video_dev_unregister_backlight() during device removal. If the work executes after acpi_video_bus_unregister_backlight() frees these resources, it causes a use-after-free when acpi_video_switch_brightness() dereferences device->brightness or device->backlight. Fix this by calling cancel_delayed_work_sync() for each device's switch_brightness_work in acpi_video_bus_remove_notify_handler() after removing the notify handler that queues the work. This ensures the work completes before the memory is freed. [ rjw: Changelog edit ] (CVE-2025-40211)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40211
https://security-tracker.debian.org/tracker/CVE-2025-40211
https://ubuntu.com/security/CVE-2025-40211

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40211

Plugin Information
Published: 2025/11/22, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277494 - Linux Distros Unpatched Vulnerability : CVE-2025-40240
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sctp: avoid NULL dereference when chunk data buffer is missing chunk->skb pointer is dereferenced in the if-block where it's supposed to be NULL only. chunk->skb can only be NULL if chunk->head_skb is not. Check for frag_list instead and do it just before replacing chunk->skb. We're sure that otherwise chunk->skb is non-NULL because of outer if() condition. (CVE-2025-40240)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40240
https://ubuntu.com/security/CVE-2025-40240

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
8.6 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
CVSS v3.0 Temporal Score
7.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.5
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40240

Plugin Information
Published: 2025/12/04, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277507 - Linux Distros Unpatched Vulnerability : CVE-2025-40258
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount on sk->sk_refcnt if the work was scheduled. This refcount will be released by mptcp_worker(). [A] if (schedule_work(...)) { [B] sock_hold(sk); return true; } Problem is that mptcp_worker() can run immediately and complete before [B] We need instead : sock_hold(sk); if (schedule_work(...)) return true; sock_put(sk); [1] refcount_t:
addition on 0; use-after-free. WARNING: CPU: 1 PID: 29 at lib/refcount.c:25 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25 Call Trace: <TASK> __refcount_add include/linux/refcount.h:-1 [inline] __refcount_inc include/linux/refcount.h:366 [inline] refcount_inc include/linux/refcount.h:383 [inline] sock_hold include/net/sock.h:816 [inline] mptcp_schedule_work+0x164/0x1a0 net/mptcp/protocol.c:943 mptcp_tout_timer+0x21/0xa0 net/mptcp/protocol.c:2316 call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747 expire_timers kernel/time/timer.c:1798 [inline] __run_timers kernel/time/timer.c:2372 [inline]
__run_timer_base+0x648/0x970 kernel/time/timer.c:2384 run_timer_base kernel/time/timer.c:2393 [inline] run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403 handle_softirqs+0x22f/0x710 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0xcf/0x190 kernel/softirq.c:1138 smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 (CVE-2025-40258)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40258
https://security-tracker.debian.org/tracker/CVE-2025-40258
https://ubuntu.com/security/CVE-2025-40258

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40258

Plugin Information
Published: 2025/12/04, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277698 - Linux Distros Unpatched Vulnerability : CVE-2025-40271
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the erased node to EMPTY, then pde_subdir_next() will return NULL to avoid uaf access. We found an uaf issue while using stress-ng testing, need to run testcase getdent and tun in the same time. The steps of the issue is as follows: 1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current pde is tun3; 2) in the [time windows] unregister netdevice tun3 and tun2, and erase them from rbtree. erase tun3 first, and then erase tun2. the pde(tun2) will be released to slab; 3) continue to getdent process, then pde_subdir_next() will return pde(tun2) which is released, it will case uaf access. CPU 0 | CPU 1
------------------------------------------------------------------------- traverse dir /proc/pid/net/dev_snmp6/ | unregister_netdevice(tun->dev) //tun3 tun2 sys_getdents64() | iterate_dir() | proc_readdir() | proc_readdir_de() | snmp6_unregister_dev() pde_get(de); | proc_remove() read_unlock(&proc_subdir_lock); | remove_proc_subtree() | write_lock(&proc_subdir_lock); [time window] | rb_erase(&root->subdir_node, &parent->subdir); | write_unlock(&proc_subdir_lock);
read_lock(&proc_subdir_lock); | next = pde_subdir_next(de); | pde_put(de); | de = next; //UAF | rbtree of dev_snmp6 | pde(tun3) / \ NULL pde(tun2) (CVE-2025-40271)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40271
https://security-tracker.debian.org/tracker/CVE-2025-40271
https://ubuntu.com/security/CVE-2025-40271

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40271

Plugin Information
Published: 2025/12/08, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277661 - Linux Distros Unpatched Vulnerability : CVE-2025-40272
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm/secretmem: fix use-after-free race in fault handler When a page fault occurs in a secret memory file created with `memfd_secret(2)`, the kernel will allocate a new folio for it, mark the underlying page as not-present in the direct map, and add it to the file mapping. If two tasks cause a fault in the same page concurrently, both could end up allocating a folio and removing the page from the direct map, but only one would succeed in adding the folio to the file mapping. The task that failed undoes the effects of its attempt by (a) freeing the folio again and (b) putting the page back into the direct map. However, by doing these two operations in this order, the page becomes available to the allocator again before it is placed back in the direct mapping. If another task attempts to allocate the page between (a) and (b), and the kernel tries to access it via the direct map, it would result in a supervisor not-present page fault.
Fix the ordering to restore the direct map before the folio is freed. (CVE-2025-40272)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40272
https://security-tracker.debian.org/tracker/CVE-2025-40272
https://ubuntu.com/security/CVE-2025-40272

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40272

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277694 - Linux Distros Unpatched Vulnerability : CVE-2025-40273
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NFSD: free copynotify stateid in nfs4_free_ol_stateid() Typically copynotify stateid is freed either when parent's stateid is being close/freed or in nfsd4_laundromat if the stateid hasn't been used in a lease period. However, in case when the server got an OPEN (which created a parent stateid), followed by a COPY_NOTIFY using that stateid, followed by a client reboot. New client instance while doing CREATE_SESSION would force expire previous state of this client. It leads to the open state being freed thru release_openowner-> nfs4_free_ol_stateid() and it finds that it still has copynotify stateid associated with it. We currently print a warning and is triggerred WARNING: CPU: 1 PID: 8858 at fs/nfsd/nfs4state.c:1550 nfs4_free_ol_stateid+0xb0/0x100 [nfsd] This patch, instead, frees the associated copynotify stateid here. If the parent stateid is freed (without freeing the copynotify stateids associated with it), it leads to the list corruption when laundromat ends up freeing the copynotify state later. [ 1626.839430] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 1626.842828] Modules linked in: nfnetlink_queue nfnetlink_log bluetooth cfg80211 rpcrdma rdma_cm iw_cm ib_cm ib_core nfsd nfs_acl lockd grace nfs_localio ext4 crc16 mbcache jbd2 overlay uinput snd_seq_dummy snd_hrtimer qrtr rfkill vfat fat uvcvideo snd_hda_codec_generic videobuf2_vmalloc videobuf2_memops snd_hda_intel uvc snd_intel_dspcfg videobuf2_v4l2 videobuf2_common snd_hda_codec snd_hda_core videodev snd_hwdep snd_seq mc snd_seq_device snd_pcm snd_timer snd soundcore sg loop auth_rpcgss vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs 8021q garp stp llc mrp nvme ghash_ce e1000e nvme_core sr_mod nvme_keyring nvme_auth cdrom vmwgfx drm_ttm_helper ttm sunrpc dm_mirror dm_region_hash dm_log iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi fuse dm_multipath dm_mod nfnetlink [ 1626.855594] CPU: 2 UID: 0 PID: 199 Comm: kworker/u24:33 Kdump: loaded Tainted: G B W 6.17.0-rc7+ #22 PREEMPT(voluntary) [ 1626.857075] Tainted: [B]=BAD_PAGE, [W]=WARN [ 1626.857573] Hardware name: VMware, Inc. VMware20,1/VBSA, BIOS VMW201.00V.24006586.BA64.2406042154 06/04/2024 [ 1626.858724] Workqueue: nfsd4 laundromat_main [nfsd] [ 1626.859304] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 1626.860010] pc :
__list_del_entry_valid_or_report+0x148/0x200 [ 1626.860601] lr :
__list_del_entry_valid_or_report+0x148/0x200 [ 1626.861182] sp : ffff8000881d7a40 [ 1626.861521] x29:
ffff8000881d7a40 x28: 0000000000000018 x27: ffff0000c2a98200 [ 1626.862260] x26: 0000000000000600 x25:
0000000000000000 x24: ffff8000881d7b20 [ 1626.862986] x23: ffff0000c2a981e8 x22: 1fffe00012410e7d x21:
ffff0000920873e8 [ 1626.863701] x20: ffff0000920873e8 x19: ffff000086f22998 x18: 0000000000000000 [ 1626.864421] x17: 20747562202c3839 x16: 3932326636383030 x15: 3030666666662065 [ 1626.865092] x14:
6220646c756f6873 x13: 0000000000000001 x12: ffff60004fd9e4a3 [ 1626.865713] x11: 1fffe0004fd9e4a2 x10:
ffff60004fd9e4a2 x9 : dfff800000000000 [ 1626.866320] x8 : 00009fffb0261b5e x7 : ffff00027ecf2513 x6 :
0000000000000001 [ 1626.866938] x5 : ffff00027ecf2510 x4 : ffff60004fd9e4a3 x3 : 0000000000000000 [ 1626.867553] x2 : 0000000000000000 x1 : ffff000096069640 x0 : 000000000000006d [ 1626.868167] Call trace:
[ 1626.868382] __list_del_entry_valid_or_report+0x148/0x200 (P) [ 1626.868876]
_free_cpntf_state_locked+0xd0/0x268 [nfsd] [ 1626.869368] nfs4_laundromat+0x6f8/0x1058 [nfsd] [ 1626.869813] laundromat_main+0x24/0x60 [nfsd] [ 1626.870231] process_one_work+0x584/0x1050 [ 1626.870595] worker_thread+0x4c4/0xc60 [ 1626.870893] kthread+0x2f8/0x398 [ 1626.871146] ret_from_fork+0x10/0x20 [ 1626.871422] Code: aa1303e1 aa1403e3 910e8000 97bc55d7 (d4210000) [ 1626.871892] SMP: stopping secondary CPUs (CVE-2025-40273)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40273
https://security-tracker.debian.org/tracker/CVE-2025-40273
https://ubuntu.com/security/CVE-2025-40273

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40273

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277680 - Linux Distros Unpatched Vulnerability : CVE-2025-40277
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE This data originates from userspace and is used in buffer offset calculations which could potentially overflow causing an out-of-bounds access. (CVE-2025-40277)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40277
https://security-tracker.debian.org/tracker/CVE-2025-40277
https://ubuntu.com/security/CVE-2025-40277

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.3
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40277

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277686 - Linux Distros Unpatched Vulnerability : CVE-2025-40280
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tipc: Fix use-after-free in tipc_mon_reinit_self(). syzbot reported use-after-free of tipc_net(net)->monitors[] in tipc_mon_reinit_self(). [0] The array is protected by RTNL, but tipc_mon_reinit_self() iterates over it without RTNL. tipc_mon_reinit_self() is called from tipc_net_finalize(), which is always under RTNL except for tipc_net_finalize_work(). Let's hold RTNL in tipc_net_finalize_work(). [0]: BUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] BUG: KASAN: slab-use-after-free in
_raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162 Read of size 1 at addr ffff88805eae1030 by task kworker/0:7/5989 CPU: 0 UID: 0 PID: 5989 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 Workqueue: events tipc_net_finalize_work Call Trace: <TASK> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 __kasan_check_byte+0x2a/0x40 mm/kasan/common.c:568 kasan_check_byte include/linux/kasan.h:399 [inline] lock_acquire+0x8d/0x360 kernel/locking/lockdep.c:5842 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162 rtlock_slowlock kernel/locking/rtmutex.c:1894 [inline] rwbase_rtmutex_lock_state kernel/locking/spinlock_rt.c:160 [inline] rwbase_write_lock+0xd3/0x7e0 kernel/locking/rwbase_rt.c:244 rt_write_lock+0x76/0x110 kernel/locking/spinlock_rt.c:243 write_lock_bh include/linux/rwlock_rt.h:99 [inline] tipc_mon_reinit_self+0x79/0x430 net/tipc/monitor.c:718 tipc_net_finalize+0x115/0x190 net/tipc/net.c:140 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x439/0x7d0 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Allocated by task 6089: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x1a8/0x320 mm/slub.c:4407 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] tipc_mon_create+0xc3/0x4d0 net/tipc/monitor.c:657 tipc_enable_bearer net/tipc/bearer.c:357 [inline] __tipc_nl_bearer_enable+0xe16/0x13f0 net/tipc/bearer.c:1047 __tipc_nl_compat_doit net/tipc/netlink_compat.c:371 [inline] tipc_nl_compat_doit+0x3bc/0x5f0 net/tipc/netlink_compat.c:393 tipc_nl_compat_handle net/tipc/netlink_compat.c:-1 [inline] tipc_nl_compat_recv+0x83c/0xbe0 net/tipc/netlink_compat.c:1321 genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:729 ____sys_sendmsg+0x508/0x820 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg net/socket.c:2700 [inline]
__do_sys_sendmsg net/socket.c:2705 [inline] __se_sys_sendmsg net/socket.c:2703 [inline]
__x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2703 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/ ---truncated--- (CVE-2025-40280)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40280
https://security-tracker.debian.org/tracker/CVE-2025-40280
https://ubuntu.com/security/CVE-2025-40280

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40280

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277727 - Linux Distros Unpatched Vulnerability : CVE-2025-40281
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto syzbot reported a possible shift- out-of-bounds [1] Blamed commit added rto_alpha_max and rto_beta_max set to 1000. It is unclear if some sctp users are setting very large rto_alpha and/or rto_beta. In order to prevent user regression, perform the test at run time. Also add READ_ONCE() annotations as sysctl values can change under us. [1] UBSAN:
shift-out-of-bounds in net/sctp/transport.c:509:41 shift exponent 64 is too large for 32-bit type 'unsigned int' CPU: 0 UID: 0 PID: 16704 Comm: syz.2.2320 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Call Trace: <TASK>
__dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:233 [inline] __ubsan_handle_shift_out_of_bounds+0x27f/0x420 lib/ubsan.c:494 sctp_transport_update_rto.cold+0x1c/0x34b net/sctp/transport.c:509 sctp_check_transmitted+0x11c4/0x1c30 net/sctp/outqueue.c:1502 sctp_outq_sack+0x4ef/0x1b20 net/sctp/outqueue.c:1338 sctp_cmd_process_sack net/sctp/sm_sideeffect.c:840 [inline] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1372 [inline] (CVE-2025-40281)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40281
https://security-tracker.debian.org/tracker/CVE-2025-40281
https://ubuntu.com/security/CVE-2025-40281

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40281

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277679 - Linux Distros Unpatched Vulnerability : CVE-2025-40283
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF There is a KASAN: slab-use-after-free read in btusb_disconnect(). Calling usb_driver_release_interface(&btusb_driver, data->intf) will free the btusb data associated with the interface. The same data is then used later in the function, hence the UAF. Fix by moving the accesses to btusb data to before the data is free'd. (CVE-2025-40283)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40283
https://security-tracker.debian.org/tracker/CVE-2025-40283
https://ubuntu.com/security/CVE-2025-40283

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40283

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277631 - Linux Distros Unpatched Vulnerability : CVE-2025-40292
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- virtio-net: fix received length check in big packets Since commit 4959aebba8c0 (virtio-net: use mtu size as buffer length for big packets), when guest gso is off, the allocated size for big packets is not MAX_SKB_FRAGS * PAGE_SIZE anymore but depends on negotiated MTU. The number of allocated frags for big packets is stored in vi->big_packets_num_skbfrags. Because the host announced buffer length can be malicious (e.g. the host vhost_net driver's get_rx_bufs is modified to announce incorrect length), we need a check in virtio_net receive path. Currently, the check is not adapted to the new change which can lead to NULL page pointer dereference in the below while loop when receiving length that is larger than the allocated one. This commit fixes the received length check corresponding to the new change.
(CVE-2025-40292)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40292
https://security-tracker.debian.org/tracker/CVE-2025-40292
https://ubuntu.com/security/CVE-2025-40292

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40292

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277703 - Linux Distros Unpatched Vulnerability : CVE-2025-40297
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: bridge: fix use-after-free due to MST port state bypass syzbot reported[1] a use-after-free when deleting an expired fdb. It is due to a race condition between learning still happening and a port being deleted, after all its fdbs have been flushed. The port's state has been toggled to disabled so no learning should happen at that time, but if we have MST enabled, it will bypass the port's state, that together with VLAN filtering disabled can lead to fdb learning at a time when it shouldn't happen while the port is being deleted. VLAN filtering must be disabled because we flush the port VLANs when it's being deleted which will stop learning. This fix adds a check for the port's vlan group which is initialized to NULL when the port is getting deleted, that avoids the port state bypass. When MST is enabled there would be a minimal new overhead in the fast-path because the port's vlan group pointer is cache-hot. [1] https://syzkaller.appspot.com/bug?extid=dd280197f0f7ab3917be (CVE-2025-40297)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40297
https://security-tracker.debian.org/tracker/CVE-2025-40297
https://ubuntu.com/security/CVE-2025-40297

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:M/Au:N/C:C/I:P/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40297

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277678 - Linux Distros Unpatched Vulnerability : CVE-2025-40302
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- media: videobuf2: forbid remove_bufs when legacy fileio is active vb2_ioctl_remove_bufs() call manipulates queue internal buffer list, potentially overwriting some pointers used by the legacy fileio access mode.
Forbid that ioctl when fileio is active to protect internal queue state between subsequent read/write calls. (CVE-2025-40302)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40302
https://security-tracker.debian.org/tracker/CVE-2025-40302
https://ubuntu.com/security/CVE-2025-40302

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40302

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277689 - Linux Distros Unpatched Vulnerability : CVE-2025-40319
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Sync pending IRQ work before freeing ring buffer Fix a race where irq_work can be queued in bpf_ringbuf_commit() but the ring buffer is freed before the work executes. In the syzbot reproducer, a BPF program attached to sched_switch triggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer is freed before this work executes, the irq_work thread may accesses freed memory. Calling `irq_work_sync(&rb->work)` ensures that all pending irq_work complete before freeing the buffer.
(CVE-2025-40319)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40319
https://security-tracker.debian.org/tracker/CVE-2025-40319
https://ubuntu.com/security/CVE-2025-40319

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40319

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277718 - Linux Distros Unpatched Vulnerability : CVE-2025-40320
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smb: client: fix potential cfid UAF in smb2_query_info_compound When smb2_query_info_compound() retries, a previously allocated cfid may have been freed in the first attempt. Because cfid wasn't reset on replay, later cleanup could act on a stale pointer, leading to a potential use-after-free. Reinitialize cfid to NULL under the replay label. Example trace (trimmed): refcount_t: underflow; use-after-free. WARNING: CPU:
1 PID: 11224 at ../lib/refcount.c:28 refcount_warn_saturate+0x9c/0x110 [...] RIP:
0010:refcount_warn_saturate+0x9c/0x110 [...] Call Trace: <TASK> smb2_query_info_compound+0x29c/0x5c0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] ? step_into+0x10d/0x690 ? __legitimize_path+0x28/0x60 smb2_queryfs+0x6a/0xf0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] smb311_queryfs+0x12d/0x140 [cifs f90b72658819bd21c94769b6a652029a07a7172f] ? kmem_cache_alloc+0x18a/0x340 ? getname_flags+0x46/0x1e0 cifs_statfs+0x9f/0x2b0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] statfs_by_dentry+0x67/0x90 vfs_statfs+0x16/0xd0 user_statfs+0x54/0xa0 __do_sys_statfs+0x20/0x50 do_syscall_64+0x58/0x80 (CVE-2025-40320)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40320
https://security-tracker.debian.org/tracker/CVE-2025-40320
https://ubuntu.com/security/CVE-2025-40320

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40320

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277658 - Linux Distros Unpatched Vulnerability : CVE-2025-40322
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fbdev: bitblit: bound-check glyph index in bit_putcs* bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and read past the end of the built-in font array. Clamp the index to the actual glyph count before computing the address. This fixes a global out-of-bounds read reported by syzbot. (CVE-2025-40322)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40322
https://security-tracker.debian.org/tracker/CVE-2025-40322
https://ubuntu.com/security/CVE-2025-40322

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0001
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40322

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277878 - Linux Distros Unpatched Vulnerability : CVE-2025-40328
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smb: client: fix potential UAF in smb2_close_cached_fid() find_or_create_cached_dir() could grab a new reference after kref_put() had seen the refcount drop to zero but before cfid_list_lock is acquired in smb2_close_cached_fid(), leading to use-after-free. Switch to kref_put_lock() so cfid_release() is called with cfid_list_lock held, closing that gap. (CVE-2025-40328)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40328
https://security-tracker.debian.org/tracker/CVE-2025-40328
https://ubuntu.com/security/CVE-2025-40328

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40328

Plugin Information
Published: 2025/12/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277835 - Linux Distros Unpatched Vulnerability : CVE-2025-40331
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sctp: Prevent TOCTOU out-of-bounds write For the following path not holding the sock lock, sctp_diag_dump() -> sctp_for_each_endpoint() -> sctp_ep_dump() make sure not to exceed bounds in case the address list has grown between buffer allocation (time-of-check) and write (time-of-use). (CVE-2025-40331)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40331
https://security-tracker.debian.org/tracker/CVE-2025-40331
https://ubuntu.com/security/CVE-2025-40331

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40331

Plugin Information
Published: 2025/12/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277853 - Linux Distros Unpatched Vulnerability : CVE-2025-40336
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/gpusvm: fix hmm_pfn_to_map_order() usage Handle the case where the hmm range partially covers a huge page (like 2M), otherwise we can potentially end up doing something nasty like mapping memory which is outside the range, and maybe not even mapped by the mm. Fix is based on the xe userptr code, which in a future patch will directly use gpusvm, so needs alignment here. v2: - Add kernel-doc (Matt B) - s/fls/ilog2/ (Thomas) (CVE-2025-40336)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40336
https://ubuntu.com/security/CVE-2025-40336

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40336

Plugin Information
Published: 2025/12/09, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277832 - Linux Distros Unpatched Vulnerability : CVE-2025-40338
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ASoC: Intel: avs: Do not share the name pointer between components By sharing 'name' directly, tearing down components may lead to use-after-free errors. Duplicate the name to avoid that. At the same time, update the order of operations - since commit cee28113db17 (ASoC: dmaengine_pcm: Allow passing component name via config) the framework does not override component->name if set before invoking the initializer.
(CVE-2025-40338)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40338
https://security-tracker.debian.org/tracker/CVE-2025-40338
https://ubuntu.com/security/CVE-2025-40338

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40338

Plugin Information
Published: 2025/12/09, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277836 - Linux Distros Unpatched Vulnerability : CVE-2025-40343
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nvmet-fc: avoid scheduling association deletion twice When forcefully shutting down a port via the configfs interface, nvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and then nvmet_disable_port(). Both functions will eventually schedule all remaining associations for deletion. The current implementation checks whether an association is about to be removed, but only after the work item has already been scheduled. As a result, it is possible for the first scheduled work item to free all resources, and then for the same work item to be scheduled again for deletion. Because the association list is an RCU list, it is not possible to take a lock and remove the list entry directly, so it cannot be looked up again. Instead, a flag (terminating) must be used to determine whether the association is already in the process of being deleted. (CVE-2025-40343)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40343
https://security-tracker.debian.org/tracker/CVE-2025-40343
https://ubuntu.com/security/CVE-2025-40343

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40343

Plugin Information
Published: 2025/12/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278574 - Linux Distros Unpatched Vulnerability : CVE-2025-40345
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: storage: sddr55: Reject out-of-bound new_pba Discovered by Atuin - Automated Vulnerability Discovery Engine. new_pba comes from the status packet returned after each write. A bogus device could report values beyond the block count derived from info->capacity, letting the driver walk off the end of pba_to_lba[] and corrupt heap memory. Reject PBAs that exceed the computed block count and fail the transfer so we avoid touching out-of-range mapping entries. (CVE-2025-40345)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40345
https://security-tracker.debian.org/tracker/CVE-2025-40345
https://ubuntu.com/security/CVE-2025-40345

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40345

Plugin Information
Published: 2025/12/12, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278897 - Linux Distros Unpatched Vulnerability : CVE-2025-40359
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- perf/x86/intel: Fix KASAN global-out-of-bounds warning When running perf mem record command on CWF, the below KASAN global-out-of-bounds warning is seen.
================================================================== BUG: KASAN: global-out-of-bounds in cmt_latency_data+0x176/0x1b0 Read of size 4 at addr ffffffffb721d000 by task dtlb/9850 Call Trace:
kasan_report+0xb8/0xf0 cmt_latency_data+0x176/0x1b0 setup_arch_pebs_sample_data+0xf49/0x2560 intel_pmu_drain_arch_pebs+0x577/0xb00 handle_pmi_common+0x6c4/0xc80 The issue is caused by below code in
__grt_latency_data(). The code tries to access x86_hybrid_pmu structure which doesn't exist on non-hybrid platform like CWF. WARN_ON_ONCE(hybrid_pmu(event->pmu)->pmu_type == hybrid_big) So add is_hybrid() check before calling this WARN_ON_ONCE to fix the global-out-of-bounds access issue. (CVE-2025-40359)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40359
https://security-tracker.debian.org/tracker/CVE-2025-40359
https://ubuntu.com/security/CVE-2025-40359

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40359

Plugin Information
Published: 2025/12/16, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278831 - Linux Distros Unpatched Vulnerability : CVE-2025-40362
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ceph: fix multifs mds auth caps issue The mds auth caps check should also validate the fsname along with the associated caps. Not doing so would result in applying the mds auth caps of one fs on to the other fs in a multifs ceph cluster. The bug causes multiple issues w.r.t user authentication, following is one such example. Steps to Reproduce (on vstart cluster): 1. Create two file systems in a cluster, say 'fsname1'
and 'fsname2' 2. Authorize read only permission to the user 'client.usr' on fs 'fsname1' $ceph fs authorize fsname1 client.usr / r 3. Authorize read and write permission to the same user 'client.usr' on fs 'fsname2' $ceph fs authorize fsname2 client.usr / rw 4. Update the keyring $ceph auth get client.usr >>
./keyring With above permssions for the user 'client.usr', following is the expectation. a. The 'client.usr' should be able to only read the contents and not allowed to create or delete files on file system 'fsname1'. b. The 'client.usr' should be able to read/write on file system 'fsname2'. But, with this bug, the 'client.usr' is allowed to read/write on file system 'fsname1'. See below. 5. Mount the file system 'fsname1' with the user 'client.usr' $sudo bin/mount.ceph usr@.fsname1=/ /kmnt_fsname1_usr/ 6. Try creating a file on file system 'fsname1' with user 'client.usr'. This should fail but passes with this bug. $touch /kmnt_fsname1_usr/file1 7. Mount the file system 'fsname1' with the user 'client.admin' and create a file. $sudo bin/mount.ceph admin@.fsname1=/ /kmnt_fsname1_admin $echo data >
/kmnt_fsname1_admin/admin_file1 8. Try removing an existing file on file system 'fsname1' with the user 'client.usr'. This shoudn't succeed but succeeds with the bug. $rm -f /kmnt_fsname1_usr/admin_file1 For more information, please take a look at the corresponding mds/fuse patch and tests added by looking into the tracker mentioned below. v2: Fix a possible null dereference in doutc v3: Don't store fsname from mdsmap, validate against ceph_mount_options's fsname and use it v4: Code refactor, better warning message and fix possible compiler warning [ Slava.Dubeyko: fsname check failed -> fsname mismatch ] (CVE-2025-40362)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40362
https://security-tracker.debian.org/tracker/CVE-2025-40362
https://ubuntu.com/security/CVE-2025-40362

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.4
EPSS Score
0.0004
CVSS v2.0 Base Score
6.0 (CVSS2#AV:L/AC:M/Au:S/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40362

Plugin Information
Published: 2025/12/16, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
276569 - Linux Distros Unpatched Vulnerability : CVE-2025-43419
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The issue was addressed with improved memory handling. This issue is fixed in Safari 26, tvOS 26, watchOS 26, iOS 26 and iPadOS 26, visionOS 26. Processing maliciously crafted web content may lead to memory corruption. (CVE-2025-43419)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-43419
https://security-tracker.debian.org/tracker/CVE-2025-43419
https://ubuntu.com/security/CVE-2025-43419

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-43419

Plugin Information
Published: 2025/11/22, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- webkit2gtk3
- webkit2gtk3-jsc
253570 - Linux Distros Unpatched Vulnerability : CVE-2025-47219
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure. (CVE-2025-47219)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-47219
https://ubuntu.com/security/CVE-2025-47219

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
8.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-47219

Plugin Information
Published: 2025/08/22, Modified: 2025/12/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gstreamer1-plugins-good
- gstreamer1-plugins-good-gtk
275439 - Linux Distros Unpatched Vulnerability : CVE-2025-47913
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process. (CVE-2025-47913)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-47913
https://security-tracker.debian.org/tracker/CVE-2025-47913
https://ubuntu.com/security/CVE-2025-47913

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-47913

Plugin Information
Published: 2025/11/14, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- podman
260222 - Linux Distros Unpatched Vulnerability : CVE-2025-48068
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active. This issue has been patched in versions 14.2.30 and 15.2.2. (CVE-2025-48068)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-48068

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
2.3 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N)
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-48068

Plugin Information
Published: 2025/09/01, Modified: 2025/09/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- dotnet-host
- firefox
- netstandard-targeting-pack-2.1
260287 - Linux Distros Unpatched Vulnerability : CVE-2025-49826
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Denial of Service (DoS) condition was found in Next.js.
This issue does not impact customers hosted on Vercel. Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page. This issue has been addressed in version 15.1.8. (CVE-2025-49826)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-49826

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.1
EPSS Score
0.0001
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-49826

Plugin Information
Published: 2025/09/02, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- dotnet-host
- firefox
- netstandard-targeting-pack-2.1
246210 - Linux Distros Unpatched Vulnerability : CVE-2025-5244
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was found in GNU Binutils up to 2.44. It has been rated as critical. Affected by this issue is the function elf_gc_sweep of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.45 is able to address this issue. It is recommended to upgrade the affected component. (CVE-2025-5244)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-5244
https://security-tracker.debian.org/tracker/CVE-2025-5244

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.4 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-5244

Plugin Information
Published: 2025/08/08, Modified: 2025/12/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gcc-toolset-13-binutils
- gcc-toolset-13-binutils-devel
- gcc-toolset-13-binutils-gold
- gcc-toolset-13-gdb
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
258936 - Linux Distros Unpatched Vulnerability : CVE-2025-5245
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability classified as critical has been found in GNU Binutils up to 2.44. This affects the function debug_type_samep of the file /binutils/debug.c of the component objdump. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. (CVE-2025-5245)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-5245
https://security-tracker.debian.org/tracker/CVE-2025-5245

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.4 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.7 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-5245

Plugin Information
Published: 2025/08/30, Modified: 2025/12/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-13-binutils
- gcc-toolset-13-binutils-devel
- gcc-toolset-13-binutils-gold
- gcc-toolset-13-gdb
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
270275 - Linux Distros Unpatched Vulnerability : CVE-2025-52885
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Poppler ia a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector `stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue. (CVE-2025-52885)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-52885
https://security-tracker.debian.org/tracker/CVE-2025-52885

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v4.0 Base Score
8.6 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.4
EPSS Score
0.0001
CVSS v2.0 Base Score
3.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
3.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-52885

Plugin Information
Published: 2025/10/14, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- poppler
- poppler-cpp
- poppler-glib
- poppler-utils
252239 - Linux Distros Unpatched Vulnerability : CVE-2025-52886
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue. (CVE-2025-52886)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-52886
https://security-tracker.debian.org/tracker/CVE-2025-52886

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
6.9 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-52886

Plugin Information
Published: 2025/08/19, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- poppler
- poppler-cpp
- poppler-data
- poppler-glib
- poppler-utils
251965 - Linux Distros Unpatched Vulnerability : CVE-2025-5372
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for successthe function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability. (CVE-2025-5372)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-5372
https://security-tracker.debian.org/tracker/CVE-2025-5372
https://ubuntu.com/security/CVE-2025-5372

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-5372

Plugin Information
Published: 2025/08/19, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libssh
- libssh-config
275841 - Linux Distros Unpatched Vulnerability : CVE-2025-58188
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains. (CVE-2025-58188)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-58188
https://security-tracker.debian.org/tracker/CVE-2025-58188
https://ubuntu.com/security/CVE-2025-58188

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
9.4 (CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
8.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-58188

Plugin Information
Published: 2025/11/20, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- conmon
- containernetworking-plugins
- podman
- rhc
265182 - Linux Distros Unpatched Vulnerability : CVE-2025-59375
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing. (CVE-2025-59375)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-59375
https://security-tracker.debian.org/tracker/CVE-2025-59375
https://ubuntu.com/security/CVE-2025-59375

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-59375

Plugin Information
Published: 2025/09/17, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
275740 - Linux Distros Unpatched Vulnerability : CVE-2025-61664
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use After Free issue, occurs because the normal_exit command is not properly unregistered when its related module is unloaded. An attacker can exploit this condition by invoking the command after the module has been removed, causing the system to improperly access a previously freed memory location. This leads to a system crash or possible impacts in data confidentiality and integrity. (CVE-2025-61664)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-61664
https://security-tracker.debian.org/tracker/CVE-2025-61664
https://ubuntu.com/security/CVE-2025-61664

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:P)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-61664

Plugin Information
Published: 2025/11/18, Modified: 2025/11/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- grub2-common
- grub2-efi-x64
- grub2-tools
- grub2-tools-minimal
270214 - Linux Distros Unpatched Vulnerability : CVE-2025-61723
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs. (CVE-2025-61723)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-61723
https://security-tracker.debian.org/tracker/CVE-2025-61723
https://ubuntu.com/security/CVE-2025-61723

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-61723

Plugin Information
Published: 2025/10/13, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- conmon
- containernetworking-plugins
- podman
- rhc
270219 - Linux Distros Unpatched Vulnerability : CVE-2025-61725
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption.
(CVE-2025-61725)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-61725
https://security-tracker.debian.org/tracker/CVE-2025-61725
https://ubuntu.com/security/CVE-2025-61725

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-61725

Plugin Information
Published: 2025/10/13, Modified: 2025/12/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- conmon
- podman
277083 - Linux Distros Unpatched Vulnerability : CVE-2025-61729
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption. (CVE-2025-61729)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-61729
https://security-tracker.debian.org/tracker/CVE-2025-61729
https://ubuntu.com/security/CVE-2025-61729

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.1
EPSS Score
0.0001
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-61729

Plugin Information
Published: 2025/12/03, Modified: 2025/12/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- containernetworking-plugins
- podman
- rhc
272129 - Linux Distros Unpatched Vulnerability : CVE-2025-6176
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression. (CVE-2025-6176)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-6176
https://security-tracker.debian.org/tracker/CVE-2025-6176
https://ubuntu.com/security/CVE-2025-6176

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-6176

Plugin Information
Published: 2025/10/31, Modified: 2025/12/08
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- brotli
- brotli-devel
- libbrotli
255430 - Linux Distros Unpatched Vulnerability : CVE-2025-6275
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been declared as problematic. Affected by this vulnerability is the function GetFuncOffset of the file src/interp/binary-reader-interp.cc. The manipulation leads to use after free. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. A similar issue reported during the same timeframe was disputed by the code maintainer because it might not affect real world wasm programs. Therefore, this entry might get disputed as well in the future. (CVE-2025-6275)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-6275
https://security-tracker.debian.org/tracker/CVE-2025-6275
https://ubuntu.com/security/CVE-2025-6275

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
5.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-6275

Plugin Information
Published: 2025/08/26, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
276641 - Linux Distros Unpatched Vulnerability : CVE-2025-64720
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component alpha 257 required by the simplified PNG API. This issue has been patched in version 1.6.51. (CVE-2025-64720)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-64720
https://ubuntu.com/security/CVE-2025-64720

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
5.0
EPSS Score
0.0003
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-64720

Plugin Information
Published: 2025/11/24, Modified: 2025/12/12
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- java-1.8.0-openjdk
- java-1.8.0-openjdk-demo
- java-1.8.0-openjdk-devel
- java-1.8.0-openjdk-headless
- java-1.8.0-openjdk-javadoc
- java-1.8.0-openjdk-javadoc-zip
- java-1.8.0-openjdk-src
- java-17-openjdk
- java-17-openjdk-demo
- java-17-openjdk-devel
- java-17-openjdk-headless
- java-17-openjdk-javadoc
- java-17-openjdk-javadoc-zip
- java-17-openjdk-jmods
- java-17-openjdk-src
- java-17-openjdk-static-libs
- java-21-openjdk
- java-21-openjdk-demo
- java-21-openjdk-devel
- java-21-openjdk-headless
- java-21-openjdk-javadoc
- java-21-openjdk-javadoc-zip
- java-21-openjdk-jmods
- java-21-openjdk-src
- java-21-openjdk-static-libs
- libpng
- libpng-devel
276643 - Linux Distros Unpatched Vulnerability : CVE-2025-65018
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51. (CVE-2025-65018)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-65018
https://ubuntu.com/security/CVE-2025-65018

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0001
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-65018

Plugin Information
Published: 2025/11/24, Modified: 2025/12/12
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- java-1.8.0-openjdk
- java-1.8.0-openjdk-demo
- java-1.8.0-openjdk-devel
- java-1.8.0-openjdk-headless
- java-1.8.0-openjdk-javadoc
- java-1.8.0-openjdk-javadoc-zip
- java-1.8.0-openjdk-src
- java-17-openjdk
- java-17-openjdk-demo
- java-17-openjdk-devel
- java-17-openjdk-headless
- java-17-openjdk-javadoc
- java-17-openjdk-javadoc-zip
- java-17-openjdk-jmods
- java-17-openjdk-src
- java-17-openjdk-static-libs
- java-21-openjdk
- java-21-openjdk-demo
- java-21-openjdk-devel
- java-21-openjdk-headless
- java-21-openjdk-javadoc
- java-21-openjdk-javadoc-zip
- java-21-openjdk-jmods
- java-21-openjdk-src
- java-21-openjdk-static-libs
- libpng
- libpng-devel
277513 - Linux Distros Unpatched Vulnerability : CVE-2025-65637
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with token too long and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2.
The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged. (CVE-2025-65637)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-65637
https://security-tracker.debian.org/tracker/CVE-2025-65637
https://ubuntu.com/security/CVE-2025-65637

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-65637

Plugin Information
Published: 2025/12/04, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- podman
277411 - Linux Distros Unpatched Vulnerability : CVE-2025-66293
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management.
Upgrade to libpng 1.6.52 or later. (CVE-2025-66293)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-66293
https://ubuntu.com/security/CVE-2025-66293

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
5.0
EPSS Score
0.0004
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-66293

Plugin Information
Published: 2025/12/04, Modified: 2025/12/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- java-1.8.0-openjdk
- java-1.8.0-openjdk-demo
- java-1.8.0-openjdk-devel
- java-1.8.0-openjdk-headless
- java-1.8.0-openjdk-javadoc
- java-1.8.0-openjdk-javadoc-zip
- java-1.8.0-openjdk-src
- java-17-openjdk
- java-17-openjdk-demo
- java-17-openjdk-devel
- java-17-openjdk-headless
- java-17-openjdk-javadoc
- java-17-openjdk-javadoc-zip
- java-17-openjdk-jmods
- java-17-openjdk-src
- java-17-openjdk-static-libs
- java-21-openjdk
- java-21-openjdk-demo
- java-21-openjdk-devel
- java-21-openjdk-headless
- java-21-openjdk-javadoc
- java-21-openjdk-javadoc-zip
- java-21-openjdk-jmods
- java-21-openjdk-src
- java-21-openjdk-static-libs
- libpng
- libpng-devel
280132 - Linux Distros Unpatched Vulnerability : CVE-2025-66862
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. (CVE-2025-66862)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-66862
https://security-tracker.debian.org/tracker/CVE-2025-66862

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-66862

Plugin Information
Published: 2025/12/29, Modified: 2025/12/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
280129 - Linux Distros Unpatched Vulnerability : CVE-2025-66863
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in function d_discriminator in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. (CVE-2025-66863)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-66863
https://security-tracker.debian.org/tracker/CVE-2025-66863

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-66863

Plugin Information
Published: 2025/12/29, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
280127 - Linux Distros Unpatched Vulnerability : CVE-2025-66865
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. (CVE-2025-66865)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-66865
https://security-tracker.debian.org/tracker/CVE-2025-66865

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
8.4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-66865

Plugin Information
Published: 2025/12/29, Modified: 2025/12/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
260288 - Linux Distros Unpatched Vulnerability : CVE-2025-6703
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Improper Input Validation vulnerability in Mozilla neqo leads to an unexploitable crash..This issue affects neqo: from 0.4.24 through 0.13.2. (CVE-2025-6703)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-6703

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v4.0 Base Score
2.3 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L)
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0008
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-6703

Plugin Information
Published: 2025/09/02, Modified: 2025/09/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
- gjs
- polkit
- polkit-libs
278788 - Linux Distros Unpatched Vulnerability : CVE-2025-68179
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP As reported by Luiz Capitulino enabling HVO on s390 leads to reproducible crashes. The problem is that kernel page tables are modified without flushing corresponding TLB entries. Even if it looks like the empty flush_tlb_all() implementation on s390 is the problem, it is actually a different problem: on s390 it is not allowed to replace an active/valid page table entry with another valid page table entry without the detour over an invalid entry. A direct replacement may lead to random crashes and/or data corruption. In order to invalidate an entry special instructions have to be used (e.g. ipte or idte). Alternatively there are also special instructions available which allow to replace a valid entry with a different valid entry (e.g. crdte or cspg). Given that the HVO code currently does not provide the hooks to allow for an implementation which is compliant with the s390 architecture requirements, disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP again, which is basically a revert of the original patch which enabled it. (CVE-2025-68179)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68179
https://security-tracker.debian.org/tracker/CVE-2025-68179
https://ubuntu.com/security/CVE-2025-68179

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68179

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278899 - Linux Distros Unpatched Vulnerability : CVE-2025-68181
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/radeon: Remove calls to drm_put_dev() Since the allocation of the drivers main structure was changed to devm_drm_dev_alloc() drm_put_dev()'ing to trigger it to be free'd should be done by devres. However, drm_put_dev() is still in the probe error and device remove paths. When the driver fails to probe warnings like the following are shown because devres is trying to drm_put_dev() after the driver already did it. [ 5.642230] radeon 0000:01:05.0: probe with driver radeon failed with error -22 [ 5.649605] ------------[ cut here ]------------ [ 5.649607] refcount_t: underflow; use-after-free. [ 5.649620] WARNING: CPU: 0 PID:
357 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110 (cherry picked from commit 3eb8c0b4c091da0a623ade0d3ee7aa4a93df1ea4) (CVE-2025-68181)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68181
https://security-tracker.debian.org/tracker/CVE-2025-68181
https://ubuntu.com/security/CVE-2025-68181

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68181

Plugin Information
Published: 2025/12/16, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278930 - Linux Distros Unpatched Vulnerability : CVE-2025-68182
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: iwlwifi: fix potential use after free in iwl_mld_remove_link() This code frees link by calling kfree_rcu(link, rcu_head) and then it dereferences link to get the link->fw_id. Save the link->fw_id first to avoid a potential use after free. (CVE-2025-68182)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68182
https://ubuntu.com/security/CVE-2025-68182

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68182

Plugin Information
Published: 2025/12/17, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278894 - Linux Distros Unpatched Vulnerability : CVE-2025-68183
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores IMA signature in security.ima and then writes/removes some other security xattr for the file. For example, on Fedora, after booting the kernel with ima_appraise=fix evm=fix ima_policy=appraise_tcb and installing rpm-plugin-ima, installing/reinstalling a package will not make good reference IMA signature generated. Instead IMA hash is generated, # getfattr -m - -d -e hex /usr/bin/bash # file: usr/bin/bash security.ima=0x0404... This happens because when setting security.selinux, the IMA_DIGSIG flag that had been set early was cleared. As a result, IMA hash is generated when the file is closed. Similarly, IMA signature can be cleared on file close after removing security xattr like security.evm or setting/removing ACL. Prevent replacing the IMA file signature with a file hash, by preventing the IMA_DIGSIG flag from being reset. Here's a minimal C reproducer which sets security.selinux as the last step which can also replaced by removing security.evm or setting ACL, #include <stdio.h> #include <sys/xattr.h> #include <fcntl.h> #include <unistd.h> #include <string.h> #include <stdlib.h> int main() { const char* file_path = /usr/sbin/test_binary; const char* hex_string = 030204d33204490066306402304; int length = strlen(hex_string); char* ima_attr_value; int fd;
fd = open(file_path, O_WRONLY|O_CREAT|O_EXCL, 0644); if (fd == -1) { perror(Error opening file); return 1; } ima_attr_value = (char*)malloc(length / 2 ); for (int i = 0, j = 0; i < length; i += 2, j++) { sscanf(hex_string + i, %2hhx, &ima_attr_value[j]); } if (fsetxattr(fd, security.ima, ima_attr_value, length/2, 0) == -1) { perror(Error setting extended attribute); close(fd); return 1; } const char* selinux_value= system_u:object_r:bin_t:s0; if (fsetxattr(fd, security.selinux, selinux_value, strlen(selinux_value), 0) == -1) { perror(Error setting extended attribute); close(fd); return 1; } close(fd); return 0; } (CVE-2025-68183)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68183
https://security-tracker.debian.org/tracker/CVE-2025-68183
https://ubuntu.com/security/CVE-2025-68183

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
1.2 (CVSS2#AV:L/AC:H/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68183

Plugin Information
Published: 2025/12/16, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278868 - Linux Distros Unpatched Vulnerability : CVE-2025-68188
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() Use RCU to avoid a pair of atomic operations and a potential UAF on dst_dev()->flags. (CVE-2025-68188)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68188
https://security-tracker.debian.org/tracker/CVE-2025-68188
https://ubuntu.com/security/CVE-2025-68188

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68188

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278859 - Linux Distros Unpatched Vulnerability : CVE-2025-68193
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/xe/guc: Add devm release action to safely tear down CT When a buffer object (BO) is allocated with the XE_BO_FLAG_GGTT_INVALIDATE flag, the driver initiates TLB invalidation requests via the CTB mechanism while releasing the BO. However a premature release of the CTB BO can lead to system crashes, as observed in: Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:h2g_write+0x2f3/0x7c0 [xe] Call Trace:
guc_ct_send_locked+0x8b/0x670 [xe] xe_guc_ct_send_locked+0x19/0x60 [xe] send_tlb_invalidation+0xb4/0x460 [xe] xe_gt_tlb_invalidation_ggtt+0x15e/0x2e0 [xe] ggtt_invalidate_gt_tlb.part.0+0x16/0x90 [xe] ggtt_node_remove+0x110/0x140 [xe] xe_ggtt_node_remove+0x40/0xa0 [xe] xe_ggtt_remove_bo+0x87/0x250 [xe] Introduce a devm-managed release action during xe_guc_ct_init() and xe_guc_ct_init_post_hwconfig() to ensure proper CTB disablement before resource deallocation, preventing the use-after-free scenario.
(CVE-2025-68193)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68193
https://security-tracker.debian.org/tracker/CVE-2025-68193
https://ubuntu.com/security/CVE-2025-68193

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68193

Plugin Information
Published: 2025/12/16, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278893 - Linux Distros Unpatched Vulnerability : CVE-2025-68200
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Add bpf_prog_run_data_pointers() syzbot found that cls_bpf_classify() is able to change tc_skb_cb(skb)->drop_reason triggering a warning in sk_skb_reason_drop(). WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 __sk_skb_reason_drop net/core/skbuff.c:1189 [inline] WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 sk_skb_reason_drop+0x76/0x170 net/core/skbuff.c:1214 struct tc_skb_cb has been added in commit ec624fe740b4 (net/sched: Extend qdisc control block with tc control block), which added a wrong interaction with db58ba459202 (bpf: wire in data and data_end for cls_act_bpf). drop_reason was added later. Add bpf_prog_run_data_pointers() helper to save/restore the net_sched storage colliding with BPF data_meta/data_end. (CVE-2025-68200)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68200
https://security-tracker.debian.org/tracker/CVE-2025-68200
https://ubuntu.com/security/CVE-2025-68200

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68200

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278910 - Linux Distros Unpatched Vulnerability : CVE-2025-68206
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfilter: nft_ct: add seqadj extension for natted connections Sequence adjustment may be required for FTP traffic with PASV/EPSV modes. due to need to re-write packet payload (IP, port) on the ftp control connection. This can require changes to the TCP length and expected seq / ack_seq. The easiest way to reproduce this issue is with PASV mode. Example ruleset: table inet ftp_nat { ct helper ftp_helper { type ftp protocol tcp l3proto inet } chain prerouting { type filter hook prerouting priority 0; policy accept; tcp dport 21 ct state new ct helper set ftp_helper } } table ip nat { chain prerouting { type nat hook prerouting priority -100; policy accept; tcp dport 21 dnat ip prefix to ip daddr map { 192.168.100.1 : 192.168.13.2/32 } } chain postrouting { type nat hook postrouting priority 100 ; policy accept; tcp sport 21 snat ip prefix to ip saddr map { 192.168.13.2 : 192.168.100.1/32 } } } Note that the ftp helper gets assigned *after* the dnat setup. The inverse (nat after helper assign) is handled by an existing check in nf_nat_setup_info() and will not show the problem. Topoloy: +-------------------+ +----------------------------------+ | FTP: 192.168.13.2 | <-> | NAT: 192.168.13.3, 192.168.100.1 | +-------------------+ +----------------------------------+ | +-----------------------+ | Client:
192.168.100.2 | +-----------------------+ ftp nat changes do not work as expected in this case: Connected to 192.168.100.1. [..] ftp> epsv EPSV/EPRT on IPv4 off. ftp> ls 227 Entering passive mode (192,168,100,1,209,129). 421 Service not available, remote server has closed connection. Kernel logs:
Missing nfct_seqadj_ext_add() setup call WARNING: CPU: 1 PID: 0 at net/netfilter/nf_conntrack_seqadj.c:41 [..] __nf_nat_mangle_tcp_packet+0x100/0x160 [nf_nat] nf_nat_ftp+0x142/0x280 [nf_nat_ftp] help+0x4d1/0x880 [nf_conntrack_ftp] nf_confirm+0x122/0x2e0 [nf_conntrack] nf_hook_slow+0x3c/0xb0 .. Fix this by adding the required extension when a conntrack helper is assigned to a connection that has a nat binding.
(CVE-2025-68206)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68206
https://security-tracker.debian.org/tracker/CVE-2025-68206
https://ubuntu.com/security/CVE-2025-68206

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
8.1 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
7.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
9.4 (CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
8.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68206

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278854 - Linux Distros Unpatched Vulnerability : CVE-2025-68207
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/xe/guc: Synchronize Dead CT worker with unbind Cancel and wait for any Dead CT worker to complete before continuing with device unbinding. Else the worker will end up using resources freed by the undind operation. (cherry picked from commit 492671339114e376aaa38626d637a2751cdef263) (CVE-2025-68207)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68207
https://security-tracker.debian.org/tracker/CVE-2025-68207
https://ubuntu.com/security/CVE-2025-68207

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68207

Plugin Information
Published: 2025/12/16, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278840 - Linux Distros Unpatched Vulnerability : CVE-2025-68208
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: account for current allocated stack depth in widen_imprecise_scalars() The usage pattern for widen_imprecise_scalars() looks as follows: prev_st = find_prev_entry(env, ...); queued_st = push_stack(...); widen_imprecise_scalars(env, prev_st, queued_st); Where prev_st is an ancestor of the queued_st in the explored states tree. This ancestor is not guaranteed to have same allocated stack depth as queued_st. E.g. in the following case: def main(): for i in 1..2: foo(i) // same callsite, differnt param def foo(i): if i == 1: use 128 bytes of stack iterator based loop Here, for a second 'foo' call prev_st->allocated_stack is 128, while queued_st->allocated_stack is much smaller.
widen_imprecise_scalars() needs to take this into account and avoid accessing bpf_verifier_state->frame[*]->stack out of bounds. (CVE-2025-68208)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68208
https://security-tracker.debian.org/tracker/CVE-2025-68208
https://ubuntu.com/security/CVE-2025-68208

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68208

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278931 - Linux Distros Unpatched Vulnerability : CVE-2025-68226
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smb: client: fix incomplete backport in cfids_invalidation_worker() The previous commit bdb596ceb4b7 (smb: client: fix potential UAF in smb2_close_cached_fid()) was an incomplete backport and missed one kref_put() call in cfids_invalidation_worker() that should have been converted to close_cached_dir().
(CVE-2025-68226)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68226
https://ubuntu.com/security/CVE-2025-68226

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68226

Plugin Information
Published: 2025/12/17, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278920 - Linux Distros Unpatched Vulnerability : CVE-2025-68227
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mptcp: Fix proto fallback detection with BPF The sockmap feature allows bpf syscall from userspace, or based on bpf sockops, replacing the sk_prot of sockets during protocol stack processing with sockmap's custom read/write interfaces. ''' tcp_rcv_state_process() syn_recv_sock()/subflow_syn_recv_sock() tcp_init_transfer(BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB) bpf_skops_established <== sockops bpf_sock_map_update(sk) <== call bpf helper tcp_bpf_update_proto() <== update sk_prot ''' When the server has MPTCP enabled but the client sends a TCP SYN without MPTCP, subflow_syn_recv_sock() performs a fallback on the subflow, replacing the subflow sk's sk_prot with the native sk_prot. '''
subflow_syn_recv_sock() subflow_ulp_fallback() subflow_drop_ctx() mptcp_subflow_ops_undo_override() '''
Then, this subflow can be normally used by sockmap, which replaces the native sk_prot with sockmap's custom sk_prot. The issue occurs when the user executes accept::mptcp_stream_accept::mptcp_fallback_tcp_ops(). Here, it uses sk->sk_prot to compare with the native sk_prot, but this is incorrect when sockmap is used, as we may incorrectly set sk->sk_socket->ops.
This fix uses the more generic sk_family for the comparison instead. Additionally, this also prevents a WARNING from occurring: result from ./scripts/decode_stacktrace.sh: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 337 at net/mptcp/protocol.c:68 mptcp_stream_accept \ (net/mptcp/protocol.c:4005) Modules linked in: ... PKRU: 55555554 Call Trace: <TASK> do_accept (net/socket.c:1989) __sys_accept4 (net/socket.c:2028 net/socket.c:2057) __x64_sys_accept (net/socket.c:2067) x64_sys_call (arch/x86/entry/syscall_64.c:41) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) RIP:
0033:0x7f87ac92b83d ---[ end trace 0000000000000000 ]--- (CVE-2025-68227)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68227
https://security-tracker.debian.org/tracker/CVE-2025-68227
https://ubuntu.com/security/CVE-2025-68227

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68227

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278814 - Linux Distros Unpatched Vulnerability : CVE-2025-68231
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm/mempool: fix poisoning order>0 pages with HIGHMEM The kernel test has reported: BUG: unable to handle page fault for address: fffba000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page *pde = 03171067 *pte = 00000000 Oops: Oops: 0002 [#1] CPU: 0 UID: 0 PID: 1 Comm:
swapper/0 Tainted: G T 6.18.0-rc2-00031-gec7f31b2a2d3 #1 NONE a1d066dfe789f54bc7645c7989957d2bdee593ca Tainted: [T]=RANDSTRUCT Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 EIP: memset (arch/x86/include/asm/string_32.h:168 arch/x86/lib/memcpy_32.c:17) Code: a5 8b 4d f4 83 e1 03 74 02 f3 a4 83 c4 04 5e 5f 5d 2e e9 73 41 01 00 90 90 90 3e 8d 74 26 00 55 89 e5 57 56 89 c6 89 d0 89 f7 <f3> aa 89 f0 5e 5f 5d 2e e9 53 41 01 00 cc cc cc 55 89 e5 53 57 56 EAX: 0000006b EBX:
00000015 ECX: 001fefff EDX: 0000006b ESI: fffb9000 EDI: fffba000 EBP: c611fbf0 ESP: c611fbe8 DS: 007b ES:
007b FS: 0000 GS: 0000 SS: 0068 EFLAGS: 00010287 CR0: 80050033 CR2: fffba000 CR3: 0316e000 CR4: 00040690 Call Trace: poison_element (mm/mempool.c:83 mm/mempool.c:102) mempool_init_node (mm/mempool.c:142 mm/mempool.c:226) mempool_init_noprof (mm/mempool.c:250 (discriminator 1)) ? mempool_alloc_pages (mm/mempool.c:640) bio_integrity_initfn (block/bio-integrity.c:483 (discriminator 8)) ? mempool_alloc_pages (mm/mempool.c:640) do_one_initcall (init/main.c:1283) Christoph found out this is due to the poisoning code not dealing properly with CONFIG_HIGHMEM because only the first page is mapped but then the whole potentially high-order page is accessed. We could give up on HIGHMEM here, but it's straightforward to fix this with a loop that's mapping, poisoning or checking and unmapping individual pages. (CVE-2025-68231)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68231
https://security-tracker.debian.org/tracker/CVE-2025-68231
https://ubuntu.com/security/CVE-2025-68231

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68231

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278817 - Linux Distros Unpatched Vulnerability : CVE-2025-68233
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/tegra: Add call to put_pid() Add a call to put_pid() corresponding to get_task_pid().
host1x_memory_context_alloc() does not take ownership of the PID so we need to free it here to avoid leaking. [mperttunen@nvidia.com: reword commit message] (CVE-2025-68233)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68233
https://security-tracker.debian.org/tracker/CVE-2025-68233
https://ubuntu.com/security/CVE-2025-68233

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68233

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278860 - Linux Distros Unpatched Vulnerability : CVE-2025-68239
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- binfmt_misc: restore write access before closing files opened by open_exec() bm_register_write() opens an executable file using open_exec(), which internally calls do_open_execat() and denies write access on the file to avoid modification while it is being executed. However, when an error occurs, bm_register_write() closes the file using filp_close() directly. This does not restore the write permission, which may cause subsequent write operations on the same file to fail. Fix this by calling exe_file_allow_write_access() before filp_close() to restore the write permission properly. (CVE-2025-68239)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68239
https://security-tracker.debian.org/tracker/CVE-2025-68239
https://ubuntu.com/security/CVE-2025-68239

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68239

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278853 - Linux Distros Unpatched Vulnerability : CVE-2025-68244
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD On completion of i915_vma_pin_ww(), a synchronous variant of dma_fence_work_commit() is called. When pinning a VMA to GGTT address space on a Cherry View family processor, or on a Broxton generation SoC with VTD enabled, i.e., when stop_machine() is then called from intel_ggtt_bind_vma(), that can potentially lead to lock inversion among reservation_ww and cpu_hotplug locks. [86.861179] ====================================================== [86.861193] WARNING: possible circular locking dependency detected [86.861209] 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 Tainted: G U [86.861226]
------------------------------------------------------ [86.861238] i915_module_loa/1432 is trying to acquire lock: [86.861252] ffffffff83489090 (cpu_hotplug_lock){++++}-{0:0}, at: stop_machine+0x1c/0x50 [86.861290] but task is already holding lock: [86.861303] ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915] [86.862233] which lock already depends on the new lock. [86.862251] the existing dependency chain (in reverse order) is:
[86.862265] -> #5 (reservation_ww_class_mutex){+.+.}-{3:3}: [86.862292] dma_resv_lockdep+0x19a/0x390 [86.862315] do_one_initcall+0x60/0x3f0 [86.862334] kernel_init_freeable+0x3cd/0x680 [86.862353] kernel_init+0x1b/0x200 [86.862369] ret_from_fork+0x47/0x70 [86.862383] ret_from_fork_asm+0x1a/0x30 [86.862399] -> #4 (reservation_ww_class_acquire){+.+.}-{0:0}: [86.862425] dma_resv_lockdep+0x178/0x390 [86.862440] do_one_initcall+0x60/0x3f0 [86.862454] kernel_init_freeable+0x3cd/0x680 [86.862470] kernel_init+0x1b/0x200 [86.862482] ret_from_fork+0x47/0x70 [86.862495] ret_from_fork_asm+0x1a/0x30 [86.862509] -> #3 (&mm->mmap_lock){++++}-{3:3}: [86.862531] down_read_killable+0x46/0x1e0 [86.862546] lock_mm_and_find_vma+0xa2/0x280 [86.862561] do_user_addr_fault+0x266/0x8e0 [86.862578] exc_page_fault+0x8a/0x2f0 [86.862593] asm_exc_page_fault+0x27/0x30 [86.862607] filldir64+0xeb/0x180 [86.862620] kernfs_fop_readdir+0x118/0x480 [86.862635] iterate_dir+0xcf/0x2b0 [86.862648]
__x64_sys_getdents64+0x84/0x140 [86.862661] x64_sys_call+0x1058/0x2660 [86.862675] do_syscall_64+0x91/0xe90 [86.862689] entry_SYSCALL_64_after_hwframe+0x76/0x7e [86.862703] -> #2 (&root->kernfs_rwsem){++++}-{3:3}: [86.862725] down_write+0x3e/0xf0 [86.862738] kernfs_add_one+0x30/0x3c0 [86.862751] kernfs_create_dir_ns+0x53/0xb0 [86.862765] internal_create_group+0x134/0x4c0 [86.862779] sysfs_create_group+0x13/0x20 [86.862792] topology_add_dev+0x1d/0x30 [86.862806] cpuhp_invoke_callback+0x4b5/0x850 [86.862822] cpuhp_issue_call+0xbf/0x1f0 [86.862836]
__cpuhp_setup_state_cpuslocked+0x111/0x320 [86.862852] __cpuhp_setup_state+0xb0/0x220 [86.862866] topology_sysfs_init+0x30/0x50 [86.862879] do_one_initcall+0x60/0x3f0 [86.862893] kernel_init_freeable+0x3cd/0x680 [86.862908] kernel_init+0x1b/0x200 [86.862921] ret_from_fork+0x47/0x70 [86.862934] ret_from_fork_asm+0x1a/0x30 [86.862947] -> #1 (cpuhp_state_mutex){+.+.}-{3:3}: [86.862969]
__mutex_lock+0xaa/0xed0 [86.862982] mutex_lock_nested+0x1b/0x30 [86.862995]
__cpuhp_setup_state_cpuslocked+0x67/0x320 [86.863012] __cpuhp_setup_state+0xb0/0x220 [86.863026] page_alloc_init_cpuhp+0x2d/0x60 [86.863041] mm_core_init+0x22/0x2d0 [86.863054] start_kernel+0x576/0xbd0 [86.863068] x86_64_start_reservations+0x18/0x30 [86.863084] x86_64_start_kernel+0xbf/0x110 [86.863098] common_startup_64+0x13e/0x141 [86.863114] -> #0 (cpu_hotplug_lock){++++}-{0:0}: [86.863135]
__lock_acquire+0x16 ---truncated--- (CVE-2025-68244)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68244
https://security-tracker.debian.org/tracker/CVE-2025-68244
https://ubuntu.com/security/CVE-2025-68244

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
8.4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
3.7 (CVSS2#AV:L/AC:H/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68244

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278898 - Linux Distros Unpatched Vulnerability : CVE-2025-68259
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced When re-injecting a soft interrupt from an INT3, INT0, or (select) INTn instruction, discard the exception and retry the instruction if the code stream is changed (e.g. by a different vCPU) between when the CPU executes the instruction and when KVM decodes the instruction to get the next RIP. As effectively predicted by commit 6ef88d6e36c2 (KVM:
SVM: Re-inject INT3/INTO instead of retrying the instruction), failure to verify that the correct INTn instruction was decoded can effectively clobber guest state due to decoding the wrong instruction and thus specifying the wrong next RIP. The bug most often manifests as Oops: int3 panics on static branch checks in Linux guests. Enabling or disabling a static branch in Linux uses the kernel's text poke code patching mechanism. To modify code while other CPUs may be executing that code, Linux (temporarily) replaces the first byte of the original instruction with an int3 (opcode 0xcc), then patches in the new code stream except for the first byte, and finally replaces the int3 with the first byte of the new code stream. If a CPU hits the int3, i.e. executes the code while it's being modified, then the guest kernel must look up the RIP to determine how to handle the #BP, e.g. by emulating the new instruction. If the RIP is incorrect, then this lookup fails and the guest kernel panics. The bug reproduces almost instantly by hacking the guest kernel to repeatedly check a static branch[1] while running a drgn script[2] on the host to constantly swap out the memory containing the guest's TSS. [1]:
https://gist.github.com/osandov/44d17c51c28c0ac998ea0334edf90b5a [2]:
https://gist.github.com/osandov/10e45e45afa29b11e0c7209247afc00b (CVE-2025-68259)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68259
https://security-tracker.debian.org/tracker/CVE-2025-68259
https://ubuntu.com/security/CVE-2025-68259

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.3
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:C/I:P/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68259

Plugin Information
Published: 2025/12/16, Modified: 2025/12/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278844 - Linux Distros Unpatched Vulnerability : CVE-2025-68261
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() Fix a race between inline data destruction and block mapping. The function ext4_destroy_inline_data_nolock() changes the inode data layout by clearing EXT4_INODE_INLINE_DATA and setting EXT4_INODE_EXTENTS. At the same time, another thread may execute ext4_map_blocks(), which tests EXT4_INODE_EXTENTS to decide whether to call ext4_ext_map_blocks() or ext4_ind_map_blocks(). Without i_data_sem protection, ext4_ind_map_blocks() may receive inode with EXT4_INODE_EXTENTS flag and triggering assert. kernel BUG at fs/ext4/indirect.c:546! EXT4-fs (loop2): unmounting filesystem. invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI Hardware name:
QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP:
0010:ext4_ind_map_blocks.cold+0x2b/0x5a fs/ext4/indirect.c:546 Call Trace: <TASK>
ext4_map_blocks+0xb9b/0x16f0 fs/ext4/inode.c:681 _ext4_get_block+0x242/0x590 fs/ext4/inode.c:822 ext4_block_write_begin+0x48b/0x12c0 fs/ext4/inode.c:1124 ext4_write_begin+0x598/0xef0 fs/ext4/inode.c:1255 ext4_da_write_begin+0x21e/0x9c0 fs/ext4/inode.c:3000 generic_perform_write+0x259/0x5d0 mm/filemap.c:3846 ext4_buffered_write_iter+0x15b/0x470 fs/ext4/file.c:285 ext4_file_write_iter+0x8e0/0x17f0 fs/ext4/file.c:679 call_write_iter include/linux/fs.h:2271 [inline] do_iter_readv_writev+0x212/0x3c0 fs/read_write.c:735 do_iter_write+0x186/0x710 fs/read_write.c:861 vfs_iter_write+0x70/0xa0 fs/read_write.c:902 iter_file_splice_write+0x73b/0xc90 fs/splice.c:685 do_splice_from fs/splice.c:763 [inline] direct_splice_actor+0x10f/0x170 fs/splice.c:950 splice_direct_to_actor+0x33a/0xa10 fs/splice.c:896 do_splice_direct+0x1a9/0x280 fs/splice.c:1002 do_sendfile+0xb13/0x12c0 fs/read_write.c:1255 __do_sys_sendfile64 fs/read_write.c:1323 [inline] __se_sys_sendfile64 fs/read_write.c:1309 [inline] __x64_sys_sendfile64+0x1cf/0x210 fs/read_write.c:1309 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 (CVE-2025-68261)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68261
https://security-tracker.debian.org/tracker/CVE-2025-68261
https://ubuntu.com/security/CVE-2025-68261

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68261

Plugin Information
Published: 2025/12/16, Modified: 2025/12/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278803 - Linux Distros Unpatched Vulnerability : CVE-2025-68265
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nvme: fix admin request_queue lifetime The namespaces can access the controller's admin request_queue, and stale references on the namespaces may exist after tearing down the controller. Ensure the admin request_queue is active by moving the controller's 'put' to after all controller references have been released to ensure no one is can access the request_queue. This fixes a reported use-after-free bug: BUG:
KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0 Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287 CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G E 6.13.2-ga1582f1a031e #15 Tainted:
[E]=UNSIGNED_MODULE Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025 Call Trace: <TASK>
dump_stack_lvl+0x4f/0x60 print_report+0xc4/0x620 ? _raw_spin_lock_irqsave+0x70/0xb0 ?
_raw_read_unlock_irqrestore+0x30/0x30 ? blk_queue_enter+0x41c/0x4a0 kasan_report+0xab/0xe0 ? blk_queue_enter+0x41c/0x4a0 blk_queue_enter+0x41c/0x4a0 ? __irq_work_queue_local+0x75/0x1d0 ? blk_queue_start_drain+0x70/0x70 ? irq_work_queue+0x18/0x20 ? vprintk_emit.part.0+0x1cc/0x350 ? wake_up_klogd_work_func+0x60/0x60 blk_mq_alloc_request+0x2b7/0x6b0 ? __blk_mq_alloc_requests+0x1060/0x1060 ? __switch_to+0x5b7/0x1060 nvme_submit_user_cmd+0xa9/0x330 nvme_user_cmd.isra.0+0x240/0x3f0 ? force_sigsegv+0xe0/0xe0 ? nvme_user_cmd64+0x400/0x400 ? vfs_fileattr_set+0x9b0/0x9b0 ? cgroup_update_frozen_flag+0x24/0x1c0 ? cgroup_leave_frozen+0x204/0x330 ? nvme_ioctl+0x7c/0x2c0 blkdev_ioctl+0x1a8/0x4d0 ? blkdev_common_ioctl+0x1930/0x1930 ? fdget+0x54/0x380
__x64_sys_ioctl+0x129/0x190 do_syscall_64+0x5b/0x160 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP:
0033:0x7f765f703b0b Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX:
00007ffe2cefe860 RCX: 00007f765f703b0b RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000 R10: 00007f765f611d50 R11:
0000000000000202 R12: 0000000000000003 R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60 </TASK> (CVE-2025-68265)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68265
https://security-tracker.debian.org/tracker/CVE-2025-68265
https://ubuntu.com/security/CVE-2025-68265

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68265

Plugin Information
Published: 2025/12/16, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278870 - Linux Distros Unpatched Vulnerability : CVE-2025-68283
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- libceph: replace BUG_ON with bounds check for map->max_osd OSD indexes come from untrusted network packets. Boundary checks are added to validate these against map->max_osd. [ idryomov: drop BUG_ON in ceph_get_primary_affinity(), minor cosmetic edits ] (CVE-2025-68283)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68283
https://security-tracker.debian.org/tracker/CVE-2025-68283
https://ubuntu.com/security/CVE-2025-68283

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68283

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278856 - Linux Distros Unpatched Vulnerability : CVE-2025-68287
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths This patch addresses a race condition caused by unsynchronized execution of multiple call paths invoking `dwc3_remove_requests()`, leading to premature freeing of USB requests and subsequent crashes. Three distinct execution paths interact with `dwc3_remove_requests()`: Path 1: Triggered via `dwc3_gadget_reset_interrupt()` during USB reset handling. The call stack includes: - `dwc3_ep0_reset_state()` - `dwc3_ep0_stall_and_restart()` - `dwc3_ep0_out_start()` - `dwc3_remove_requests()` - `dwc3_gadget_del_and_unmap_request()` Path 2: Also initiated from `dwc3_gadget_reset_interrupt()`, but through `dwc3_stop_active_transfers()`. The call stack includes: - `dwc3_stop_active_transfers()` - `dwc3_remove_requests()` - `dwc3_gadget_del_and_unmap_request()` Path 3:
Occurs independently during `adb root` execution, which triggers USB function unbind and bind operations.
The sequence includes: - `gserial_disconnect()` - `usb_ep_disable()` - `dwc3_gadget_ep_disable()` - `dwc3_remove_requests()` with `-ESHUTDOWN` status Path 3 operates asynchronously and lacks synchronization with Paths 1 and 2. When Path 3 completes, it disables endpoints and frees 'out' requests. If Paths 1 or 2 are still processing these requests, accessing freed memory leads to a crash due to use-after-free conditions. To fix this added check for request completion and skip processing if already completed and added the request status for ep0 while queue. (CVE-2025-68287)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68287
https://security-tracker.debian.org/tracker/CVE-2025-68287
https://ubuntu.com/security/CVE-2025-68287

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68287

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278807 - Linux Distros Unpatched Vulnerability : CVE-2025-68300
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fs/namespace: fix reference leak in grab_requested_mnt_ns lookup_mnt_ns() already takes a reference on mnt_ns. grab_requested_mnt_ns() doesn't need to take an extra reference. (CVE-2025-68300)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68300
https://ubuntu.com/security/CVE-2025-68300

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68300

Plugin Information
Published: 2025/12/16, Modified: 2025/12/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278825 - Linux Distros Unpatched Vulnerability : CVE-2025-68301
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: atlantic: fix fragment overflow handling in RX path The atlantic driver can receive packets with more than MAX_SKB_FRAGS (17) fragments when handling large multi-descriptor packets. This causes an out-of- bounds write in skb_add_rx_frag_netmem() leading to kernel panic. The issue occurs because the driver doesn't check the total number of fragments before calling skb_add_rx_frag(). When a packet requires more than MAX_SKB_FRAGS fragments, the fragment index exceeds the array bounds. Fix by assuming there will be an extra frag if buff->len > AQ_CFG_RX_HDR_SIZE, then all fragments are accounted for. And reusing the existing check to prevent the overflow earlier in the code path. This crash occurred in production with an Aquantia AQC113 10G NIC. Stack trace from production environment: ``` RIP:
0010:skb_add_rx_frag_netmem+0x29/0xd0 Code: 90 f3 0f 1e fa 0f 1f 44 00 00 48 89 f8 41 89 ca 48 89 d7 48 63 ce 8b 90 c0 00 00 00 48 c1 e1 04 48 01 ca 48 03 90 c8 00 00 00 <48> 89 7a 30 44 89 52 3c 44 89 42 38 40 f6 c7 01 75 74 48 89 fa 83 RSP: 0018:ffffa9bec02a8d50 EFLAGS: 00010287 RAX: ffff925b22e80a00 RBX:
ffff925ad38d2700 RCX: fffffffe0a0c8000 RDX: ffff9258ea95bac0 RSI: ffff925ae0a0c800 RDI: 0000000000037a40 RBP: 0000000000000024 R08: 0000000000000000 R09: 0000000000000021 R10: 0000000000000848 R11:
0000000000000000 R12: ffffa9bec02a8e24 R13: ffff925ad8615570 R14: 0000000000000000 R15: ffff925b22e80a00 FS: 0000000000000000(0000) GS:ffff925e47880000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff9258ea95baf0 CR3: 0000000166022004 CR4: 0000000000f72ef0 PKRU: 55555554 Call Trace: <IRQ> aq_ring_rx_clean+0x175/0xe60 [atlantic] ? aq_ring_rx_clean+0x14d/0xe60 [atlantic] ? aq_ring_tx_clean+0xdf/0x190 [atlantic] ? kmem_cache_free+0x348/0x450 ? aq_vec_poll+0x81/0x1d0 [atlantic] ?
__napi_poll+0x28/0x1c0 ? net_rx_action+0x337/0x420 ``` Changes in v4: - Add Fixes: tag to satisfy patch validation requirements. Changes in v3: - Fix by assuming there will be an extra frag if buff->len >
AQ_CFG_RX_HDR_SIZE, then all fragments are accounted for. (CVE-2025-68301)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68301
https://security-tracker.debian.org/tracker/CVE-2025-68301
https://ubuntu.com/security/CVE-2025-68301

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68301

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278777 - Linux Distros Unpatched Vulnerability : CVE-2025-68305
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: hci_sock: Prevent race in socket write iter and sock bind There is a potential race condition between sock bind and socket write iter. bind may free the same cmd via mgmt_pending before write iter sends the cmd, just as syzbot reported in UAF[1]. Here we use hci_dev_lock to synchronize the two, thereby avoiding the UAF mentioned in [1]. [1] syzbot reported: BUG: KASAN: slab-use-after-free in mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316 Read of size 8 at addr ffff888077164818 by task syz.0.17/5989 Call Trace: mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316 set_link_security+0x5c2/0x710 net/bluetooth/mgmt.c:1918 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 sock_write_iter+0x279/0x360 net/socket.c:1195 Allocated by task 5989: mgmt_pending_add+0x35/0x140 net/bluetooth/mgmt_util.c:296 set_link_security+0x557/0x710 net/bluetooth/mgmt.c:1910 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 sock_write_iter+0x279/0x360 net/socket.c:1195 Freed by task 5991: mgmt_pending_free net/bluetooth/mgmt_util.c:311 [inline] mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257 mgmt_index_removed+0x112/0x2f0 net/bluetooth/mgmt.c:9477 hci_sock_bind+0xbe9/0x1000 net/bluetooth/hci_sock.c:1314 (CVE-2025-68305)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68305
https://security-tracker.debian.org/tracker/CVE-2025-68305
https://ubuntu.com/security/CVE-2025-68305

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:A/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68305

Plugin Information
Published: 2025/12/16, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278906 - Linux Distros Unpatched Vulnerability : CVE-2025-68312
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usbnet: Prevents free active kevent The root cause of this issue are: 1. When probing the usbnet device, executing usbnet_link_change(dev, 0, 0); put the kevent work in global workqueue. However, the kevent has not yet been scheduled when the usbnet device is unregistered. Therefore, executing free_netdev() results in the free active object (kevent) error reported here. 2. Another factor is that when calling usbnet_disconnect()->unregister_netdev(), if the usbnet device is up, ndo_stop() is executed to cancel the kevent. However, because the device is not up, ndo_stop() is not executed. The solution to this problem is to cancel the kevent before executing free_netdev(). (CVE-2025-68312)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68312
https://security-tracker.debian.org/tracker/CVE-2025-68312
https://ubuntu.com/security/CVE-2025-68312

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68312

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279577 - Linux Distros Unpatched Vulnerability : CVE-2025-68331
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer When a UAS device is unplugged during data transfer, there is a probability of a system panic occurring. The root cause is an access to an invalid memory address during URB callback handling. Specifically, this happens when the dma_direct_unmap_sg() function is called within the usb_hcd_unmap_urb_for_dma() interface, but the sg->dma_address field is 0 and the sg data structure has already been freed. The SCSI driver sends transfer commands by invoking uas_queuecommand_lck() in uas.c, using the uas_submit_urbs() function to submit requests to USB. Within the uas_submit_urbs() implementation, three URBs (sense_urb, data_urb, and cmd_urb) are sequentially submitted. Device removal may occur at any point during uas_submit_urbs execution, which may result in URB submission failure. However, some URBs might have been successfully submitted before the failure, and uas_submit_urbs will return the -ENODEV error code in this case. The current error handling directly calls scsi_done(). In the SCSI driver, this eventually triggers scsi_complete() to invoke scsi_end_request() for releasing the sgtable. The successfully submitted URBs, when being unlinked to giveback, call usb_hcd_unmap_urb_for_dma() in hcd.c, leading to exceptions during sg unmapping operations since the sg data structure has already been freed. This patch modifies the error condition check in the uas_submit_urbs() function. When a UAS device is removed but one or more URBs have already been successfully submitted to USB, it avoids immediately invoking scsi_done() and save the cmnd to devinfo->cmnd array. If the successfully submitted URBs is completed before devinfo->resetting being set, then the scsi_done() function will be called within uas_try_complete() after all pending URB operations are finalized. Otherwise, the scsi_done() function will be called within uas_zap_pending(), which is executed after usb_kill_anchored_urbs(). The error handling only takes effect when uas_queuecommand_lck() calls uas_submit_urbs() and returns the error value -ENODEV . In this case, the device is disconnected, and the flow proceeds to uas_disconnect(), where uas_zap_pending() is invoked to call uas_try_complete(). (CVE-2025-68331)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68331
https://security-tracker.debian.org/tracker/CVE-2025-68331
https://ubuntu.com/security/CVE-2025-68331

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68331

Plugin Information
Published: 2025/12/22, Modified: 2025/12/23
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279642 - Linux Distros Unpatched Vulnerability : CVE-2025-68340
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- team: Move team device type change at the end of team_port_add Attempting to add a port device that is already up will expectedly fail, but not before modifying the team device header_ops. In the case of the syzbot reproducer the gre0 device is already in state UP when it attempts to add it as a port device of team0, this fails but before that header_ops->create of team0 is changed from eth_header to ipgre_header in the call to team_dev_type_check_change. Later when we end up in ipgre_header() struct ip_tunnel* points to nonsense as the private data of the device still holds a struct team. Example sequence of iproute2 commands to reproduce the hang/BUG(): ip link add dev team0 type team ip link add dev gre0 type gre ip link set dev gre0 up ip link set dev gre0 master team0 ip link set dev team0 up ping -I team0 1.1.1.1 Move team_dev_type_check_change down where all other checks have passed as it changes the dev type with no way to restore it in case one of the checks that follow it fail. Also make sure to preserve the origial mtu assignment: - If port_dev is not the same type as dev, dev takes mtu from port_dev - If port_dev is the same type as dev, port_dev takes mtu from dev This is done by adding a conditional before the call to dev_set_mtu to prevent it from assigning port_dev->mtu = dev->mtu and instead letting team_dev_type_check_change assign dev->mtu = port_dev->mtu. The conditional is needed because the patch moves the call to team_dev_type_check_change past dev_set_mtu. Testing: - team device driver in-tree selftests - Add/remove various devices as slaves of team device - syzbot (CVE-2025-68340)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68340
https://security-tracker.debian.org/tracker/CVE-2025-68340
https://ubuntu.com/security/CVE-2025-68340

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68340

Plugin Information
Published: 2025/12/23, Modified: 2025/12/24
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279787 - Linux Distros Unpatched Vulnerability : CVE-2025-68354
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex regulator_supply_alias_list was accessed without any locking in regulator_supply_alias(), regulator_register_supply_alias(), and regulator_unregister_supply_alias(). Concurrent registration, unregistration and lookups can race, leading to: 1 use-after-free if an alias entry is removed while being read, 2 duplicate entries when two threads register the same alias, 3 inconsistent alias mappings observed by consumers. Protect all traversals, insertions and deletions on regulator_supply_alias_list with the existing regulator_list_mutex.
(CVE-2025-68354)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68354
https://security-tracker.debian.org/tracker/CVE-2025-68354
https://ubuntu.com/security/CVE-2025-68354

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68354

Plugin Information
Published: 2025/12/24, Modified: 2025/12/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279715 - Linux Distros Unpatched Vulnerability : CVE-2025-68357
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- iomap: allocate s_dio_done_wq for async reads as well Since commit 222f2c7c6d14 (iomap: always run error completions in user context), read error completions are deferred to s_dio_done_wq. This means the workqueue also needs to be allocated for async reads. (CVE-2025-68357)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68357
https://security-tracker.debian.org/tracker/CVE-2025-68357
https://ubuntu.com/security/CVE-2025-68357

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68357

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279699 - Linux Distros Unpatched Vulnerability : CVE-2025-68360
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks MT7996 driver can use both wed and wed_hif2 devices to offload traffic from/to the wireless NIC. In the current codebase we assume to always use the primary wed device in wed callbacks resulting in the following crash if the hw runs wed_hif2 (e.g.
6GHz link). [ 297.455876] Unable to handle kernel read from unreadable memory at virtual address 000000000000080a [ 297.464928] Mem abort info: [ 297.467722] ESR = 0x0000000096000005 [ 297.471461] EC = 0x25: DABT (current EL), IL = 32 bits [ 297.476766] SET = 0, FnV = 0 [ 297.479809] EA = 0, S1PTW = 0 [ 297.482940] FSC = 0x05: level 1 translation fault [ 297.487809] Data abort info: [ 297.490679] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 297.496156] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 297.501196] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 297.506500] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000107480000 [ 297.512927] [000000000000080a] pgd=08000001097fb003, p4d=08000001097fb003, pud=08000001097fb003, pmd=0000000000000000 [ 297.523532] Internal error: Oops: 0000000096000005 [#1] SMP [ 297.715393] CPU: 2 UID: 0 PID: 45 Comm: kworker/u16:2 Tainted: G O 6.12.50 #0 [ 297.723908] Tainted:
[O]=OOT_MODULE [ 297.727384] Hardware name: Banana Pi BPI-R4 (2x SFP+) (DT) [ 297.732857] Workqueue:
nf_ft_offload_del nf_flow_rule_route_ipv6 [nf_flow_table] [ 297.740254] pstate: 60400005 (nZCv daif +PAN
-UAO -TCO -DIT -SSBS BTYPE=--) [ 297.747205] pc : mt76_wed_offload_disable+0x64/0xa0 [mt76] [ 297.752688] lr : mtk_wed_flow_remove+0x58/0x80 [ 297.757126] sp : ffffffc080fe3ae0 [ 297.760430] x29: ffffffc080fe3ae0 x28: ffffffc080fe3be0 x27: 00000000deadbef7 [ 297.767557] x26: ffffff80c5ebca00 x25: 0000000000000001 x24:
ffffff80c85f4c00 [ 297.774683] x23: ffffff80c1875b78 x22: ffffffc080d42cd0 x21: ffffffc080660018 [ 297.781809] x20: ffffff80c6a076d0 x19: ffffff80c6a043c8 x18: 0000000000000000 [ 297.788935] x17:
0000000000000000 x16: 0000000000000001 x15: 0000000000000000 [ 297.796060] x14: 0000000000000019 x13:
ffffff80c0ad8ec0 x12: 00000000fa83b2da [ 297.803185] x11: ffffff80c02700c0 x10: ffffff80c0ad8ec0 x9 :
ffffff81fef96200 [ 297.810311] x8 : ffffff80c02700c0 x7 : ffffff80c02700d0 x6 : 0000000000000002 [ 297.817435] x5 : 0000000000000400 x4 : 0000000000000000 x3 : 0000000000000000 [ 297.824561] x2 :
0000000000000001 x1 : 0000000000000800 x0 : ffffff80c6a063c8 [ 297.831686] Call trace: [ 297.834123] mt76_wed_offload_disable+0x64/0xa0 [mt76] [ 297.839254] mtk_wed_flow_remove+0x58/0x80 [ 297.843342] mtk_flow_offload_cmd+0x434/0x574 [ 297.847689] mtk_wed_setup_tc_block_cb+0x30/0x40 [ 297.852295] nf_flow_offload_ipv6_hook+0x7f4/0x964 [nf_flow_table] [ 297.858466] nf_flow_rule_route_ipv6+0x438/0x4a4 [nf_flow_table] [ 297.864463] process_one_work+0x174/0x300 [ 297.868465] worker_thread+0x278/0x430 [ 297.872204] kthread+0xd8/0xdc [ 297.875251] ret_from_fork+0x10/0x20 [ 297.878820] Code: 928b5ae0 8b000273 91400a60 f943fa61 (79401421) [ 297.884901] ---[ end trace 0000000000000000 ]--- Fix the issue detecting the proper wed reference to use running wed callabacks. (CVE-2025-68360)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68360
https://security-tracker.debian.org/tracker/CVE-2025-68360
https://ubuntu.com/security/CVE-2025-68360

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68360

Plugin Information
Published: 2025/12/24, Modified: 2025/12/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279712 - Linux Distros Unpatched Vulnerability : CVE-2025-68363
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Check skb->transport_header is set in bpf_skb_check_mtu The bpf_skb_check_mtu helper needs to use skb->transport_header when the BPF_MTU_CHK_SEGS flag is used: bpf_skb_check_mtu(skb, ifindex, &mtu_len, 0, BPF_MTU_CHK_SEGS) The transport_header is not always set. There is a WARN_ON_ONCE report when CONFIG_DEBUG_NET is enabled + skb->gso_size is set + bpf_prog_test_run is used: WARNING: CPU: 1 PID: 2216 at ./include/linux/skbuff.h:3071 skb_gso_validate_network_len bpf_skb_check_mtu bpf_prog_3920e25740a41171_tc_chk_segs_flag # A test in the next patch bpf_test_run bpf_prog_test_run_skb For a normal ingress skb (not test_run), skb_reset_transport_header is performed but there is plan to avoid setting it as described in commit 2170a1f09148 (net: no longer reset transport_header in
__netif_receive_skb_core()). This patch fixes the bpf helper by checking skb_transport_header_was_set().
The check is done just before skb->transport_header is used, to avoid breaking the existing bpf prog. The WARN_ON_ONCE is limited to bpf_prog_test_run, so targeting bpf-next. (CVE-2025-68363)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68363
https://security-tracker.debian.org/tracker/CVE-2025-68363
https://ubuntu.com/security/CVE-2025-68363

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68363

Plugin Information
Published: 2025/12/24, Modified: 2025/12/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279739 - Linux Distros Unpatched Vulnerability : CVE-2025-68366
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nbd: defer config unlock in nbd_genl_connect There is one use-after-free warning when running NBD_CMD_CONNECT and NBD_CLEAR_SOCK: nbd_genl_connect nbd_alloc_and_init_config // config_refs=1 nbd_start_device // config_refs=2 set NBD_RT_HAS_CONFIG_REF open nbd // config_refs=3 recv_work done // config_refs=2 NBD_CLEAR_SOCK // config_refs=1 close nbd // config_refs=0 refcount_inc -> uaf ------------[ cut here ]------------ refcount_t: addition on 0; use-after-free. WARNING: CPU: 24 PID: 1014 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x290 nbd_genl_connect+0x16d0/0x1ab0 genl_family_rcv_msg_doit+0x1f3/0x310 genl_rcv_msg+0x44a/0x790 The issue can be easily reproduced by adding a small delay before refcount_inc(&nbd->config_refs) in nbd_genl_connect():
mutex_unlock(&nbd->config_lock); if (!ret) { set_bit(NBD_RT_HAS_CONFIG_REF, &config->runtime_flags); + printk(before sleep ); + mdelay(5 * 1000); + printk(after sleep ); refcount_inc(&nbd->config_refs);
nbd_connect_reply(info, nbd->index); } (CVE-2025-68366)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68366
https://security-tracker.debian.org/tracker/CVE-2025-68366
https://ubuntu.com/security/CVE-2025-68366

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68366

Plugin Information
Published: 2025/12/24, Modified: 2025/12/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279746 - Linux Distros Unpatched Vulnerability : CVE-2025-68372
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nbd: defer config put in recv_work There is one uaf issue in recv_work when running NBD_CLEAR_SOCK and NBD_CMD_RECONFIGURE: nbd_genl_connect // conf_ref=2 (connect and recv_work A) nbd_open // conf_ref=3 recv_work A done // conf_ref=2 NBD_CLEAR_SOCK // conf_ref=1 nbd_genl_reconfigure // conf_ref=2 (trigger recv_work B) close nbd // conf_ref=1 recv_work B config_put // conf_ref=0 atomic_dec(&config->recv_threads); -> UAF Or only running NBD_CLEAR_SOCK: nbd_genl_connect // conf_ref=2 nbd_open // conf_ref=3 NBD_CLEAR_SOCK // conf_ref=2 close nbd nbd_release config_put // conf_ref=1 recv_work config_put // conf_ref=0 atomic_dec(&config->recv_threads); -> UAF Commit 87aac3a80af5 (nbd:
call nbd_config_put() before notifying the waiter) moved nbd_config_put() to run before waking up the waiter in recv_work, in order to ensure that nbd_start_device_ioctl() would not be woken up while nbd->task_recv was still uncleared. However, in nbd_start_device_ioctl(), after being woken up it explicitly calls flush_workqueue() to make sure all current works are finished. Therefore, there is no need to move the config put ahead of the wakeup. Move nbd_config_put() to the end of recv_work, so that the reference is held for the whole lifetime of the worker thread. This makes sure the config cannot be freed while recv_work is still running, even if clear + reconfigure interleave. In addition, we don't need to worry about recv_work dropping the last nbd_put (which causes deadlock): path A (netlink with NBD_CFLAG_DESTROY_ON_DISCONNECT): connect // nbd_refs=1 (trigger recv_work) open nbd // nbd_refs=2 NBD_CLEAR_SOCK close nbd nbd_release nbd_disconnect_and_put flush_workqueue // recv_work done nbd_config_put nbd_put // nbd_refs=1 nbd_put // nbd_refs=0 queue_work path B (netlink without NBD_CFLAG_DESTROY_ON_DISCONNECT): connect // nbd_refs=2 (trigger recv_work) open nbd // nbd_refs=3 NBD_CLEAR_SOCK // conf_refs=2 close nbd nbd_release nbd_config_put // conf_refs=1 nbd_put // nbd_refs=2 recv_work done // conf_refs=0, nbd_refs=1 rmmod // nbd_refs=0 Depends-on: e2daec488c57 (nbd: Fix hungtask when nbd_config_put) (CVE-2025-68372)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68372
https://security-tracker.debian.org/tracker/CVE-2025-68372
https://ubuntu.com/security/CVE-2025-68372

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.2 (CVSS2#AV:L/AC:H/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
4.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68372

Plugin Information
Published: 2025/12/24, Modified: 2025/12/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279706 - Linux Distros Unpatched Vulnerability : CVE-2025-68374
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- md: fix rcu protection in md_wakeup_thread We attempted to use RCU to protect the pointer 'thread', but directly passed the value when calling md_wakeup_thread(). This means that the RCU pointer has been acquired before rcu_read_lock(), which renders rcu_read_lock() ineffective and could lead to a use-after- free. (CVE-2025-68374)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68374
https://security-tracker.debian.org/tracker/CVE-2025-68374
https://ubuntu.com/security/CVE-2025-68374

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68374

Plugin Information
Published: 2025/12/24, Modified: 2025/12/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279763 - Linux Distros Unpatched Vulnerability : CVE-2025-68378
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Fix stackmap overflow check in __bpf_get_stackid() Syzkaller reported a KASAN slab-out-of-bounds write in __bpf_get_stackid() when copying stack trace data. The issue occurs when the perf trace contains more stack entries than the stack map bucket can hold, leading to an out-of-bounds write in the bucket's data array. (CVE-2025-68378)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68378
https://security-tracker.debian.org/tracker/CVE-2025-68378
https://ubuntu.com/security/CVE-2025-68378

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68378

Plugin Information
Published: 2025/12/24, Modified: 2025/12/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279784 - Linux Distros Unpatched Vulnerability : CVE-2025-68724
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id Use check_add_overflow() to guard against potential integer overflows when adding the binary blob lengths and the size of an asymmetric_key_id structure and return ERR_PTR(-EOVERFLOW) accordingly. This prevents a possible buffer overflow when copying data from potentially malicious X.509 certificate fields that can be arbitrarily large, such as ASN.1 INTEGER serial numbers, issuer names, etc. (CVE-2025-68724)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68724
https://security-tracker.debian.org/tracker/CVE-2025-68724
https://ubuntu.com/security/CVE-2025-68724

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68724

Plugin Information
Published: 2025/12/24, Modified: 2025/12/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279824 - Linux Distros Unpatched Vulnerability : CVE-2025-68742
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Fix invalid prog->stats access when update_effective_progs fails Syzkaller triggers an invalid memory access issue following fault injection in update_effective_progs. The issue can be described as follows:
__cgroup_bpf_detach update_effective_progs compute_effective_progs bpf_prog_array_alloc <-- fault inject purge_effective_progs /* change to dummy_bpf_prog */ array->items[index] = &dummy_bpf_prog.prog ---softirq start--- __do_softirq ... __cgroup_bpf_run_filter_skb __bpf_prog_run_save_cb bpf_prog_run stats = this_cpu_ptr(prog->stats) /* invalid memory access */ flags = u64_stats_update_begin_irqsave(&stats->syncp) ---softirq end--- static_branch_dec(&cgroup_bpf_enabled_key[atype]) The reason is that fault injection caused update_effective_progs to fail and then changed the original prog into dummy_bpf_prog.prog in purge_effective_progs. Then a softirq came, and accessing the members of dummy_bpf_prog.prog in the softirq triggers invalid mem access. To fix it, skip updating stats when stats is NULL. (CVE-2025-68742)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68742
https://security-tracker.debian.org/tracker/CVE-2025-68742
https://ubuntu.com/security/CVE-2025-68742

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68742

Plugin Information
Published: 2025/12/24, Modified: 2025/12/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279753 - Linux Distros Unpatched Vulnerability : CVE-2025-68744
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Free special fields when update [lru_,]percpu_hash maps As [lru_,]percpu_hash maps support BPF_KPTR_{REF,PERCPU}, missing calls to 'bpf_obj_free_fields()' in 'pcpu_copy_value()' could cause the memory referenced by BPF_KPTR_{REF,PERCPU} fields to be held until the map gets freed. Fix this by calling 'bpf_obj_free_fields()' after 'copy_map_value[,_long]()' in 'pcpu_copy_value()'. (CVE-2025-68744)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68744
https://security-tracker.debian.org/tracker/CVE-2025-68744
https://ubuntu.com/security/CVE-2025-68744

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68744

Plugin Information
Published: 2025/12/24, Modified: 2025/12/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279800 - Linux Distros Unpatched Vulnerability : CVE-2025-68745
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: qla2xxx: Clear cmds after chip reset Commit aefed3e5548f (scsi: qla2xxx: target: Fix offline port handling and host reset handling) caused two problems: 1. Commands sent to FW, after chip reset got stuck and never freed as FW is not going to respond to them anymore. 2. BUG_ON(cmd->sg_mapped) in qlt_free_cmd(). Commit 26f9ce53817a (scsi: qla2xxx: Fix missed DMA unmap for aborted commands) attempted to fix this, but introduced another bug under different circumstances when two different CPUs were racing to call qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in dma_unmap_sg_attrs(). So revert scsi: qla2xxx: Fix missed DMA unmap for aborted commands and partially revert scsi: qla2xxx:
target: Fix offline port handling and host reset handling at __qla2x00_abort_all_cmds. (CVE-2025-68745)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68745
https://security-tracker.debian.org/tracker/CVE-2025-68745
https://ubuntu.com/security/CVE-2025-68745

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68745

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280113 - Linux Distros Unpatched Vulnerability : CVE-2025-68973
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.) (CVE-2025-68973)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68973
https://security-tracker.debian.org/tracker/CVE-2025-68973

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.9
EPSS Score
0.0001
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68973

Plugin Information
Published: 2025/12/28, Modified: 2026/01/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gnupg2
245465 - Linux Distros Unpatched Vulnerability : CVE-2025-7545
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability classified as problematic was found in GNU Binutils 2.45. Affected by this vulnerability is the function copy_section of the file binutils/objcopy.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is named 08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944. It is recommended to apply a patch to fix this issue. (CVE-2025-7545)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-7545
https://security-tracker.debian.org/tracker/CVE-2025-7545

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0001
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-7545

Plugin Information
Published: 2025/08/07, Modified: 2025/12/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-13-binutils
- gcc-toolset-13-binutils-devel
- gcc-toolset-13-binutils-gold
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
247053 - Linux Distros Unpatched Vulnerability : CVE-2025-7546
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability, which was classified as problematic, has been found in GNU Binutils 2.45. Affected by this issue is the function bfd_elf_set_group_contents of the file bfd/elf.c. The manipulation leads to out-of-bounds write. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The name of the patch is 41461010eb7c79fee7a9d5f6209accdaac66cc6b. It is recommended to apply a patch to fix this issue. (CVE-2025-7546)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-7546
https://security-tracker.debian.org/tracker/CVE-2025-7546

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
3.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
2.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-7546

Plugin Information
Published: 2025/08/09, Modified: 2025/12/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-13-binutils
- gcc-toolset-13-binutils-devel
- gcc-toolset-13-binutils-gold
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
259892 - Linux Distros Unpatched Vulnerability : CVE-2025-8851
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was determined in LibTIFF up to 4.5.1. Affected by this issue is the function readSeparateStripsetoBuffer of the file tools/tiffcrop.c of the component tiffcrop. The manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The patch is identified as 8a7a48d7a645992ca83062b3a1873c951661e2b3. It is recommended to apply a patch to fix this issue.
(CVE-2025-8851)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-8851
https://security-tracker.debian.org/tracker/CVE-2025-8851
https://ubuntu.com/security/CVE-2025-8851

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0001
CVSS v2.0 Base Score
4.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-8851

Plugin Information
Published: 2025/08/30, Modified: 2025/11/24
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libtiff
- libtiff-devel
259998 - Linux Distros Unpatched Vulnerability : CVE-2025-8961
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A weakness has been identified in LibTIFF 4.7.0. This affects the function main of the file tiffcrop.c of the component tiffcrop. Executing manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to the public and could be exploited.
(CVE-2025-8961)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-8961
https://security-tracker.debian.org/tracker/CVE-2025-8961

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.4 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-8961

Plugin Information
Published: 2025/08/31, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libtiff
- libtiff-devel
264804 - Linux Distros Unpatched Vulnerability : CVE-2025-9086
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- 1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3.
The same cookie name is set - but with just a slash as path (`path='/'`). Since this site is not secure, the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay. (CVE-2025-9086)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-9086
https://security-tracker.debian.org/tracker/CVE-2025-9086
https://ubuntu.com/security/CVE-2025-9086

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-9086

Plugin Information
Published: 2025/09/15, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- curl
- libcurl
242209 - RHEL 10 / 8 / 9 : java-21-openjdk (RHSA-2025:10873)
-
Synopsis
The remote Red Hat host is missing one or more security updates for java-21-openjdk.
Description
The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10873 advisory.
The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit.
Security Fix(es):
* JDK: Better Glyph drawing (CVE-2025-30749)
* JDK: Enhance TLS protocol support (CVE-2025-30754)
* JDK: Improve HTTP client header handling (CVE-2025-50059)
* JDK: Better Glyph drawing redux (CVE-2025-50106)
Bug Fix(es):
* In Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 systems, the default graphical display system is Wayland. The use of Wayland in these systems causes a failure in the traditional X11 method that java.awt.Robot uses to take a screen capture, producing a blank image. With this update, the RPM now recommends installing the PipeWire package, which the JDK can use to take screen captures in Wayland systems (RHEL-102683, RHEL-102684, RHEL-102685)
* On NUMA systems, the operating system can choose to migrate a task from one NUMA node to another. In the G1 garbage collector, G1AllocRegion objects are associated with NUMA nodes. The G1Allocator code assumes that obtaining the G1AllocRegion object for the current thread is sufficient, but OS scheduling can lead to arbitrary changes in the NUMA-to-thread association. This can cause crashes when the G1AllocRegion being used changes mid-operation. This update resolves this issue by always using the same NUMA node and associated G1AllocRegion object throughout an operation. (RHEL-90307, RHEL-90308, RHEL-90311)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
http://www.nessus.org/u?cd531471
https://access.redhat.com/errata/RHSA-2025:10873

Solution
Update the RHEL java-21-openjdk package based on the guidance in RHSA-2025:10873.
Risk Factor
High
CVSS v3.0 Base Score
8.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
7.6 (CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-30749
CVE | CVE-2025-30754
CVE | CVE-2025-50059
CVE | CVE-2025-50106
XREF | RHSA:2025:10873
XREF | CWE:122
XREF | CWE:201
XREF | CWE:325

Plugin Information
Published: 2025/07/16, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : java-21-openjdk-21.0.4.0.7-1.el9
Should be : java-21-openjdk-21.0.8.0.9-1.el9
Remote package installed : java-21-openjdk-demo-21.0.4.0.7-1.el9
Should be : java-21-openjdk-demo-21.0.8.0.9-1.el9
Remote package installed : java-21-openjdk-devel-21.0.4.0.7-1.el9
Should be : java-21-openjdk-devel-21.0.8.0.9-1.el9
Remote package installed : java-21-openjdk-headless-21.0.4.0.7-1.el9
Should be : java-21-openjdk-headless-21.0.8.0.9-1.el9
Remote package installed : java-21-openjdk-javadoc-21.0.4.0.7-1.el9
Should be : java-21-openjdk-javadoc-21.0.8.0.9-1.el9
Remote package installed : java-21-openjdk-javadoc-zip-21.0.4.0.7-1.el9
Should be : java-21-openjdk-javadoc-zip-21.0.8.0.9-1.el9
Remote package installed : java-21-openjdk-jmods-21.0.4.0.7-1.el9
Should be : java-21-openjdk-jmods-21.0.8.0.9-1.el9
Remote package installed : java-21-openjdk-src-21.0.4.0.7-1.el9
Should be : java-21-openjdk-src-21.0.8.0.9-1.el9
Remote package installed : java-21-openjdk-static-libs-21.0.4.0.7-1.el9
Should be : java-21-openjdk-static-libs-21.0.8.0.9-1.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
271222 - RHEL 10 / 8 / 9 : java-21-openjdk (RHSA-2025:18824)
-
Synopsis
The remote Red Hat host is missing one or more security updates for java-21-openjdk.
Description
The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:18824 advisory.
The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit.
Security Fix(es):
* JDK: Enhance Path Factories (CVE-2025-53066)
* JDK: Enhance Certificate Handling (CVE-2025-53057)
* JDK: Enhance String Handling (CVE-2025-61748)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
http://www.nessus.org/u?c6205136
https://access.redhat.com/errata/RHSA-2025:18824

Solution
Update the RHEL java-21-openjdk package based on the guidance in RHSA-2025:18824.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-53057
CVE | CVE-2025-53066
CVE | CVE-2025-61748
XREF | RHSA:2025:18824
XREF | CWE:581
XREF | CWE:838

Plugin Information
Published: 2025/10/23, Modified: 2025/10/24
Plugin Output

## tcp/0

Remote package installed : java-21-openjdk-21.0.4.0.7-1.el9
Should be : java-21-openjdk-21.0.9.0.10-1.el9
Remote package installed : java-21-openjdk-demo-21.0.4.0.7-1.el9
Should be : java-21-openjdk-demo-21.0.9.0.10-1.el9
Remote package installed : java-21-openjdk-devel-21.0.4.0.7-1.el9
Should be : java-21-openjdk-devel-21.0.9.0.10-1.el9
Remote package installed : java-21-openjdk-headless-21.0.4.0.7-1.el9
Should be : java-21-openjdk-headless-21.0.9.0.10-1.el9
Remote package installed : java-21-openjdk-javadoc-21.0.4.0.7-1.el9
Should be : java-21-openjdk-javadoc-21.0.9.0.10-1.el9
Remote package installed : java-21-openjdk-javadoc-zip-21.0.4.0.7-1.el9
Should be : java-21-openjdk-javadoc-zip-21.0.9.0.10-1.el9
Remote package installed : java-21-openjdk-jmods-21.0.4.0.7-1.el9
Should be : java-21-openjdk-jmods-21.0.9.0.10-1.el9
Remote package installed : java-21-openjdk-src-21.0.4.0.7-1.el9
Should be : java-21-openjdk-src-21.0.9.0.10-1.el9
Remote package installed : java-21-openjdk-static-libs-21.0.4.0.7-1.el9
Should be : java-21-openjdk-static-libs-21.0.9.0.10-1.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
242421 - RHEL 7 / 8 / 9 : java-11-openjdk ELS (RHSA-2025:10865)
-
Synopsis
The remote Red Hat host is missing one or more security updates for java-11-openjdk ELS.
Description
The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10865 advisory.
The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.
This release contains OpenJDK 11 with Extended Lifecycle Support for Red Hat Enterprise Linux versions 7, 8, and 9.
Security Fix(es):
* JDK: Better Glyph drawing (CVE-2025-30749)
* JDK: Enhance TLS protocol support (CVE-2025-30754)
* JDK: Improve scripting supports (CVE-2025-30761)
* JDK: Improve HTTP client header handling (CVE-2025-50059)
* JDK: Better Glyph drawing redux (CVE-2025-50106)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
http://www.nessus.org/u?fb0e6cc6
https://access.redhat.com/errata/RHSA-2025:10865

Solution
Update the RHEL java-11-openjdk ELS package based on the guidance in RHSA-2025:10865.
Risk Factor
High
CVSS v3.0 Base Score
8.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
7.6 (CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-30749
CVE | CVE-2025-30754
CVE | CVE-2025-30761
CVE | CVE-2025-50059
CVE | CVE-2025-50106
XREF | RHSA:2025:10865
XREF | CWE:122
XREF | CWE:201
XREF | CWE:325

Plugin Information
Published: 2025/07/21, Modified: 2025/07/21
Plugin Output

## tcp/0

Remote package installed : java-11-openjdk-11.0.24.0.8-2.el9
Should be : java-11-openjdk-11.0.28.0.6-1.el9
Remote package installed : java-11-openjdk-demo-11.0.24.0.8-2.el9
Should be : java-11-openjdk-demo-11.0.28.0.6-1.el9
Remote package installed : java-11-openjdk-devel-11.0.24.0.8-2.el9
Should be : java-11-openjdk-devel-11.0.28.0.6-1.el9
Remote package installed : java-11-openjdk-headless-11.0.24.0.8-2.el9
Should be : java-11-openjdk-headless-11.0.28.0.6-1.el9
Remote package installed : java-11-openjdk-javadoc-11.0.24.0.8-2.el9
Should be : java-11-openjdk-javadoc-11.0.28.0.6-1.el9
Remote package installed : java-11-openjdk-javadoc-zip-11.0.24.0.8-2.el9
Should be : java-11-openjdk-javadoc-zip-11.0.28.0.6-1.el9
Remote package installed : java-11-openjdk-jmods-11.0.24.0.8-2.el9
Should be : java-11-openjdk-jmods-11.0.28.0.6-1.el9
Remote package installed : java-11-openjdk-src-11.0.24.0.8-2.el9
Should be : java-11-openjdk-src-11.0.28.0.6-1.el9
Remote package installed : java-11-openjdk-static-libs-11.0.24.0.8-2.el9
Should be : java-11-openjdk-static-libs-11.0.28.0.6-1.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
271267 - RHEL 7 / 8 / 9 : java-11-openjdk ELS (RHSA-2025:18818)
-
Synopsis
The remote Red Hat host is missing one or more security updates for java-11-openjdk ELS.
Description
The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:18818 advisory.
The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.
This release contains OpenJDK 11 with Extended Lifecycle Support for Red Hat Enterprise Linux versions 7, 8, and 9.
Security Fix(es):
* JDK: Enhance Path Factories (CVE-2025-53066)
* JDK: Enhance Certificate Handling (CVE-2025-53057)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
http://www.nessus.org/u?a030e0d3
https://access.redhat.com/errata/RHSA-2025:18818

Solution
Update the RHEL java-11-openjdk ELS package based on the guidance in RHSA-2025:18818.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-53057
CVE | CVE-2025-53066
XREF | RHSA:2025:18818
XREF | CWE:838

Plugin Information
Published: 2025/10/23, Modified: 2025/10/24
Plugin Output

## tcp/0

Remote package installed : java-11-openjdk-11.0.24.0.8-2.el9
Should be : java-11-openjdk-11.0.29.0.7-1.el9
Remote package installed : java-11-openjdk-demo-11.0.24.0.8-2.el9
Should be : java-11-openjdk-demo-11.0.29.0.7-1.el9
Remote package installed : java-11-openjdk-devel-11.0.24.0.8-2.el9
Should be : java-11-openjdk-devel-11.0.29.0.7-1.el9
Remote package installed : java-11-openjdk-headless-11.0.24.0.8-2.el9
Should be : java-11-openjdk-headless-11.0.29.0.7-1.el9
Remote package installed : java-11-openjdk-javadoc-11.0.24.0.8-2.el9
Should be : java-11-openjdk-javadoc-11.0.29.0.7-1.el9
Remote package installed : java-11-openjdk-javadoc-zip-11.0.24.0.8-2.el9
Should be : java-11-openjdk-javadoc-zip-11.0.29.0.7-1.el9
Remote package installed : java-11-openjdk-jmods-11.0.24.0.8-2.el9
Should be : java-11-openjdk-jmods-11.0.29.0.7-1.el9
Remote package installed : java-11-openjdk-src-11.0.24.0.8-2.el9
Should be : java-11-openjdk-src-11.0.29.0.7-1.el9
Remote package installed : java-11-openjdk-static-libs-11.0.24.0.8-2.el9
Should be : java-11-openjdk-static-libs-11.0.29.0.7-1.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
234652 - RHEL 7 / 8 / 9 : java-11-openjdk ELS (RHSA-2025:3848)
-
Synopsis
The remote Red Hat host is missing one or more security updates for java-11-openjdk ELS.
Description
The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:3848 advisory.
The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.
This release contains OpenJDK 11 with Extended Lifecycle Support for Red Hat Enterprise Linux versions 7, 8, and 9.
Security Fix(es):
* JDK: Better TLS connection support (CVE-2025-21587)
* JDK: Improve compiler transformations (CVE-2025-30691)
* JDK: Enhance Buffered Image handling (CVE-2025-30698)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
http://www.nessus.org/u?daf2abb1
https://access.redhat.com/errata/RHSA-2025:3848

Solution
Update the RHEL java-11-openjdk ELS package based on the guidance in RHSA-2025:3848.
Risk Factor
High
CVSS v3.0 Base Score
7.4 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.2
EPSS Score
0.0004
CVSS v2.0 Base Score
7.1 (CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-21587
CVE | CVE-2025-30691
CVE | CVE-2025-30698
XREF | RHSA:2025:3848
XREF | CWE:120
XREF | CWE:122
XREF | CWE:208

Plugin Information
Published: 2025/04/21, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : java-11-openjdk-11.0.24.0.8-2.el9
Should be : java-11-openjdk-11.0.27.0.6-1.el9
Remote package installed : java-11-openjdk-demo-11.0.24.0.8-2.el9
Should be : java-11-openjdk-demo-11.0.27.0.6-1.el9
Remote package installed : java-11-openjdk-devel-11.0.24.0.8-2.el9
Should be : java-11-openjdk-devel-11.0.27.0.6-1.el9
Remote package installed : java-11-openjdk-headless-11.0.24.0.8-2.el9
Should be : java-11-openjdk-headless-11.0.27.0.6-1.el9
Remote package installed : java-11-openjdk-javadoc-11.0.24.0.8-2.el9
Should be : java-11-openjdk-javadoc-11.0.27.0.6-1.el9
Remote package installed : java-11-openjdk-javadoc-zip-11.0.24.0.8-2.el9
Should be : java-11-openjdk-javadoc-zip-11.0.27.0.6-1.el9
Remote package installed : java-11-openjdk-jmods-11.0.24.0.8-2.el9
Should be : java-11-openjdk-jmods-11.0.27.0.6-1.el9
Remote package installed : java-11-openjdk-src-11.0.24.0.8-2.el9
Should be : java-11-openjdk-src-11.0.27.0.6-1.el9
Remote package installed : java-11-openjdk-static-libs-11.0.24.0.8-2.el9
Should be : java-11-openjdk-static-libs-11.0.27.0.6-1.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
209167 - RHEL 8 / 9 : java-1.8.0-openjdk (RHSA-2024:8117)
-
Synopsis
The remote Red Hat host is missing one or more security updates for java-1.8.0-openjdk.
Description
The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8117 advisory.
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.
Security Fix(es):
* giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161)
* JDK: Array indexing integer overflow (8328544) (CVE-2024-21210)
* JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208)
* JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217)
* JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2251025
https://bugzilla.redhat.com/show_bug.cgi?id=2318524
https://bugzilla.redhat.com/show_bug.cgi?id=2318526
https://bugzilla.redhat.com/show_bug.cgi?id=2318530
https://bugzilla.redhat.com/show_bug.cgi?id=2318534
http://www.nessus.org/u?d836d291
https://access.redhat.com/errata/RHSA-2024:8117

Solution
Update the RHEL java-1.8.0-openjdk package based on the guidance in RHSA-2024:8117.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0043
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-48161
CVE | CVE-2024-21208
CVE | CVE-2024-21210
CVE | CVE-2024-21217
CVE | CVE-2024-21235
XREF | RHSA:2024:8117
XREF | CWE:119
XREF | CWE:130
XREF | CWE:190
XREF | CWE:195
XREF | CWE:789

Plugin Information
Published: 2024/10/17, Modified: 2024/11/07
Plugin Output

## tcp/0

Remote package installed : java-1.8.0-openjdk-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-1.8.0.432.b06-2.el9
Remote package installed : java-1.8.0-openjdk-demo-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-demo-1.8.0.432.b06-2.el9
Remote package installed : java-1.8.0-openjdk-devel-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-devel-1.8.0.432.b06-2.el9
Remote package installed : java-1.8.0-openjdk-headless-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-headless-1.8.0.432.b06-2.el9
Remote package installed : java-1.8.0-openjdk-javadoc-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-javadoc-1.8.0.432.b06-2.el9
Remote package installed : java-1.8.0-openjdk-javadoc-zip-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-javadoc-zip-1.8.0.432.b06-2.el9
Remote package installed : java-1.8.0-openjdk-src-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-src-1.8.0.432.b06-2.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
242335 - RHEL 8 / 9 : java-1.8.0-openjdk (RHSA-2025:10862)
-
Synopsis
The remote Red Hat host is missing one or more security updates for java-1.8.0-openjdk.
Description
The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10862 advisory.
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.
Security Fix(es):
* JDK: Better Glyph drawing (CVE-2025-30749)
* JDK: Enhance TLS protocol support (CVE-2025-30754)
* JDK: Improve scripting supports (CVE-2025-30761)
* JDK: Better Glyph drawing redux (CVE-2025-50106)
Bug Fix(es):
* On certain system configurations where the IPv4 stack was preferred over IPv6 (either due to
-Djava.net.preferIPv4Stack=true being specified or no IPv6 interfaces being present), the method java.net.InetAddress.getLocalHost().getHostName() would return the fully qualified hostname instead of the short hostname. This behavior was only ever intended for Solaris systems and it deviated from the method's behavior for IPv6 interfaces. In this release, the method will return the short hostname on all interfaces. (RHEL-102904, RHEL-102905, RHEL-102906, RHEL-102907, RHEL-102908, RHEL-102909, RHEL-102910, RHEL-102911, RHEL-102912)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
http://www.nessus.org/u?a5459454
https://access.redhat.com/errata/RHSA-2025:10862

Solution
Update the RHEL java-1.8.0-openjdk package based on the guidance in RHSA-2025:10862.
Risk Factor
High
CVSS v3.0 Base Score
8.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
7.6 (CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-30749
CVE | CVE-2025-30754
CVE | CVE-2025-30761
CVE | CVE-2025-50106
XREF | RHSA:2025:10862
XREF | CWE:122
XREF | CWE:325

Plugin Information
Published: 2025/07/18, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : java-1.8.0-openjdk-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-1.8.0.462.b08-3.el9
Remote package installed : java-1.8.0-openjdk-demo-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-demo-1.8.0.462.b08-3.el9
Remote package installed : java-1.8.0-openjdk-devel-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-devel-1.8.0.462.b08-3.el9
Remote package installed : java-1.8.0-openjdk-headless-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-headless-1.8.0.462.b08-3.el9
Remote package installed : java-1.8.0-openjdk-javadoc-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-javadoc-1.8.0.462.b08-3.el9
Remote package installed : java-1.8.0-openjdk-javadoc-zip-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-javadoc-zip-1.8.0.462.b08-3.el9
Remote package installed : java-1.8.0-openjdk-src-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-src-1.8.0.462.b08-3.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
271273 - RHEL 8 / 9 : java-1.8.0-openjdk (RHSA-2025:18815)
-
Synopsis
The remote Red Hat host is missing one or more security updates for java-1.8.0-openjdk.
Description
The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:18815 advisory.
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.
Security Fix(es):
* JDK: Enhance Path Factories (CVE-2025-53066)
* JDK: Enhance Certificate Handling (CVE-2025-53057)
Bug Fix(es):
* Since the 8.8 release of Red Hat Enterprise Linux 8 and the 9.2 release of Red Hat Enterprise Linux 9, OpenJDK 8 has used a single build repackaged for each major Red Hat Enterprise Linux release. With this release, this same build is now also used by the following older releases: 8.2, 8.4, 8.6, and 9.0. On Red Hat Enterprise Linux 8.2 systems, this means that OpenJDK's FIPS mode will now be enabled by default when the system is in FIPS mode. To revert to the previous behaviour, use -Dcom.redhat.fips=false (RHEL-118777, RHEL-118778, RHEL-118779, RHEL-118782)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
http://www.nessus.org/u?b57979fb
https://access.redhat.com/errata/RHSA-2025:18815

Solution
Update the RHEL java-1.8.0-openjdk package based on the guidance in RHSA-2025:18815.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-53057
CVE | CVE-2025-53066
XREF | RHSA:2025:18815
XREF | CWE:838

Plugin Information
Published: 2025/10/23, Modified: 2025/10/24
Plugin Output

## tcp/0

Remote package installed : java-1.8.0-openjdk-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-1.8.0.472.b08-1.el9
Remote package installed : java-1.8.0-openjdk-demo-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-demo-1.8.0.472.b08-1.el9
Remote package installed : java-1.8.0-openjdk-devel-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-devel-1.8.0.472.b08-1.el9
Remote package installed : java-1.8.0-openjdk-headless-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-headless-1.8.0.472.b08-1.el9
Remote package installed : java-1.8.0-openjdk-javadoc-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-javadoc-1.8.0.472.b08-1.el9
Remote package installed : java-1.8.0-openjdk-javadoc-zip-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-javadoc-zip-1.8.0.472.b08-1.el9
Remote package installed : java-1.8.0-openjdk-src-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-src-1.8.0.472.b08-1.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
234662 - RHEL 8 / 9 : java-1.8.0-openjdk (RHSA-2025:3845)
-
Synopsis
The remote Red Hat host is missing one or more security updates for java-1.8.0-openjdk.
Description
The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:3845 advisory.
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.
Security Fix(es):
* JDK: Better TLS connection support (CVE-2025-21587)
* JDK: Improve compiler transformations (CVE-2025-30691)
* JDK: Enhance Buffered Image handling (CVE-2025-30698)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
http://www.nessus.org/u?a2309506
https://access.redhat.com/errata/RHSA-2025:3845

Solution
Update the RHEL java-1.8.0-openjdk package based on the guidance in RHSA-2025:3845.
Risk Factor
High
CVSS v3.0 Base Score
7.4 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.2
EPSS Score
0.0004
CVSS v2.0 Base Score
7.1 (CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-21587
CVE | CVE-2025-30691
CVE | CVE-2025-30698
XREF | RHSA:2025:3845
XREF | CWE:120
XREF | CWE:122
XREF | CWE:208

Plugin Information
Published: 2025/04/21, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : java-1.8.0-openjdk-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-1.8.0.452.b09-2.el9
Remote package installed : java-1.8.0-openjdk-demo-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-demo-1.8.0.452.b09-2.el9
Remote package installed : java-1.8.0-openjdk-devel-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-devel-1.8.0.452.b09-2.el9
Remote package installed : java-1.8.0-openjdk-headless-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-headless-1.8.0.452.b09-2.el9
Remote package installed : java-1.8.0-openjdk-javadoc-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-javadoc-1.8.0.452.b09-2.el9
Remote package installed : java-1.8.0-openjdk-javadoc-zip-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-javadoc-zip-1.8.0.452.b09-2.el9
Remote package installed : java-1.8.0-openjdk-src-1.8.0.422.b05-2.el9
Should be : java-1.8.0-openjdk-src-1.8.0.452.b09-2.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
209158 - RHEL 8 / 9 : java-11-openjdk (RHSA-2024:8121)
-
Synopsis
The remote Red Hat host is missing one or more security updates for java-11-openjdk.
Description
The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8121 advisory.
The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.
Security Fix(es):
* giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161)
* JDK: Array indexing integer overflow (8328544) (CVE-2024-21210)
* JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208)
* JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217)
* JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2251025
https://bugzilla.redhat.com/show_bug.cgi?id=2318524
https://bugzilla.redhat.com/show_bug.cgi?id=2318526
https://bugzilla.redhat.com/show_bug.cgi?id=2318530
https://bugzilla.redhat.com/show_bug.cgi?id=2318534
http://www.nessus.org/u?c2523b04
https://access.redhat.com/errata/RHSA-2024:8121

Solution
Update the RHEL java-11-openjdk package based on the guidance in RHSA-2024:8121.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0043
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-48161
CVE | CVE-2024-21208
CVE | CVE-2024-21210
CVE | CVE-2024-21217
CVE | CVE-2024-21235
XREF | RHSA:2024:8121
XREF | CWE:119
XREF | CWE:130
XREF | CWE:190
XREF | CWE:195
XREF | CWE:789

Plugin Information
Published: 2024/10/16, Modified: 2024/11/07
Plugin Output

## tcp/0

Remote package installed : java-11-openjdk-11.0.24.0.8-2.el9
Should be : java-11-openjdk-11.0.25.0.9-2.el9
Remote package installed : java-11-openjdk-demo-11.0.24.0.8-2.el9
Should be : java-11-openjdk-demo-11.0.25.0.9-2.el9
Remote package installed : java-11-openjdk-devel-11.0.24.0.8-2.el9
Should be : java-11-openjdk-devel-11.0.25.0.9-2.el9
Remote package installed : java-11-openjdk-headless-11.0.24.0.8-2.el9
Should be : java-11-openjdk-headless-11.0.25.0.9-2.el9
Remote package installed : java-11-openjdk-javadoc-11.0.24.0.8-2.el9
Should be : java-11-openjdk-javadoc-11.0.25.0.9-2.el9
Remote package installed : java-11-openjdk-javadoc-zip-11.0.24.0.8-2.el9
Should be : java-11-openjdk-javadoc-zip-11.0.25.0.9-2.el9
Remote package installed : java-11-openjdk-jmods-11.0.24.0.8-2.el9
Should be : java-11-openjdk-jmods-11.0.25.0.9-2.el9
Remote package installed : java-11-openjdk-src-11.0.24.0.8-2.el9
Should be : java-11-openjdk-src-11.0.25.0.9-2.el9
Remote package installed : java-11-openjdk-static-libs-11.0.24.0.8-2.el9
Should be : java-11-openjdk-static-libs-11.0.25.0.9-2.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
209161 - RHEL 8 / 9 : java-17-openjdk (RHSA-2024:8124)
-
Synopsis
The remote Red Hat host is missing one or more security updates for java-17-openjdk.
Description
The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8124 advisory.
The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.
Security Fix(es):
* giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161)
* JDK: Array indexing integer overflow (8328544) (CVE-2024-21210)
* JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208)
* JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217)
* JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2251025
https://bugzilla.redhat.com/show_bug.cgi?id=2318524
https://bugzilla.redhat.com/show_bug.cgi?id=2318526
https://bugzilla.redhat.com/show_bug.cgi?id=2318530
https://bugzilla.redhat.com/show_bug.cgi?id=2318534
http://www.nessus.org/u?14affffc
https://access.redhat.com/errata/RHSA-2024:8124

Solution
Update the RHEL java-17-openjdk package based on the guidance in RHSA-2024:8124.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0043
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-48161
CVE | CVE-2024-21208
CVE | CVE-2024-21210
CVE | CVE-2024-21217
CVE | CVE-2024-21235
XREF | RHSA:2024:8124
XREF | CWE:119
XREF | CWE:130
XREF | CWE:190
XREF | CWE:195
XREF | CWE:789

Plugin Information
Published: 2024/10/16, Modified: 2024/11/07
Plugin Output

## tcp/0

Remote package installed : java-17-openjdk-17.0.12.0.7-2.el9
Should be : java-17-openjdk-17.0.13.0.11-3.el9
Remote package installed : java-17-openjdk-demo-17.0.12.0.7-2.el9
Should be : java-17-openjdk-demo-17.0.13.0.11-3.el9
Remote package installed : java-17-openjdk-devel-17.0.12.0.7-2.el9
Should be : java-17-openjdk-devel-17.0.13.0.11-3.el9
Remote package installed : java-17-openjdk-headless-17.0.12.0.7-2.el9
Should be : java-17-openjdk-headless-17.0.13.0.11-3.el9
Remote package installed : java-17-openjdk-javadoc-17.0.12.0.7-2.el9
Should be : java-17-openjdk-javadoc-17.0.13.0.11-3.el9
Remote package installed : java-17-openjdk-javadoc-zip-17.0.12.0.7-2.el9
Should be : java-17-openjdk-javadoc-zip-17.0.13.0.11-3.el9
Remote package installed : java-17-openjdk-jmods-17.0.12.0.7-2.el9
Should be : java-17-openjdk-jmods-17.0.13.0.11-3.el9
Remote package installed : java-17-openjdk-src-17.0.12.0.7-2.el9
Should be : java-17-openjdk-src-17.0.13.0.11-3.el9
Remote package installed : java-17-openjdk-static-libs-17.0.12.0.7-2.el9
Should be : java-17-openjdk-static-libs-17.0.13.0.11-3.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
242142 - RHEL 8 / 9 : java-17-openjdk (RHSA-2025:10867)
-
Synopsis
The remote Red Hat host is missing one or more security updates for java-17-openjdk.
Description
The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10867 advisory.
The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.
Security Fix(es):
* JDK: Better Glyph drawing (CVE-2025-30749)
* JDK: Enhance TLS protocol support (CVE-2025-30754)
* JDK: Improve HTTP client header handling (CVE-2025-50059)
* JDK: Better Glyph drawing redux (CVE-2025-50106)
Bug Fix(es):
* In Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 systems, the default graphical display system is Wayland. The use of Wayland in these systems causes a failure in the traditional X11 method that java.awt.Robot uses to take a screen capture, producing a blank image. With this update, the RPM now recommends installing the PipeWire package, which the JDK can use to take screen captures in Wayland systems (RHEL-102668, RHEL-102669, RHEL-102670, RHEL-102672)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
http://www.nessus.org/u?525ad5e4
https://access.redhat.com/errata/RHSA-2025:10867

Solution
Update the RHEL java-17-openjdk package based on the guidance in RHSA-2025:10867.
Risk Factor
High
CVSS v3.0 Base Score
8.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
7.6 (CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-30749
CVE | CVE-2025-30754
CVE | CVE-2025-50059
CVE | CVE-2025-50106
XREF | RHSA:2025:10867
XREF | CWE:122
XREF | CWE:201
XREF | CWE:325

Plugin Information
Published: 2025/07/16, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : java-17-openjdk-17.0.12.0.7-2.el9
Should be : java-17-openjdk-17.0.16.0.8-2.el9
Remote package installed : java-17-openjdk-demo-17.0.12.0.7-2.el9
Should be : java-17-openjdk-demo-17.0.16.0.8-2.el9
Remote package installed : java-17-openjdk-devel-17.0.12.0.7-2.el9
Should be : java-17-openjdk-devel-17.0.16.0.8-2.el9
Remote package installed : java-17-openjdk-headless-17.0.12.0.7-2.el9
Should be : java-17-openjdk-headless-17.0.16.0.8-2.el9
Remote package installed : java-17-openjdk-javadoc-17.0.12.0.7-2.el9
Should be : java-17-openjdk-javadoc-17.0.16.0.8-2.el9
Remote package installed : java-17-openjdk-javadoc-zip-17.0.12.0.7-2.el9
Should be : java-17-openjdk-javadoc-zip-17.0.16.0.8-2.el9
Remote package installed : java-17-openjdk-jmods-17.0.12.0.7-2.el9
Should be : java-17-openjdk-jmods-17.0.16.0.8-2.el9
Remote package installed : java-17-openjdk-src-17.0.12.0.7-2.el9
Should be : java-17-openjdk-src-17.0.16.0.8-2.el9
Remote package installed : java-17-openjdk-static-libs-17.0.12.0.7-2.el9
Should be : java-17-openjdk-static-libs-17.0.16.0.8-2.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
271219 - RHEL 8 / 9 : java-17-openjdk (RHSA-2025:18821)
-
Synopsis
The remote Red Hat host is missing one or more security updates for java-17-openjdk.
Description
The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:18821 advisory.
The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.
Security Fix(es):
* JDK: Enhance Path Factories (CVE-2025-53066)
* JDK: Enhance Certificate Handling (CVE-2025-53057)
Bug Fix(es):
* Since the 8.8 release of Red Hat Enterprise Linux 8 and the 9.2 release of Red Hat Enterprise Linux 9, OpenJDK 17 has used a single build repackaged for each major Red Hat Enterprise Linux release. With this release, this same build is now also used by the following older releases: 8.4, 8.6 and 9.0 (RHEL-118788, RHEL-118789, RHEL-118792)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
http://www.nessus.org/u?d3db181b
https://access.redhat.com/errata/RHSA-2025:18821

Solution
Update the RHEL java-17-openjdk package based on the guidance in RHSA-2025:18821.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-53057
CVE | CVE-2025-53066
XREF | RHSA:2025:18821
XREF | CWE:838

Plugin Information
Published: 2025/10/23, Modified: 2025/10/24
Plugin Output

## tcp/0

Remote package installed : java-17-openjdk-17.0.12.0.7-2.el9
Should be : java-17-openjdk-17.0.17.0.10-1.el9
Remote package installed : java-17-openjdk-demo-17.0.12.0.7-2.el9
Should be : java-17-openjdk-demo-17.0.17.0.10-1.el9
Remote package installed : java-17-openjdk-devel-17.0.12.0.7-2.el9
Should be : java-17-openjdk-devel-17.0.17.0.10-1.el9
Remote package installed : java-17-openjdk-headless-17.0.12.0.7-2.el9
Should be : java-17-openjdk-headless-17.0.17.0.10-1.el9
Remote package installed : java-17-openjdk-javadoc-17.0.12.0.7-2.el9
Should be : java-17-openjdk-javadoc-17.0.17.0.10-1.el9
Remote package installed : java-17-openjdk-javadoc-zip-17.0.12.0.7-2.el9
Should be : java-17-openjdk-javadoc-zip-17.0.17.0.10-1.el9
Remote package installed : java-17-openjdk-jmods-17.0.12.0.7-2.el9
Should be : java-17-openjdk-jmods-17.0.17.0.10-1.el9
Remote package installed : java-17-openjdk-src-17.0.12.0.7-2.el9
Should be : java-17-openjdk-src-17.0.17.0.10-1.el9
Remote package installed : java-17-openjdk-static-libs-17.0.12.0.7-2.el9
Should be : java-17-openjdk-static-libs-17.0.17.0.10-1.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
234670 - RHEL 8 / 9 : java-17-openjdk (RHSA-2025:3852)
-
Synopsis
The remote Red Hat host is missing one or more security updates for java-17-openjdk.
Description
The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:3852 advisory.
The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.
Security Fix(es):
* JDK: Better TLS connection support (CVE-2025-21587)
* JDK: Improve compiler transformations (CVE-2025-30691)
* JDK: Enhance Buffered Image handling (CVE-2025-30698)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
http://www.nessus.org/u?79d15e85
https://access.redhat.com/errata/RHSA-2025:3852

Solution
Update the RHEL java-17-openjdk package based on the guidance in RHSA-2025:3852.
Risk Factor
High
CVSS v3.0 Base Score
7.4 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.2
EPSS Score
0.0004
CVSS v2.0 Base Score
7.1 (CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-21587
CVE | CVE-2025-30691
CVE | CVE-2025-30698
XREF | RHSA:2025:3852
XREF | CWE:120
XREF | CWE:122
XREF | CWE:208

Plugin Information
Published: 2025/04/21, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : java-17-openjdk-17.0.12.0.7-2.el9
Should be : java-17-openjdk-17.0.15.0.6-2.el9
Remote package installed : java-17-openjdk-demo-17.0.12.0.7-2.el9
Should be : java-17-openjdk-demo-17.0.15.0.6-2.el9
Remote package installed : java-17-openjdk-devel-17.0.12.0.7-2.el9
Should be : java-17-openjdk-devel-17.0.15.0.6-2.el9
Remote package installed : java-17-openjdk-headless-17.0.12.0.7-2.el9
Should be : java-17-openjdk-headless-17.0.15.0.6-2.el9
Remote package installed : java-17-openjdk-javadoc-17.0.12.0.7-2.el9
Should be : java-17-openjdk-javadoc-17.0.15.0.6-2.el9
Remote package installed : java-17-openjdk-javadoc-zip-17.0.12.0.7-2.el9
Should be : java-17-openjdk-javadoc-zip-17.0.15.0.6-2.el9
Remote package installed : java-17-openjdk-jmods-17.0.12.0.7-2.el9
Should be : java-17-openjdk-jmods-17.0.15.0.6-2.el9
Remote package installed : java-17-openjdk-src-17.0.12.0.7-2.el9
Should be : java-17-openjdk-src-17.0.15.0.6-2.el9
Remote package installed : java-17-openjdk-static-libs-17.0.12.0.7-2.el9
Should be : java-17-openjdk-static-libs-17.0.15.0.6-2.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
209160 - RHEL 8 / 9 : java-21-openjdk (RHSA-2024:8127)
-
Synopsis
The remote Red Hat host is missing one or more security updates for java-21-openjdk.
Description
The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8127 advisory.
The OpenJDK 21 runtime environment.
Security Fix(es):
* giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161)
* JDK: Array indexing integer overflow (8328544) (CVE-2024-21210)
* JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208)
* JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217)
* JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2251025
https://bugzilla.redhat.com/show_bug.cgi?id=2318524
https://bugzilla.redhat.com/show_bug.cgi?id=2318526
https://bugzilla.redhat.com/show_bug.cgi?id=2318530
https://bugzilla.redhat.com/show_bug.cgi?id=2318534
http://www.nessus.org/u?9e2d6eed
https://access.redhat.com/errata/RHSA-2024:8127

Solution
Update the RHEL java-21-openjdk package based on the guidance in RHSA-2024:8127.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0043
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-48161
CVE | CVE-2024-21208
CVE | CVE-2024-21210
CVE | CVE-2024-21217
CVE | CVE-2024-21235
XREF | RHSA:2024:8127
XREF | CWE:119
XREF | CWE:130
XREF | CWE:190
XREF | CWE:195
XREF | CWE:789

Plugin Information
Published: 2024/10/16, Modified: 2024/11/07
Plugin Output

## tcp/0

Remote package installed : java-21-openjdk-21.0.4.0.7-1.el9
Should be : java-21-openjdk-21.0.5.0.10-3.el9
Remote package installed : java-21-openjdk-demo-21.0.4.0.7-1.el9
Should be : java-21-openjdk-demo-21.0.5.0.10-3.el9
Remote package installed : java-21-openjdk-devel-21.0.4.0.7-1.el9
Should be : java-21-openjdk-devel-21.0.5.0.10-3.el9
Remote package installed : java-21-openjdk-headless-21.0.4.0.7-1.el9
Should be : java-21-openjdk-headless-21.0.5.0.10-3.el9
Remote package installed : java-21-openjdk-javadoc-21.0.4.0.7-1.el9
Should be : java-21-openjdk-javadoc-21.0.5.0.10-3.el9
Remote package installed : java-21-openjdk-javadoc-zip-21.0.4.0.7-1.el9
Should be : java-21-openjdk-javadoc-zip-21.0.5.0.10-3.el9
Remote package installed : java-21-openjdk-jmods-21.0.4.0.7-1.el9
Should be : java-21-openjdk-jmods-21.0.5.0.10-3.el9
Remote package installed : java-21-openjdk-src-21.0.4.0.7-1.el9
Should be : java-21-openjdk-src-21.0.5.0.10-3.el9
Remote package installed : java-21-openjdk-static-libs-21.0.4.0.7-1.el9
Should be : java-21-openjdk-static-libs-21.0.5.0.10-3.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
234672 - RHEL 8 / 9 : java-21-openjdk (RHSA-2025:3855)
-
Synopsis
The remote Red Hat host is missing one or more security updates for java-21-openjdk.
Description
The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:3855 advisory.
The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit.
Security Fix(es):
* JDK: Better TLS connection support (CVE-2025-21587)
* JDK: Improve compiler transformations (CVE-2025-30691)
* JDK: Enhance Buffered Image handling (CVE-2025-30698)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
http://www.nessus.org/u?fd7d6df6
https://access.redhat.com/errata/RHSA-2025:3855

Solution
Update the RHEL java-21-openjdk package based on the guidance in RHSA-2025:3855.
Risk Factor
High
CVSS v3.0 Base Score
7.4 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.2
EPSS Score
0.0004
CVSS v2.0 Base Score
7.1 (CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-21587
CVE | CVE-2025-30691
CVE | CVE-2025-30698
XREF | RHSA:2025:3855
XREF | CWE:120
XREF | CWE:122
XREF | CWE:208

Plugin Information
Published: 2025/04/21, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : java-21-openjdk-21.0.4.0.7-1.el9
Should be : java-21-openjdk-21.0.7.0.6-1.el9
Remote package installed : java-21-openjdk-demo-21.0.4.0.7-1.el9
Should be : java-21-openjdk-demo-21.0.7.0.6-1.el9
Remote package installed : java-21-openjdk-devel-21.0.4.0.7-1.el9
Should be : java-21-openjdk-devel-21.0.7.0.6-1.el9
Remote package installed : java-21-openjdk-headless-21.0.4.0.7-1.el9
Should be : java-21-openjdk-headless-21.0.7.0.6-1.el9
Remote package installed : java-21-openjdk-javadoc-21.0.4.0.7-1.el9
Should be : java-21-openjdk-javadoc-21.0.7.0.6-1.el9
Remote package installed : java-21-openjdk-javadoc-zip-21.0.4.0.7-1.el9
Should be : java-21-openjdk-javadoc-zip-21.0.7.0.6-1.el9
Remote package installed : java-21-openjdk-jmods-21.0.4.0.7-1.el9
Should be : java-21-openjdk-jmods-21.0.7.0.6-1.el9
Remote package installed : java-21-openjdk-src-21.0.4.0.7-1.el9
Should be : java-21-openjdk-src-21.0.7.0.6-1.el9
Remote package installed : java-21-openjdk-static-libs-21.0.4.0.7-1.el9
Should be : java-21-openjdk-static-libs-21.0.7.0.6-1.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
177428 - RHEL 8 / 9 : texlive (RHSA-2023:3661)
-
Synopsis
The remote Red Hat host is missing a security update for texlive.
Description
The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3661 advisory.
The texlive packages contain TeXLive, an implementation of TeX for Linux or UNIX systems.
Security Fix(es):
* texlive: arbitrary code execution allows document complied with older version (CVE-2023-32700)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?683d72c5
https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2208943
https://access.redhat.com/errata/RHSA-2023:3661

Solution
Update the RHEL texlive package based on the guidance in RHSA-2023:3661.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0099
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-32700
XREF | RHSA:2023:3661
XREF | CWE:77

Plugin Information
Published: 2023/06/19, Modified: 2024/11/08
Plugin Output

## tcp/0

Remote package installed : texlive-lib-20200406-26.el9
Should be : texlive-lib-20200406-26.el9_2
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
232790 - RHEL 9 : .NET 9.0 (RHSA-2025:2668)
-
Synopsis
The remote Red Hat host is missing a security update.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2668 advisory.
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.104 and .NET Runtime 9.0.3.Security Fix(es):
* dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method (CVE-2025-24070)
Bug Fix(es) and Enhancement(s):
* dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method (BZ#2349733)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2349733
http://www.nessus.org/u?7c59bbb9
https://access.redhat.com/errata/RHSA-2025:2668

Solution
Update the affected packages.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H)
CVSS v3.0 Temporal Score
6.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.5
EPSS Score
0.0015
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-24070
XREF | RHSA:2025:2668
XREF | CWE:269

Plugin Information
Published: 2025/03/15, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : netstandard-targeting-pack-2.1-9.0.100~preview.7.24407.1-0.2.el9
Should be : netstandard-targeting-pack-2.1-9.0.104-1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237348 - RHEL 9 : .NET 9.0 (RHSA-2025:7600)
-
Synopsis
The remote Red Hat host is missing a security update for .NET 9.0.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7600 advisory.
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.106 and .NET Runtime 9.0.5.Security Fix(es):
* dotnet: .NET and Visual Studio Spoofing Vulnerability (CVE-2025-26646)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2365317
http://www.nessus.org/u?29d42fd2
https://access.redhat.com/errata/RHSA-2025:7600

Solution
Update the RHEL .NET 9.0 package based on the guidance in RHSA-2025:7600.
Risk Factor
High
CVSS v3.0 Base Score
8.0 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
9.0 (CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-26646
XREF | RHSA:2025:7600
XREF | CWE:290

Plugin Information
Published: 2025/05/27, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : aspnetcore-runtime-9.0-9.0.5-1
Should be : aspnetcore-runtime-9.0-9.0.5-1.el9_6
Remote package installed : aspnetcore-targeting-pack-9.0-9.0.5-1
Should be : aspnetcore-targeting-pack-9.0-9.0.5-1.el9_6
Remote package installed : dotnet-apphost-pack-9.0-9.0.5-1
Should be : dotnet-apphost-pack-9.0-9.0.5-1.el9_6
Remote package installed : dotnet-host-9.0.5-1
Should be : dotnet-host-9.0.5-1.el9_6
Remote package installed : dotnet-hostfxr-9.0-9.0.5-1
Should be : dotnet-hostfxr-9.0-9.0.5-1.el9_6
Remote package installed : dotnet-runtime-9.0-9.0.5-1
Should be : dotnet-runtime-9.0-9.0.5-1.el9_6
Remote package installed : dotnet-targeting-pack-9.0-9.0.5-1
Should be : dotnet-targeting-pack-9.0-9.0.5-1.el9_6
Remote package installed : netstandard-targeting-pack-2.1-9.0.100~preview.7.24407.1-0.2.el9
Should be : netstandard-targeting-pack-2.1-9.0.106-1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
240668 - RHEL 9 : .NET 9.0 (RHSA-2025:8817)
-
Synopsis
The remote Red Hat host is missing a security update for .NET 9.0.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8817 advisory.
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.107 and .NET Runtime 9.0.6.Security Fix(es):
* dotnet: .NET Remote Code Vulnerability (CVE-2025-30399)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2369701
http://www.nessus.org/u?fb52ec46
https://access.redhat.com/errata/RHSA-2025:8817

Solution
Update the RHEL .NET 9.0 package based on the guidance in RHSA-2025:8817.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0006
CVSS v2.0 Base Score
7.6 (CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-30399
XREF | RHSA:2025:8817
XREF | CWE:427

Plugin Information
Published: 2025/06/26, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : aspnetcore-runtime-9.0-9.0.5-1
Should be : aspnetcore-runtime-9.0-9.0.6-1.el9_6
Remote package installed : aspnetcore-targeting-pack-9.0-9.0.5-1
Should be : aspnetcore-targeting-pack-9.0-9.0.6-1.el9_6
Remote package installed : dotnet-apphost-pack-9.0-9.0.5-1
Should be : dotnet-apphost-pack-9.0-9.0.6-1.el9_6
Remote package installed : dotnet-host-9.0.5-1
Should be : dotnet-host-9.0.6-1.el9_6
Remote package installed : dotnet-hostfxr-9.0-9.0.5-1
Should be : dotnet-hostfxr-9.0-9.0.6-1.el9_6
Remote package installed : dotnet-runtime-9.0-9.0.5-1
Should be : dotnet-runtime-9.0-9.0.6-1.el9_6
Remote package installed : dotnet-targeting-pack-9.0-9.0.5-1
Should be : dotnet-targeting-pack-9.0-9.0.6-1.el9_6
Remote package installed : netstandard-targeting-pack-2.1-9.0.100~preview.7.24407.1-0.2.el9
Should be : netstandard-targeting-pack-2.1-9.0.107-1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
214280 - RHEL 9 : Securityes for NetworkManager (Moderate) (RHSA-2025:0377)
-
Synopsis
The remote Red Hat host is missing a security update.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0377 advisory.
NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services.
Security and bug fix(es):
* Routes in table different to main are not deleted on reapply [rhel-9.5.z] (JIRA:RHEL-73013)
* Route to VPN server not stored in routing table that is specified by ipv4.route-table [rhel-9.5.z] (JIRA:RHEL-73166)
* VPN connections do not support ipv4.routing-rules settings [rhel-9.5.z] (JIRA:RHEL-73167)
* CVE-2024-3661 NetworkManager: DHCP routing options can manipulate interface-based VPN traffic [rhel-9.5.z] (JIRA:RHEL-64726)
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
http://www.nessus.org/u?5ef771bd
https://access.redhat.com/errata/RHSA-2025:0377

Solution
Update the affected packages.
Risk Factor
High
CVSS v4.0 Base Score
2.1 (CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.6 (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
5.5
EPSS Score
0.0082
CVSS v2.0 Base Score
7.3 (CVSS2#AV:A/AC:L/Au:N/C:C/I:P/A:P)
CVSS v2.0 Temporal Score
5.7 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-3661
XREF | RHSA:2025:0377
XREF | CWE:501

Plugin Information
Published: 2025/01/16, Modified: 2025/09/10
Plugin Output

## tcp/0

Remote package installed : NetworkManager-1.48.10-2.el9_5
Should be : NetworkManager-1.48.10-5.el9_5
Remote package installed : NetworkManager-adsl-1.48.10-2.el9_5
Should be : NetworkManager-adsl-1.48.10-5.el9_5
Remote package installed : NetworkManager-bluetooth-1.48.10-2.el9_5
Should be : NetworkManager-bluetooth-1.48.10-5.el9_5
Remote package installed : NetworkManager-config-server-1.48.10-2.el9_5
Should be : NetworkManager-config-server-1.48.10-5.el9_5
Remote package installed : NetworkManager-libnm-1.48.10-2.el9_5
Should be : NetworkManager-libnm-1.48.10-5.el9_5
Remote package installed : NetworkManager-team-1.48.10-2.el9_5
Should be : NetworkManager-team-1.48.10-5.el9_5
Remote package installed : NetworkManager-tui-1.48.10-2.el9_5
Should be : NetworkManager-tui-1.48.10-5.el9_5
Remote package installed : NetworkManager-wifi-1.48.10-2.el9_5
Should be : NetworkManager-wifi-1.48.10-5.el9_5
Remote package installed : NetworkManager-wwan-1.48.10-2.el9_5
Should be : NetworkManager-wwan-1.48.10-5.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
235831 - RHEL 9 : aardvark-dns (RHSA-2025:7094)
-
Synopsis
The remote Red Hat host is missing a security update for aardvark-dns.
Description
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:7094 advisory.
Authoritative DNS server for A/AAAA container records Forwards other request to configured resolvers.
Read more about configuration in `src/backend/mod.rs`.
Security Fix(es):
* containers/aardvark-dns: TCP Query Handling Flaw in Aardvark-dns Leading to Denial of Service (CVE-2024-8418)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?a7e51e86
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2309683
https://issues.redhat.com/browse/RHEL-57695
http://www.nessus.org/u?5599bf5a
https://access.redhat.com/errata/RHSA-2025:7094

Solution
Update the RHEL aardvark-dns package based on the guidance in RHSA-2025:7094.
Risk Factor
High
CVSS v4.0 Base Score
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0053
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-8418
XREF | RHSA:2025:7094
XREF | CWE:400

Plugin Information
Published: 2025/05/13, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : aardvark-dns-1.12.1-1.el9
Should be : aardvark-dns-1.14.0-1.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
216501 - RHEL 9 : bind (RHSA-2025:1681)
-
Synopsis
The remote Red Hat host is missing a security update for bind.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:1681 advisory.
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.
Security Fix(es):
* bind: bind9: Many records in the additional section cause CPU exhaustion (CVE-2024-11187)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2342879
http://www.nessus.org/u?4d9d7cd8
https://access.redhat.com/errata/RHSA-2025:1681

Solution
Update the RHEL bind package based on the guidance in RHSA-2025:1681.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0008
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-11187
XREF | RHSA:2025:1681
XREF | CWE:400

Plugin Information
Published: 2025/02/19, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : bind-libs-9.16.23-24.el9_5
Should be : bind-libs-9.16.23-24.el9_5.3
Remote package installed : bind-license-9.16.23-24.el9_5
Should be : bind-license-9.16.23-24.el9_5.3
Remote package installed : bind-utils-9.16.23-24.el9_5
Should be : bind-utils-9.16.23-24.el9_5.3
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
274563 - RHEL 9 : bind (RHSA-2025:19951)
-
Synopsis
The remote Red Hat host is missing one or more security updates for bind.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19951 advisory.
BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.
Security Fix(es):
* Prevent cache poisoning due to weak PRNG (CVE-2025-40780)
* Address various spoofing attacks (CVE-2025-40778)
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2405827
https://bugzilla.redhat.com/show_bug.cgi?id=2405829
http://www.nessus.org/u?094e06a8
https://access.redhat.com/errata/RHSA-2025:19951

Solution
Update the RHEL bind package based on the guidance in RHSA-2025:19951.
Risk Factor
High
CVSS v3.0 Base Score
8.6 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
7.1
EPSS Score
0.0001
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-40778
CVE | CVE-2025-40780
XREF | RHSA:2025:19951
XREF | CWE:338
XREF | CWE:347

Plugin Information
Published: 2025/11/10, Modified: 2025/11/10
Plugin Output

## tcp/0

Remote package installed : bind-libs-9.16.23-24.el9_5
Should be : bind-libs-9.16.23-31.el9_6.2
Remote package installed : bind-license-9.16.23-24.el9_5
Should be : bind-license-9.16.23-31.el9_6.2
Remote package installed : bind-utils-9.16.23-24.el9_5
Should be : bind-utils-9.16.23-31.el9_6.2
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
275162 - RHEL 9 : bind (RHSA-2025:21110)
-
Synopsis
The remote Red Hat host is missing one or more security updates for bind.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:21110 advisory.
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.
Security Fix(es):
* bind: Cache poisoning attacks with unsolicited RRs (CVE-2025-40778)
* bind: Cache poisoning due to weak PRNG (CVE-2025-40780)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2405827
https://bugzilla.redhat.com/show_bug.cgi?id=2405829
http://www.nessus.org/u?7d006e8c
https://access.redhat.com/errata/RHSA-2025:21110

Solution
Update the RHEL bind package based on the guidance in RHSA-2025:21110.
Risk Factor
High
CVSS v3.0 Base Score
8.6 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
7.1
EPSS Score
0.0001
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-40778
CVE | CVE-2025-40780
XREF | RHSA:2025:21110
XREF | CWE:338
XREF | CWE:347

Plugin Information
Published: 2025/11/12, Modified: 2025/11/12
Plugin Output

## tcp/0

Remote package installed : bind-libs-9.16.23-24.el9_5
Should be : bind-libs-9.16.23-34.el9_7.1
Remote package installed : bind-license-9.16.23-24.el9_5
Should be : bind-license-9.16.23-34.el9_7.1
Remote package installed : bind-utils-9.16.23-24.el9_5
Should be : bind-utils-9.16.23-34.el9_7.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
279124 - RHEL 9 : binutils (RHSA-2025:23343)
-
Synopsis
The remote Red Hat host is missing a security update for binutils.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:23343 advisory.
The binutils packages provide a collection of binary utilities for the manipulation of object code in various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf, size, strings, strip, and addr2line utilities.
Security Fix(es):
* binutils: GNU Binutils Linker heap-based overflow (CVE-2025-11083)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2399948
http://www.nessus.org/u?e281682a
https://access.redhat.com/errata/RHSA-2025:23343

Solution
Update the RHEL binutils package based on the guidance in RHSA-2025:23343.
Risk Factor
Medium
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
4.3 (CVSS2#AV:L/AC:L/Au:S/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-11083
XREF | RHSA:2025:23343
XREF | CWE:122

Plugin Information
Published: 2025/12/18, Modified: 2025/12/18
Plugin Output

## tcp/0

Remote package installed : binutils-2.35.2-54.el9
Should be : binutils-2.35.2-67.el9_7.1
Remote package installed : binutils-gold-2.35.2-54.el9
Should be : binutils-gold-2.35.2-67.el9_7.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
210786 - RHEL 9 : buildah (RHSA-2024:9459)
-
Synopsis
The remote Red Hat host is missing one or more security updates for buildah.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:9459 advisory.
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.
Security Fix(es):
* go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion (CVE-2024-34155)
* encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)
* go/build/constraint: golang: Calling Parse on a // +build build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158)
* Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (CVE-2024-9341)
* Buildah: Podman: Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (CVE-2024-9407)
* buildah: Buildah allows arbitrary directory mount (CVE-2024-9675)
* Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (CVE-2024-9676)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2310527
https://bugzilla.redhat.com/show_bug.cgi?id=2310528
https://bugzilla.redhat.com/show_bug.cgi?id=2310529
https://bugzilla.redhat.com/show_bug.cgi?id=2315691
https://bugzilla.redhat.com/show_bug.cgi?id=2315887
https://bugzilla.redhat.com/show_bug.cgi?id=2317458
https://bugzilla.redhat.com/show_bug.cgi?id=2317467
https://issues.redhat.com/browse/RHEL-62107
http://www.nessus.org/u?0c9f1026
https://access.redhat.com/errata/RHSA-2024:9459

Solution
Update the RHEL buildah package based on the guidance in RHSA-2024:9459.
Risk Factor
High
CVSS v3.0 Base Score
8.2 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0261
CVSS v2.0 Base Score
8.5 (CVSS2#AV:N/AC:L/Au:N/C:C/I:P/A:N)
CVSS v2.0 Temporal Score
6.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-9341
CVE | CVE-2024-9407
CVE | CVE-2024-9675
CVE | CVE-2024-9676
CVE | CVE-2024-34155
CVE | CVE-2024-34156
CVE | CVE-2024-34158
XREF | RHSA:2024:9459
XREF | CWE:20
XREF | CWE:22
XREF | CWE:59
XREF | CWE:674
XREF | CWE:1325

Plugin Information
Published: 2024/11/12, Modified: 2025/03/06
Plugin Output

## tcp/0

Remote package installed : buildah-1.37.2-1.el9
Should be : buildah-1.37.5-1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
214943 - RHEL 9 : buildah (RHSA-2025:0923)
-
Synopsis
The remote Red Hat host is missing a security update for buildah.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0923 advisory.
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.
Security Fix(es):
* podman: buildah: Container breakout by using --jobs=2 and a race condition when building a malicious Containerfile (CVE-2024-11218)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2326231
http://www.nessus.org/u?099a24ad
https://access.redhat.com/errata/RHSA-2025:0923

Solution
Update the RHEL buildah package based on the guidance in RHSA-2025:0923.
Risk Factor
High
CVSS v3.0 Base Score
8.6 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
8.1
EPSS Score
0.0001
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-11218
XREF | RHSA:2025:0923
XREF | CWE:269

Plugin Information
Published: 2025/02/04, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : buildah-1.37.2-1.el9
Should be : buildah-1.37.6-1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237322 - RHEL 9 : buildah (RHSA-2025:7389)
-
Synopsis
The remote Red Hat host is missing a security update for buildah.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7389 advisory.
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.
Security Fix(es):
* go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2347423
https://issues.redhat.com/browse/RHEL-80997
https://issues.redhat.com/browse/RHEL-85114
http://www.nessus.org/u?85f502e3
https://access.redhat.com/errata/RHSA-2025:7389

Solution
Update the RHEL buildah package based on the guidance in RHSA-2025:7389.
Risk Factor
High
CVSS v4.0 Base Score
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-27144
XREF | RHSA:2025:7389
XREF | CWE:770

Plugin Information
Published: 2025/05/27, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : buildah-1.37.2-1.el9
Should be : buildah-1.39.4-1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237360 - RHEL 9 : compat-openssl11 (RHSA-2025:7937)
-
Synopsis
The remote Red Hat host is missing a security update for compat-openssl11.
Description
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:7937 advisory.
The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL package contains only the libraries from the 1.1.1 version and is provided for compatibility with previous releases.
Security Fix(es):
* openssl: X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2164440
http://www.nessus.org/u?69ee491b
https://access.redhat.com/errata/RHSA-2025:7937

Solution
Update the RHEL compat-openssl11 package based on the guidance in RHSA-2025:7937.
Risk Factor
High
CVSS v3.0 Base Score
7.4 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.8847
CVSS v2.0 Base Score
7.1 (CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-0286
XREF | RHSA:2025:7937
XREF | CWE:704

Plugin Information
Published: 2025/05/27, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : compat-openssl11-1.1.1k-4.el9_0
Should be : compat-openssl11-1.1.1k-5.el9_6.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
213157 - RHEL 9 : containernetworking-plugins (RHSA-2024:11216)
-
Synopsis
The remote Red Hat host is missing a security update for containernetworking-plugins.
Description
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:11216 advisory.
The Container Network Interface (CNI) project consists of a specification and libraries for writing plug- ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted.
Security Fix(es):
* encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2310528
http://www.nessus.org/u?2fa36773
https://access.redhat.com/errata/RHSA-2024:11216

Solution
Update the RHEL containernetworking-plugins package based on the guidance in RHSA-2024:11216.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0007
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-34156
XREF | RHSA:2024:11216
XREF | CWE:674

Plugin Information
Published: 2024/12/18, Modified: 2025/03/06
Plugin Output

## tcp/0

Remote package installed : containernetworking-plugins-1.5.1-2.el9
Should be : containernetworking-plugins-1.5.1-3.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
264555 - RHEL 9 : cups (RHSA-2025:15700)
-
Synopsis
The remote Red Hat host is missing one or more security updates for cups.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:15700 advisory.
The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.
Security Fix(es):
* cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS (CVE-2025-58364)
* cups: Authentication Bypass in CUPS Authorization Handling (CVE-2025-58060)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2392595
https://bugzilla.redhat.com/show_bug.cgi?id=2393078
http://www.nessus.org/u?26e02689
https://access.redhat.com/errata/RHSA-2025:15700

Solution
Update the RHEL cups package based on the guidance in RHSA-2025:15700.
Risk Factor
Medium
CVSS v3.0 Base Score
8.0 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.3
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-58060
CVE | CVE-2025-58364
XREF | RHSA:2025:15700
XREF | CWE:287
XREF | CWE:476

Plugin Information
Published: 2025/09/11, Modified: 2025/09/11
Plugin Output

## tcp/0

Remote package installed : cups-2.3.3op2-30.el9
Should be : cups-2.3.3op2-33.el9_6.1
Remote package installed : cups-client-2.3.3op2-30.el9
Should be : cups-client-2.3.3op2-33.el9_6.1
Remote package installed : cups-filesystem-2.3.3op2-30.el9
Should be : cups-filesystem-2.3.3op2-33.el9_6.1
Remote package installed : cups-ipptool-2.3.3op2-30.el9
Should be : cups-ipptool-2.3.3op2-33.el9_6.1
Remote package installed : cups-libs-2.3.3op2-30.el9
Should be : cups-libs-2.3.3op2-33.el9_6.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
216906 - RHEL 9 : emacs (RHSA-2025:1915)
-
Synopsis
The remote Red Hat host is missing a security update for emacs.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:1915 advisory.
GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.
Security Fix(es):
* emacs: Shell Injection Vulnerability in GNU Emacs via Custom man URI Scheme (CVE-2025-1244)
* emacs: Shell Injection Vulnerability in GNU Emacs via Custom man URI Scheme [rhel-9.5.z] (CVE-2025-1244)
Bug Fix(es):
* Eliminate use of obsolete %patchN syntax [rhel-9.5.z] (JIRA:RHEL-80450)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2345150
http://www.nessus.org/u?6609cd2c
https://access.redhat.com/errata/RHSA-2025:1915

Solution
Update the RHEL emacs package based on the guidance in RHSA-2025:1915.
Risk Factor
Critical
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0009
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-1244
XREF | RHSA:2025:1915
XREF | CWE:78

Plugin Information
Published: 2025/02/27, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : emacs-filesystem-27.2-10.el9
Should be : emacs-filesystem-27.2-11.el9_5.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
235700 - RHEL 9 : emacs (RHSA-2025:4787)
-
Synopsis
The remote Red Hat host is missing a security update for emacs.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:4787 advisory.
GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.
Security Fix(es):
* emacs: arbitrary code execution via Lisp macro expansion (CVE-2024-53920)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2329161
http://www.nessus.org/u?0911f772
https://access.redhat.com/errata/RHSA-2025:4787

Solution
Update the RHEL emacs package based on the guidance in RHSA-2025:4787.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-53920
XREF | RHSA:2025:4787
XREF | CWE:94

Plugin Information
Published: 2025/05/12, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : emacs-filesystem-27.2-10.el9
Should be : emacs-filesystem-27.2-11.el9_5.2
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
240478 - RHEL 9 : emacs (RHSA-2025:9448)
-
Synopsis
The remote Red Hat host is missing a security update for emacs.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9448 advisory.
GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.
Security Fix(es):
* emacs: arbitrary code execution via Lisp macro expansion (CVE-2024-53920)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2329161
http://www.nessus.org/u?0026b8e1
https://access.redhat.com/errata/RHSA-2025:9448

Solution
Update the RHEL emacs package based on the guidance in RHSA-2025:9448.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-53920
XREF | RHSA:2025:9448
XREF | CWE:94

Plugin Information
Published: 2025/06/25, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : emacs-filesystem-27.2-10.el9
Should be : emacs-filesystem-27.2-14.el9_6.2
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
277357 - RHEL 9 : expat (RHSA-2025:22175)
-
Synopsis
The remote Red Hat host is missing a security update for expat.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:22175 advisory.
Expat is a C library for parsing XML documents.
Security Fix(es):
* expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2395108
http://www.nessus.org/u?55bd623a
https://access.redhat.com/errata/RHSA-2025:22175

Solution
Update the RHEL expat package based on the guidance in RHSA-2025:22175.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-59375
XREF | RHSA:2025:22175
XREF | CWE:770

Plugin Information
Published: 2025/12/04, Modified: 2025/12/04
Plugin Output

## tcp/0

Remote package installed : expat-2.5.0-2.el9_4.1
Should be : expat-2.5.0-5.el9_7.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
233826 - RHEL 9 : expat (RHSA-2025:3531)
-
Synopsis
The remote Red Hat host is missing a security update for expat.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:3531 advisory.
Expat is a C library for parsing XML documents.
Security Fix(es):
* libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat (CVE-2024-8176)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2310137
http://www.nessus.org/u?7ae22599
https://access.redhat.com/errata/RHSA-2025:3531

Solution
Update the RHEL expat package based on the guidance in RHSA-2025:3531.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0069
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-8176
XREF | RHSA:2025:3531
XREF | CWE:674

Plugin Information
Published: 2025/04/03, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : expat-2.5.0-2.el9_4.1
Should be : expat-2.5.0-3.el9_5.3
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237372 - RHEL 9 : expat (RHSA-2025:7444)
-
Synopsis
The remote Red Hat host is missing a security update for expat.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7444 advisory.
Expat is a C library for parsing XML documents.
Security Fix(es):
* libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat (CVE-2024-8176)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2310137
http://www.nessus.org/u?40789494
https://access.redhat.com/errata/RHSA-2025:7444

Solution
Update the RHEL expat package based on the guidance in RHSA-2025:7444.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0069
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-8176
XREF | RHSA:2025:7444
XREF | CWE:674

Plugin Information
Published: 2025/05/27, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : expat-2.5.0-2.el9_4.1
Should be : expat-2.5.0-5.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
211995 - RHEL 9 : firefox (RHSA-2024:10702)
-
Synopsis
The remote Red Hat host is missing one or more security updates for firefox.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:10702 advisory.
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims (CVE-2024-11694)
* firefox: thunderbird: Unhandled Exception in Add-on Signature Verification (CVE-2024-11696)
* firefox: thunderbird: Select list elements could be shown over another site (CVE-2024-11692)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5 (CVE-2024-11699)
* firefox: thunderbird: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters (CVE-2024-11695)
* firefox: thunderbird: Improper Keypress Handling in Executable File Confirmation Dialog (CVE-2024-11697)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2328941
https://bugzilla.redhat.com/show_bug.cgi?id=2328943
https://bugzilla.redhat.com/show_bug.cgi?id=2328946
https://bugzilla.redhat.com/show_bug.cgi?id=2328947
https://bugzilla.redhat.com/show_bug.cgi?id=2328948
https://bugzilla.redhat.com/show_bug.cgi?id=2328950
http://www.nessus.org/u?b2b65dd9
https://access.redhat.com/errata/RHSA-2024:10702

Solution
Update the RHEL firefox package based on the guidance in RHSA-2024:10702.
Risk Factor
Critical
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0011
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
STIG Severity
I
References

CVE | CVE-2024-11692
CVE | CVE-2024-11694
CVE | CVE-2024-11695
CVE | CVE-2024-11696
CVE | CVE-2024-11697
CVE | CVE-2024-11699
XREF | RHSA:2024:10702
XREF | IAVA:2024-A-0769-S
XREF | CWE:79
XREF | CWE:120
XREF | CWE:354
XREF | CWE:356
XREF | CWE:451

Plugin Information
Published: 2024/12/02, Modified: 2025/03/22
Plugin Output

## tcp/0

Remote package installed : firefox-128.3.0-1.el9_4
Should be : firefox-128.5.1-1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
210031 - RHEL 9 : firefox (RHSA-2024:8726)
-
Synopsis
The remote Red Hat host is missing one or more security updates for firefox.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8726 advisory.
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in the browser (CVE-2024-10464)
* firefox: thunderbird: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response (CVE-2024-10461)
* firefox: thunderbird: Permission leak via embed or object elements (CVE-2024-10458)
* firefox: thunderbird: Use-after-free in layout with accessibility (CVE-2024-10459)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4 (CVE-2024-10467)
* firefox: thunderbird: Clipboard paste button persisted across tabs (CVE-2024-10465)
* firefox: DOM push subscription message could hang Firefox (CVE-2024-10466)
* firefox: thunderbird: Cross origin video frame leak (CVE-2024-10463)
* firefox: thunderbird: Origin of permission prompt could be spoofed by long URL (CVE-2024-10462)
* firefox: thunderbird: Confusing display of origin for external protocol handler prompt (CVE-2024-10460)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2322424
https://bugzilla.redhat.com/show_bug.cgi?id=2322425
https://bugzilla.redhat.com/show_bug.cgi?id=2322428
https://bugzilla.redhat.com/show_bug.cgi?id=2322429
https://bugzilla.redhat.com/show_bug.cgi?id=2322433
https://bugzilla.redhat.com/show_bug.cgi?id=2322434
https://bugzilla.redhat.com/show_bug.cgi?id=2322438
https://bugzilla.redhat.com/show_bug.cgi?id=2322439
https://bugzilla.redhat.com/show_bug.cgi?id=2322440
https://bugzilla.redhat.com/show_bug.cgi?id=2322444
http://www.nessus.org/u?3601ed72
https://access.redhat.com/errata/RHSA-2024:8726

Solution
Update the RHEL firefox package based on the guidance in RHSA-2024:8726.
Risk Factor
Critical
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0032
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-10458
CVE | CVE-2024-10459
CVE | CVE-2024-10460
CVE | CVE-2024-10461
CVE | CVE-2024-10462
CVE | CVE-2024-10463
CVE | CVE-2024-10464
CVE | CVE-2024-10465
CVE | CVE-2024-10466
CVE | CVE-2024-10467
XREF | RHSA:2024:8726
XREF | CWE:20
XREF | CWE:79
XREF | CWE:120
XREF | CWE:280
XREF | CWE:400
XREF | CWE:416
XREF | CWE:799
XREF | CWE:940
XREF | CWE:942

Plugin Information
Published: 2024/11/01, Modified: 2024/11/05
Plugin Output

## tcp/0

Remote package installed : firefox-128.3.0-1.el9_4
Should be : firefox-128.4.0-1.el9_4
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
213623 - RHEL 9 : firefox (RHSA-2025:0080)
-
Synopsis
The remote Red Hat host is missing one or more security updates for firefox.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:0080 advisory.
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* firefox: Use-after-free when breaking lines in text (CVE-2025-0238)
* firefox: Memory corruption when using JavaScript Text Segmentation (CVE-2025-0241)
* firefox: Alt-Svc ALPN validation failure when redirected (CVE-2025-0239)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6 (CVE-2025-0243)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6 (CVE-2025-0242)
* firefox: WebChannel APIs susceptible to confused deputy attack (CVE-2025-0237)
* firefox: Compartment mismatch when parsing JavaScript JSON module (CVE-2025-0240)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2336165
https://bugzilla.redhat.com/show_bug.cgi?id=2336168
https://bugzilla.redhat.com/show_bug.cgi?id=2336170
https://bugzilla.redhat.com/show_bug.cgi?id=2336175
https://bugzilla.redhat.com/show_bug.cgi?id=2336181
https://bugzilla.redhat.com/show_bug.cgi?id=2336182
https://bugzilla.redhat.com/show_bug.cgi?id=2336188
http://www.nessus.org/u?3582b524
https://access.redhat.com/errata/RHSA-2025:0080

Solution
Update the RHEL firefox package based on the guidance in RHSA-2025:0080.
Risk Factor
Critical
CVSS v3.0 Base Score
7.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.3
EPSS Score
0.0011
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
STIG Severity
I
References

CVE | CVE-2025-0237
CVE | CVE-2025-0238
CVE | CVE-2025-0239
CVE | CVE-2025-0240
CVE | CVE-2025-0241
CVE | CVE-2025-0242
CVE | CVE-2025-0243
XREF | RHSA:2025:0080
XREF | IAVA:2025-A-0009-S
XREF | CWE:119
XREF | CWE:120
XREF | CWE:416
XREF | CWE:441
XREF | CWE:601

Plugin Information
Published: 2025/01/09, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : firefox-128.3.0-1.el9_4
Should be : firefox-128.6.0-1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
254408 - RHEL 9 : firefox (RHSA-2025:14416)
-
Synopsis
The remote Red Hat host is missing one or more security updates for firefox.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:14416 advisory.
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component (CVE-2025-9182)
* thunderbird: firefox: Sandbox escape due to invalid pointer in the Audio/Video: GMP component (CVE-2025-9179)
* thunderbird: firefox: Same-origin policy bypass in the Graphics: Canvas2D component (CVE-2025-9180)
* thunderbird: firefox: Uninitialized memory in the JavaScript Engine component (CVE-2025-9181)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 (CVE-2025-9185)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2389575
https://bugzilla.redhat.com/show_bug.cgi?id=2389580
https://bugzilla.redhat.com/show_bug.cgi?id=2389581
https://bugzilla.redhat.com/show_bug.cgi?id=2389583
https://bugzilla.redhat.com/show_bug.cgi?id=2389584
http://www.nessus.org/u?c2d08667
https://access.redhat.com/errata/RHSA-2025:14416

Solution
Update the RHEL firefox package based on the guidance in RHSA-2025:14416.
Risk Factor
High
CVSS v3.0 Base Score
8.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.6 (CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-9179
CVE | CVE-2025-9180
CVE | CVE-2025-9181
CVE | CVE-2025-9182
CVE | CVE-2025-9185
XREF | RHSA:2025:14416
XREF | CWE:119
XREF | CWE:200
XREF | CWE:400
XREF | CWE:665

Plugin Information
Published: 2025/08/25, Modified: 2025/08/25
Plugin Output

## tcp/0

Remote package installed : firefox-128.3.0-1.el9_4
Should be : firefox-128.14.0-2.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
265350 - RHEL 9 : firefox (RHSA-2025:16108)
-
Synopsis
The remote Red Hat host is missing one or more security updates for firefox.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:16108 advisory.
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* firefox: thunderbird: Sandbox escape due to use-after-free in the Graphics: Canvas2D component (CVE-2025-10527)
* firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component (CVE-2025-10532)
* firefox: thunderbird: Sandbox escape due to undefined behavior, invalid pointer in the Graphics:
Canvas2D component (CVE-2025-10528)
* firefox: thunderbird: Same-origin policy bypass in the Layout component (CVE-2025-10529)
* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143 (CVE-2025-10537)
* firefox: thunderbird: Information disclosure in the Networking: Cache component (CVE-2025-10536)
* firefox: thunderbird: Integer overflow in the SVG component (CVE-2025-10533)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2395745
https://bugzilla.redhat.com/show_bug.cgi?id=2395754
https://bugzilla.redhat.com/show_bug.cgi?id=2395755
https://bugzilla.redhat.com/show_bug.cgi?id=2395756
https://bugzilla.redhat.com/show_bug.cgi?id=2395759
https://bugzilla.redhat.com/show_bug.cgi?id=2395764
https://bugzilla.redhat.com/show_bug.cgi?id=2395766
http://www.nessus.org/u?e0ff94a7
https://access.redhat.com/errata/RHSA-2025:16108

Solution
Update the RHEL firefox package based on the guidance in RHSA-2025:16108.
Risk Factor
Critical
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0005
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-10527
CVE | CVE-2025-10528
CVE | CVE-2025-10529
CVE | CVE-2025-10532
CVE | CVE-2025-10533
CVE | CVE-2025-10536
CVE | CVE-2025-10537
XREF | RHSA:2025:16108
XREF | CWE:125
XREF | CWE:190
XREF | CWE:416
XREF | CWE:824

Plugin Information
Published: 2025/09/17, Modified: 2025/09/17
Plugin Output

## tcp/0

Remote package installed : firefox-128.3.0-1.el9_4
Should be : firefox-140.3.0-1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
275372 - RHEL 9 : firefox (RHSA-2025:21280)
-
Synopsis
The remote Red Hat host is missing one or more security updates for firefox.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:21280 advisory.
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018)
* firefox: Use-after-free in the Audio/Video component (CVE-2025-13014)
* firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016)
* firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019)
* firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020)
* firefox: Race condition in the Graphics component (CVE-2025-13012)
* firefox: Spoofing issue in Firefox (CVE-2025-13015)
* firefox: Mitigation bypass in the DOM: Core & HTML component (CVE-2025-13013)
* firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2414079
https://bugzilla.redhat.com/show_bug.cgi?id=2414080
https://bugzilla.redhat.com/show_bug.cgi?id=2414083
https://bugzilla.redhat.com/show_bug.cgi?id=2414084
https://bugzilla.redhat.com/show_bug.cgi?id=2414085
https://bugzilla.redhat.com/show_bug.cgi?id=2414086
https://bugzilla.redhat.com/show_bug.cgi?id=2414090
https://bugzilla.redhat.com/show_bug.cgi?id=2414091
https://bugzilla.redhat.com/show_bug.cgi?id=2414092
http://www.nessus.org/u?ce59da0c
https://access.redhat.com/errata/RHSA-2025:21280

Solution
Update the RHEL firefox package based on the guidance in RHSA-2025:21280.
Risk Factor
Critical
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-13012
CVE | CVE-2025-13013
CVE | CVE-2025-13014
CVE | CVE-2025-13015
CVE | CVE-2025-13016
CVE | CVE-2025-13017
CVE | CVE-2025-13018
CVE | CVE-2025-13019
CVE | CVE-2025-13020
XREF | RHSA:2025:21280
XREF | CWE:79
XREF | CWE:290
XREF | CWE:346
XREF | CWE:366
XREF | CWE:501
XREF | CWE:787
XREF | CWE:825

Plugin Information
Published: 2025/11/13, Modified: 2025/11/13
Plugin Output

## tcp/0

Remote package installed : firefox-128.3.0-1.el9_4
Should be : firefox-140.5.0-1.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
232537 - RHEL 9 : firefox (RHSA-2025:2359)
-
Synopsis
The remote Red Hat host is missing one or more security updates for firefox.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2359 advisory.
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* firefox: Use-after-free in WebTransportChild (CVE-2025-1931)
* firefox: AudioIPC StreamData could trigger a use-after-free in the Browser process (CVE-2025-1930)
* firefox: Unexpected GC during RegExp bailout processing (CVE-2025-1934)
* firefox: Clickjacking the registerProtocolHandler info-bar Reporter (CVE-2025-1935)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8 (CVE-2025-1938)
* firefox: JIT corruption of WASM i32 return values on 64-bit CPUs (CVE-2025-1933)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8 (CVE-2025-1937)
* firefox: Inconsistent comparator in XSLT sorting led to out-of-bounds access (CVE-2025-1932)
* firefox: Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents (CVE-2025-1936)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2349786
https://bugzilla.redhat.com/show_bug.cgi?id=2349787
https://bugzilla.redhat.com/show_bug.cgi?id=2349790
https://bugzilla.redhat.com/show_bug.cgi?id=2349792
https://bugzilla.redhat.com/show_bug.cgi?id=2349793
https://bugzilla.redhat.com/show_bug.cgi?id=2349794
https://bugzilla.redhat.com/show_bug.cgi?id=2349795
https://bugzilla.redhat.com/show_bug.cgi?id=2349796
https://bugzilla.redhat.com/show_bug.cgi?id=2349797
http://www.nessus.org/u?89bd57f6
https://access.redhat.com/errata/RHSA-2025:2359

Solution
Update the RHEL firefox package based on the guidance in RHSA-2025:2359.
Risk Factor
Critical
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.9 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0018
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.8 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-1930
CVE | CVE-2025-1931
CVE | CVE-2025-1932
CVE | CVE-2025-1933
CVE | CVE-2025-1934
CVE | CVE-2025-1935
CVE | CVE-2025-1936
CVE | CVE-2025-1937
CVE | CVE-2025-1938
XREF | RHSA:2025:2359
XREF | CWE:120
XREF | CWE:125
XREF | CWE:416
XREF | CWE:460
XREF | CWE:754
XREF | CWE:843
XREF | CWE:1021

Plugin Information
Published: 2025/03/10, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : firefox-128.3.0-1.el9_4
Should be : firefox-128.8.0-1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
233932 - RHEL 9 : firefox (RHSA-2025:3556)
-
Synopsis
The remote Red Hat host is missing one or more security updates for firefox.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:3556 advisory.
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* firefox: thunderbird: URL Bar Spoofing via non-BMP Unicode characters (CVE-2025-3029)
* firefox: thunderbird: Use-after-free triggered by XSLTProcessor (CVE-2025-3028)
* firefox: thunderbird: Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9 (CVE-2025-3030)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2356556
https://bugzilla.redhat.com/show_bug.cgi?id=2356562
https://bugzilla.redhat.com/show_bug.cgi?id=2356563
http://www.nessus.org/u?19217816
https://access.redhat.com/errata/RHSA-2025:3556

Solution
Update the RHEL firefox package based on the guidance in RHSA-2025:3556.
Risk Factor
Critical
CVSS v3.0 Base Score
8.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.3 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0005
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.8 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-3028
CVE | CVE-2025-3029
CVE | CVE-2025-3030
XREF | RHSA:2025:3556
XREF | CWE:120
XREF | CWE:346
XREF | CWE:416

Plugin Information
Published: 2025/04/05, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : firefox-128.3.0-1.el9_4
Should be : firefox-128.9.0-2.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237377 - RHEL 9 : firefox (RHSA-2025:8049)
-
Synopsis
The remote Red Hat host is missing one or more security updates for firefox.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8049 advisory.
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* firefox: Out-of-bounds access when resolving Promise objects (CVE-2025-4918)
* firefox: Out-of-bounds access when optimizing linear sums (CVE-2025-4919)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2367016
https://bugzilla.redhat.com/show_bug.cgi?id=2367018
http://www.nessus.org/u?701eba1f
https://access.redhat.com/errata/RHSA-2025:8049

Solution
Update the RHEL firefox package based on the guidance in RHSA-2025:8049.
Risk Factor
Critical
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.9 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.8 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-4918
CVE | CVE-2025-4919
XREF | RHSA:2025:8049
XREF | CWE:787

Plugin Information
Published: 2025/05/27, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : firefox-128.3.0-1.el9_4
Should be : firefox-128.10.1-1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
200663 - RHEL 9 : flatpak (RHSA-2024:3959)
-
Synopsis
The remote Red Hat host is missing a security update for flatpak.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:3959 advisory.
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
* flatpak: sandbox escape via RequestBackground portal (CVE-2024-32462)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2275981
http://www.nessus.org/u?7e8d4ecd
https://access.redhat.com/errata/RHSA-2024:3959

Solution
Update the RHEL flatpak package based on the guidance in RHSA-2024:3959.
Risk Factor
Medium
CVSS v3.0 Base Score
8.4 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
7.3 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
7.1
EPSS Score
0.0014
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:N)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-32462
XREF | RHSA:2024:3959
XREF | CWE:88

Plugin Information
Published: 2024/06/17, Modified: 2024/11/07
Plugin Output

## tcp/0

Remote package installed : flatpak-1.12.9-1.el9
Should be : flatpak-1.12.9-1.el9_4
Remote package installed : flatpak-libs-1.12.9-1.el9
Should be : flatpak-libs-1.12.9-1.el9_4
Remote package installed : flatpak-selinux-1.12.9-1.el9
Should be : flatpak-selinux-1.12.9-1.el9_4
Remote package installed : flatpak-session-helper-1.12.9-1.el9
Should be : flatpak-session-helper-1.12.9-1.el9_4
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
233901 - RHEL 9 : freetype (RHSA-2025:3407)
-
Synopsis
The remote Red Hat host is missing a security update for freetype.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:3407 advisory.
FreeType is a free, high-quality, portable font engine that can open and manage font files. FreeType loads, hints, and renders individual glyphs efficiently.
Security Fix(es):
* freetype: OOB write when attempting to parse font subglyph structures related to TrueType GX and variable font files (CVE-2025-27363)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2351357
http://www.nessus.org/u?609732ba
https://access.redhat.com/errata/RHSA-2025:3407

Solution
Update the RHEL freetype package based on the guidance in RHSA-2025:3407.
Risk Factor
High
CVSS v3.0 Base Score
8.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.5 (CVSS:3.0/E:F/RL:O/RC:C)
VPR Score
7.4
EPSS Score
0.7668
CVSS v2.0 Base Score
7.6 (CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.3 (CVSS2#E:F/RL:OF/RC:C)
References

CVE | CVE-2025-27363
XREF | RHSA:2025:3407
XREF | CISA-KNOWN-EXPLOITED:2025/05/27
XREF | CWE:787

Plugin Information
Published: 2025/04/05, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : freetype-2.10.4-9.el9
Should be : freetype-2.10.4-10.el9_5
Remote package installed : freetype-devel-2.10.4-9.el9
Should be : freetype-devel-2.10.4-10.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
279114 - RHEL 9 : gcc-toolset-13-binutils (RHSA-2025:23336)
-
Synopsis
The remote Red Hat host is missing a security update for gcc-toolset-13-binutils.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:23336 advisory.
Binutils is a collection of binary utilities, including ar (for creating, modifying and extracting from archives), as (a family of GNU assemblers), gprof (for displaying call graph profile data), ld (the GNU linker), nm (for listing symbols from object files), objcopy (for copying and translating object files), objdump (for displaying information from object files), ranlib (for generating an index for the contents of an archive), readelf (for displaying detailed information about binary files), size (for listing the section sizes of an object or archive file), strings (for listing printable strings from files), strip (for discarding symbols), and addr2line (for converting addresses to file and line).
Security Fix(es):
* binutils: GNU Binutils Linker heap-based overflow (CVE-2025-11083)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2399948
http://www.nessus.org/u?adfbc861
https://access.redhat.com/errata/RHSA-2025:23336

Solution
Update the RHEL gcc-toolset-13-binutils package based on the guidance in RHSA-2025:23336.
Risk Factor
Medium
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
4.3 (CVSS2#AV:L/AC:L/Au:S/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-11083
XREF | RHSA:2025:23336
XREF | CWE:122

Plugin Information
Published: 2025/12/18, Modified: 2025/12/18
Plugin Output

## tcp/0

Remote package installed : gcc-toolset-13-binutils-2.40-21.el9
Should be : gcc-toolset-13-binutils-2.40-21.el9_7.1
Remote package installed : gcc-toolset-13-binutils-devel-2.40-21.el9
Should be : gcc-toolset-13-binutils-devel-2.40-21.el9_7.1
Remote package installed : gcc-toolset-13-binutils-gold-2.40-21.el9
Should be : gcc-toolset-13-binutils-gold-2.40-21.el9_7.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
243562 - RHEL 9 : gdk-pixbuf2 (RHSA-2025:12841)
-
Synopsis
The remote Red Hat host is missing a security update for gdk-pixbuf2.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:12841 advisory.
The gdk-pixbuf2 packages provide an image loading library that can be extended by loadable modules for new image formats. It is used by toolkits such as GTK+ or clutter.
Security Fix(es):
* gdk?pixbuf: Heap?buffer?overflow in gdk?pixbuf (CVE-2025-7345)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2377063
http://www.nessus.org/u?905a69ed
https://access.redhat.com/errata/RHSA-2025:12841

Solution
Update the RHEL gdk-pixbuf2 package based on the guidance in RHSA-2025:12841.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-7345
XREF | RHSA:2025:12841
XREF | CWE:120

Plugin Information
Published: 2025/08/05, Modified: 2025/08/05
Plugin Output

## tcp/0

Remote package installed : gdk-pixbuf2-2.42.6-4.el9_4
Should be : gdk-pixbuf2-2.42.6-6.el9_6
Remote package installed : gdk-pixbuf2-devel-2.42.6-4.el9_4
Should be : gdk-pixbuf2-devel-2.42.6-6.el9_6
Remote package installed : gdk-pixbuf2-modules-2.42.6-4.el9_4
Should be : gdk-pixbuf2-modules-2.42.6-6.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237319 - RHEL 9 : ghostscript (RHSA-2025:7422)
-
Synopsis
The remote Red Hat host is missing one or more security updates for ghostscript.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7422 advisory.
The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.
Security Fix(es):
* ghostscript: dangling pointer in gdev_prn_open_printer_seekable() (CVE-2023-46751)
* ghostscript: Buffer Overflow in Ghostscript PDF XRef Stream Handling (CVE-2024-46952)
* ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space (CVE-2024-46951)
* ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding (CVE-2024-46954)
* ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript (CVE-2024-46953)
* ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution (CVE-2024-46956)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2253365
https://bugzilla.redhat.com/show_bug.cgi?id=2325041
https://bugzilla.redhat.com/show_bug.cgi?id=2325043
https://bugzilla.redhat.com/show_bug.cgi?id=2325044
https://bugzilla.redhat.com/show_bug.cgi?id=2325045
https://bugzilla.redhat.com/show_bug.cgi?id=2325047
http://www.nessus.org/u?79300fe0
https://access.redhat.com/errata/RHSA-2025:7422

Solution
Update the RHEL ghostscript package based on the guidance in RHSA-2025:7422.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0097
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-46751
CVE | CVE-2024-46951
CVE | CVE-2024-46952
CVE | CVE-2024-46953
CVE | CVE-2024-46954
CVE | CVE-2024-46956
XREF | RHSA:2025:7422
XREF | CWE:22
XREF | CWE:120
XREF | CWE:125
XREF | CWE:190
XREF | CWE:416
XREF | CWE:824

Plugin Information
Published: 2025/05/27, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : ghostscript-9.54.0-17.el9_4
Should be : ghostscript-9.54.0-18.el9_6
Remote package installed : ghostscript-tools-fonts-9.54.0-17.el9_4
Should be : ghostscript-tools-fonts-9.54.0-18.el9_6
Remote package installed : ghostscript-tools-printing-9.54.0-17.el9_4
Should be : ghostscript-tools-printing-9.54.0-18.el9_6
Remote package installed : libgs-9.54.0-17.el9_4
Should be : libgs-9.54.0-18.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
242476 - RHEL 9 : git (RHSA-2025:11462)
-
Synopsis
The remote Red Hat host is missing one or more security updates for git.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:11462 advisory.
Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.
Security Fix(es):
* git: Git does not sanitize URLs when asking for credentials interactively (CVE-2024-50349)
* git: Newline confusion in credential helpers can lead to credential exfiltration in git (CVE-2024-52006)
* git: Git arbitrary code execution (CVE-2025-48384)
* git: Git arbitrary file writes (CVE-2025-48385)
* gitk: Git file creation flaw (CVE-2025-27613)
* gitk: git script execution flaw (CVE-2025-27614)
* git: Git GUI can create and overwrite files for which the user has write permission (CVE-2025-46835)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2337824
https://bugzilla.redhat.com/show_bug.cgi?id=2337956
https://bugzilla.redhat.com/show_bug.cgi?id=2378806
https://bugzilla.redhat.com/show_bug.cgi?id=2378808
https://bugzilla.redhat.com/show_bug.cgi?id=2379124
https://bugzilla.redhat.com/show_bug.cgi?id=2379125
https://bugzilla.redhat.com/show_bug.cgi?id=2379326
http://www.nessus.org/u?4f8f99a5
https://access.redhat.com/errata/RHSA-2025:11462

Solution
Update the RHEL git package based on the guidance in RHSA-2025:11462.
Risk Factor
High
CVSS v4.0 Base Score
8.6 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
8.6 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.0 (CVSS:3.0/E:F/RL:O/RC:C)
VPR Score
9.2
EPSS Score
0.0008
CVSS v2.0 Base Score
9.7 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:P)
CVSS v2.0 Temporal Score
8.0 (CVSS2#E:F/RL:OF/RC:C)
References

CVE | CVE-2024-50349
CVE | CVE-2024-52006
CVE | CVE-2025-27613
CVE | CVE-2025-27614
CVE | CVE-2025-46835
CVE | CVE-2025-48384
CVE | CVE-2025-48385
XREF | RHSA:2025:11462
XREF | CISA-KNOWN-EXPLOITED:2025/09/15
XREF | CWE:59
XREF | CWE:73
XREF | CWE:88
XREF | CWE:150

Plugin Information
Published: 2025/07/21, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : git-2.43.5-1.el9_4
Should be : git-2.47.3-1.el9_6
Remote package installed : git-core-2.43.5-1.el9_4
Should be : git-core-2.47.3-1.el9_6
Remote package installed : git-core-doc-2.43.5-1.el9_4
Should be : git-core-doc-2.47.3-1.el9_6
Remote package installed : perl-Git-2.43.5-1.el9_4
Should be : perl-Git-2.47.3-1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237333 - RHEL 9 : git (RHSA-2025:7409)
-
Synopsis
The remote Red Hat host is missing a security update for git.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7409 advisory.
Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.
Security Fix(es):
* git: The sideband payload is passed unfiltered to the terminal in git (CVE-2024-52005)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2338289
http://www.nessus.org/u?d5da188c
https://access.redhat.com/errata/RHSA-2025:7409

Solution
Update the RHEL git package based on the guidance in RHSA-2025:7409.
Risk Factor
High
CVSS v4.0 Base Score
7.5 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
7.6 (CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-52005
XREF | RHSA:2025:7409
XREF | CWE:150

Plugin Information
Published: 2025/05/27, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : git-2.43.5-1.el9_4
Should be : git-2.47.1-2.el9_6
Remote package installed : git-core-2.43.5-1.el9_4
Should be : git-core-2.47.1-2.el9_6
Remote package installed : git-core-doc-2.43.5-1.el9_4
Should be : git-core-doc-2.47.1-2.el9_6
Remote package installed : perl-Git-2.43.5-1.el9_4
Should be : perl-Git-2.47.1-2.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
234897 - RHEL 9 : glibc (RHSA-2025:4244)
-
Synopsis
The remote Red Hat host is missing a security update for glibc.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:4244 advisory.
The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
Without these libraries, the Linux system cannot function correctly.
Security Fix(es):
* glibc: buffer overflow in the GNU C Library's assert() (CVE-2025-0395)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2339460
http://www.nessus.org/u?9c43c3b0
https://access.redhat.com/errata/RHSA-2025:4244

Solution
Update the RHEL glibc package based on the guidance in RHSA-2025:4244.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.002
CVSS v2.0 Base Score
5.0 (CVSS2#AV:L/AC:H/Au:S/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-0395
XREF | RHSA:2025:4244
XREF | CWE:131

Plugin Information
Published: 2025/04/28, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : glibc-2.34-125.el9_5.1
Should be : glibc-2.34-125.el9_5.8
Remote package installed : glibc-all-langpacks-2.34-125.el9_5.1
Should be : glibc-all-langpacks-2.34-125.el9_5.8
Remote package installed : glibc-common-2.34-125.el9_5.1
Should be : glibc-common-2.34-125.el9_5.8
Remote package installed : glibc-devel-2.34-125.el9_5.1
Should be : glibc-devel-2.34-125.el9_5.8
Remote package installed : glibc-gconv-extra-2.34-125.el9_5.1
Should be : glibc-gconv-extra-2.34-125.el9_5.8
Remote package installed : glibc-headers-2.34-125.el9_5.1
Should be : glibc-headers-2.34-125.el9_5.8
Remote package installed : glibc-langpack-en-2.34-125.el9_5.1
Should be : glibc-langpack-en-2.34-125.el9_5.8
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237980 - RHEL 9 : glibc (RHSA-2025:8655)
-
Synopsis
The remote Red Hat host is missing a security update for glibc.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8655 advisory.
The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
Without these libraries, the Linux system cannot function correctly.
Security Fix(es):
* glibc: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH (CVE-2025-4802)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2367468
https://issues.redhat.com/browse/RHEL-71583
http://www.nessus.org/u?508df370
https://access.redhat.com/errata/RHSA-2025:8655

Solution
Update the RHEL glibc package based on the guidance in RHSA-2025:8655.
Risk Factor
Critical
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.8 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-4802
XREF | RHSA:2025:8655
XREF | CWE:426

Plugin Information
Published: 2025/06/09, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : glibc-2.34-125.el9_5.1
Should be : glibc-2.34-168.el9_6.19
Remote package installed : glibc-all-langpacks-2.34-125.el9_5.1
Should be : glibc-all-langpacks-2.34-168.el9_6.19
Remote package installed : glibc-common-2.34-125.el9_5.1
Should be : glibc-common-2.34-168.el9_6.19
Remote package installed : glibc-devel-2.34-125.el9_5.1
Should be : glibc-devel-2.34-168.el9_6.19
Remote package installed : glibc-gconv-extra-2.34-125.el9_5.1
Should be : glibc-gconv-extra-2.34-168.el9_6.19
Remote package installed : glibc-headers-2.34-125.el9_5.1
Should be : glibc-headers-2.34-168.el9_6.19
Remote package installed : glibc-langpack-en-2.34-125.el9_5.1
Should be : glibc-langpack-en-2.34-168.el9_6.19
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
241528 - RHEL 9 : gnome-remote-desktop (RHSA-2025:10631)
-
Synopsis
The remote Red Hat host is missing a security update for gnome-remote-desktop.
Description
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:10631 advisory.
GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment.
Security Fix(es):
* gnome-remote-desktop: Uncontrolled Resource Consumption due to Malformed RDP PDUs (CVE-2025-5024)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2367717
http://www.nessus.org/u?b64099ae
https://access.redhat.com/errata/RHSA-2025:10631

Solution
Update the RHEL gnome-remote-desktop package based on the guidance in RHSA-2025:10631.
Risk Factor
High
CVSS v3.0 Base Score
7.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.2
EPSS Score
0.0003
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-5024
XREF | RHSA:2025:10631
XREF | CWE:400

Plugin Information
Published: 2025/07/08, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : gnome-remote-desktop-40.0-10.el9
Should be : gnome-remote-desktop-40.0-11.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
265352 - RHEL 9 : gnutls (RHSA-2025:16116)
-
Synopsis
The remote Red Hat host is missing one or more security updates.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:16116 advisory.
The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.
Security Fix(es):
* gnutls: Vulnerability in GnuTLS certtool template parsing (CVE-2025-32990)
* gnutls: Vulnerability in GnuTLS SCT extension parsing (CVE-2025-32989)
* gnutls: Vulnerability in GnuTLS otherName SAN export (CVE-2025-32988)
* gnutls: NULL pointer dereference in _gnutls_figure_common_ciphersuite() (CVE-2025-6395)
Bug Fix(es) and Enhancement(s):
* gnutls: Vulnerability in GnuTLS certtool template parsing (BZ#2359620)
* gnutls: Vulnerability in GnuTLS SCT extension parsing (BZ#2359621)
* gnutls: Vulnerability in GnuTLS otherName SAN export (BZ#2359622)
* gnutls: NULL pointer dereference in _gnutls_figure_common_ciphersuite() (BZ#2376755)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2359620
https://bugzilla.redhat.com/show_bug.cgi?id=2359621
https://bugzilla.redhat.com/show_bug.cgi?id=2359622
https://bugzilla.redhat.com/show_bug.cgi?id=2376755
http://www.nessus.org/u?c3240919
https://access.redhat.com/errata/RHSA-2025:16116

Solution
Update the affected packages.
Risk Factor
High
CVSS v3.0 Base Score
8.2 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.0
EPSS Score
0.0004
CVSS v2.0 Base Score
8.5 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
6.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-6395
CVE | CVE-2025-32988
CVE | CVE-2025-32989
CVE | CVE-2025-32990
XREF | RHSA:2025:16116
XREF | CWE:122
XREF | CWE:295
XREF | CWE:415
XREF | CWE:476

Plugin Information
Published: 2025/09/17, Modified: 2025/09/17
Plugin Output

## tcp/0

Remote package installed : gnutls-3.8.3-4.el9_4
Should be : gnutls-3.8.3-6.el9_6.2
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
233200 - RHEL 9 : grub2 (RHSA-2025:2867)
-
Synopsis
The remote Red Hat host is missing a security update for grub2.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2867 advisory.
The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices.
Security Fix(es):
* grub2: net: Out-of-bounds write in grub_net_search_config_file() (CVE-2025-0624)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2346112
http://www.nessus.org/u?2f5b1c75
https://access.redhat.com/errata/RHSA-2025:2867

Solution
Update the RHEL grub2 package based on the guidance in RHSA-2025:2867.
Risk Factor
Medium
CVSS v3.0 Base Score
7.6 (CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.6 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
8.1
EPSS Score
0.0068
CVSS v2.0 Base Score
6.2 (CVSS2#AV:A/AC:H/Au:M/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-0624
XREF | RHSA:2025:2867
XREF | CWE:787

Plugin Information
Published: 2025/03/21, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : grub2-common-2.06-92.el9
Should be : grub2-common-2.06-94.el9_5
Remote package installed : grub2-efi-x64-2.06-92.el9
Should be : grub2-efi-x64-2.06-94.el9_5
Remote package installed : grub2-tools-2.06-92.el9
Should be : grub2-tools-2.06-94.el9_5
Remote package installed : grub2-tools-minimal-2.06-92.el9
Should be : grub2-tools-minimal-2.06-94.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
235807 - RHEL 9 : gstreamer1, gstreamer1-plugins-bad-free, gstreamer1-plugins-ugly-free, and gstreamer1-rtsp-server (RHSA-2025:7178)
-
Synopsis
The remote Red Hat host is missing one or more security updates for gstreamer1 / gstreamer1-plugins-bad-free / gstreamer1-plugins-ugly-free / gstreamer1-rtsp-server.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7178 advisory.
The gstreamer1 packages contain a streaming media framework, based on graphs of filters which operate on media data.
Security Fix(es):
* gstreamer: EXIF Metadata Parsing Integer Overflow (CVE-2024-4453)
* gstreamer: AV1 Video Parsing Stack-based Buffer Overflow (CVE-2024-0444)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?a7e51e86
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2282999
https://bugzilla.redhat.com/show_bug.cgi?id=2292335
http://www.nessus.org/u?b0e16be1
https://access.redhat.com/errata/RHSA-2025:7178

Solution
Update the RHEL gstreamer1 / gstreamer1-plugins-bad-free / gstreamer1-plugins-ugly-free / gstreamer1-rtsp-server packages based on the guidance in RHSA-2025:7178.
Risk Factor
Critical
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0119
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-0444
CVE | CVE-2024-4453
XREF | RHSA:2025:7178
XREF | CWE:121
XREF | CWE:190

Plugin Information
Published: 2025/05/13, Modified: 2025/07/01
Plugin Output

## tcp/0

Remote package installed : gstreamer1-1.22.1-2.el9
Should be : gstreamer1-1.22.12-3.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237267 - RHEL 9 : gstreamer1-plugins-bad-free (RHSA-2025:8183)
-
Synopsis
The remote Red Hat host is missing a security update for gstreamer1-plugins-bad-free.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8183 advisory.
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.
Security Fix(es):
* GStreamer: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-3887)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2367919
http://www.nessus.org/u?544505f7
https://access.redhat.com/errata/RHSA-2025:8183

Solution
Update the RHEL gstreamer1-plugins-bad-free package based on the guidance in RHSA-2025:8183.
Risk Factor
Critical
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0017
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-3887
XREF | RHSA:2025:8183
XREF | CWE:121

Plugin Information
Published: 2025/05/27, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : gstreamer1-plugins-bad-free-1.22.1-4.el9
Should be : gstreamer1-plugins-bad-free-1.22.12-4.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
242992 - RHEL 9 : icu (RHSA-2025:12083)
-
Synopsis
The remote Red Hat host is missing a security update for icu.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:12083 advisory.
The International Components for Unicode (ICU) library provides robust and full-featured Unicode services.
Security Fix(es):
* icu: Stack buffer overflow in the SRBRoot::addTag function (CVE-2025-5222)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2368600
http://www.nessus.org/u?3fd5268d
https://access.redhat.com/errata/RHSA-2025:12083

Solution
Update the RHEL icu package based on the guidance in RHSA-2025:12083.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0001
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-5222
XREF | RHSA:2025:12083
XREF | CWE:120

Plugin Information
Published: 2025/07/29, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : libicu-67.1-9.el9
Should be : libicu-67.1-10.el9_6
Remote package installed : libicu-devel-67.1-9.el9
Should be : libicu-devel-67.1-10.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
241526 - RHEL 9 : jq (RHSA-2025:10585)
-
Synopsis
The remote Red Hat host is missing one or more security updates for jq.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10585 advisory.
jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text.
Security Fix(es):
* jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337)
* jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2367807
https://bugzilla.redhat.com/show_bug.cgi?id=2367842
http://www.nessus.org/u?0c86754f
https://access.redhat.com/errata/RHSA-2025:10585

Solution
Update the RHEL jq package based on the guidance in RHSA-2025:10585.
Risk Factor
High
CVSS v4.0 Base Score
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-23337
CVE | CVE-2025-48060
XREF | RHSA:2025:10585
XREF | CWE:125
XREF | CWE:126

Plugin Information
Published: 2025/07/08, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : jq-1.6-17.el9
Should be : jq-1.6-17.el9_6.2
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
211849 - RHEL 9 : kernel (RHSA-2024:10274)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:10274 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: bpf: Fix overrunning reservations in ringbuf (CVE-2024-41009)
* kernel: USB: serial: mos7840: fix crash on resume (CVE-2024-42244)
* kernel: cxl/port: Fix use-after-free, permit out-of-order decoder shutdown (CVE-2024-50226)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2298412
https://bugzilla.redhat.com/show_bug.cgi?id=2324876
http://www.nessus.org/u?f1fb1c77
https://access.redhat.com/errata/RHSA-2024:10274

Solution
Update the RHEL kernel package based on the guidance in RHSA-2024:10274.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0009
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-41009
CVE | CVE-2024-42244
CVE | CVE-2024-50226
XREF | RHSA:2024:10274
XREF | CWE:99
XREF | CWE:121

Plugin Information
Published: 2024/11/26, Modified: 2024/11/26
Plugin Output

## tcp/0

Remote package installed : bpftool-7.4.0-503.11.1.el9_5
Should be : bpftool-7.4.0-503.15.1.el9_5
Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-503.15.1.el9_5
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-503.15.1.el9_5
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-503.15.1.el9_5
Remote package installed : kernel-headers-5.14.0-503.11.1.el9_5
Should be : kernel-headers-5.14.0-503.15.1.el9_5
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-503.15.1.el9_5
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-503.15.1.el9_5
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-503.15.1.el9_5
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-503.15.1.el9_5
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-503.15.1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
213198 - RHEL 9 : kernel (RHSA-2024:11486)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:11486 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (CVE-2024-27399)
* kernel: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (CVE-2024-38564)
* kernel: bpf: Fix a kernel verifier crash in stacksafe() (CVE-2024-45020)
* kernel: nfsd: ensure that nfsd4_fattr_args.context is zeroed out (CVE-2024-46697)
* kernel: bpf: Fix use-after-free in bpf_uprobe_multi_link_attach() (CVE-2024-47675)
* kernel: bpf: Fix a sdiv overflow issue (CVE-2024-49888)
* kernel: arm64: probes: Remove broken LDR (literal) uprobe support (CVE-2024-50099)
* kernel: xfrm: fix one more kernel-infoleak in algo dumping (CVE-2024-50110)
* kernel: Bluetooth: SCO: Fix UAF on sco_sock_timeout (CVE-2024-50125)
* kernel: Bluetooth: ISO: Fix UAF on iso_sock_timeout (CVE-2024-50124)
* kernel: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (CVE-2024-50115)
* kernel: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (CVE-2024-50142)
* kernel: Bluetooth: bnep: fix wild-memory-access in proto_unregister (CVE-2024-50148)
* kernel: irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (CVE-2024-50192)
* kernel: Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs (CVE-2024-50255)
* kernel: sched/numa: Fix the potential null pointer dereference in task_numa_work() (CVE-2024-50223)
* kernel: bpf: Fix out-of-bounds write in trie_get_next_key() (CVE-2024-50262)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2280462
https://bugzilla.redhat.com/show_bug.cgi?id=2293429
https://bugzilla.redhat.com/show_bug.cgi?id=2311717
https://bugzilla.redhat.com/show_bug.cgi?id=2312085
https://bugzilla.redhat.com/show_bug.cgi?id=2320254
https://bugzilla.redhat.com/show_bug.cgi?id=2320517
https://bugzilla.redhat.com/show_bug.cgi?id=2323904
https://bugzilla.redhat.com/show_bug.cgi?id=2323930
https://bugzilla.redhat.com/show_bug.cgi?id=2323937
https://bugzilla.redhat.com/show_bug.cgi?id=2323944
https://bugzilla.redhat.com/show_bug.cgi?id=2323955
https://bugzilla.redhat.com/show_bug.cgi?id=2324315
https://bugzilla.redhat.com/show_bug.cgi?id=2324332
https://bugzilla.redhat.com/show_bug.cgi?id=2324612
https://bugzilla.redhat.com/show_bug.cgi?id=2324867
https://bugzilla.redhat.com/show_bug.cgi?id=2324868
https://bugzilla.redhat.com/show_bug.cgi?id=2324892
http://www.nessus.org/u?8b3a18ac
https://access.redhat.com/errata/RHSA-2024:11486

Solution
Update the RHEL kernel package based on the guidance in RHSA-2024:11486.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0035
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-27399
CVE | CVE-2024-38564
CVE | CVE-2024-45020
CVE | CVE-2024-46697
CVE | CVE-2024-47675
CVE | CVE-2024-49888
CVE | CVE-2024-50099
CVE | CVE-2024-50110
CVE | CVE-2024-50115
CVE | CVE-2024-50124
CVE | CVE-2024-50125
CVE | CVE-2024-50142
CVE | CVE-2024-50148
CVE | CVE-2024-50192
CVE | CVE-2024-50223
CVE | CVE-2024-50255
CVE | CVE-2024-50262
XREF | RHSA:2024:11486
XREF | CWE:125
XREF | CWE:190
XREF | CWE:20
XREF | CWE:362
XREF | CWE:416
XREF | CWE:457
XREF | CWE:459
XREF | CWE:476
XREF | CWE:665
XREF | CWE:787
XREF | CWE:908

Plugin Information
Published: 2024/12/19, Modified: 2025/03/10
Plugin Output

## tcp/0

Remote package installed : bpftool-7.4.0-503.11.1.el9_5
Should be : bpftool-7.4.0-503.19.1.el9_5
Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-503.19.1.el9_5
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-503.19.1.el9_5
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-503.19.1.el9_5
Remote package installed : kernel-headers-5.14.0-503.11.1.el9_5
Should be : kernel-headers-5.14.0-503.19.1.el9_5
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-503.19.1.el9_5
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-503.19.1.el9_5
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-503.19.1.el9_5
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-503.19.1.el9_5
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-503.19.1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
213586 - RHEL 9 : kernel (RHSA-2025:0059)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:0059 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: perf/aux: Fix AUX buffer serialization (CVE-2024-46713)
* kernel: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (CVE-2024-50208)
* kernel: mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address (CVE-2024-50252)
* kernel: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (CVE-2024-53122)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2312221
https://bugzilla.redhat.com/show_bug.cgi?id=2324611
https://bugzilla.redhat.com/show_bug.cgi?id=2324898
https://bugzilla.redhat.com/show_bug.cgi?id=2329932
http://www.nessus.org/u?1c686340
https://access.redhat.com/errata/RHSA-2025:0059

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:0059.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0013
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-46713
CVE | CVE-2024-50208
CVE | CVE-2024-50252
CVE | CVE-2024-53122
XREF | RHSA:2025:0059
XREF | CWE:125
XREF | CWE:369
XREF | CWE:401
XREF | CWE:662

Plugin Information
Published: 2025/01/09, Modified: 2025/09/29
Plugin Output

## tcp/0

Remote package installed : bpftool-7.4.0-503.11.1.el9_5
Should be : bpftool-7.4.0-503.21.1.el9_5
Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-503.21.1.el9_5
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-503.21.1.el9_5
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-503.21.1.el9_5
Remote package installed : kernel-headers-5.14.0-503.11.1.el9_5
Should be : kernel-headers-5.14.0-503.21.1.el9_5
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-503.21.1.el9_5
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-503.21.1.el9_5
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-503.21.1.el9_5
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-503.21.1.el9_5
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-503.21.1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
214450 - RHEL 9 : kernel (RHSA-2025:0578)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:0578 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (CVE-2024-50154)
* kernel: arm64/sve: Discard stale CPU state when handling SVE traps (CVE-2024-50275)
* kernel: i40e: fix race condition by adding filter's intermediate sync state (CVE-2024-53088)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2324313
https://bugzilla.redhat.com/show_bug.cgi?id=2327198
https://bugzilla.redhat.com/show_bug.cgi?id=2327328
http://www.nessus.org/u?264141db
https://access.redhat.com/errata/RHSA-2025:0578

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:0578.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
6.0 (CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
4.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-50154
CVE | CVE-2024-50275
CVE | CVE-2024-53088
CVE | CVE-2024-57947
XREF | RHSA:2025:0578
XREF | CWE:99
XREF | CWE:362
XREF | CWE:401
XREF | CWE:416

Plugin Information
Published: 2025/01/22, Modified: 2025/08/15
Plugin Output

## tcp/0

Remote package installed : bpftool-7.4.0-503.11.1.el9_5
Should be : bpftool-7.4.0-503.22.1.el9_5
Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-503.22.1.el9_5
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-503.22.1.el9_5
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-503.22.1.el9_5
Remote package installed : kernel-headers-5.14.0-503.11.1.el9_5
Should be : kernel-headers-5.14.0-503.22.1.el9_5
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-503.22.1.el9_5
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-503.22.1.el9_5
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-503.22.1.el9_5
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-503.22.1.el9_5
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-503.22.1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
241445 - RHEL 9 : kernel (RHSA-2025:10379)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10379 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759)
* kernel: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (CVE-2025-21887)
* kernel: net: atm: fix use after free in lec_send() (CVE-2025-22004)
* kernel: udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CVE-2022-49846)
* kernel: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (CVE-2025-37799)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2348596
https://bugzilla.redhat.com/show_bug.cgi?id=2355405
https://bugzilla.redhat.com/show_bug.cgi?id=2357142
https://bugzilla.redhat.com/show_bug.cgi?id=2363432
https://bugzilla.redhat.com/show_bug.cgi?id=2363876
http://www.nessus.org/u?6e3236b6
https://access.redhat.com/errata/RHSA-2025:10379

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:10379.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49846
CVE | CVE-2025-21759
CVE | CVE-2025-21887
CVE | CVE-2025-22004
CVE | CVE-2025-37799
XREF | RHSA:2025:10379
XREF | CWE:200
XREF | CWE:416

Plugin Information
Published: 2025/07/07, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.25.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.25.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.25.1.el9_6
Remote package installed : kernel-headers-5.14.0-503.11.1.el9_5
Should be : kernel-headers-5.14.0-570.25.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.25.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.25.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.25.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.25.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.25.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
242057 - RHEL 9 : kernel (RHSA-2025:10837)
-
Synopsis
The remote Red Hat host is missing a security update for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10837 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CVE-2025-21991)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2356917
http://www.nessus.org/u?250f7892
https://access.redhat.com/errata/RHSA-2025:10837

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:10837.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-21991
XREF | RHSA:2025:10837
XREF | CWE:787

Plugin Information
Published: 2025/07/14, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.26.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.26.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.26.1.el9_6
Remote package installed : kernel-headers-5.14.0-503.11.1.el9_5
Should be : kernel-headers-5.14.0-570.26.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.26.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.26.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.26.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.26.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.26.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
242426 - RHEL 9 : kernel (RHSA-2025:11411)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:11411 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: media: uvcvideo: Remove dangling pointers (CVE-2024-58002)
* kernel: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (CVE-2025-38089)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2348513
https://bugzilla.redhat.com/show_bug.cgi?id=2375529
http://www.nessus.org/u?3dbea3e6
https://access.redhat.com/errata/RHSA-2025:11411

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:11411.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-58002
CVE | CVE-2025-38089
XREF | RHSA:2025:11411
XREF | CWE:416
XREF | CWE:754

Plugin Information
Published: 2025/07/21, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.28.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.28.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.28.1.el9_6
Remote package installed : kernel-headers-5.14.0-503.11.1.el9_5
Should be : kernel-headers-5.14.0-570.28.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.28.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.28.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.28.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.28.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.28.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
242907 - RHEL 9 : kernel (RHSA-2025:11861)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:11861 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: media: uvcvideo: Fix double free in error path (CVE-2024-57980)
* kernel: wifi: iwlwifi: limit printed string from FW file (CVE-2025-21905)
* kernel: RDMA/mlx5: Fix page_size variable overflow (CVE-2025-22091)
* kernel: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (CVE-2025-22121)
* kernel: ext4: avoid journaling sb update on error if journal is destroying (CVE-2025-22113)
* kernel: RDMA/core: Fix use-after-free when rename device name (CVE-2025-22085)
* kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797)
* kernel: mm/huge_memory: fix dereferencing invalid pmd migration entry (CVE-2025-37958)
* kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)
* kernel: net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (CVE-2025-38110)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2348599
https://bugzilla.redhat.com/show_bug.cgi?id=2356613
https://bugzilla.redhat.com/show_bug.cgi?id=2360186
https://bugzilla.redhat.com/show_bug.cgi?id=2360199
https://bugzilla.redhat.com/show_bug.cgi?id=2360212
https://bugzilla.redhat.com/show_bug.cgi?id=2360219
https://bugzilla.redhat.com/show_bug.cgi?id=2363672
https://bugzilla.redhat.com/show_bug.cgi?id=2367572
https://bugzilla.redhat.com/show_bug.cgi?id=2375305
https://bugzilla.redhat.com/show_bug.cgi?id=2376035
http://www.nessus.org/u?07cab354
https://access.redhat.com/errata/RHSA-2025:11861

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:11861.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-57980
CVE | CVE-2025-21905
CVE | CVE-2025-22085
CVE | CVE-2025-22091
CVE | CVE-2025-22113
CVE | CVE-2025-22121
CVE | CVE-2025-37797
CVE | CVE-2025-37958
CVE | CVE-2025-38086
CVE | CVE-2025-38110
XREF | RHSA:2025:11861
XREF | CWE:99
XREF | CWE:125
XREF | CWE:415
XREF | CWE:416
XREF | CWE:908
XREF | CWE:1284

Plugin Information
Published: 2025/07/28, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.30.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.30.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.30.1.el9_6
Remote package installed : kernel-headers-5.14.0-503.11.1.el9_5
Should be : kernel-headers-5.14.0-570.30.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.30.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.30.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.30.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.30.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.30.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
216056 - RHEL 9 : kernel (RHSA-2025:1262)
-
Synopsis
The remote Red Hat host is missing a security update for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:1262 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (CVE-2024-53104)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2329817
http://www.nessus.org/u?7e786003
https://access.redhat.com/errata/RHSA-2025:1262

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:1262.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.2 (CVSS:3.0/E:F/RL:O/RC:C)
VPR Score
7.4
EPSS Score
0.0014
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:F/RL:OF/RC:C)
References

CVE | CVE-2024-53104
XREF | CISA-KNOWN-EXPLOITED:2025/02/26
XREF | RHSA:2025:1262
XREF | CWE:787

Plugin Information
Published: 2025/02/11, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : bpftool-7.4.0-503.11.1.el9_5
Should be : bpftool-7.4.0-503.23.2.el9_5
Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-503.23.2.el9_5
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-503.23.2.el9_5
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-503.23.2.el9_5
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-503.23.2.el9_5
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-503.23.2.el9_5
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-503.23.2.el9_5
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-503.23.2.el9_5
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-503.23.2.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
243400 - RHEL 9 : kernel (RHSA-2025:12746)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:12746 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)
* kernel: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CVE-2025-21928)
* kernel: HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() (CVE-2025-21929)
* kernel: cifs: Fix integer overflow while processing closetimeo mount option (CVE-2025-21962)
* kernel: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CVE-2025-22020)
* kernel: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CVE-2022-49788)
* kernel: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CVE-2025-37890)
* kernel: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CVE-2025-38052)
* kernel: net/sched: fix use-after-free in taprio_dev_notifier (CVE-2025-38087)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2348516
https://bugzilla.redhat.com/show_bug.cgi?id=2356592
https://bugzilla.redhat.com/show_bug.cgi?id=2356594
https://bugzilla.redhat.com/show_bug.cgi?id=2356624
https://bugzilla.redhat.com/show_bug.cgi?id=2360099
https://bugzilla.redhat.com/show_bug.cgi?id=2363378
https://bugzilla.redhat.com/show_bug.cgi?id=2366848
https://bugzilla.redhat.com/show_bug.cgi?id=2373380
https://bugzilla.redhat.com/show_bug.cgi?id=2375531
http://www.nessus.org/u?a16bf58a
https://access.redhat.com/errata/RHSA-2025:12746

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:12746.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
7.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49788
CVE | CVE-2025-21727
CVE | CVE-2025-21928
CVE | CVE-2025-21929
CVE | CVE-2025-21962
CVE | CVE-2025-22020
CVE | CVE-2025-37890
CVE | CVE-2025-38052
CVE | CVE-2025-38087
XREF | RHSA:2025:12746
XREF | CWE:190
XREF | CWE:401
XREF | CWE:416
XREF | CWE:820

Plugin Information
Published: 2025/08/04, Modified: 2025/08/04
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.32.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.32.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.32.1.el9_6
Remote package installed : kernel-headers-5.14.0-503.11.1.el9_5
Should be : kernel-headers-5.14.0-570.32.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.32.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.32.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.32.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.32.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.32.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
248465 - RHEL 9 : kernel (RHSA-2025:13602)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:13602 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: crypto: algif_hash - fix double free in hash_accept (CVE-2025-38079)
* kernel: wifi: ath12k: fix invalid access to memory (CVE-2025-38292)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2373383
https://bugzilla.redhat.com/show_bug.cgi?id=2379219
http://www.nessus.org/u?943d4bb4
https://access.redhat.com/errata/RHSA-2025:13602

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:13602.
Risk Factor
Medium
CVSS v3.0 Base Score
7.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.4 (CVSS2#AV:L/AC:L/Au:S/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-38079
CVE | CVE-2025-38292
XREF | RHSA:2025:13602
XREF | CWE:415
XREF | CWE:416

Plugin Information
Published: 2025/08/12, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.33.2.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.33.2.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.33.2.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.33.2.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.33.2.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.33.2.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.33.2.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.33.2.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
251368 - RHEL 9 : kernel (RHSA-2025:13962)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:13962 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (CVE-2025-21867)
* microcode_ctl: From CVEorg collector (CVE-2024-28956)
* kernel: mm/hugetlb: unshare page tables during VMA split, not before (CVE-2025-38084)
* kernel: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (CVE-2025-38085)
* kernel: net: fix udp gso skb_segment after pull from frag_list (CVE-2025-38124)
* kernel: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CVE-2025-38159)
* kernel: Bluetooth: hci_core: Fix use-after-free in vhci_flush() (CVE-2025-38250)
* kernel: i2c/designware: Fix an initialization issue (CVE-2025-38380)
* kernel: tls: always refresh the queue when reading sock (CVE-2025-38471)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2355334
https://bugzilla.redhat.com/show_bug.cgi?id=2366125
https://bugzilla.redhat.com/show_bug.cgi?id=2375303
https://bugzilla.redhat.com/show_bug.cgi?id=2375304
https://bugzilla.redhat.com/show_bug.cgi?id=2376041
https://bugzilla.redhat.com/show_bug.cgi?id=2376064
https://bugzilla.redhat.com/show_bug.cgi?id=2378982
https://bugzilla.redhat.com/show_bug.cgi?id=2383381
https://bugzilla.redhat.com/show_bug.cgi?id=2383893
http://www.nessus.org/u?90407c78
https://access.redhat.com/errata/RHSA-2025:13962

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:13962.
Risk Factor
High
CVSS v4.0 Base Score
5.7 (CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.3 (CVSS2#AV:N/AC:H/Au:N/C:C/I:P/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-28956
CVE | CVE-2025-21867
CVE | CVE-2025-38084
CVE | CVE-2025-38085
CVE | CVE-2025-38124
CVE | CVE-2025-38159
CVE | CVE-2025-38250
CVE | CVE-2025-38471
XREF | RHSA:2025:13962
XREF | CWE:119
XREF | CWE:200
XREF | CWE:362
XREF | CWE:416
XREF | CWE:704
XREF | CWE:908
XREF | CWE:1421

Plugin Information
Published: 2025/08/18, Modified: 2025/09/24
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.35.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.35.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.35.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.35.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.35.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.35.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.35.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.35.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
254411 - RHEL 9 : kernel (RHSA-2025:14420)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:14420 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: udp: Fix memory accounting leak. (CVE-2025-22058)
* kernel: net_sched: ets: Fix double list add in class with netem as child qdisc (CVE-2025-37914)
* kernel: ice: fix eswitch code memory leak in reset scenario (CVE-2025-38417)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2360276
https://bugzilla.redhat.com/show_bug.cgi?id=2367500
https://bugzilla.redhat.com/show_bug.cgi?id=2383463
http://www.nessus.org/u?27e3d1bc
https://access.redhat.com/errata/RHSA-2025:14420

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:14420.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-22058
CVE | CVE-2025-37914
CVE | CVE-2025-38417
XREF | RHSA:2025:14420
XREF | CWE:123
XREF | CWE:190
XREF | CWE:392

Plugin Information
Published: 2025/08/25, Modified: 2025/08/31
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.37.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.37.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.37.1.el9_6
Remote package installed : kernel-headers-5.14.0-503.11.1.el9_5
Should be : kernel-headers-5.14.0-570.37.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.37.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.37.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.37.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.37.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.37.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
260447 - RHEL 9 : kernel (RHSA-2025:15011)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:15011 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CVE-2025-37823)
* kernel: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (CVE-2025-38200)
* kernel: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (CVE-2025-38211)
* kernel: net/sched: Always pass notifications when child class becomes empty (CVE-2025-38350)
* kernel: tipc: Fix use-after-free in tipc_conn_close() (CVE-2025-38464)
* kernel: vsock: Fix transport_* TOCTOU (CVE-2025-38461)
* kernel: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (CVE-2025-38500)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2365024
https://bugzilla.redhat.com/show_bug.cgi?id=2376392
https://bugzilla.redhat.com/show_bug.cgi?id=2376406
https://bugzilla.redhat.com/show_bug.cgi?id=2382054
https://bugzilla.redhat.com/show_bug.cgi?id=2383509
https://bugzilla.redhat.com/show_bug.cgi?id=2383513
https://bugzilla.redhat.com/show_bug.cgi?id=2387866
http://www.nessus.org/u?4e25833d
https://access.redhat.com/errata/RHSA-2025:15011

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:15011.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
7.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-37823
CVE | CVE-2025-38200
CVE | CVE-2025-38211
CVE | CVE-2025-38350
CVE | CVE-2025-38461
CVE | CVE-2025-38464
CVE | CVE-2025-38500
CVE | CVE-2025-38684
XREF | RHSA:2025:15011
XREF | CWE:191
XREF | CWE:416
XREF | CWE:476
XREF | CWE:664
XREF | CWE:825

Plugin Information
Published: 2025/09/02, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.39.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.39.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.39.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.39.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.39.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.39.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.39.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.39.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
261694 - RHEL 9 : kernel (RHSA-2025:15429)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:15429 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: udmabuf: fix a buf size overflow issue during udmabuf creation (CVE-2025-37803)
* kernel: idpf: convert control queue mutex to a spinlock (CVE-2025-38392)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2365013
https://bugzilla.redhat.com/show_bug.cgi?id=2383407
http://www.nessus.org/u?121afc81
https://access.redhat.com/errata/RHSA-2025:15429

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:15429.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-37803
CVE | CVE-2025-38392
CVE | CVE-2025-39825
XREF | RHSA:2025:15429
XREF | CWE:120
XREF | CWE:366
XREF | CWE:767

Plugin Information
Published: 2025/09/08, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.41.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.41.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.41.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.41.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.41.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.41.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.41.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.41.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
264525 - RHEL 9 : kernel (RHSA-2025:15661)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:15661 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: drm/vkms: Fix use after free and double free on init error (CVE-2025-22097)
* kernel: scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332)
* kernel: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CVE-2025-38352)
* kernel: drm/gem: Acquire references on GEM handles for framebuffers (CVE-2025-38449)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2360223
https://bugzilla.redhat.com/show_bug.cgi?id=2379246
https://bugzilla.redhat.com/show_bug.cgi?id=2382581
https://bugzilla.redhat.com/show_bug.cgi?id=2383519
http://www.nessus.org/u?be6ae66a
https://access.redhat.com/errata/RHSA-2025:15661

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:15661.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.2 (CVSS:3.0/E:F/RL:O/RC:C)
VPR Score
9.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:F/RL:OF/RC:C)
References

CVE | CVE-2025-22097
CVE | CVE-2025-38332
CVE | CVE-2025-38352
CVE | CVE-2025-38449
XREF | CISA-KNOWN-EXPLOITED:2025/09/25
XREF | RHSA:2025:15661
XREF | CWE:170
XREF | CWE:362
XREF | CWE:416

Plugin Information
Published: 2025/09/11, Modified: 2025/09/11
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.42.2.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.42.2.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.42.2.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.42.2.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.42.2.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.42.2.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.42.2.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.42.2.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
264792 - RHEL 9 : kernel (RHSA-2025:15740)
-
Synopsis
The remote Red Hat host is missing a security update for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:15740 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (CVE-2025-38550)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2388941
http://www.nessus.org/u?6a95d40d
https://access.redhat.com/errata/RHSA-2025:15740

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:15740.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.2
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:A/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-38550
XREF | RHSA:2025:15740

Plugin Information
Published: 2025/09/15, Modified: 2025/09/15
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.44.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.44.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.44.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.44.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.44.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.44.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.44.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.44.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
265725 - RHEL 9 : kernel (RHSA-2025:16398)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:16398 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: net: usb: smsc75xx: Limit packet length to skb->len (CVE-2023-53125)
* kernel: usb: dwc3: gadget: check that event count does not exceed event buffer length (CVE-2025-37810)
* kernel: do_change_type(): refuse to operate on unmounted/not ours mounts (CVE-2025-38498)
* kernel: s390/sclp: Fix SCCB present check (CVE-2025-39694)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2363686
https://bugzilla.redhat.com/show_bug.cgi?id=2365028
https://bugzilla.redhat.com/show_bug.cgi?id=2384422
https://bugzilla.redhat.com/show_bug.cgi?id=2393534
http://www.nessus.org/u?f6e886e3
https://access.redhat.com/errata/RHSA-2025:16398

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:16398.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-53125
CVE | CVE-2025-37810
CVE | CVE-2025-38498
CVE | CVE-2025-39694
XREF | RHSA:2025:16398
XREF | CWE:125
XREF | CWE:787
XREF | CWE:1285

Plugin Information
Published: 2025/09/23, Modified: 2025/09/23
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.46.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.46.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.46.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.46.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.46.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.46.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.46.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.46.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
266053 - RHEL 9 : kernel (RHSA-2025:16880)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:16880 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (CVE-2025-38472)
* kernel: smb: client: fix use-after-free in cifs_oplock_break (CVE-2025-38527)
* kernel: sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)
* kernel: tls: fix handling of zero-length records on the rx_list (CVE-2025-39682)
* kernel: io_uring/futex: ensure io_futex_wait() cleans up properly on failure (CVE-2025-39698)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2383916
https://bugzilla.redhat.com/show_bug.cgi?id=2388928
https://bugzilla.redhat.com/show_bug.cgi?id=2393166
https://bugzilla.redhat.com/show_bug.cgi?id=2393511
https://bugzilla.redhat.com/show_bug.cgi?id=2393519
http://www.nessus.org/u?3f209c81
https://access.redhat.com/errata/RHSA-2025:16880

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:16880.
Risk Factor
Medium
CVSS v3.0 Base Score
7.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-38472
CVE | CVE-2025-38527
CVE | CVE-2025-38718
CVE | CVE-2025-39682
CVE | CVE-2025-39698
XREF | RHSA:2025:16880
XREF | CWE:362
XREF | CWE:416
XREF | CWE:664
XREF | CWE:825

Plugin Information
Published: 2025/09/29, Modified: 2025/09/29
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.49.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.49.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.49.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.49.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.49.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.49.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.49.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.49.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
266737 - RHEL 9 : kernel (RHSA-2025:17377)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:17377 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: security/keys: fix slab-out-of-bounds in key_task_permission (CVE-2024-50301)
* kernel: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (CVE-2025-38351)
* kernel: wifi: ath12k: Decrement TID on RX peer frag setup error handling (CVE-2025-39761)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2327188
https://bugzilla.redhat.com/show_bug.cgi?id=2382059
https://bugzilla.redhat.com/show_bug.cgi?id=2394606
http://www.nessus.org/u?103f2818
https://access.redhat.com/errata/RHSA-2025:17377

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:17377.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0004
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-50301
CVE | CVE-2025-38351
CVE | CVE-2025-39761
XREF | RHSA:2025:17377
XREF | CWE:125
XREF | CWE:754

Plugin Information
Published: 2025/10/06, Modified: 2025/10/06
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.51.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.51.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.51.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.51.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.51.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.51.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.51.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.51.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
270118 - RHEL 9 : kernel (RHSA-2025:17760)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:17760 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556)
* kernel: eventpoll: Fix semi-unbounded recursion (CVE-2025-38614)
* kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CVE-2025-39757)
* kernel: crypto: seqiv - Handle EBUSY correctly (CVE-2023-53373)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2389456
https://bugzilla.redhat.com/show_bug.cgi?id=2389491
https://bugzilla.redhat.com/show_bug.cgi?id=2394615
https://bugzilla.redhat.com/show_bug.cgi?id=2396379
http://www.nessus.org/u?bc16d722
https://access.redhat.com/errata/RHSA-2025:17760

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:17760.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.5 (CVSS2#AV:A/AC:H/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-53373
CVE | CVE-2025-38556
CVE | CVE-2025-38614
CVE | CVE-2025-39757
XREF | RHSA:2025:17760
XREF | CWE:20
XREF | CWE:125
XREF | CWE:416
XREF | CWE:674

Plugin Information
Published: 2025/10/13, Modified: 2025/10/13
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.52.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.52.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.52.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.52.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.52.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.52.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.52.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.52.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
270789 - RHEL 9 : kernel (RHSA-2025:18281)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:18281 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: nfsd: don't ignore the return code of svc_proc_register() (CVE-2025-22026)
* kernel: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (CVE-2022-50087)
* kernel: sunrpc: fix client side handling of tls alerts (CVE-2025-38571)
* kernel: sunrpc: fix handling of server side tls alerts (CVE-2025-38566)
* kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817)
* kernel: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CVE-2025-39849)
* kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path (CVE-2025-39841)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2360224
https://bugzilla.redhat.com/show_bug.cgi?id=2373539
https://bugzilla.redhat.com/show_bug.cgi?id=2389480
https://bugzilla.redhat.com/show_bug.cgi?id=2389487
https://bugzilla.redhat.com/show_bug.cgi?id=2395805
https://bugzilla.redhat.com/show_bug.cgi?id=2396928
https://bugzilla.redhat.com/show_bug.cgi?id=2396944
http://www.nessus.org/u?ee51316c
https://access.redhat.com/errata/RHSA-2025:18281

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:18281.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
7.6 (CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-50087
CVE | CVE-2025-22026
CVE | CVE-2025-38566
CVE | CVE-2025-38571
CVE | CVE-2025-39817
CVE | CVE-2025-39841
CVE | CVE-2025-39849
XREF | RHSA:2025:18281
XREF | CWE:125
XREF | CWE:252
XREF | CWE:416
XREF | CWE:754
XREF | CWE:787
XREF | CWE:825

Plugin Information
Published: 2025/10/20, Modified: 2025/10/20
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.55.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.55.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.55.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.55.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.55.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.55.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.55.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.55.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
271733 - RHEL 9 : kernel (RHSA-2025:19105)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19105 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: vsock/virtio: Validate length in packet header before skb_put() (CVE-2025-39718)
* kernel: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CVE-2025-39730)
* kernel: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CVE-2025-39751)
* kernel: fs/smb: Fix inconsistent refcnt update (CVE-2025-39819)
* kernel: pstore/ram: Check start of empty przs during init (CVE-2023-53331)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2393507
https://bugzilla.redhat.com/show_bug.cgi?id=2393731
https://bugzilla.redhat.com/show_bug.cgi?id=2394624
https://bugzilla.redhat.com/show_bug.cgi?id=2395806
https://bugzilla.redhat.com/show_bug.cgi?id=2395880
http://www.nessus.org/u?8377deb7
https://access.redhat.com/errata/RHSA-2025:19105

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:19105.
Risk Factor
High
CVSS v3.0 Base Score
7.6 (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
CVSS v3.0 Temporal Score
6.6 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
7.3 (CVSS2#AV:A/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-53331
CVE | CVE-2025-39718
CVE | CVE-2025-39730
CVE | CVE-2025-39819
XREF | RHSA:2025:19105
XREF | CWE:120
XREF | CWE:125
XREF | CWE:129
XREF | CWE:787

Plugin Information
Published: 2025/10/28, Modified: 2025/10/28
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.58.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.58.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.58.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.58.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.58.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.58.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.58.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.58.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
272178 - RHEL 9 : kernel (RHSA-2025:19409)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19409 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: ipv6: sr: Fix MAC comparison to be constant-time (CVE-2025-39702)
* kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy (CVE-2022-50367)
* kernel: crypto: xts - Handle EBUSY correctly (CVE-2023-53494)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2393533
https://bugzilla.redhat.com/show_bug.cgi?id=2396114
https://bugzilla.redhat.com/show_bug.cgi?id=2400777
http://www.nessus.org/u?928822f0
https://access.redhat.com/errata/RHSA-2025:19409

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:19409.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-50367
CVE | CVE-2023-53494
CVE | CVE-2025-39702
XREF | RHSA:2025:19409
XREF | CWE:208
XREF | CWE:416
XREF | CWE:664

Plugin Information
Published: 2025/11/03, Modified: 2025/11/03
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.60.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.60.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.60.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.60.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.60.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.60.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.60.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.60.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
274839 - RHEL 9 : kernel (RHSA-2025:20518)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:20518 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: can: isotp: fix potential CAN frame reception race in isotp_rcv() (CVE-2022-48830)
* kernel: soc: qcom: cmd-db: Map shared memory as WC, not WB (CVE-2024-46689)
* kernel: Squashfs: sanity check symbolic link size (CVE-2024-46744)
* kernel: vfs: fix race between evice_inodes() and find_inode()&iput() (CVE-2024-47679)
* kernel: x86/tdx: Fix in-kernel MMIO check (CVE-2024-47727)
* kernel: rxrpc: Fix a race between socket set up and I/O thread creation (CVE-2024-49864)
* kernel: io_uring: check if we need to reschedule during overflow flush (CVE-2024-50060)
* kernel: can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods (CVE-2022-49024)
* kernel: posix-clock: Fix missing timespec64 check in pc_clock_settime() (CVE-2024-50195)
* kernel: rxrpc: Fix missing locking causing hanging calls (CVE-2024-50294)
* kernel: io_uring/rw: fix missing NOWAIT check for O_DIRECT start write (CVE-2024-53052)
* kernel: afs: Fix lock recursion (CVE-2024-53090)
* kernel: virtio/vsock: Fix accept_queue memory leak (CVE-2024-53119)
* kernel: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (CVE-2024-53135)
* kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466) (CVE-2024-53241)
* kernel: RDMA/rxe: Fix the qp flush warnings in req (CVE-2024-53229)
* kernel: block: fix uaf for flush rq while iterating tags (CVE-2024-53170)
* kernel: nfsd: release svc_expkey/svc_export with rcu_work (CVE-2024-53216)
* kernel: net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603)
* kernel: blk-cgroup: Fix UAF in blkcg_unpin_online() (CVE-2024-56672)
* kernel: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (CVE-2024-56662)
* kernel: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (CVE-2024-56675)
* kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645)
* kernel: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY (CVE-2024-56690)
* kernel: io_uring: check if iowq is killed before queuing (CVE-2024-56709)
* kernel: rtc: check if __rtc_read_time was successful in rtc_timer_do_work() (CVE-2024-56739)
* kernel: bpf: put bpf_link's program when link is safe to be deallocated (CVE-2024-56786)
* kernel: igb: Fix potential invalid memory access in igb_init_module() (CVE-2024-52332)
* kernel: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (CVE-2024-53680)
* kernel: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (CVE-2025-21648)
* kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts (CVE-2025-21647)
* kernel: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() (CVE-2025-21631)
* kernel: zram: fix potential UAF of zram table (CVE-2025-21671)
* kernel: afs: Fix merge preference rule failure condition (CVE-2025-21672)
* kernel: mm: zswap: properly synchronize freeing resources during CPU hotunplug (CVE-2025-21693)
* kernel: cachestat: fix page cache statistics permission checking (CVE-2025-21691)
* kernel: mm: clear uffd-wp PTE/PMD state on mremap() (CVE-2025-21696)
* kernel: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (CVE-2025-21702)
* kernel: usbnet: fix memory leak in error case (CVE-2022-49657)
* kernel: powerpc/xics: fix refcount leak in icp_opal_init() (CVE-2022-49432)
* kernel: net: tun: unlink NAPI from device on destruction (CVE-2022-49672)
* kernel: powerpc/papr_scm: don't requests stats with '0' sized stats buffer (CVE-2022-49353)
* kernel: powerpc/xive: Fix refcount leak in xive_spapr_init (CVE-2022-49437)
* kernel: ima: Fix potential memory leak in ima_init_crypto() (CVE-2022-49627)
* kernel: linux/dim: Fix divide by 0 in RDMA DIM (CVE-2022-49670)
* kernel: can: isotp: sanitize CAN ID checks in isotp_bind() (CVE-2022-49269)
* kernel: ima: Fix a potential integer overflow in ima_appraise_measurement (CVE-2022-49643)
* kernel: powerpc/xive/spapr: correct bitmap allocation size (CVE-2022-49623)
* kernel: efi: Do not import certificates from UEFI Secure Boot for T2 Macs (CVE-2022-49357)
* kernel: list: fix a data-race around ep->rdllist (CVE-2022-49443)
* kernel: tracing/histograms: Fix memory leak problem (CVE-2022-49648)
* kernel: Input: synaptics - fix crash when enabling pass-through port (CVE-2025-21746)
* kernel: NFSD: fix hang in nfsd4_shutdown_callback (CVE-2025-21795)
* kernel: bpf: Send signals asynchronously if !preemptible (CVE-2025-21728)
* kernel: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() (CVE-2024-54456)
* kernel: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() (CVE-2024-57987)
* kernel: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (CVE-2024-58014)
* kernel: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() (CVE-2024-57988)
* kernel: RDMA/mlx5: Fix implicit ODP use after free (CVE-2025-21714)
* kernel: drm/xe/tracing: Fix a potential TP_printk UAF (CVE-2024-49570)
* kernel: HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check (CVE-2024-57993)
* kernel: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (CVE-2025-21729)
* kernel: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links (CVE-2024-57989)
* kernel: wifi: ath12k: Fix for out-of bound access error (CVE-2024-58015)
* kernel: OPP: add index check to assert to avoid buffer overflow in _read_freq() (CVE-2024-57998)
* kernel: wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995)
* kernel: nfsd: clear acl_access/acl_default after releasing them (CVE-2025-21796)
* kernel: scsi: ufs: core: Fix use-after free in init error and remove paths (CVE-2025-21739)
* kernel: workqueue: Put the pwq after detaching the rescuer from the pool (CVE-2025-21786)
* kernel: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (CVE-2025-21738)
* kernel: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections (CVE-2024-57986)
* kernel: padata: avoid UAF for reorder_work (CVE-2025-21726)
* kernel: vrf: use RCU protection in l3mdev_l3_out() (CVE-2025-21791)
* kernel: team: better TEAM_OPTION_TYPE_STRING validation (CVE-2025-21787)
* kernel: usb: xhci: Fix NULL pointer dereference on certain command aborts (CVE-2024-57981)
* kernel: vxlan: check vxlan_vnigroup_init() return value (CVE-2025-21790)
* kernel: wifi: mt76: mt7925: fix off by one in mt7925_load_clc() (CVE-2024-57990)
* kernel: ipv6: use RCU protection in ip6_default_advmss() (CVE-2025-21765)
* kernel: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (CVE-2024-58012)
* kernel: blk-cgroup: Fix class @block_class's subsystem refcount leakage (CVE-2025-21745)
* kernel: net: let net.core.dev_weight always be non-zero (CVE-2025-21806)
* kernel: wifi: rtlwifi: remove unused check_buddy_priv (CVE-2024-58072)
* kernel: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (CVE-2024-58068)
* kernel: wifi: iwlwifi: mvm: avoid NULL pointer dereference (CVE-2024-58062)
* kernel: idpf: convert workqueues to unbound (CVE-2024-58057)
* kernel: wifi: mac80211: don't flush non-uploaded STAs (CVE-2025-21828)
* kernel: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (CVE-2024-58083)
* kernel: netfilter: nf_tables: reject mismatching sum of field_len with set key length (CVE-2025-21826)
* kernel: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback (CVE-2024-58077)
* kernel: crypto: tegra - do not transfer req when tegra init fails (CVE-2024-58075)
* kernel: RDMA/rxe: Fix the warning __rxe_cleanup+0x12c/0x170 [rdma_rxe] (CVE-2025-21829)
* kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (CVE-2025-21839)
* kernel: io_uring/uring_cmd: unconditionally copy SQEs at prep time (CVE-2025-21837)
* kernel: information leak via transient execution vulnerability in some AMD processors (CVE-2024-36350)
* kernel: transient execution vulnerability in some AMD processors (CVE-2024-36357)
* kernel: bpf: Fix softlockup in arena_map_free on 64k page kernel (CVE-2025-21851)
* kernel: ibmvnic: Don't reference skb after sending to VIOS (CVE-2025-21855)
* kernel: smb: client: Add check for next_buffer in receive_encrypted_standard() (CVE-2025-21844)
* kernel: bpf: avoid holding freeze_mutex during mmap operation (CVE-2025-21853)
* kernel: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() (CVE-2025-21847)
* kernel: tcp: drop secpath at the same time as we currently drop dst (CVE-2025-21864)
* kernel: bpf: Fix deadlock when freeing cgroup storage (CVE-2024-58088)
* kernel: acct: perform last write from workqueue (CVE-2025-21846)
* kernel: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() (CVE-2025-21861)
* kernel: io_uring: prevent opcode speculation (CVE-2025-21863)
* kernel: nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() (CVE-2025-21848)
* kernel: netfilter: nft_tunnel: fix geneve_opt type confusion addition (CVE-2025-22056)
* kernel: can: j1939: j1939_send_one(): fix missing CAN header initialization (CVE-2022-49845)
* kernel: usb: typec: ucsi: displayport: Fix NULL pointer access (CVE-2025-37994)
* kernel: wifi: ath12k: fix uaf in ath12k_core_init() (CVE-2025-38116)
* kernel: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (CVE-2025-38396)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?b6159d8b
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2298169
https://bugzilla.redhat.com/show_bug.cgi?id=2312077
https://bugzilla.redhat.com/show_bug.cgi?id=2313092
https://bugzilla.redhat.com/show_bug.cgi?id=2320172
https://bugzilla.redhat.com/show_bug.cgi?id=2320259
https://bugzilla.redhat.com/show_bug.cgi?id=2320455
https://bugzilla.redhat.com/show_bug.cgi?id=2320616
https://bugzilla.redhat.com/show_bug.cgi?id=2320722
https://bugzilla.redhat.com/show_bug.cgi?id=2324549
https://bugzilla.redhat.com/show_bug.cgi?id=2327203
https://bugzilla.redhat.com/show_bug.cgi?id=2327374
https://bugzilla.redhat.com/show_bug.cgi?id=2327887
https://bugzilla.redhat.com/show_bug.cgi?id=2329918
https://bugzilla.redhat.com/show_bug.cgi?id=2330341
https://bugzilla.redhat.com/show_bug.cgi?id=2331326
https://bugzilla.redhat.com/show_bug.cgi?id=2334357
https://bugzilla.redhat.com/show_bug.cgi?id=2334396
https://bugzilla.redhat.com/show_bug.cgi?id=2334415
https://bugzilla.redhat.com/show_bug.cgi?id=2334439
https://bugzilla.redhat.com/show_bug.cgi?id=2334537
https://bugzilla.redhat.com/show_bug.cgi?id=2334547
https://bugzilla.redhat.com/show_bug.cgi?id=2334548
https://bugzilla.redhat.com/show_bug.cgi?id=2334560
https://bugzilla.redhat.com/show_bug.cgi?id=2334676
https://bugzilla.redhat.com/show_bug.cgi?id=2334795
https://bugzilla.redhat.com/show_bug.cgi?id=2334829
https://bugzilla.redhat.com/show_bug.cgi?id=2336541
https://bugzilla.redhat.com/show_bug.cgi?id=2337121
https://bugzilla.redhat.com/show_bug.cgi?id=2337124
https://bugzilla.redhat.com/show_bug.cgi?id=2338814
https://bugzilla.redhat.com/show_bug.cgi?id=2338828
https://bugzilla.redhat.com/show_bug.cgi?id=2338832
https://bugzilla.redhat.com/show_bug.cgi?id=2343172
https://bugzilla.redhat.com/show_bug.cgi?id=2343175
https://bugzilla.redhat.com/show_bug.cgi?id=2344684
https://bugzilla.redhat.com/show_bug.cgi?id=2344687
https://bugzilla.redhat.com/show_bug.cgi?id=2345240
https://bugzilla.redhat.com/show_bug.cgi?id=2346272
https://bugzilla.redhat.com/show_bug.cgi?id=2347707
https://bugzilla.redhat.com/show_bug.cgi?id=2347753
https://bugzilla.redhat.com/show_bug.cgi?id=2347759
https://bugzilla.redhat.com/show_bug.cgi?id=2347781
https://bugzilla.redhat.com/show_bug.cgi?id=2347807
https://bugzilla.redhat.com/show_bug.cgi?id=2347859
https://bugzilla.redhat.com/show_bug.cgi?id=2347919
https://bugzilla.redhat.com/show_bug.cgi?id=2347968
https://bugzilla.redhat.com/show_bug.cgi?id=2348022
https://bugzilla.redhat.com/show_bug.cgi?id=2348071
https://bugzilla.redhat.com/show_bug.cgi?id=2348238
https://bugzilla.redhat.com/show_bug.cgi?id=2348240
https://bugzilla.redhat.com/show_bug.cgi?id=2348279
https://bugzilla.redhat.com/show_bug.cgi?id=2348515
https://bugzilla.redhat.com/show_bug.cgi?id=2348523
https://bugzilla.redhat.com/show_bug.cgi?id=2348528
https://bugzilla.redhat.com/show_bug.cgi?id=2348541
https://bugzilla.redhat.com/show_bug.cgi?id=2348543
https://bugzilla.redhat.com/show_bug.cgi?id=2348547
https://bugzilla.redhat.com/show_bug.cgi?id=2348550
https://bugzilla.redhat.com/show_bug.cgi?id=2348554
https://bugzilla.redhat.com/show_bug.cgi?id=2348556
https://bugzilla.redhat.com/show_bug.cgi?id=2348566
https://bugzilla.redhat.com/show_bug.cgi?id=2348573
https://bugzilla.redhat.com/show_bug.cgi?id=2348574
https://bugzilla.redhat.com/show_bug.cgi?id=2348577
https://bugzilla.redhat.com/show_bug.cgi?id=2348578
https://bugzilla.redhat.com/show_bug.cgi?id=2348581
https://bugzilla.redhat.com/show_bug.cgi?id=2348584
https://bugzilla.redhat.com/show_bug.cgi?id=2348585
https://bugzilla.redhat.com/show_bug.cgi?id=2348587
https://bugzilla.redhat.com/show_bug.cgi?id=2348595
https://bugzilla.redhat.com/show_bug.cgi?id=2348597
https://bugzilla.redhat.com/show_bug.cgi?id=2348600
https://bugzilla.redhat.com/show_bug.cgi?id=2348601
https://bugzilla.redhat.com/show_bug.cgi?id=2348615
https://bugzilla.redhat.com/show_bug.cgi?id=2348620
https://bugzilla.redhat.com/show_bug.cgi?id=2348625
https://bugzilla.redhat.com/show_bug.cgi?id=2348634
https://bugzilla.redhat.com/show_bug.cgi?id=2348645
https://bugzilla.redhat.com/show_bug.cgi?id=2348650
https://bugzilla.redhat.com/show_bug.cgi?id=2348654
https://bugzilla.redhat.com/show_bug.cgi?id=2348901
https://bugzilla.redhat.com/show_bug.cgi?id=2350363
https://bugzilla.redhat.com/show_bug.cgi?id=2350367
https://bugzilla.redhat.com/show_bug.cgi?id=2350374
https://bugzilla.redhat.com/show_bug.cgi?id=2350375
https://bugzilla.redhat.com/show_bug.cgi?id=2350386
https://bugzilla.redhat.com/show_bug.cgi?id=2350388
https://bugzilla.redhat.com/show_bug.cgi?id=2350392
https://bugzilla.redhat.com/show_bug.cgi?id=2350396
https://bugzilla.redhat.com/show_bug.cgi?id=2350397
https://bugzilla.redhat.com/show_bug.cgi?id=2350400
https://bugzilla.redhat.com/show_bug.cgi?id=2350585
https://bugzilla.redhat.com/show_bug.cgi?id=2350589
https://bugzilla.redhat.com/show_bug.cgi?id=2350725
https://bugzilla.redhat.com/show_bug.cgi?id=2350726
https://bugzilla.redhat.com/show_bug.cgi?id=2351606
https://bugzilla.redhat.com/show_bug.cgi?id=2351608
https://bugzilla.redhat.com/show_bug.cgi?id=2351612
https://bugzilla.redhat.com/show_bug.cgi?id=2351613
https://bugzilla.redhat.com/show_bug.cgi?id=2351616
https://bugzilla.redhat.com/show_bug.cgi?id=2351618
https://bugzilla.redhat.com/show_bug.cgi?id=2351620
https://bugzilla.redhat.com/show_bug.cgi?id=2351624
https://bugzilla.redhat.com/show_bug.cgi?id=2351625
https://bugzilla.redhat.com/show_bug.cgi?id=2351629
https://bugzilla.redhat.com/show_bug.cgi?id=2351633
https://bugzilla.redhat.com/show_bug.cgi?id=2360215
https://bugzilla.redhat.com/show_bug.cgi?id=2363380
https://bugzilla.redhat.com/show_bug.cgi?id=2369184
https://bugzilla.redhat.com/show_bug.cgi?id=2376076
https://bugzilla.redhat.com/show_bug.cgi?id=2383441
https://issues.redhat.com/browse/RHEL-331
https://issues.redhat.com/browse/RHEL-52839
https://issues.redhat.com/browse/RHEL-68997
https://issues.redhat.com/browse/RHEL-73706
https://issues.redhat.com/browse/RHEL-81900
https://issues.redhat.com/browse/RHEL-86487
https://issues.redhat.com/browse/RHEL-90133
https://issues.redhat.com/browse/RHEL-94578
http://www.nessus.org/u?527a684c
https://access.redhat.com/errata/RHSA-2025:20518

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:20518.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
7.4
EPSS Score
0.0007
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48830
CVE | CVE-2022-49024
CVE | CVE-2022-49269
CVE | CVE-2022-49353
CVE | CVE-2022-49357
CVE | CVE-2022-49432
CVE | CVE-2022-49437
CVE | CVE-2022-49443
CVE | CVE-2022-49623
CVE | CVE-2022-49627
CVE | CVE-2022-49643
CVE | CVE-2022-49648
CVE | CVE-2022-49657
CVE | CVE-2022-49670
CVE | CVE-2022-49672
CVE | CVE-2022-49845
CVE | CVE-2024-36350
CVE | CVE-2024-36357
CVE | CVE-2024-46689
CVE | CVE-2024-46744
CVE | CVE-2024-47679
CVE | CVE-2024-47727
CVE | CVE-2024-49570
CVE | CVE-2024-49864
CVE | CVE-2024-50060
CVE | CVE-2024-50195
CVE | CVE-2024-50294
CVE | CVE-2024-52332
CVE | CVE-2024-53052
CVE | CVE-2024-53090
CVE | CVE-2024-53119
CVE | CVE-2024-53135
CVE | CVE-2024-53170
CVE | CVE-2024-53216
CVE | CVE-2024-53229
CVE | CVE-2024-53241
CVE | CVE-2024-53680
CVE | CVE-2024-54456
CVE | CVE-2024-56603
CVE | CVE-2024-56645
CVE | CVE-2024-56662
CVE | CVE-2024-56672
CVE | CVE-2024-56675
CVE | CVE-2024-56690
CVE | CVE-2024-56709
CVE | CVE-2024-56739
CVE | CVE-2024-57981
CVE | CVE-2024-57986
CVE | CVE-2024-57987
CVE | CVE-2024-57988
CVE | CVE-2024-57989
CVE | CVE-2024-57990
CVE | CVE-2024-57993
CVE | CVE-2024-57995
CVE | CVE-2024-57998
CVE | CVE-2024-58012
CVE | CVE-2024-58014
CVE | CVE-2024-58015
CVE | CVE-2024-58057
CVE | CVE-2024-58062
CVE | CVE-2024-58068
CVE | CVE-2024-58072
CVE | CVE-2024-58075
CVE | CVE-2024-58077
CVE | CVE-2024-58083
CVE | CVE-2024-58088
CVE | CVE-2025-21631
CVE | CVE-2025-21647
CVE | CVE-2025-21648
CVE | CVE-2025-21671
CVE | CVE-2025-21672
CVE | CVE-2025-21691
CVE | CVE-2025-21693
CVE | CVE-2025-21696
CVE | CVE-2025-21702
CVE | CVE-2025-21714
CVE | CVE-2025-21726
CVE | CVE-2025-21728
CVE | CVE-2025-21729
CVE | CVE-2025-21738
CVE | CVE-2025-21739
CVE | CVE-2025-21745
CVE | CVE-2025-21746
CVE | CVE-2025-21765
CVE | CVE-2025-21786
CVE | CVE-2025-21787
CVE | CVE-2025-21790
CVE | CVE-2025-21791
CVE | CVE-2025-21795
CVE | CVE-2025-21796
CVE | CVE-2025-21806
CVE | CVE-2025-21826
CVE | CVE-2025-21828
CVE | CVE-2025-21829
CVE | CVE-2025-21839
CVE | CVE-2025-21844
CVE | CVE-2025-21846
CVE | CVE-2025-21847
CVE | CVE-2025-21848
CVE | CVE-2025-21851
CVE | CVE-2025-21853
CVE | CVE-2025-21855
CVE | CVE-2025-21861
CVE | CVE-2025-21863
CVE | CVE-2025-21864
CVE | CVE-2025-22056
CVE | CVE-2025-22097
CVE | CVE-2025-37994
CVE | CVE-2025-38116
CVE | CVE-2025-38396
XREF | RHSA:2025:20518
XREF | CWE:20
XREF | CWE:59
XREF | CWE:99
XREF | CWE:119
XREF | CWE:120
XREF | CWE:125
XREF | CWE:193
XREF | CWE:252
XREF | CWE:266
XREF | CWE:362
XREF | CWE:367
XREF | CWE:369
XREF | CWE:395
XREF | CWE:400
XREF | CWE:401
XREF | CWE:413
XREF | CWE:414
XREF | CWE:416
XREF | CWE:438
XREF | CWE:457
XREF | CWE:476
XREF | CWE:665
XREF | CWE:667
XREF | CWE:674
XREF | CWE:682
XREF | CWE:703
XREF | CWE:754
XREF | CWE:787
XREF | CWE:789
XREF | CWE:833
XREF | CWE:863
XREF | CWE:908

Plugin Information
Published: 2025/11/12, Modified: 2025/11/17
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-611.5.1.el9_7
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-611.5.1.el9_7
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-611.5.1.el9_7
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-611.5.1.el9_7
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-611.5.1.el9_7
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-611.5.1.el9_7
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-611.5.1.el9_7
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-611.5.1.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
275153 - RHEL 9 : kernel (RHSA-2025:21112)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:21112 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (CVE-2022-50087)
* kernel: sunrpc: fix client side handling of tls alerts (CVE-2025-38571)
* kernel: sunrpc: fix handling of server side tls alerts (CVE-2025-38566)
* kernel: vsock/virtio: Validate length in packet header before skb_put() (CVE-2025-39718)
* kernel: ipv6: sr: Fix MAC comparison to be constant-time (CVE-2025-39702)
* kernel: x86/vmscape: Add conditional IBPB mitigation (CVE-2025-40300)
* kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817)
* kernel: pstore/ram: Check start of empty przs during init (CVE-2023-53331)
* kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy (CVE-2022-50367)
* kernel: crypto: seqiv - Handle EBUSY correctly (CVE-2023-53373)
* kernel: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CVE-2025-39849)
* kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path (CVE-2025-39841)
* kernel: crypto: xts - Handle EBUSY correctly (CVE-2023-53494)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2373539
https://bugzilla.redhat.com/show_bug.cgi?id=2389480
https://bugzilla.redhat.com/show_bug.cgi?id=2389487
https://bugzilla.redhat.com/show_bug.cgi?id=2393507
https://bugzilla.redhat.com/show_bug.cgi?id=2393533
https://bugzilla.redhat.com/show_bug.cgi?id=2394627
https://bugzilla.redhat.com/show_bug.cgi?id=2395805
https://bugzilla.redhat.com/show_bug.cgi?id=2395880
https://bugzilla.redhat.com/show_bug.cgi?id=2396114
https://bugzilla.redhat.com/show_bug.cgi?id=2396379
https://bugzilla.redhat.com/show_bug.cgi?id=2396928
https://bugzilla.redhat.com/show_bug.cgi?id=2396944
https://bugzilla.redhat.com/show_bug.cgi?id=2400777
http://www.nessus.org/u?d8ab5509
https://access.redhat.com/errata/RHSA-2025:21112

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:21112.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.6 (CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-50087
CVE | CVE-2022-50367
CVE | CVE-2023-53331
CVE | CVE-2023-53373
CVE | CVE-2023-53494
CVE | CVE-2025-38566
CVE | CVE-2025-38571
CVE | CVE-2025-39702
CVE | CVE-2025-39718
CVE | CVE-2025-39817
CVE | CVE-2025-39841
CVE | CVE-2025-39849
CVE | CVE-2025-40300
XREF | RHSA:2025:21112
XREF | CWE:125
XREF | CWE:129
XREF | CWE:208
XREF | CWE:402
XREF | CWE:416
XREF | CWE:664
XREF | CWE:754
XREF | CWE:787
XREF | CWE:825

Plugin Information
Published: 2025/11/12, Modified: 2025/11/12
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-611.7.1.el9_7
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-611.7.1.el9_7
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-611.7.1.el9_7
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-611.7.1.el9_7
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-611.7.1.el9_7
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-611.7.1.el9_7
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-611.7.1.el9_7
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-611.7.1.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
275536 - RHEL 9 : kernel (RHSA-2025:21469)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:21469 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (CVE-2025-38351)
* kernel: do_change_type(): refuse to operate on unmounted/not ours mounts (CVE-2025-38498)
* kernel: NFS: Fix a race when updating an existing write (CVE-2025-39697)
* kernel: kernfs: Fix UAF in polling when open file is released (CVE-2025-39881)
* kernel: Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (CVE-2025-39982)
* kernel: i40e: fix idx validation in config queues msg (CVE-2025-39971)
* kernel: Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue (CVE-2025-39983)
* kernel: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (CVE-2025-40047)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2382059
https://bugzilla.redhat.com/show_bug.cgi?id=2384422
https://bugzilla.redhat.com/show_bug.cgi?id=2393481
https://bugzilla.redhat.com/show_bug.cgi?id=2397558
https://bugzilla.redhat.com/show_bug.cgi?id=2404100
https://bugzilla.redhat.com/show_bug.cgi?id=2404108
https://bugzilla.redhat.com/show_bug.cgi?id=2404117
https://bugzilla.redhat.com/show_bug.cgi?id=2406758
http://www.nessus.org/u?cbb017d5
https://access.redhat.com/errata/RHSA-2025:21469

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:21469.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
8.0 (CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-38351
CVE | CVE-2025-38498
CVE | CVE-2025-39697
CVE | CVE-2025-39881
CVE | CVE-2025-39971
CVE | CVE-2025-39982
CVE | CVE-2025-39983
CVE | CVE-2025-40047
XREF | RHSA:2025:21469
XREF | CWE:362
XREF | CWE:416
XREF | CWE:662
XREF | CWE:754
XREF | CWE:787

Plugin Information
Published: 2025/11/17, Modified: 2025/11/17
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-611.8.1.el9_7
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-611.8.1.el9_7
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-611.8.1.el9_7
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-611.8.1.el9_7
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-611.8.1.el9_7
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-611.8.1.el9_7
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-611.8.1.el9_7
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-611.8.1.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
277065 - RHEL 9 : kernel (RHSA-2025:22405)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22405 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CVE-2025-38724)
* kernel: wifi: cfg80211: fix use-after-free in cmp_bss() (CVE-2025-39864)
* kernel: e1000e: fix heap overflow in e1000_set_eeprom (CVE-2025-39898)
* kernel: wifi: mt76: fix linked list corruption (CVE-2025-39918)
* kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (CVE-2025-39955)
* kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)
* kernel: iommu/vt-d: Disallow dirty tracking if incoherent page walk (CVE-2025-40058)
* kernel: ice: ice_adapter: release xa entry on adapter allocation failure (CVE-2025-40185)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2393172
https://bugzilla.redhat.com/show_bug.cgi?id=2396934
https://bugzilla.redhat.com/show_bug.cgi?id=2400598
https://bugzilla.redhat.com/show_bug.cgi?id=2400628
https://bugzilla.redhat.com/show_bug.cgi?id=2402699
https://bugzilla.redhat.com/show_bug.cgi?id=2404105
https://bugzilla.redhat.com/show_bug.cgi?id=2406776
https://bugzilla.redhat.com/show_bug.cgi?id=2414741
http://www.nessus.org/u?096e6bbf
https://access.redhat.com/errata/RHSA-2025:22405

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:22405.
Risk Factor
High
CVSS v3.0 Base Score
7.6 (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
CVSS v3.0 Temporal Score
6.6 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
8.0 (CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-38724
CVE | CVE-2025-39864
CVE | CVE-2025-39918
CVE | CVE-2025-39955
CVE | CVE-2025-39981
CVE | CVE-2025-40058
CVE | CVE-2025-40185
XREF | RHSA:2025:22405
XREF | CWE:119
XREF | CWE:122
XREF | CWE:213
XREF | CWE:367
XREF | CWE:416
XREF | CWE:476

Plugin Information
Published: 2025/12/02, Modified: 2025/12/02
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-611.11.1.el9_7
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-611.11.1.el9_7
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-611.11.1.el9_7
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-611.11.1.el9_7
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-611.11.1.el9_7
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-611.11.1.el9_7
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-611.11.1.el9_7
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-611.11.1.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
278951 - RHEL 9 : kernel (RHSA-2025:23241)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23241 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (CVE-2025-38499)
* kernel: iommufd: Fix race during abort for file descriptors (CVE-2025-39966)
* kernel: tls: wait for pending async decryptions if tls_strp_msg_hold fails (CVE-2025-40176)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2387670
https://bugzilla.redhat.com/show_bug.cgi?id=2404107
https://bugzilla.redhat.com/show_bug.cgi?id=2414524
http://www.nessus.org/u?8a574a52
https://access.redhat.com/errata/RHSA-2025:23241

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:23241.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-38499
CVE | CVE-2025-39966
CVE | CVE-2025-40176
XREF | RHSA:2025:23241
XREF | CWE:266
XREF | CWE:416
XREF | CWE:825

Plugin Information
Published: 2025/12/17, Modified: 2025/12/17
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-611.16.1.el9_7
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-611.16.1.el9_7
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-611.16.1.el9_7
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-611.16.1.el9_7
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-611.16.1.el9_7
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-611.16.1.el9_7
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-611.16.1.el9_7
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-611.16.1.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
232817 - RHEL 9 : kernel (RHSA-2025:2627)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2627 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: ACPI: extlog: fix NULL pointer dereference check (CVE-2023-52605)
* kernel: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (CVE-2024-50264)
* kernel: HID: core: zero-initialize the report buffer (CVE-2024-50302)
* kernel: can: bcm: Fix UAF in bcm_proc_show() (CVE-2023-52922)
* kernel: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (CVE-2024-53113)
* kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (CVE-2024-53197)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2268295
https://bugzilla.redhat.com/show_bug.cgi?id=2327168
https://bugzilla.redhat.com/show_bug.cgi?id=2327169
https://bugzilla.redhat.com/show_bug.cgi?id=2329370
https://bugzilla.redhat.com/show_bug.cgi?id=2329924
https://bugzilla.redhat.com/show_bug.cgi?id=2334412
http://www.nessus.org/u?4b6973ed
https://access.redhat.com/errata/RHSA-2025:2627

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:2627.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.2 (CVSS:3.0/E:F/RL:O/RC:C)
VPR Score
8.4
EPSS Score
0.0024
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:F/RL:OF/RC:C)
References

CVE | CVE-2023-52922
CVE | CVE-2024-50264
CVE | CVE-2024-50302
CVE | CVE-2024-53113
CVE | CVE-2024-53197
XREF | RHSA:2025:2627
XREF | CISA-KNOWN-EXPLOITED:2025/04/30
XREF | CISA-KNOWN-EXPLOITED:2025/03/25
XREF | CWE:120
XREF | CWE:416
XREF | CWE:476
XREF | CWE:908

Plugin Information
Published: 2025/03/15, Modified: 2025/09/24
Plugin Output

## tcp/0

Remote package installed : bpftool-7.4.0-503.11.1.el9_5
Should be : bpftool-7.4.0-503.31.1.el9_5
Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-503.31.1.el9_5
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-503.31.1.el9_5
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-503.31.1.el9_5
Remote package installed : kernel-headers-5.14.0-503.11.1.el9_5
Should be : kernel-headers-5.14.0-503.31.1.el9_5
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-503.31.1.el9_5
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-503.31.1.el9_5
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-503.31.1.el9_5
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-503.31.1.el9_5
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-503.31.1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
233512 - RHEL 9 : kernel (RHSA-2025:3208)
-
Synopsis
The remote Red Hat host is missing a security update for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:3208 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CVE-2025-21785)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2348630
http://www.nessus.org/u?fffae582
https://access.redhat.com/errata/RHSA-2025:3208

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:3208.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-21785
XREF | RHSA:2025:3208
XREF | CWE:787

Plugin Information
Published: 2025/03/29, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : bpftool-7.4.0-503.11.1.el9_5
Should be : bpftool-7.4.0-503.34.1.el9_5
Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-503.34.1.el9_5
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-503.34.1.el9_5
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-503.34.1.el9_5
Remote package installed : kernel-headers-5.14.0-503.11.1.el9_5
Should be : kernel-headers-5.14.0-503.34.1.el9_5
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-503.34.1.el9_5
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-503.34.1.el9_5
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-503.34.1.el9_5
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-503.34.1.el9_5
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-503.34.1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
234671 - RHEL 9 : kernel (RHSA-2025:3937)
-
Synopsis
The remote Red Hat host is missing a security update for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:3937 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: ALSA: usb-audio: Fix out of bounds reads when finding clock sources (CVE-2024-53150)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2333971
http://www.nessus.org/u?0f35ce81
https://access.redhat.com/errata/RHSA-2025:3937

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:3937.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.6 (CVSS:3.0/E:F/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.1 (CVSS2#E:F/RL:OF/RC:C)
References

CVE | CVE-2024-53150
XREF | CISA-KNOWN-EXPLOITED:2025/04/30
XREF | RHSA:2025:3937
XREF | CWE:125

Plugin Information
Published: 2025/04/21, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : bpftool-7.4.0-503.11.1.el9_5
Should be : bpftool-7.4.0-503.38.1.el9_5
Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-503.38.1.el9_5
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-503.38.1.el9_5
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-503.38.1.el9_5
Remote package installed : kernel-headers-5.14.0-503.11.1.el9_5
Should be : kernel-headers-5.14.0-503.38.1.el9_5
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-503.38.1.el9_5
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-503.38.1.el9_5
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-503.38.1.el9_5
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-503.38.1.el9_5
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-503.38.1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
235002 - RHEL 9 : kernel (RHSA-2025:4341)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:4341 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: kobject_uevent: Fix OOB access within zap_modalias_env() (CVE-2024-42292)
* kernel: ipvs: properly dereference pe in ip_vs_add_service (CVE-2024-42322)
* kernel: bonding: fix null pointer deref in bond_ipsec_offload_ok (CVE-2024-44990)
* kernel: ELF: fix kernel.randomize_va_space double read (CVE-2024-46826)
* kernel: nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (CVE-2025-21927)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2309853
https://bugzilla.redhat.com/show_bug.cgi?id=2315178
https://bugzilla.redhat.com/show_bug.cgi?id=2356593
http://www.nessus.org/u?8a8c7d36
https://access.redhat.com/errata/RHSA-2025:4341

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:4341.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-42292
CVE | CVE-2024-42322
CVE | CVE-2024-44990
CVE | CVE-2024-46826
CVE | CVE-2025-21927
XREF | RHSA:2025:4341
XREF | CWE:20
XREF | CWE:119
XREF | CWE:125
XREF | CWE:476

Plugin Information
Published: 2025/04/30, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : bpftool-7.4.0-503.11.1.el9_5
Should be : bpftool-7.4.0-503.40.1.el9_5
Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-503.40.1.el9_5
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-503.40.1.el9_5
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-503.40.1.el9_5
Remote package installed : kernel-headers-5.14.0-503.11.1.el9_5
Should be : kernel-headers-5.14.0-503.40.1.el9_5
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-503.40.1.el9_5
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-503.40.1.el9_5
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-503.40.1.el9_5
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-503.40.1.el9_5
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-503.40.1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237369 - RHEL 9 : kernel (RHSA-2025:7423)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7423 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: io_uring/sqpoll: zero sqd->thread on tctx errors (CVE-2025-21633)
* kernel: soc: qcom: socinfo: Avoid out of bounds read of serial number (CVE-2024-58007)
* kernel: tpm: Change to kvalloc() in eventlog/acpi.c (CVE-2024-58005)
* kernel: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read (CVE-2024-58069)
* kernel: nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (CVE-2025-21927)
* kernel: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() (CVE-2025-21993)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2338813
https://bugzilla.redhat.com/show_bug.cgi?id=2348565
https://bugzilla.redhat.com/show_bug.cgi?id=2348590
https://bugzilla.redhat.com/show_bug.cgi?id=2350364
https://bugzilla.redhat.com/show_bug.cgi?id=2356593
https://bugzilla.redhat.com/show_bug.cgi?id=2356908
http://www.nessus.org/u?72cf455f
https://access.redhat.com/errata/RHSA-2025:7423

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:7423.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-58005
CVE | CVE-2024-58007
CVE | CVE-2024-58069
CVE | CVE-2025-21927
CVE | CVE-2025-21993
XREF | RHSA:2025:7423
XREF | CWE:99
XREF | CWE:119
XREF | CWE:125
XREF | CWE:416
XREF | CWE:787

Plugin Information
Published: 2025/05/27, Modified: 2025/09/24
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.16.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.16.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.16.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.16.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.16.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.16.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.16.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.16.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237359 - RHEL 9 : kernel (RHSA-2025:7903)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7903 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: vsock: Keep the binding until socket destruction (CVE-2025-21756)
* kernel: dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature (CVE-2025-21966)
* kernel: net: ppp: Add bound checking for skb data on ppp_sync_txmung (CVE-2025-37749)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2348609
https://bugzilla.redhat.com/show_bug.cgi?id=2356605
https://bugzilla.redhat.com/show_bug.cgi?id=2363332
http://www.nessus.org/u?6242acd0
https://access.redhat.com/errata/RHSA-2025:7903

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:7903.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
9.0
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-21756
CVE | CVE-2025-21966
CVE | CVE-2025-37749
XREF | RHSA:2025:7903
XREF | CWE:119
XREF | CWE:125
XREF | CWE:416

Plugin Information
Published: 2025/05/27, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.17.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.17.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.17.1.el9_6
Remote package installed : kernel-headers-5.14.0-503.11.1.el9_5
Should be : kernel-headers-5.14.0-570.17.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.17.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.17.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.17.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.17.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.17.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237634 - RHEL 9 : kernel (RHSA-2025:8333)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8333 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: Use after Free in gru_set_context_option leading to kernel panic (CVE-2022-3424)
* kernel: ndisc: use RCU protection in ndisc_alloc_skb() (CVE-2025-21764)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2132640
https://bugzilla.redhat.com/show_bug.cgi?id=2348575
http://www.nessus.org/u?193c6573
https://access.redhat.com/errata/RHSA-2025:8333

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:8333.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-3424
CVE | CVE-2025-21764
XREF | RHSA:2025:8333
XREF | CWE:416

Plugin Information
Published: 2025/06/02, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.19.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.19.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.19.1.el9_6
Remote package installed : kernel-headers-5.14.0-503.11.1.el9_5
Should be : kernel-headers-5.14.0-570.19.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.19.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.19.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.19.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.19.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.19.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237977 - RHEL 9 : kernel (RHSA-2025:8643)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8643 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: net: gso: fix ownership in __udp_gso_segment (CVE-2025-21926)
* kernel: vlan: enforce underlying device type (CVE-2025-21920)
* kernel: xsk: fix an integer overflow in xp_create_and_assign_umem() (CVE-2025-21997)
* kernel: net: fix geneve_opt length integer overflow (CVE-2025-22055)
* kernel: ext4: fix OOB read when checking dotdot dir (CVE-2025-37785)
* kernel: wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (CVE-2025-37943)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2356587
https://bugzilla.redhat.com/show_bug.cgi?id=2356639
https://bugzilla.redhat.com/show_bug.cgi?id=2357143
https://bugzilla.redhat.com/show_bug.cgi?id=2360300
https://bugzilla.redhat.com/show_bug.cgi?id=2360921
https://bugzilla.redhat.com/show_bug.cgi?id=2367748
http://www.nessus.org/u?14e1e735
https://access.redhat.com/errata/RHSA-2025:8643

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:8643.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-21920
CVE | CVE-2025-21926
CVE | CVE-2025-21997
CVE | CVE-2025-22055
CVE | CVE-2025-37785
CVE | CVE-2025-37943
XREF | RHSA:2025:8643
XREF | CWE:125
XREF | CWE:190
XREF | CWE:253
XREF | CWE:416

Plugin Information
Published: 2025/06/09, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.21.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.21.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.21.1.el9_6
Remote package installed : kernel-headers-5.14.0-503.11.1.el9_5
Should be : kernel-headers-5.14.0-570.21.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.21.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.21.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.21.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.21.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.21.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
238499 - RHEL 9 : kernel (RHSA-2025:9080)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:9080 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: eth: bnxt: fix truesize for mb-xdp-pass case (CVE-2025-21961)
* kernel: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd (CVE-2025-21969)
* kernel: cifs: Fix integer overflow while processing acdirmax mount option (CVE-2025-21963)
* kernel: wifi: cfg80211: cancel wiphy_work before freeing wiphy (CVE-2025-21979)
* kernel: proc: fix UAF in proc_get_inode() (CVE-2025-21999)
* kernel: md: fix mddev uaf while iterating all_mddevs list (CVE-2025-22126)
* kernel: smb: client: fix UAF in decryption with multichannel (CVE-2025-37750)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2356584
https://bugzilla.redhat.com/show_bug.cgi?id=2356633
https://bugzilla.redhat.com/show_bug.cgi?id=2356642
https://bugzilla.redhat.com/show_bug.cgi?id=2356652
https://bugzilla.redhat.com/show_bug.cgi?id=2357134
https://bugzilla.redhat.com/show_bug.cgi?id=2360236
https://bugzilla.redhat.com/show_bug.cgi?id=2363341
http://www.nessus.org/u?1afc658f
https://access.redhat.com/errata/RHSA-2025:9080

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:9080.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-21961
CVE | CVE-2025-21963
CVE | CVE-2025-21969
CVE | CVE-2025-21979
CVE | CVE-2025-21999
CVE | CVE-2025-22126
CVE | CVE-2025-37750
XREF | RHSA:2025:9080
XREF | CWE:190
XREF | CWE:416
XREF | CWE:665

Plugin Information
Published: 2025/06/16, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.22.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.22.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.22.1.el9_6
Remote package installed : kernel-headers-5.14.0-503.11.1.el9_5
Should be : kernel-headers-5.14.0-570.22.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.22.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.22.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.22.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.22.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.22.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
240259 - RHEL 9 : kernel (RHSA-2025:9302)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:9302 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: ice: Fix deinitializing VF in error path (CVE-2025-21883)
* kernel: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CVE-2025-21919)
* kernel: ibmvnic: Use kernel helpers for hex dumps (CVE-2025-22104)
* kernel: ext4: fix off-by-one error in do_split (CVE-2025-23150)
* kernel: ext4: ignore xattrs past end (CVE-2025-37738)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2355415
https://bugzilla.redhat.com/show_bug.cgi?id=2356618
https://bugzilla.redhat.com/show_bug.cgi?id=2360265
https://bugzilla.redhat.com/show_bug.cgi?id=2363268
https://bugzilla.redhat.com/show_bug.cgi?id=2363305
http://www.nessus.org/u?a2104a08
https://access.redhat.com/errata/RHSA-2025:9302

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:9302.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
7.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-21883
CVE | CVE-2025-21919
CVE | CVE-2025-22104
CVE | CVE-2025-23150
CVE | CVE-2025-37738
XREF | RHSA:2025:9302
XREF | CWE:120
XREF | CWE:416
XREF | CWE:787

Plugin Information
Published: 2025/06/23, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.23.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.23.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.23.1.el9_6
Remote package installed : kernel-headers-5.14.0-503.11.1.el9_5
Should be : kernel-headers-5.14.0-570.23.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.23.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.23.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.23.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.23.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.23.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
240922 - RHEL 9 : kernel (RHSA-2025:9880)
-
Synopsis
The remote Red Hat host is missing a security update for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9880 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: Squashfs: fix handling and sanity checking of xattr_ids count (CVE-2023-52933)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2355476
http://www.nessus.org/u?dc91bcf4
https://access.redhat.com/errata/RHSA-2025:9880

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:9880.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52933
XREF | RHSA:2025:9880
XREF | CWE:190

Plugin Information
Published: 2025/06/30, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.24.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.24.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.24.1.el9_6
Remote package installed : kernel-headers-5.14.0-503.11.1.el9_5
Should be : kernel-headers-5.14.0-570.24.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.24.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.24.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.24.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.24.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.24.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
240476 - RHEL 9 : libarchive (RHSA-2025:9431)
-
Synopsis
The remote Red Hat host is missing a security update for libarchive.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9431 advisory.
The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.
Security Fix(es):
* libarchive: Buffer Overflow vulnerability in libarchive (CVE-2025-25724)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2349221
http://www.nessus.org/u?05c40ba6
https://access.redhat.com/errata/RHSA-2025:9431

Solution
Update the RHEL libarchive package based on the guidance in RHSA-2025:9431.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-25724
XREF | RHSA:2025:9431
XREF | CWE:252

Plugin Information
Published: 2025/06/25, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : libarchive-3.5.3-4.el9
Should be : libarchive-3.5.3-5.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
240242 - RHEL 9 : libblockdev (RHSA-2025:9327)
-
Synopsis
The remote Red Hat host is missing a security update for libblockdev.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9327 advisory.
The libblockdev packages provide a C library with GObject introspection support used for low-level operations on block devices. The library serves as a thin wrapper around plug-ins for specific functionality, such as LVM, Btrfs, LUKS, or MD RAID.
Security Fix(es):
* libblockdev: LPE from allow_active to root in libblockdev via udisks (CVE-2025-6019)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2370051
http://www.nessus.org/u?01e97ba9
https://access.redhat.com/errata/RHSA-2025:9327

Solution
Update the RHEL libblockdev package based on the guidance in RHSA-2025:9327.
Risk Factor
Medium
CVSS v3.0 Base Score
7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.3 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
7.4
EPSS Score
0.0001
CVSS v2.0 Base Score
6.0 (CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-6019
XREF | RHSA:2025:9327
XREF | CWE:250

Plugin Information
Published: 2025/06/23, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : libblockdev-2.28-10.el9
Should be : libblockdev-2.28-14.el9_6
Remote package installed : libblockdev-crypto-2.28-10.el9
Should be : libblockdev-crypto-2.28-14.el9_6
Remote package installed : libblockdev-fs-2.28-10.el9
Should be : libblockdev-fs-2.28-14.el9_6
Remote package installed : libblockdev-loop-2.28-10.el9
Should be : libblockdev-loop-2.28-14.el9_6
Remote package installed : libblockdev-lvm-2.28-10.el9
Should be : libblockdev-lvm-2.28-14.el9_6
Remote package installed : libblockdev-mdraid-2.28-10.el9
Should be : libblockdev-mdraid-2.28-14.el9_6
Remote package installed : libblockdev-part-2.28-10.el9
Should be : libblockdev-part-2.28-14.el9_6
Remote package installed : libblockdev-swap-2.28-10.el9
Should be : libblockdev-swap-2.28-14.el9_6
Remote package installed : libblockdev-utils-2.28-10.el9
Should be : libblockdev-utils-2.28-14.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
210901 - RHEL 9 : libsoup (RHSA-2024:9559)
-
Synopsis
The remote Red Hat host is missing one or more security updates for libsoup.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:9559 advisory.
The libsoup packages provide an HTTP client and server library for GNOME.
Security Fix(es):
* libsoup: infinite loop while reading websocket data (CVE-2024-52532)
* libsoup: HTTP request smuggling via stripping null bytes from the ends of header names (CVE-2024-52530)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2325276
https://bugzilla.redhat.com/show_bug.cgi?id=2325284
http://www.nessus.org/u?eb30ad62
https://access.redhat.com/errata/RHSA-2024:9559

Solution
Update the RHEL libsoup package based on the guidance in RHSA-2024:9559.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0013
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-52530
CVE | CVE-2024-52532
XREF | RHSA:2024:9559
XREF | CWE:444
XREF | CWE:835

Plugin Information
Published: 2024/11/13, Modified: 2025/09/05
Plugin Output

## tcp/0

Remote package installed : libsoup-2.72.0-8.el9
Should be : libsoup-2.72.0-8.el9_5.2
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
214769 - RHEL 9 : libsoup (RHSA-2025:0791)
-
Synopsis
The remote Red Hat host is missing a security update for libsoup.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0791 advisory.
The libsoup packages provide an HTTP client and server library for GNOME.
Security Fix(es):
* libsoup: buffer overflow via UTF-8 conversion in soup_header_parse_param_list_strict (CVE-2024-52531)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2325277
http://www.nessus.org/u?e618670f
https://access.redhat.com/errata/RHSA-2025:0791

Solution
Update the RHEL libsoup package based on the guidance in RHSA-2025:0791.
Risk Factor
High
CVSS v3.0 Base Score
8.4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.6 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-52531
XREF | RHSA:2025:0791
XREF | CWE:122

Plugin Information
Published: 2025/01/29, Modified: 2025/09/05
Plugin Output

## tcp/0

Remote package installed : libsoup-2.72.0-8.el9
Should be : libsoup-2.72.0-8.el9_5.3
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
272284 - RHEL 9 : libsoup (RHSA-2025:19713)
-
Synopsis
The remote Red Hat host is missing one or more security updates for libsoup.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19713 advisory.
The libsoup packages provide an HTTP client and server library for GNOME.
Security Fix(es):
* libsoup: Integer Overflow in Cookie Expiration Date Handling in libsoup (CVE-2025-4945)
* libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP Library (CVE-2025-11021)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2367175
https://bugzilla.redhat.com/show_bug.cgi?id=2399627
http://www.nessus.org/u?d1e33287
https://access.redhat.com/errata/RHSA-2025:19713

Solution
Update the RHEL libsoup package based on the guidance in RHSA-2025:19713.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-4945
CVE | CVE-2025-11021
XREF | RHSA:2025:19713
XREF | CWE:125
XREF | CWE:190

Plugin Information
Published: 2025/11/04, Modified: 2025/11/04
Plugin Output

## tcp/0

Remote package installed : libsoup-2.72.0-8.el9
Should be : libsoup-2.72.0-10.el9_6.3
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
274820 - RHEL 9 : libsoup (RHSA-2025:20959)
-
Synopsis
The remote Red Hat host is missing one or more security updates for libsoup.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:20959 advisory.
The libsoup packages provide an HTTP client and server library for GNOME.
Security Fix(es):
* libsoup: Integer Overflow in Cookie Expiration Date Handling in libsoup (CVE-2025-4945)
* libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP Library (CVE-2025-11021)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2367175
https://bugzilla.redhat.com/show_bug.cgi?id=2399627
http://www.nessus.org/u?d6d4bc95
https://access.redhat.com/errata/RHSA-2025:20959

Solution
Update the RHEL libsoup package based on the guidance in RHSA-2025:20959.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-4945
CVE | CVE-2025-11021
XREF | RHSA:2025:20959
XREF | CWE:125
XREF | CWE:190

Plugin Information
Published: 2025/11/11, Modified: 2025/11/11
Plugin Output

## tcp/0

Remote package installed : libsoup-2.72.0-8.el9
Should be : libsoup-2.72.0-12.el9_7.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
270705 - RHEL 9 : libssh (RHSA-2025:18275)
-
Synopsis
The remote Red Hat host is missing a security update for libssh.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:18275 advisory.
libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.
Security Fix(es):
* libssh: out-of-bounds read in sftp_handle() (CVE-2025-5318)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2369131
http://www.nessus.org/u?464c08d3
https://access.redhat.com/errata/RHSA-2025:18275

Solution
Update the RHEL libssh package based on the guidance in RHSA-2025:18275.
Risk Factor
High
CVSS v3.0 Base Score
8.1 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0004
CVSS v2.0 Base Score
8.5 (CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
6.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-5318
XREF | RHSA:2025:18275
XREF | CWE:125

Plugin Information
Published: 2025/10/17, Modified: 2025/10/17
Plugin Output

## tcp/0

Remote package installed : libssh-0.10.4-13.el9
Should be : libssh-0.10.4-15.el9_6
Remote package installed : libssh-config-0.10.4-13.el9
Should be : libssh-config-0.10.4-15.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
274819 - RHEL 9 : libssh (RHSA-2025:20943)
-
Synopsis
The remote Red Hat host is missing a security update for libssh.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:20943 advisory.
libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.
Security Fix(es):
* libssh: out-of-bounds read in sftp_handle() (CVE-2025-5318)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2369131
http://www.nessus.org/u?ec896775
https://access.redhat.com/errata/RHSA-2025:20943

Solution
Update the RHEL libssh package based on the guidance in RHSA-2025:20943.
Risk Factor
High
CVSS v3.0 Base Score
8.1 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0004
CVSS v2.0 Base Score
8.5 (CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
6.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-5318
XREF | RHSA:2025:20943
XREF | CWE:125

Plugin Information
Published: 2025/11/11, Modified: 2025/11/11
Plugin Output

## tcp/0

Remote package installed : libssh-0.10.4-13.el9
Should be : libssh-0.10.4-15.el9_7
Remote package installed : libssh-config-0.10.4-13.el9
Should be : libssh-config-0.10.4-15.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
279084 - RHEL 9 : libssh (RHSA-2025:23483)
-
Synopsis
The remote Red Hat host is missing a security update for libssh.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:23483 advisory.
libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.
Security Fix(es):
* libssh: Invalid return code for chacha20 poly1305 with OpenSSL backend (CVE-2025-5987)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2376219
https://issues.redhat.com/browse/RHEL-135506
http://www.nessus.org/u?cfabfe39
https://access.redhat.com/errata/RHSA-2025:23483

Solution
Update the RHEL libssh package based on the guidance in RHSA-2025:23483.
Risk Factor
High
CVSS v3.0 Base Score
8.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
7.6 (CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-5987
XREF | RHSA:2025:23483
XREF | CWE:393

Plugin Information
Published: 2025/12/18, Modified: 2025/12/18
Plugin Output

## tcp/0

Remote package installed : libssh-0.10.4-13.el9
Should be : libssh-0.10.4-17.el9_7
Remote package installed : libssh-config-0.10.4-13.el9
Should be : libssh-config-0.10.4-17.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
271847 - RHEL 9 : libtiff (RHSA-2025:19113)
-
Synopsis
The remote Red Hat host is missing one or more security updates for libtiff.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19113 advisory.
The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.
Security Fix(es):
* libtiff: LibTIFF Use-After-Free Vulnerability (CVE-2025-8176)
* libtiff: Libtiff Write-What-Where (CVE-2025-9900)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2383598
https://bugzilla.redhat.com/show_bug.cgi?id=2392784
http://www.nessus.org/u?bec8329b
https://access.redhat.com/errata/RHSA-2025:19113

Solution
Update the RHEL libtiff package based on the guidance in RHSA-2025:19113.
Risk Factor
Medium
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0005
CVSS v2.0 Base Score
4.3 (CVSS2#AV:L/AC:L/Au:S/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-8176
CVE | CVE-2025-9900
XREF | RHSA:2025:19113
XREF | CWE:123
XREF | CWE:416

Plugin Information
Published: 2025/10/28, Modified: 2025/10/28
Plugin Output

## tcp/0

Remote package installed : libtiff-4.4.0-13.el9
Should be : libtiff-4.4.0-13.el9_6.2
Remote package installed : libtiff-devel-4.4.0-13.el9
Should be : libtiff-devel-4.4.0-13.el9_6.2
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
274775 - RHEL 9 : libtiff (RHSA-2025:20801)
-
Synopsis
The remote Red Hat host is missing one or more security updates for libtiff.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:20801 advisory.
The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.
Security Fix(es):
* libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM (CVE-2023-52355)
* libtiff: Segment fault in libtiff in TIFFReadRGBATileExt() leading to denial of service (CVE-2023-52356)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?b6159d8b
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2251326
https://bugzilla.redhat.com/show_bug.cgi?id=2251344
http://www.nessus.org/u?68740101
https://access.redhat.com/errata/RHSA-2025:20801

Solution
Update the RHEL libtiff package based on the guidance in RHSA-2025:20801.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.024
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-52355
CVE | CVE-2023-52356
XREF | RHSA:2025:20801
XREF | CWE:122
XREF | CWE:787

Plugin Information
Published: 2025/11/11, Modified: 2025/11/11
Plugin Output

## tcp/0

Remote package installed : libtiff-4.4.0-13.el9
Should be : libtiff-4.4.0-15.el9
Remote package installed : libtiff-devel-4.4.0-13.el9
Should be : libtiff-devel-4.4.0-15.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
274752 - RHEL 9 : libtiff (RHSA-2025:20956)
-
Synopsis
The remote Red Hat host is missing one or more security updates for libtiff.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:20956 advisory.
The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.
Security Fix(es):
* libtiff: LibTIFF Use-After-Free Vulnerability (CVE-2025-8176)
* libtiff: Libtiff Write-What-Where (CVE-2025-9900)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2383598
https://bugzilla.redhat.com/show_bug.cgi?id=2392784
http://www.nessus.org/u?1fa759e2
https://access.redhat.com/errata/RHSA-2025:20956

Solution
Update the RHEL libtiff package based on the guidance in RHSA-2025:20956.
Risk Factor
Medium
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0005
CVSS v2.0 Base Score
4.3 (CVSS2#AV:L/AC:L/Au:S/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-8176
CVE | CVE-2025-9900
XREF | RHSA:2025:20956
XREF | CWE:123
XREF | CWE:416

Plugin Information
Published: 2025/11/11, Modified: 2025/11/11
Plugin Output

## tcp/0

Remote package installed : libtiff-4.4.0-13.el9
Should be : libtiff-4.4.0-15.el9_7.2
Remote package installed : libtiff-devel-4.4.0-13.el9
Should be : libtiff-devel-4.4.0-15.el9_7.2
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
243236 - RHEL 9 : libxml2 (RHSA-2025:12447)
-
Synopsis
The remote Red Hat host is missing a security update for libxml2.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:12447 advisory.
The libxml2 library is a development toolbox providing the implementation of various XML standards.
Security Fix(es):
* libxslt: Heap Use-After-Free in libxslt caused by atype corruption in xmlAttrPtr (CVE-2025-7425)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2379274
http://www.nessus.org/u?b35a3c87
https://access.redhat.com/errata/RHSA-2025:12447

Solution
Update the RHEL libxml2 package based on the guidance in RHSA-2025:12447.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
7.9
EPSS Score
0.0001
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:H/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-7425
XREF | RHSA:2025:12447
XREF | CWE:416

Plugin Information
Published: 2025/07/31, Modified: 2025/08/06
Plugin Output

## tcp/0

Remote package installed : libxml2-2.9.13-6.el9_4
Should be : libxml2-2.9.13-11.el9_6
Remote package installed : libxml2-devel-2.9.13-6.el9_4
Should be : libxml2-devel-2.9.13-11.el9_6
Remote package installed : python3-libxml2-2.9.13-6.el9_4
Should be : python3-libxml2-2.9.13-11.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
245207 - RHEL 9 : libxml2 (RHSA-2025:13428)
-
Synopsis
The remote Red Hat host is missing one or more security updates for libxml2.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:13428 advisory.
The libxml2 library is a development toolbox providing the implementation of various XML standards.
Security Fix(es):
* libxml2: Out-of-Bounds Read in libxml2 (CVE-2025-32414)
* libxml2: Out-of-bounds Read in xmlSchemaIDCFillNodeTables (CVE-2025-32415)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2358121
https://bugzilla.redhat.com/show_bug.cgi?id=2360768
http://www.nessus.org/u?30c5f05d
https://access.redhat.com/errata/RHSA-2025:13428

Solution
Update the RHEL libxml2 package based on the guidance in RHSA-2025:13428.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-32414
CVE | CVE-2025-32415
XREF | RHSA:2025:13428
XREF | CWE:125
XREF | CWE:393

Plugin Information
Published: 2025/08/07, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : libxml2-2.9.13-6.el9_4
Should be : libxml2-2.9.13-12.el9_6
Remote package installed : libxml2-devel-2.9.13-6.el9_4
Should be : libxml2-devel-2.9.13-12.el9_6
Remote package installed : python3-libxml2-2.9.13-6.el9_4
Should be : python3-libxml2-2.9.13-12.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
216173 - RHEL 9 : libxml2 (RHSA-2025:1350)
-
Synopsis
The remote Red Hat host is missing a security update for libxml2.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:1350 advisory.
The libxml2 library is a development toolbox providing the implementation of various XML standards.
Security Fix(es):
* libxml: use-after-free in xmlXIncludeAddNode (CVE-2022-49043)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2342118
http://www.nessus.org/u?5be2a4de
https://access.redhat.com/errata/RHSA-2025:1350

Solution
Update the RHEL libxml2 package based on the guidance in RHSA-2025:1350.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49043
XREF | RHSA:2025:1350
XREF | CWE:416

Plugin Information
Published: 2025/02/12, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : libxml2-2.9.13-6.el9_4
Should be : libxml2-2.9.13-6.el9_5.1
Remote package installed : libxml2-devel-2.9.13-6.el9_4
Should be : libxml2-devel-2.9.13-6.el9_5.1
Remote package installed : python3-libxml2-2.9.13-6.el9_4
Should be : python3-libxml2-2.9.13-6.el9_5.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
232806 - RHEL 9 : libxml2 (RHSA-2025:2679)
-
Synopsis
The remote Red Hat host is missing one or more security updates for libxml2.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2679 advisory.
The libxml2 library is a development toolbox providing the implementation of various XML standards.
Security Fix(es):
* libxml2: Use-After-Free in libxml2 (CVE-2024-56171)
* libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2 (CVE-2025-24928)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2346416
https://bugzilla.redhat.com/show_bug.cgi?id=2346421
http://www.nessus.org/u?7086a90d
https://access.redhat.com/errata/RHSA-2025:2679

Solution
Update the RHEL libxml2 package based on the guidance in RHSA-2025:2679.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-56171
CVE | CVE-2025-24928
XREF | RHSA:2025:2679
XREF | CWE:121
XREF | CWE:416

Plugin Information
Published: 2025/03/15, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : libxml2-2.9.13-6.el9_4
Should be : libxml2-2.9.13-6.el9_5.2
Remote package installed : libxml2-devel-2.9.13-6.el9_4
Should be : libxml2-devel-2.9.13-6.el9_5.2
Remote package installed : python3-libxml2-2.9.13-6.el9_4
Should be : python3-libxml2-2.9.13-6.el9_5.2
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
233516 - RHEL 9 : libxslt (RHSA-2025:3107)
-
Synopsis
The remote Red Hat host is missing a security update for libxslt.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:3107 advisory.
libxslt is a library for transforming XML files into other textual formats (including HTML, plain text, and other XML representations of the underlying data) using the standard XSLT stylesheet transformation mechanism.
Security Fix(es):
* libxslt: Use-After-Free in libxslt numbers.c (CVE-2025-24855)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2352483
http://www.nessus.org/u?dc3275cc
https://access.redhat.com/errata/RHSA-2025:3107

Solution
Update the RHEL libxslt package based on the guidance in RHSA-2025:3107.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:H/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-24855
XREF | RHSA:2025:3107
XREF | CWE:416

Plugin Information
Published: 2025/03/29, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : libxslt-1.1.34-9.el9
Should be : libxslt-1.1.34-9.el9_5.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
234772 - RHEL 9 : libxslt (RHSA-2025:4025)
-
Synopsis
The remote Red Hat host is missing a security update for libxslt.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:4025 advisory.
libxslt is a library for transforming XML files into other textual formats (including HTML, plain text, and other XML representations of the underlying data) using the standard XSLT stylesheet transformation mechanism.
Security Fix(es):
* libxslt: Use-After-Free in libxslt (xsltGetInheritedNsList) (CVE-2024-55549)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2352484
http://www.nessus.org/u?cee10de5
https://access.redhat.com/errata/RHSA-2025:4025

Solution
Update the RHEL libxslt package based on the guidance in RHSA-2025:4025.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:H/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-55549
XREF | RHSA:2025:4025
XREF | CWE:416

Plugin Information
Published: 2025/04/23, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : libxslt-1.1.34-9.el9
Should be : libxslt-1.1.34-9.el9_5.2
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237326 - RHEL 9 : libxslt (RHSA-2025:7410)
-
Synopsis
The remote Red Hat host is missing a security update for libxslt.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7410 advisory.
libxslt is a library for transforming XML files into other textual formats (including HTML, plain text, and other XML representations of the underlying data) using the standard XSLT stylesheet transformation mechanism.
Security Fix(es):
* libxslt: Use-After-Free in libxslt (xsltGetInheritedNsList) (CVE-2024-55549)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2352484
https://issues.redhat.com/browse/RHEL-85988
http://www.nessus.org/u?e1a4d89e
https://access.redhat.com/errata/RHSA-2025:7410

Solution
Update the RHEL libxslt package based on the guidance in RHSA-2025:7410.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:H/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-55549
XREF | RHSA:2025:7410
XREF | CWE:416

Plugin Information
Published: 2025/05/27, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : libxslt-1.1.34-9.el9
Should be : libxslt-1.1.34-13.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
243554 - RHEL 9 : ncurses (RHSA-2025:12876)
-
Synopsis
The remote Red Hat host is missing a security update for ncurses.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:12876 advisory.
The ncurses (new curses) library routines are a terminal-independent method of updating character screens with reasonable optimization. The ncurses packages contain support utilities including a terminfo compiler tic, a decompiler infocmp, clear, tput, tset, and a termcap conversion tool captoinfo.
Security Fix(es):
* ncurses: segfaulting OOB read (CVE-2022-29458)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#low
https://bugzilla.redhat.com/show_bug.cgi?id=2076483
http://www.nessus.org/u?5dabe45c
https://access.redhat.com/errata/RHSA-2025:12876

Solution
Update the RHEL ncurses package based on the guidance in RHSA-2025:12876.
Risk Factor
Medium
CVSS v3.0 Base Score
7.1 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-29458
XREF | RHSA:2025:12876
XREF | CWE:125

Plugin Information
Published: 2025/08/05, Modified: 2025/08/05
Plugin Output

## tcp/0

Remote package installed : ncurses-6.2-10.20210508.el9
Should be : ncurses-6.2-10.20210508.el9_6.2
Remote package installed : ncurses-base-6.2-10.20210508.el9
Should be : ncurses-base-6.2-10.20210508.el9_6.2
Remote package installed : ncurses-libs-6.2-10.20210508.el9
Should be : ncurses-libs-6.2-10.20210508.el9_6.2
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
269220 - RHEL 9 : open-vm-tools (RHSA-2025:17428)
-
Synopsis
The remote Red Hat host is missing a security update for open-vm-tools.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:17428 advisory.
The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines.
Security Fix(es):
* open-vm-tools: Local privilege escalation in open-vm-tools (CVE-2025-41244)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2397752
http://www.nessus.org/u?b2c9aabc
https://access.redhat.com/errata/RHSA-2025:17428

Solution
Update the RHEL open-vm-tools package based on the guidance in RHSA-2025:17428.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.2 (CVSS:3.0/E:F/RL:O/RC:C)
VPR Score
9.2
EPSS Score
0.0001
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:F/RL:OF/RC:C)
References

CVE | CVE-2025-41244
XREF | RHSA:2025:17428
XREF | CISA-KNOWN-EXPLOITED:2025/11/20
XREF | CWE:280

Plugin Information
Published: 2025/10/07, Modified: 2025/10/30
Plugin Output

## tcp/0

Remote package installed : open-vm-tools-12.4.0-2.el9
Should be : open-vm-tools-12.5.0-1.el9_6.2
Remote package installed : open-vm-tools-desktop-12.4.0-2.el9
Should be : open-vm-tools-desktop-12.5.0-1.el9_6.2
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
275299 - RHEL 9 : openssl (RHSA-2025:21255)
-
Synopsis
The remote Red Hat host is missing a security update for openssl.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:21255 advisory.
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.
Security Fix(es):
* openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap (CVE-2025-9230)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2396054
http://www.nessus.org/u?18314436
https://access.redhat.com/errata/RHSA-2025:21255

Solution
Update the RHEL openssl package based on the guidance in RHSA-2025:21255.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.1 (CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-9230
XREF | RHSA:2025:21255
XREF | CWE:125

Plugin Information
Published: 2025/11/13, Modified: 2025/11/13
Plugin Output

## tcp/0

Remote package installed : openssl-3.2.2-6.el9_5
Should be : openssl-3.5.1-4.el9_7
Remote package installed : openssl-devel-3.2.2-6.el9_5
Should be : openssl-devel-3.5.1-4.el9_7
Remote package installed : openssl-libs-3.2.2-6.el9_5
Should be : openssl-libs-3.5.1-4.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
261135 - RHEL 9 : pam (RHSA-2025:15099)
-
Synopsis
The remote Red Hat host is missing one or more security updates for pam.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:15099 advisory.
Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.
Security Fix(es):
* linux-pam: Linux-pam directory Traversal (CVE-2025-6020)
* linux-pam: Incomplete fix for CVE-2025-6020 (CVE-2025-8941)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2372512
https://bugzilla.redhat.com/show_bug.cgi?id=2388220
http://www.nessus.org/u?63795c21
https://access.redhat.com/errata/RHSA-2025:15099

Solution
Update the RHEL pam package based on the guidance in RHSA-2025:15099.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-6020
CVE | CVE-2025-8941
XREF | RHSA:2025:15099
XREF | CWE:22

Plugin Information
Published: 2025/09/03, Modified: 2025/09/03
Plugin Output

## tcp/0

Remote package installed : pam-1.5.1-20.el9
Should be : pam-1.5.1-26.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
240500 - RHEL 9 : pam (RHSA-2025:9526)
-
Synopsis
The remote Red Hat host is missing a security update for pam.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9526 advisory.
Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.
Security Fix(es):
* linux-pam: Linux-pam directory Traversal (CVE-2025-6020)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2372512
http://www.nessus.org/u?ab2f7cbf
https://access.redhat.com/errata/RHSA-2025:9526

Solution
Update the RHEL pam package based on the guidance in RHSA-2025:9526.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-6020
XREF | RHSA:2025:9526
XREF | CWE:22

Plugin Information
Published: 2025/06/25, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : pam-1.5.1-20.el9
Should be : pam-1.5.1-25.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
211836 - RHEL 9 : pam:1.5.1 (RHSA-2024:10244)
-
Synopsis
The remote Red Hat host is missing a security update for pam:1.5.1.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:10244 advisory.
Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.
Security Fix(es):
* pam: Improper Hostname Interpretation in pam_access Leads to Access Control Bypass (CVE-2024-10963)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2324291
http://www.nessus.org/u?d6cabae6
https://access.redhat.com/errata/RHSA-2024:10244

Solution
Update the RHEL pam:1.5.1 package based on the guidance in RHSA-2024:10244.
Risk Factor
High
CVSS v3.0 Base Score
7.4 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.2
EPSS Score
0.0016
CVSS v2.0 Base Score
7.1 (CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-10963
XREF | RHSA:2024:10244
XREF | CWE:287

Plugin Information
Published: 2024/11/26, Modified: 2025/04/08
Plugin Output

## tcp/0

Remote package installed : pam-1.5.1-20.el9
Should be : pam-1.5.1-22.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
186804 - RHEL 9 : pixman (RHSA-2023:7754)
-
Synopsis
The remote Red Hat host is missing a security update for pixman.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7754 advisory.
Pixman is a pixel manipulation library for the X Window System and Cairo.
Security Fix(es):
* pixman: Integer overflow in pixman_sample_floor_y leading to heap out-of-bounds write (CVE-2022-44638)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?6a1f4ccf
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2139988
https://access.redhat.com/errata/RHSA-2023:7754

Solution
Update the RHEL pixman package based on the guidance in RHSA-2023:7754.
Risk Factor
Critical
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.9 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0029
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.8 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-44638
XREF | RHSA:2023:7754
XREF | CWE:787

Plugin Information
Published: 2023/12/12, Modified: 2024/11/08
Plugin Output

## tcp/0

Remote package installed : pixman-0.40.0-6.el9
Should be : pixman-0.40.0-6.el9_3
Remote package installed : pixman-devel-0.40.0-6.el9
Should be : pixman-devel-0.40.0-6.el9_3
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
194821 - RHEL 9 : podman (RHSA-2024:2548)
-
Synopsis
The remote Red Hat host is missing one or more security updates for podman.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2548 advisory.
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.
Security Fixes:
* podman: golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786)
* podman: buildah: full container escape at build time (CVE-2024-1753)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fixes:
* liveness probe not called by podman when using httpGet (JIRA:RHEL-28633)
* Unable to copy image from one virtual machine to another using podman image scp (JIRA:RHEL-28629)
* [v4.9] Backport two docker CLI compatibility fixes (JIRA:RHEL-28636)
* Issue in podman causing S2I to fail in overwriting ENTRYPOINT (JIRA:RHEL-14922)
* Need to backport podman fix for SIGSEGV in RHEL 9.3/8.9 for UBI based containers (JIRA:RHEL-26843)
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?3ae46519
https://access.redhat.com/errata/RHSA-2024:2548
https://access.redhat.com/security/updates/classification#important
https://access.redhat.com/security/updates/classification/#moderate
https://issues.redhat.com/browse/RHEL-14922
https://issues.redhat.com/browse/RHEL-28629
https://issues.redhat.com/browse/RHEL-28636
https://issues.redhat.com/browse/RHEL-30886

Solution
Update the RHEL podman package based on the guidance in RHSA-2024:2548.
Risk Factor
High
CVSS v3.0 Base Score
8.6 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
8.1
EPSS Score
0.0015
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-1753
CVE | CVE-2024-24786
XREF | RHSA:2024:2548
XREF | CWE:59
XREF | CWE:835

Plugin Information
Published: 2024/04/30, Modified: 2025/03/06
Plugin Output

## tcp/0

Remote package installed : podman-5.2.2-1.el9
Should be : podman-4.9.4-3.el9_4
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
201964 - RHEL 9 : podman (RHSA-2024:4378)
-
Synopsis
The remote Red Hat host is missing a security update for podman.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4378 advisory.
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.
Security Fix(es):
* golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?1efe7235
https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2262921
https://access.redhat.com/errata/RHSA-2024:4378

Solution
Update the RHEL podman package based on the guidance in RHSA-2024:4378.
Risk Factor
Medium
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0178
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-1394
XREF | RHSA:2024:4378
XREF | CWE:401

Plugin Information
Published: 2024/07/08, Modified: 2025/03/06
Plugin Output

## tcp/0

Remote package installed : podman-5.2.2-1.el9
Should be : podman-4.9.4-5.el9_4
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
208988 - RHEL 9 : podman (RHSA-2024:8039)
-
Synopsis
The remote Red Hat host is missing one or more security updates for podman.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8039 advisory.
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.
Security Fix(es):
* go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion (CVE-2024-34155)
* encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)
* go/build/constraint: golang: Calling Parse on a // +build build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158)
* Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (CVE-2024-9341)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2310527
https://bugzilla.redhat.com/show_bug.cgi?id=2310528
https://bugzilla.redhat.com/show_bug.cgi?id=2310529
https://bugzilla.redhat.com/show_bug.cgi?id=2315691
http://www.nessus.org/u?38502cb5
https://access.redhat.com/errata/RHSA-2024:8039

Solution
Update the RHEL podman package based on the guidance in RHSA-2024:8039.
Risk Factor
High
CVSS v3.0 Base Score
8.2 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0061
CVSS v2.0 Base Score
8.5 (CVSS2#AV:N/AC:L/Au:N/C:C/I:P/A:N)
CVSS v2.0 Temporal Score
6.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-9341
CVE | CVE-2024-34155
CVE | CVE-2024-34156
CVE | CVE-2024-34158
XREF | RHSA:2024:8039
XREF | CWE:59
XREF | CWE:674
XREF | CWE:1325

Plugin Information
Published: 2024/10/14, Modified: 2025/03/06
Plugin Output

## tcp/0

Remote package installed : podman-5.2.2-1.el9
Should be : podman-4.9.4-13.el9_4
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
210824 - RHEL 9 : podman (RHSA-2024:9454)
-
Synopsis
The remote Red Hat host is missing one or more security updates for podman.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:9454 advisory.
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.
Security Fix(es):
* go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion (CVE-2024-34155)
* encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)
* go/build/constraint: golang: Calling Parse on a // +build build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158)
* Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (CVE-2024-9341)
* Buildah: Podman: Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (CVE-2024-9407)
* buildah: Buildah allows arbitrary directory mount (CVE-2024-9675)
* Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (CVE-2024-9676)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2310527
https://bugzilla.redhat.com/show_bug.cgi?id=2310528
https://bugzilla.redhat.com/show_bug.cgi?id=2310529
https://bugzilla.redhat.com/show_bug.cgi?id=2315691
https://bugzilla.redhat.com/show_bug.cgi?id=2315887
https://bugzilla.redhat.com/show_bug.cgi?id=2317458
https://bugzilla.redhat.com/show_bug.cgi?id=2317467
https://issues.redhat.com/browse/RHEL-60263
https://issues.redhat.com/browse/RHEL-61249
http://www.nessus.org/u?816c1f67
https://access.redhat.com/errata/RHSA-2024:9454

Solution
Update the RHEL podman package based on the guidance in RHSA-2024:9454.
Risk Factor
High
CVSS v3.0 Base Score
8.2 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0261
CVSS v2.0 Base Score
8.5 (CVSS2#AV:N/AC:L/Au:N/C:C/I:P/A:N)
CVSS v2.0 Temporal Score
6.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-9341
CVE | CVE-2024-9407
CVE | CVE-2024-9675
CVE | CVE-2024-9676
CVE | CVE-2024-34155
CVE | CVE-2024-34156
CVE | CVE-2024-34158
XREF | RHSA:2024:9454
XREF | CWE:20
XREF | CWE:22
XREF | CWE:59
XREF | CWE:674
XREF | CWE:1325

Plugin Information
Published: 2024/11/12, Modified: 2025/03/06
Plugin Output

## tcp/0

Remote package installed : podman-5.2.2-1.el9
Should be : podman-5.2.2-9.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
214930 - RHEL 9 : podman (RHSA-2025:0922)
-
Synopsis
The remote Red Hat host is missing a security update for podman.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0922 advisory.
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.
Security Fix(es):
* podman: buildah: Container breakout by using --jobs=2 and a race condition when building a malicious Containerfile (CVE-2024-11218)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2326231
http://www.nessus.org/u?26786b8b
https://access.redhat.com/errata/RHSA-2025:0922

Solution
Update the RHEL podman package based on the guidance in RHSA-2025:0922.
Risk Factor
High
CVSS v3.0 Base Score
8.6 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
8.1
EPSS Score
0.0001
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-11218
XREF | RHSA:2025:0922
XREF | CWE:269

Plugin Information
Published: 2025/02/04, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : podman-5.2.2-1.el9
Should be : podman-5.2.2-13.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
241500 - RHEL 9 : podman (RHSA-2025:10550)
-
Synopsis
The remote Red Hat host is missing a security update for podman.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10550 advisory.
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.
Security Fix(es):
* podman: podman missing TLS verification (CVE-2025-6032)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2372501
http://www.nessus.org/u?e3f5648a
https://access.redhat.com/errata/RHSA-2025:10550

Solution
Update the RHEL podman package based on the guidance in RHSA-2025:10550.
Risk Factor
High
CVSS v3.0 Base Score
8.3 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
8.1
EPSS Score
0.0002
CVSS v2.0 Base Score
7.6 (CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-6032
XREF | RHSA:2025:10550
XREF | CWE:295

Plugin Information
Published: 2025/07/08, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : podman-5.2.2-1.el9
Should be : podman-5.4.0-12.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
264871 - RHEL 9 : podman (RHSA-2025:15900)
-
Synopsis
The remote Red Hat host is missing a security update for podman.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:15900 advisory.
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.
Security Fix(es):
* podman: Podman kube play command may overwrite host files (CVE-2025-9566)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2393152
http://www.nessus.org/u?eddeb80a
https://access.redhat.com/errata/RHSA-2025:15900

Solution
Update the RHEL podman package based on the guidance in RHSA-2025:15900.
Risk Factor
High
CVSS v3.0 Base Score
8.1 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0006
CVSS v2.0 Base Score
8.5 (CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
6.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-9566
XREF | RHSA:2025:15900
XREF | CWE:22

Plugin Information
Published: 2025/09/16, Modified: 2025/09/16
Plugin Output

## tcp/0

Remote package installed : podman-5.2.2-1.el9
Should be : podman-5.4.0-13.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
274808 - RHEL 9 : podman (RHSA-2025:20909)
-
Synopsis
The remote Red Hat host is missing one or more security updates for podman.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:20909 advisory.
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.
Security Fix(es):
* database/sql: Postgres Scan Race Condition (CVE-2025-47907)
* podman: Podman kube play command may overwrite host files (CVE-2025-9566)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2387083
https://bugzilla.redhat.com/show_bug.cgi?id=2393152
https://issues.redhat.com/browse/RHEL-110317
https://issues.redhat.com/browse/RHEL-111076
https://issues.redhat.com/browse/RHEL-116091
http://www.nessus.org/u?3d6da625
https://access.redhat.com/errata/RHSA-2025:20909

Solution
Update the RHEL podman package based on the guidance in RHSA-2025:20909.
Risk Factor
High
CVSS v3.0 Base Score
8.1 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0006
CVSS v2.0 Base Score
8.5 (CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
6.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-9566
CVE | CVE-2025-47907
XREF | RHSA:2025:20909
XREF | CWE:22
XREF | CWE:362

Plugin Information
Published: 2025/11/11, Modified: 2025/11/11
Plugin Output

## tcp/0

Remote package installed : podman-5.2.2-1.el9
Should be : podman-5.6.0-6.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
275708 - RHEL 9 : podman (RHSA-2025:21702)
-
Synopsis
The remote Red Hat host is missing a security update for podman.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:21702 advisory.
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.
Security Fix(es):
* runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects (CVE-2025-52881)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2404715
http://www.nessus.org/u?84e6dab5
https://access.redhat.com/errata/RHSA-2025:21702

Solution
Update the RHEL podman package based on the guidance in RHSA-2025:21702.
Risk Factor
High
CVSS v4.0 Base Score
7.3 (CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
CVSS v3.0 Base Score
8.2 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
9.2
EPSS Score
0.0001
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-52881
XREF | RHSA:2025:21702
XREF | CWE:59

Plugin Information
Published: 2025/11/18, Modified: 2025/11/18
Plugin Output

## tcp/0

Remote package installed : podman-5.2.2-1.el9
Should be : podman-5.6.0-7.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
233532 - RHEL 9 : podman (RHSA-2025:3336)
-
Synopsis
The remote Red Hat host is missing a security update for podman.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:3336 advisory.
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.
Security Fix(es):
* golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (CVE-2025-22869)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2348367
http://www.nessus.org/u?c2bfd21b
https://access.redhat.com/errata/RHSA-2025:3336

Solution
Update the RHEL podman package based on the guidance in RHSA-2025:3336.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0008
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-22869
XREF | RHSA:2025:3336
XREF | CWE:770

Plugin Information
Published: 2025/03/29, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : podman-5.2.2-1.el9
Should be : podman-5.2.2-15.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
235832 - RHEL 9 : podman (RHSA-2025:7391)
-
Synopsis
The remote Red Hat host is missing one or more security updates for podman.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7391 advisory.
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.
Security Fix(es):
* go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)
* golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (CVE-2025-22869)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2347423
https://bugzilla.redhat.com/show_bug.cgi?id=2348367
https://issues.redhat.com/browse/RHEL-79694
https://issues.redhat.com/browse/RHEL-80259
https://issues.redhat.com/browse/RHEL-82509
https://issues.redhat.com/browse/RHEL-85116
https://issues.redhat.com/browse/RHEL-85218
https://issues.redhat.com/browse/RHEL-86092
http://www.nessus.org/u?7ada26ba
https://access.redhat.com/errata/RHSA-2025:7391

Solution
Update the RHEL podman package based on the guidance in RHSA-2025:7391.
Risk Factor
High
CVSS v4.0 Base Score
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0008
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-22869
CVE | CVE-2025-27144
XREF | RHSA:2025:7391
XREF | CWE:770

Plugin Information
Published: 2025/05/13, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : podman-5.2.2-1.el9
Should be : podman-5.4.0-9.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
235830 - RHEL 9 : protobuf (RHSA-2025:7138)
-
Synopsis
The remote Red Hat host is missing a security update for protobuf.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7138 advisory.
The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data.
Security Fix(es):
* protobuf: message parsing vulnerability in ProtocolBuffers (CVE-2022-1941)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?a7e51e86
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2291470
https://issues.redhat.com/browse/RHEL-40572
http://www.nessus.org/u?fb5800a7
https://access.redhat.com/errata/RHSA-2025:7138

Solution
Update the RHEL protobuf package based on the guidance in RHSA-2025:7138.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0011
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-1941
XREF | RHSA:2025:7138
XREF | CWE:400

Plugin Information
Published: 2025/05/13, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : protobuf-lite-3.14.0-13.el9
Should be : protobuf-lite-3.14.0-16.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
241448 - RHEL 9 : python-setuptools (RHSA-2025:10407)
-
Synopsis
The remote Red Hat host is missing a security update for python-setuptools.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10407 advisory.
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* setuptools: Path Traversal Vulnerability in setuptools PackageIndex (CVE-2025-47273)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2366982
http://www.nessus.org/u?b71e5ca6
https://access.redhat.com/errata/RHSA-2025:10407

Solution
Update the RHEL python-setuptools package based on the guidance in RHSA-2025:10407.
Risk Factor
High
CVSS v4.0 Base Score
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.9 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0027
CVSS v2.0 Base Score
9.0 (CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.0 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-47273
XREF | RHSA:2025:10407
XREF | CWE:22

Plugin Information
Published: 2025/07/07, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : python3-setuptools-53.0.0-13.el9
Should be : python3-setuptools-53.0.0-13.el9_6.1
Remote package installed : python3-setuptools-wheel-53.0.0-13.el9
Should be : python3-setuptools-wheel-53.0.0-13.el9_6.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
210800 - RHEL 9 : python3.9 (RHSA-2024:9468)
-
Synopsis
The remote Red Hat host is missing a security update for python3.9.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:9468 advisory.
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* python: cpython: tarfile: ReDos via excessive backtracking while parsing header values (CVE-2024-6232)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2309426
http://www.nessus.org/u?a7128889
https://access.redhat.com/errata/RHSA-2024:9468

Solution
Update the RHEL python3.9 package based on the guidance in RHSA-2024:9468.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0032
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-6232
XREF | RHSA:2024:9468
XREF | CWE:1333

Plugin Information
Published: 2024/11/12, Modified: 2024/11/12
Plugin Output

## tcp/0

Remote package installed : python-unversioned-command-3.9.19-8.el9
Should be : python-unversioned-command-3.9.19-8.el9_5.1
Remote package installed : python3-3.9.19-8.el9
Should be : python3-3.9.19-8.el9_5.1
Remote package installed : python3-libs-3.9.19-8.el9
Should be : python3-libs-3.9.19-8.el9_5.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
260451 - RHEL 9 : python3.9 (RHSA-2025:15019)
-
Synopsis
The remote Red Hat host is missing a security update for python3.9.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:15019 advisory.
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* cpython: Cpython infinite loop when parsing a tarfile (CVE-2025-8194)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2384043
http://www.nessus.org/u?95f470e4
https://access.redhat.com/errata/RHSA-2025:15019

Solution
Update the RHEL python3.9 package based on the guidance in RHSA-2025:15019.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-8194
XREF | RHSA:2025:15019
XREF | CWE:835

Plugin Information
Published: 2025/09/02, Modified: 2025/09/02
Plugin Output

## tcp/0

Remote package installed : python-unversioned-command-3.9.19-8.el9
Should be : python-unversioned-command-3.9.21-2.el9_6.2
Remote package installed : python3-3.9.19-8.el9
Should be : python3-3.9.21-2.el9_6.2
Remote package installed : python3-libs-3.9.19-8.el9
Should be : python3-libs-3.9.21-2.el9_6.2
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
212678 - RHEL 9 : python3.9:3.9.21 (RHSA-2024:10983)
-
Synopsis
The remote Red Hat host is missing one or more security updates for python3.9:3.9.21.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:10983 advisory.
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)
* python: Improper validation of IPv6 and IPvFuture addresses (CVE-2024-11168)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2321440
https://bugzilla.redhat.com/show_bug.cgi?id=2325776
http://www.nessus.org/u?65c17fe6
https://access.redhat.com/errata/RHSA-2024:10983

Solution
Update the RHEL python3.9:3.9.21 package based on the guidance in RHSA-2024:10983.
Risk Factor
Medium
CVSS v4.0 Base Score
6.3 (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N)
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0018
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-9287
CVE | CVE-2024-11168
XREF | RHSA:2024:10983
XREF | CWE:428
XREF | CWE:1287

Plugin Information
Published: 2024/12/12, Modified: 2025/04/08
Plugin Output

## tcp/0

Remote package installed : python-unversioned-command-3.9.19-8.el9
Should be : python-unversioned-command-3.9.21-1.el9_5
Remote package installed : python3-3.9.19-8.el9
Should be : python3-3.9.21-1.el9_5
Remote package installed : python3-libs-3.9.19-8.el9
Should be : python3-libs-3.9.21-1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
212040 - RHEL 9 : rhc (RHSA-2024:10759)
-
Synopsis
The remote Red Hat host is missing a security update for rhc.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:10759 advisory.
rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management.
Security Fix(es):
* go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#low
https://bugzilla.redhat.com/show_bug.cgi?id=2163037
http://www.nessus.org/u?31a447c4
https://access.redhat.com/errata/RHSA-2024:10759

Solution
Update the RHEL rhc package based on the guidance in RHSA-2024:10759.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0186
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-3064
XREF | RHSA:2024:10759
XREF | CWE:400

Plugin Information
Published: 2024/12/03, Modified: 2025/03/22
Plugin Output

## tcp/0

Remote package installed : rhc-0.2.4-5.el9
Should be : rhc-0.2.5-1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
214210 - RHEL 9 : rsync (RHSA-2025:0324)
-
Synopsis
The remote Red Hat host is missing a security update for rsync.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0324 advisory.
The rsync utility enables the users to copy and synchronize files locally or across a network.
Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.
Security Fix(es):
* rsync: Info Leak via Uninitialized Stack Contents (CVE-2024-12085)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2330539
http://www.nessus.org/u?64e4a1b1
https://access.redhat.com/errata/RHSA-2025:0324

Solution
Update the RHEL rsync package based on the guidance in RHSA-2025:0324.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
5.1
EPSS Score
0.0012
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-12085
XREF | RHSA:2025:0324
XREF | CWE:119

Plugin Information
Published: 2025/01/15, Modified: 2025/07/17
Plugin Output

## tcp/0

Remote package installed : rsync-3.2.3-20.el9
Should be : rsync-3.2.3-20.el9_5.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
235800 - RHEL 9 : rsync (RHSA-2025:7050)
-
Synopsis
The remote Red Hat host is missing one or more security updates for rsync.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7050 advisory.
The rsync utility enables the users to copy and synchronize files locally or across a network.
Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.
Security Fix(es):
* rsync: Path traversal vulnerability in rsync (CVE-2024-12087)
* rsync: --safe-links option bypass leads to path traversal (CVE-2024-12088)
* rsync: Race Condition in rsync Handling Symbolic Links (CVE-2024-12747)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?a7e51e86
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2330672
https://bugzilla.redhat.com/show_bug.cgi?id=2330676
https://bugzilla.redhat.com/show_bug.cgi?id=2332968
https://issues.redhat.com/browse/RHEL-18216
https://issues.redhat.com/browse/RHEL-67142
https://issues.redhat.com/browse/RHEL-70265
http://www.nessus.org/u?113a818a
https://access.redhat.com/errata/RHSA-2025:7050

Solution
Update the RHEL rsync package based on the guidance in RHSA-2025:7050.
Risk Factor
High
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
5.2
EPSS Score
0.001
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-12087
CVE | CVE-2024-12088
CVE | CVE-2024-12747
XREF | RHSA:2025:7050
XREF | CWE:35
XREF | CWE:362

Plugin Information
Published: 2025/05/13, Modified: 2025/07/01
Plugin Output

## tcp/0

Remote package installed : rsync-3.2.3-20.el9
Should be : rsync-3.2.5-3.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
193660 - RHEL 9 : shim update (Important) (RHSA-2024:1903)
-
Synopsis
The remote Red Hat host is missing one or more security updates.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1903 advisory.
The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.
Security Fix(es):
* shim: RCE in http boot support may lead to Secure Boot bypass (CVE-2023-40547)
* shim: Interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems (CVE-2023-40548)
* shim: Out-of-bounds read printing error messages (CVE-2023-40546)
* shim: Out-of-bounds read in verify_buffer_authenticode() malformed PE file (CVE-2023-40549)
* shim: Out-of-bound read in verify_buffer_sbat() (CVE-2023-40550)
* shim: out of bounds read when parsing MZ binaries (CVE-2023-40551)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?3fef4320
https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2234589
https://bugzilla.redhat.com/show_bug.cgi?id=2241782
https://bugzilla.redhat.com/show_bug.cgi?id=2241796
https://bugzilla.redhat.com/show_bug.cgi?id=2241797
https://bugzilla.redhat.com/show_bug.cgi?id=2259915
https://bugzilla.redhat.com/show_bug.cgi?id=2259918
https://access.redhat.com/errata/RHSA-2024:1903

Solution
Update the affected shim-aa64 and / or shim-x64 packages.
Risk Factor
Medium
CVSS v3.0 Base Score
8.3 (CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
8.1
EPSS Score
0.0169
CVSS v2.0 Base Score
6.8 (CVSS2#AV:A/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-40546
CVE | CVE-2023-40547
CVE | CVE-2023-40548
CVE | CVE-2023-40549
CVE | CVE-2023-40550
CVE | CVE-2023-40551
XREF | RHSA:2024:1903
XREF | CWE:125
XREF | CWE:476
XREF | CWE:787

Plugin Information
Published: 2024/04/20, Modified: 2024/11/07
Plugin Output

## tcp/0

Remote package installed : shim-x64-15.8-3.el9_4
Should be : shim-x64-15.8-4.el9_3
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
274829 - RHEL 9 : sssd (RHSA-2025:20954)
-
Synopsis
The remote Red Hat host is missing a security update for sssd.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:20954 advisory.
The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.
Security Fix(es):
* sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems (CVE-2025-11561)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2402727
http://www.nessus.org/u?25d99731
https://access.redhat.com/errata/RHSA-2025:20954

Solution
Update the RHEL sssd package based on the guidance in RHSA-2025:20954.
Risk Factor
High
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0007
CVSS v2.0 Base Score
9.0 (CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-11561
XREF | RHSA:2025:20954
XREF | CWE:269

Plugin Information
Published: 2025/11/11, Modified: 2025/11/11
Plugin Output

## tcp/0

Remote package installed : libipa_hbac-2.9.5-4.el9
Should be : libipa_hbac-2.9.7-4.el9_7.1
Remote package installed : libsss_certmap-2.9.5-4.el9
Should be : libsss_certmap-2.9.7-4.el9_7.1
Remote package installed : libsss_idmap-2.9.5-4.el9
Should be : libsss_idmap-2.9.7-4.el9_7.1
Remote package installed : libsss_nss_idmap-2.9.5-4.el9
Should be : libsss_nss_idmap-2.9.7-4.el9_7.1
Remote package installed : libsss_sudo-2.9.5-4.el9
Should be : libsss_sudo-2.9.7-4.el9_7.1
Remote package installed : sssd-2.9.5-4.el9
Should be : sssd-2.9.7-4.el9_7.1
Remote package installed : sssd-ad-2.9.5-4.el9
Should be : sssd-ad-2.9.7-4.el9_7.1
Remote package installed : sssd-client-2.9.5-4.el9
Should be : sssd-client-2.9.7-4.el9_7.1
Remote package installed : sssd-common-2.9.5-4.el9
Should be : sssd-common-2.9.7-4.el9_7.1
Remote package installed : sssd-common-pac-2.9.5-4.el9
Should be : sssd-common-pac-2.9.7-4.el9_7.1
Remote package installed : sssd-ipa-2.9.5-4.el9
Should be : sssd-ipa-2.9.7-4.el9_7.1
Remote package installed : sssd-kcm-2.9.5-4.el9
Should be : sssd-kcm-2.9.7-4.el9_7.1
Remote package installed : sssd-krb5-2.9.5-4.el9
Should be : sssd-krb5-2.9.7-4.el9_7.1
Remote package installed : sssd-krb5-common-2.9.5-4.el9
Should be : sssd-krb5-common-2.9.7-4.el9_7.1
Remote package installed : sssd-ldap-2.9.5-4.el9
Should be : sssd-ldap-2.9.7-4.el9_7.1
Remote package installed : sssd-proxy-2.9.5-4.el9
Should be : sssd-proxy-2.9.7-4.el9_7.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
241023 - RHEL 9 : sudo (RHSA-2025:9978)
-
Synopsis
The remote Red Hat host is missing a security update for sudo.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9978 advisory.
The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.
Security Fix(es):
* sudo: LPE via host option (CVE-2025-32462)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2374692
http://www.nessus.org/u?797439b7
https://access.redhat.com/errata/RHSA-2025:9978

Solution
Update the RHEL sudo package based on the guidance in RHSA-2025:9978.
Risk Factor
Medium
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.9 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
8.1
EPSS Score
0.2072
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
STIG Severity
I
References

CVE | CVE-2025-32462
XREF | RHSA:2025:9978
XREF | IAVA:2025-A-0465
XREF | CWE:863

Plugin Information
Published: 2025/07/01, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : sudo-1.9.5p2-10.el9_3
Should be : sudo-1.9.5p2-10.el9_6.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
211784 - RHEL 9 : tigervnc (RHSA-2024:10090)
-
Synopsis
The remote Red Hat host is missing a security update for tigervnc.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:10090 advisory.
Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients.
Security Fix(es):
* xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability (CVE-2024-9632)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2317233
http://www.nessus.org/u?5303db3f
https://access.redhat.com/errata/RHSA-2024:10090

Solution
Update the RHEL tigervnc package based on the guidance in RHSA-2024:10090.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0007
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-9632
XREF | RHSA:2024:10090
XREF | CWE:122

Plugin Information
Published: 2024/11/25, Modified: 2024/11/25
Plugin Output

## tcp/0

Remote package installed : tigervnc-1.14.0-2.el9_5
Should be : tigervnc-1.14.1-1.el9_5
Remote package installed : tigervnc-icons-1.14.0-2.el9_5
Should be : tigervnc-icons-1.14.1-1.el9_5
Remote package installed : tigervnc-license-1.14.0-2.el9_5
Should be : tigervnc-license-1.14.1-1.el9_5
Remote package installed : tigervnc-selinux-1.14.0-2.el9_5
Should be : tigervnc-selinux-1.14.1-1.el9_5
Remote package installed : tigervnc-server-1.14.0-2.el9_5
Should be : tigervnc-server-1.14.1-1.el9_5
Remote package installed : tigervnc-server-minimal-1.14.0-2.el9_5
Should be : tigervnc-server-minimal-1.14.1-1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
272222 - RHEL 9 : tigervnc (RHSA-2025:19489)
-
Synopsis
The remote Red Hat host is missing one or more security updates for tigervnc.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19489 advisory.
Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients.
Security Fix(es):
* xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229)
* xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230)
* xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2402649
https://bugzilla.redhat.com/show_bug.cgi?id=2402653
https://bugzilla.redhat.com/show_bug.cgi?id=2402660
http://www.nessus.org/u?4bffb572
https://access.redhat.com/errata/RHSA-2025:19489

Solution
Update the RHEL tigervnc package based on the guidance in RHSA-2025:19489.
Risk Factor
High
CVSS v3.0 Base Score
7.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
7.0
EPSS Score
0.0001
CVSS v2.0 Base Score
9.0 (CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-62229
CVE | CVE-2025-62230
CVE | CVE-2025-62231
XREF | RHSA:2025:19489
XREF | CWE:190
XREF | CWE:416

Plugin Information
Published: 2025/11/03, Modified: 2025/11/03
Plugin Output

## tcp/0

Remote package installed : tigervnc-1.14.0-2.el9_5
Should be : tigervnc-1.14.1-9.el9_6
Remote package installed : tigervnc-icons-1.14.0-2.el9_5
Should be : tigervnc-icons-1.14.1-9.el9_6
Remote package installed : tigervnc-license-1.14.0-2.el9_5
Should be : tigervnc-license-1.14.1-9.el9_6
Remote package installed : tigervnc-selinux-1.14.0-2.el9_5
Should be : tigervnc-selinux-1.14.1-9.el9_6
Remote package installed : tigervnc-server-1.14.0-2.el9_5
Should be : tigervnc-server-1.14.1-9.el9_6
Remote package installed : tigervnc-server-minimal-1.14.0-2.el9_5
Should be : tigervnc-server-minimal-1.14.1-9.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
274821 - RHEL 9 : tigervnc (RHSA-2025:20958)
-
Synopsis
The remote Red Hat host is missing one or more security updates for tigervnc.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:20958 advisory.
Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients.
Security Fix(es):
* xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229)
* xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230)
* xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2402649
https://bugzilla.redhat.com/show_bug.cgi?id=2402653
https://bugzilla.redhat.com/show_bug.cgi?id=2402660
http://www.nessus.org/u?991c2b9f
https://access.redhat.com/errata/RHSA-2025:20958

Solution
Update the RHEL tigervnc package based on the guidance in RHSA-2025:20958.
Risk Factor
High
CVSS v3.0 Base Score
7.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
7.0
EPSS Score
0.0001
CVSS v2.0 Base Score
9.0 (CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-62229
CVE | CVE-2025-62230
CVE | CVE-2025-62231
XREF | RHSA:2025:20958
XREF | CWE:190
XREF | CWE:416

Plugin Information
Published: 2025/11/11, Modified: 2025/11/11
Plugin Output

## tcp/0

Remote package installed : tigervnc-1.14.0-2.el9_5
Should be : tigervnc-1.15.0-6.el9_7
Remote package installed : tigervnc-icons-1.14.0-2.el9_5
Should be : tigervnc-icons-1.15.0-6.el9_7
Remote package installed : tigervnc-license-1.14.0-2.el9_5
Should be : tigervnc-license-1.15.0-6.el9_7
Remote package installed : tigervnc-selinux-1.14.0-2.el9_5
Should be : tigervnc-selinux-1.15.0-6.el9_7
Remote package installed : tigervnc-server-1.14.0-2.el9_5
Should be : tigervnc-server-1.15.0-6.el9_7
Remote package installed : tigervnc-server-minimal-1.14.0-2.el9_5
Should be : tigervnc-server-minimal-1.15.0-6.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
232788 - RHEL 9 : tigervnc (RHSA-2025:2500)
-
Synopsis
The remote Red Hat host is missing one or more security updates for tigervnc.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2500 advisory.
Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients.
Security Fix(es):
* X.Org: Xwayland: Use-after-free of the root cursor (CVE-2025-26594)
* xorg: xwayland: Use-after-free in SyncInitTrigger() (CVE-2025-26601)
* xorg: xwayland: Use-after-free in PlayReleasedEvents() (CVE-2025-26600)
* xorg: xwayland: Use of uninitialized pointer in compRedirectWindow() (CVE-2025-26599)
* xorg: xwayland: Out-of-bounds write in CreatePointerBarrierClient() (CVE-2025-26598)
* xorg: xwayland: Buffer overflow in XkbChangeTypesOfKey() (CVE-2025-26597)
* xorg: xwayland: Heap overflow in XkbWriteKeySyms() (CVE-2025-26596)
* Xorg: xwayland: Buffer overflow in XkbVModMaskText() (CVE-2025-26595)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2345248
https://bugzilla.redhat.com/show_bug.cgi?id=2345251
https://bugzilla.redhat.com/show_bug.cgi?id=2345252
https://bugzilla.redhat.com/show_bug.cgi?id=2345253
https://bugzilla.redhat.com/show_bug.cgi?id=2345254
https://bugzilla.redhat.com/show_bug.cgi?id=2345255
https://bugzilla.redhat.com/show_bug.cgi?id=2345256
https://bugzilla.redhat.com/show_bug.cgi?id=2345257
http://www.nessus.org/u?f3bdfc90
https://access.redhat.com/errata/RHSA-2025:2500

Solution
Update the RHEL tigervnc package based on the guidance in RHSA-2025:2500.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-26594
CVE | CVE-2025-26595
CVE | CVE-2025-26596
CVE | CVE-2025-26597
CVE | CVE-2025-26598
CVE | CVE-2025-26599
CVE | CVE-2025-26600
CVE | CVE-2025-26601
XREF | RHSA:2025:2500
XREF | CWE:119
XREF | CWE:121
XREF | CWE:416
XREF | CWE:787
XREF | CWE:824

Plugin Information
Published: 2025/03/15, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : tigervnc-1.14.0-2.el9_5
Should be : tigervnc-1.14.1-1.el9_5.1
Remote package installed : tigervnc-icons-1.14.0-2.el9_5
Should be : tigervnc-icons-1.14.1-1.el9_5.1
Remote package installed : tigervnc-license-1.14.0-2.el9_5
Should be : tigervnc-license-1.14.1-1.el9_5.1
Remote package installed : tigervnc-selinux-1.14.0-2.el9_5
Should be : tigervnc-selinux-1.14.1-1.el9_5.1
Remote package installed : tigervnc-server-1.14.0-2.el9_5
Should be : tigervnc-server-1.14.1-1.el9_5.1
Remote package installed : tigervnc-server-minimal-1.14.0-2.el9_5
Should be : tigervnc-server-minimal-1.14.1-1.el9_5.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
240256 - RHEL 9 : tigervnc (RHSA-2025:9306)
-
Synopsis
The remote Red Hat host is missing one or more security updates for tigervnc.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:9306 advisory.
Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients.
Security Fix(es):
* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension Animated Cursors (CVE-2025-49175)
* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension (CVE-2025-49176)
* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore (CVE-2025-49178)
* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension (CVE-2025-49179)
* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension (CVE-2025-49180)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2369947
https://bugzilla.redhat.com/show_bug.cgi?id=2369954
https://bugzilla.redhat.com/show_bug.cgi?id=2369977
https://bugzilla.redhat.com/show_bug.cgi?id=2369978
https://bugzilla.redhat.com/show_bug.cgi?id=2369981
http://www.nessus.org/u?a46118d3
https://access.redhat.com/errata/RHSA-2025:9306

Solution
Update the RHEL tigervnc package based on the guidance in RHSA-2025:9306.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-49175
CVE | CVE-2025-49176
CVE | CVE-2025-49178
CVE | CVE-2025-49179
CVE | CVE-2025-49180
XREF | RHSA:2025:9306
XREF | CWE:125
XREF | CWE:190
XREF | CWE:667

Plugin Information
Published: 2025/06/23, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : tigervnc-1.14.0-2.el9_5
Should be : tigervnc-1.14.1-8.el9_6
Remote package installed : tigervnc-icons-1.14.0-2.el9_5
Should be : tigervnc-icons-1.14.1-8.el9_6
Remote package installed : tigervnc-license-1.14.0-2.el9_5
Should be : tigervnc-license-1.14.1-8.el9_6
Remote package installed : tigervnc-selinux-1.14.0-2.el9_5
Should be : tigervnc-selinux-1.14.1-8.el9_6
Remote package installed : tigervnc-server-1.14.0-2.el9_5
Should be : tigervnc-server-1.14.1-8.el9_6
Remote package installed : tigervnc-server-minimal-1.14.0-2.el9_5
Should be : tigervnc-server-minimal-1.14.1-8.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
211878 - RHEL 9 : tuned (RHSA-2024:10384)
-
Synopsis
The remote Red Hat host is missing one or more security updates for tuned.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:10384 advisory.
The tuned packages provide a service that tunes system settings according to a selected profile.
Security Fix(es):
* tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root (CVE-2024-52336)
* tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method (CVE-2024-52337)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2324540
https://bugzilla.redhat.com/show_bug.cgi?id=2324541
http://www.nessus.org/u?96ddfcc7
https://access.redhat.com/errata/RHSA-2024:10384

Solution
Update the RHEL tuned package based on the guidance in RHSA-2024:10384.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-52336
CVE | CVE-2024-52337
XREF | RHSA:2024:10384
XREF | CWE:20

Plugin Information
Published: 2024/11/26, Modified: 2024/11/26
Plugin Output

## tcp/0

Remote package installed : tuned-2.24.0-1.el9
Should be : tuned-2.24.0-2.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
260445 - RHEL 9 : udisks2 (RHSA-2025:15018)
-
Synopsis
The remote Red Hat host is missing a security update for udisks2.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:15018 advisory.
The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies.
Security Fix(es):
* udisks: Out-of-bounds read in UDisks Daemon (CVE-2025-8067)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2388623
http://www.nessus.org/u?35063e56
https://access.redhat.com/errata/RHSA-2025:15018

Solution
Update the RHEL udisks2 package based on the guidance in RHSA-2025:15018.
Risk Factor
Medium
CVSS v3.0 Base Score
8.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H)
CVSS v3.0 Temporal Score
7.4 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.6
EPSS Score
0.0001
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-8067
XREF | RHSA:2025:15018
XREF | CWE:125

Plugin Information
Published: 2025/09/02, Modified: 2025/09/02
Plugin Output

## tcp/0

Remote package installed : libudisks2-2.9.4-11.el9
Should be : libudisks2-2.9.4-11.el9_6.1
Remote package installed : udisks2-2.9.4-11.el9
Should be : udisks2-2.9.4-11.el9_6.1
Remote package installed : udisks2-iscsi-2.9.4-11.el9
Should be : udisks2-iscsi-2.9.4-11.el9_6.1
Remote package installed : udisks2-lvm2-2.9.4-11.el9
Should be : udisks2-lvm2-2.9.4-11.el9_6.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
242904 - RHEL 9 : unbound (RHSA-2025:11849)
-
Synopsis
The remote Red Hat host is missing a security update for unbound.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:11849 advisory.
The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.
Security Fix(es):
* unbound: Unbound Cache poisoning (CVE-2025-5994)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2380949
http://www.nessus.org/u?bea8c210
https://access.redhat.com/errata/RHSA-2025:11849

Solution
Update the RHEL unbound package based on the guidance in RHSA-2025:11849.
Risk Factor
High
CVSS v4.0 Base Score
8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
6.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-5994
XREF | RHSA:2025:11849
XREF | CWE:349

Plugin Information
Published: 2025/07/28, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : unbound-libs-1.16.2-3.el9_3.5
Should be : unbound-libs-1.16.2-19.el9_6.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237309 - RHEL 9 : vim (RHSA-2025:7440)
-
Synopsis
The remote Red Hat host is missing a security update for vim.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7440 advisory.
Vim (Vi IMproved) is an updated and improved version of the vi editor.
Security Fix(es):
* vim: use-after-free in function ins_compl_get_exp in vim/vim (CVE-2023-4752)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#low
https://bugzilla.redhat.com/show_bug.cgi?id=2237311
http://www.nessus.org/u?24c3b3c2
https://access.redhat.com/errata/RHSA-2025:7440

Solution
Update the RHEL vim package based on the guidance in RHSA-2025:7440.
Risk Factor
High
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-4752
XREF | RHSA:2025:7440
XREF | CWE:416

Plugin Information
Published: 2025/05/27, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : vim-common-8.2.2637-21.el9
Should be : vim-common-8.2.2637-22.el9_6
Remote package installed : vim-enhanced-8.2.2637-21.el9
Should be : vim-enhanced-8.2.2637-22.el9_6
Remote package installed : vim-filesystem-8.2.2637-21.el9
Should be : vim-filesystem-8.2.2637-22.el9_6
Remote package installed : vim-minimal-8.2.2637-21.el9
Should be : vim-minimal-8.2.2637-22.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
213625 - RHEL 9 : webkit2gtk3 (RHSA-2025:0146)
-
Synopsis
The remote Red Hat host is missing one or more security updates for webkit2gtk3.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:0146 advisory.
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* WebKitGTK: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-54479)
* webkit: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-54502)
* webkit: Processing maliciously crafted web content may lead to memory corruption (CVE-2024-54505)
* webkit: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-54508)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2333841
https://bugzilla.redhat.com/show_bug.cgi?id=2333843
https://bugzilla.redhat.com/show_bug.cgi?id=2333844
https://bugzilla.redhat.com/show_bug.cgi?id=2333845
http://www.nessus.org/u?fc75fc3a
https://access.redhat.com/errata/RHSA-2025:0146

Solution
Update the RHEL webkit2gtk3 package based on the guidance in RHSA-2025:0146.
Risk Factor
Critical
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0018
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-54479
CVE | CVE-2024-54502
CVE | CVE-2024-54505
CVE | CVE-2024-54508
XREF | RHSA:2025:0146
XREF | CWE:20
XREF | CWE:125
XREF | CWE:404
XREF | CWE:843

Plugin Information
Published: 2025/01/09, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : webkit2gtk3-2.44.3-2.el9
Should be : webkit2gtk3-2.46.5-1.el9_5
Remote package installed : webkit2gtk3-jsc-2.44.3-2.el9
Should be : webkit2gtk3-jsc-2.46.5-1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
249343 - RHEL 9 : webkit2gtk3 (RHSA-2025:13782)
-
Synopsis
The remote Red Hat host is missing one or more security updates for webkit2gtk3.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:13782 advisory.
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* angle: insufficient input validation can cause undefined behavior (CVE-2025-6558)
* webkitgtk: A download?s origin may be incorrectly associated (CVE-2025-43240)
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-31273)
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-31278)
* webkitgtk: Processing web content may lead to a denial-of-service (CVE-2025-43211)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43212)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43216)
* webkitgtk: Processing maliciously crafted web content may disclose sensitive user information (CVE-2025-43227)
* webkitgtk: Processing maliciously crafted web content may disclose internal states of the app (CVE-2025-43265)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2380254
https://bugzilla.redhat.com/show_bug.cgi?id=2384385
https://bugzilla.redhat.com/show_bug.cgi?id=2386268
https://bugzilla.redhat.com/show_bug.cgi?id=2386269
https://bugzilla.redhat.com/show_bug.cgi?id=2386270
https://bugzilla.redhat.com/show_bug.cgi?id=2386271
https://bugzilla.redhat.com/show_bug.cgi?id=2386273
https://bugzilla.redhat.com/show_bug.cgi?id=2386274
https://bugzilla.redhat.com/show_bug.cgi?id=2386276
http://www.nessus.org/u?b585d4b0
https://access.redhat.com/errata/RHSA-2025:13782

Solution
Update the RHEL webkit2gtk3 package based on the guidance in RHSA-2025:13782.
Risk Factor
Critical
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.2 (CVSS:3.0/E:F/RL:O/RC:C)
VPR Score
9.2
EPSS Score
0.0009
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
8.3 (CVSS2#E:F/RL:OF/RC:C)
References

CVE | CVE-2025-6558
CVE | CVE-2025-31273
CVE | CVE-2025-31278
CVE | CVE-2025-43211
CVE | CVE-2025-43212
CVE | CVE-2025-43216
CVE | CVE-2025-43227
CVE | CVE-2025-43240
CVE | CVE-2025-43265
XREF | CISA-KNOWN-EXPLOITED:2025/08/12
XREF | RHSA:2025:13782
XREF | CWE:76
XREF | CWE:119
XREF | CWE:125
XREF | CWE:359
XREF | CWE:416
XREF | CWE:703
XREF | CWE:770

Plugin Information
Published: 2025/08/14, Modified: 2025/08/14
Plugin Output

## tcp/0

Remote package installed : webkit2gtk3-2.44.3-2.el9
Should be : webkit2gtk3-2.48.5-1.el9_6
Remote package installed : webkit2gtk3-jsc-2.44.3-2.el9
Should be : webkit2gtk3-jsc-2.48.5-1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
217009 - RHEL 9 : webkit2gtk3 (RHSA-2025:2035)
-
Synopsis
The remote Red Hat host is missing one or more security updates for webkit2gtk3.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2035 advisory.
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2024-54543)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-24162)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2344619
https://bugzilla.redhat.com/show_bug.cgi?id=2344624
http://www.nessus.org/u?00cd6dbf
https://access.redhat.com/errata/RHSA-2025:2035

Solution
Update the RHEL webkit2gtk3 package based on the guidance in RHSA-2025:2035.
Risk Factor
Critical
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0009
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-54543
CVE | CVE-2025-24162
XREF | RHSA:2025:2035
XREF | CWE:119
XREF | CWE:787

Plugin Information
Published: 2025/03/03, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : webkit2gtk3-2.44.3-2.el9
Should be : webkit2gtk3-2.46.6-1.el9_5
Remote package installed : webkit2gtk3-jsc-2.44.3-2.el9
Should be : webkit2gtk3-jsc-2.46.6-1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
277612 - RHEL 9 : webkit2gtk3 (RHSA-2025:22790)
-
Synopsis
The remote Red Hat host is missing one or more security updates for webkit2gtk3.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22790 advisory.
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)
* webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)
* webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2416300
https://bugzilla.redhat.com/show_bug.cgi?id=2416325
https://bugzilla.redhat.com/show_bug.cgi?id=2416327
https://bugzilla.redhat.com/show_bug.cgi?id=2416329
https://bugzilla.redhat.com/show_bug.cgi?id=2416330
https://bugzilla.redhat.com/show_bug.cgi?id=2416331
https://bugzilla.redhat.com/show_bug.cgi?id=2416332
https://bugzilla.redhat.com/show_bug.cgi?id=2416334
https://bugzilla.redhat.com/show_bug.cgi?id=2416335
https://bugzilla.redhat.com/show_bug.cgi?id=2416336
https://bugzilla.redhat.com/show_bug.cgi?id=2416337
https://bugzilla.redhat.com/show_bug.cgi?id=2416355
https://bugzilla.redhat.com/show_bug.cgi?id=2418576
https://bugzilla.redhat.com/show_bug.cgi?id=2418855
https://bugzilla.redhat.com/show_bug.cgi?id=2418857
http://www.nessus.org/u?435a1834
https://access.redhat.com/errata/RHSA-2025:22790

Solution
Update the RHEL webkit2gtk3 package based on the guidance in RHSA-2025:22790.
Risk Factor
Critical
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
7.4
EPSS Score
0.0004
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
STIG Severity
I
References

CVE | CVE-2025-13502
CVE | CVE-2025-13947
CVE | CVE-2025-43392
CVE | CVE-2025-43421
CVE | CVE-2025-43425
CVE | CVE-2025-43427
CVE | CVE-2025-43429
CVE | CVE-2025-43430
CVE | CVE-2025-43431
CVE | CVE-2025-43432
CVE | CVE-2025-43434
CVE | CVE-2025-43440
CVE | CVE-2025-43443
CVE | CVE-2025-43458
CVE | CVE-2025-66287
XREF | RHSA:2025:22790
XREF | IAVA:2025-A-0901
XREF | CWE:20
XREF | CWE:119
XREF | CWE:120
XREF | CWE:190
XREF | CWE:200
XREF | CWE:416

Plugin Information
Published: 2025/12/08, Modified: 2025/12/12
Plugin Output

## tcp/0

Remote package installed : webkit2gtk3-2.44.3-2.el9
Should be : webkit2gtk3-2.50.3-1.el9_7
Remote package installed : webkit2gtk3-jsc-2.44.3-2.el9
Should be : webkit2gtk3-jsc-2.50.3-1.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
279266 - RHEL 9 : webkit2gtk3 (RHSA-2025:23700)
-
Synopsis
The remote Red Hat host is missing one or more security updates for webkit2gtk3.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23700 advisory.
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: webkitgtk: Use-after-free due to improper memory management (CVE-2025-43529)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43501)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43531)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43535)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43536)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43541)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2423166
https://bugzilla.redhat.com/show_bug.cgi?id=2423185
https://bugzilla.redhat.com/show_bug.cgi?id=2423187
https://bugzilla.redhat.com/show_bug.cgi?id=2423188
https://bugzilla.redhat.com/show_bug.cgi?id=2423190
https://bugzilla.redhat.com/show_bug.cgi?id=2423191
http://www.nessus.org/u?47e7d5fd
https://access.redhat.com/errata/RHSA-2025:23700

Solution
Update the RHEL webkit2gtk3 package based on the guidance in RHSA-2025:23700.
Risk Factor
Critical
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.2 (CVSS:3.0/E:F/RL:O/RC:C)
VPR Score
9.2
EPSS Score
0.0029
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
8.3 (CVSS2#E:F/RL:OF/RC:C)
References

CVE | CVE-2025-43501
CVE | CVE-2025-43529
CVE | CVE-2025-43531
CVE | CVE-2025-43535
CVE | CVE-2025-43536
CVE | CVE-2025-43541
XREF | CISA-KNOWN-EXPLOITED:2026/01/05
XREF | RHSA:2025:23700
XREF | CWE:119
XREF | CWE:120
XREF | CWE:362
XREF | CWE:416
XREF | CWE:825
XREF | CWE:843

Plugin Information
Published: 2025/12/18, Modified: 2025/12/18
Plugin Output

## tcp/0

Remote package installed : webkit2gtk3-2.44.3-2.el9
Should be : webkit2gtk3-2.50.4-1.el9_7
Remote package installed : webkit2gtk3-jsc-2.44.3-2.el9
Should be : webkit2gtk3-jsc-2.50.4-1.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
233044 - RHEL 9 : webkit2gtk3 (RHSA-2025:2864)
-
Synopsis
The remote Red Hat host is missing a security update for webkit2gtk3.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2864 advisory.
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: out-of-bounds write vulnerability (CVE-2025-24201)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2351802
http://www.nessus.org/u?15235a48
https://access.redhat.com/errata/RHSA-2025:2864

Solution
Update the RHEL webkit2gtk3 package based on the guidance in RHSA-2025:2864.
Risk Factor
Critical
CVSS v3.0 Base Score
8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
8.2 (CVSS:3.0/E:F/RL:O/RC:C)
VPR Score
10.0
EPSS Score
0.0021
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
8.3 (CVSS2#E:F/RL:OF/RC:C)
References

CVE | CVE-2025-24201
XREF | CISA-KNOWN-EXPLOITED:2025/04/03
XREF | RHSA:2025:2864
XREF | CWE:787

Plugin Information
Published: 2025/03/20, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : webkit2gtk3-2.44.3-2.el9
Should be : webkit2gtk3-2.46.6-2.el9_5
Remote package installed : webkit2gtk3-jsc-2.44.3-2.el9
Should be : webkit2gtk3-jsc-2.46.6-2.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
236806 - RHEL 9 : xdg-utils (RHSA-2025:7672)
-
Synopsis
The remote Red Hat host is missing a security update for xdg-utils.
Description
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:7672 advisory.
The xdg-utils package is a set of simple scripts that provide basic desktop integration functions for any Free Desktop.
Security Fix(es):
* xdg-utils: improper parse of mailto URIs allows bypass of Thunderbird security mechanism for attachments (CVE-2022-4055)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2143792
http://www.nessus.org/u?922cbb09
https://access.redhat.com/errata/RHSA-2025:7672

Solution
Update the RHEL xdg-utils package based on the guidance in RHSA-2025:7672.
Risk Factor
High
CVSS v3.0 Base Score
7.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
6.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
5.2
EPSS Score
0.0014
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-4055
XREF | RHSA:2025:7672

Plugin Information
Published: 2025/05/15, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : xdg-utils-1.1.3-11.el9
Should be : xdg-utils-1.1.3-13.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
274822 - RHEL 9 : xorg-x11-server (RHSA-2025:20961)
-
Synopsis
The remote Red Hat host is missing one or more security updates for xorg-x11-server.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:20961 advisory.
X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.
Security Fix(es):
* xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229)
* xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230)
* xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2402649
https://bugzilla.redhat.com/show_bug.cgi?id=2402653
https://bugzilla.redhat.com/show_bug.cgi?id=2402660
http://www.nessus.org/u?677eda2d
https://access.redhat.com/errata/RHSA-2025:20961

Solution
Update the RHEL xorg-x11-server package based on the guidance in RHSA-2025:20961.
Risk Factor
High
CVSS v3.0 Base Score
7.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
7.0
EPSS Score
0.0001
CVSS v2.0 Base Score
9.0 (CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-62229
CVE | CVE-2025-62230
CVE | CVE-2025-62231
XREF | RHSA:2025:20961
XREF | CWE:190
XREF | CWE:416

Plugin Information
Published: 2025/11/11, Modified: 2025/11/11
Plugin Output

## tcp/0

Remote package installed : xorg-x11-server-common-1.20.11-26.el9
Should be : xorg-x11-server-common-1.20.11-32.el9_7
Remote package installed : xorg-x11-server-Xorg-1.20.11-26.el9
Should be : xorg-x11-server-Xorg-1.20.11-32.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237332 - RHEL 9 : xorg-x11-server (RHSA-2025:7163)
-
Synopsis
The remote Red Hat host is missing one or more security updates for xorg-x11-server.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7163 advisory.
X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.
Security Fix(es):
* xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability (CVE-2024-9632)
* X.Org: Xwayland: Use-after-free of the root cursor (CVE-2025-26594)
* xorg: xwayland: Use-after-free in SyncInitTrigger() (CVE-2025-26601)
* xorg: xwayland: Use-after-free in PlayReleasedEvents() (CVE-2025-26600)
* xorg: xwayland: Use of uninitialized pointer in compRedirectWindow() (CVE-2025-26599)
* xorg: xwayland: Out-of-bounds write in CreatePointerBarrierClient() (CVE-2025-26598)
* xorg: xwayland: Buffer overflow in XkbChangeTypesOfKey() (CVE-2025-26597)
* xorg: xwayland: Heap overflow in XkbWriteKeySyms() (CVE-2025-26596)
* Xorg: xwayland: Buffer overflow in XkbVModMaskText() (CVE-2025-26595)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?a7e51e86
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2317233
https://bugzilla.redhat.com/show_bug.cgi?id=2345248
https://bugzilla.redhat.com/show_bug.cgi?id=2345251
https://bugzilla.redhat.com/show_bug.cgi?id=2345252
https://bugzilla.redhat.com/show_bug.cgi?id=2345253
https://bugzilla.redhat.com/show_bug.cgi?id=2345254
https://bugzilla.redhat.com/show_bug.cgi?id=2345255
https://bugzilla.redhat.com/show_bug.cgi?id=2345256
https://bugzilla.redhat.com/show_bug.cgi?id=2345257
http://www.nessus.org/u?cf1ea3af
https://access.redhat.com/errata/RHSA-2025:7163

Solution
Update the RHEL xorg-x11-server package based on the guidance in RHSA-2025:7163.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0007
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-9632
CVE | CVE-2025-26594
CVE | CVE-2025-26595
CVE | CVE-2025-26596
CVE | CVE-2025-26597
CVE | CVE-2025-26598
CVE | CVE-2025-26599
CVE | CVE-2025-26600
CVE | CVE-2025-26601
XREF | RHSA:2025:7163
XREF | CWE:119
XREF | CWE:121
XREF | CWE:122
XREF | CWE:416
XREF | CWE:787
XREF | CWE:824

Plugin Information
Published: 2025/05/27, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : xorg-x11-server-common-1.20.11-26.el9
Should be : xorg-x11-server-common-1.20.11-28.el9_6
Remote package installed : xorg-x11-server-Xorg-1.20.11-26.el9
Should be : xorg-x11-server-Xorg-1.20.11-28.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
240254 - RHEL 9 : xorg-x11-server and xorg-x11-server-Xwayland (RHSA-2025:9303)
-
Synopsis
The remote Red Hat host is missing one or more security updates for xorg-x11-server / xorg-x11-server-Xwayland.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:9303 advisory.
X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.
Security Fix(es):
* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension Animated Cursors (CVE-2025-49175)
* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension (CVE-2025-49176)
* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore (CVE-2025-49178)
* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension (CVE-2025-49179)
* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension (CVE-2025-49180)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2369947
https://bugzilla.redhat.com/show_bug.cgi?id=2369954
https://bugzilla.redhat.com/show_bug.cgi?id=2369977
https://bugzilla.redhat.com/show_bug.cgi?id=2369978
https://bugzilla.redhat.com/show_bug.cgi?id=2369981
http://www.nessus.org/u?1bfe7c54
https://access.redhat.com/errata/RHSA-2025:9303

Solution
Update the RHEL xorg-x11-server / xorg-x11-server-Xwayland packages based on the guidance in RHSA-2025:9303.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
STIG Severity
I
References

CVE | CVE-2025-49175
CVE | CVE-2025-49176
CVE | CVE-2025-49178
CVE | CVE-2025-49179
CVE | CVE-2025-49180
XREF | RHSA:2025:9303
XREF | IAVA:2025-A-0442
XREF | CWE:125
XREF | CWE:190
XREF | CWE:667

Plugin Information
Published: 2025/06/23, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : xorg-x11-server-common-1.20.11-26.el9
Should be : xorg-x11-server-common-1.20.11-31.el9_6
Remote package installed : xorg-x11-server-Xorg-1.20.11-26.el9
Should be : xorg-x11-server-Xorg-1.20.11-31.el9_6
Remote package installed : xorg-x11-server-Xwayland-23.2.7-1.el9
Should be : xorg-x11-server-Xwayland-23.2.7-4.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
272189 - RHEL 9 : xorg-x11-server update (Moderate) (RHSA-2025:19433)
-
Synopsis
The remote Red Hat host is missing one or more security updates.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19433 advisory.
Please update
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2402649
https://bugzilla.redhat.com/show_bug.cgi?id=2402653
https://bugzilla.redhat.com/show_bug.cgi?id=2402660
http://www.nessus.org/u?1ad04129
https://access.redhat.com/errata/RHSA-2025:19433

Solution
Update the affected packages.
Risk Factor
High
CVSS v3.0 Base Score
7.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
7.0
EPSS Score
0.0001
CVSS v2.0 Base Score
9.0 (CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-62229
CVE | CVE-2025-62230
CVE | CVE-2025-62231
XREF | RHSA:2025:19433
XREF | CWE:190
XREF | CWE:416

Plugin Information
Published: 2025/11/03, Modified: 2025/11/03
Plugin Output

## tcp/0

Remote package installed : xorg-x11-server-common-1.20.11-26.el9
Should be : xorg-x11-server-common-1.20.11-32.el9_6
Remote package installed : xorg-x11-server-Xorg-1.20.11-26.el9
Should be : xorg-x11-server-Xorg-1.20.11-32.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
274762 - RHEL 9 : xorg-x11-server-Xwayland (RHSA-2025:20960)
-
Synopsis
The remote Red Hat host is missing one or more security updates for xorg-x11-server-Xwayland.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:20960 advisory.
Xwayland is an X server for running X clients under Wayland.
Security Fix(es):
* xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229)
* xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230)
* xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2402649
https://bugzilla.redhat.com/show_bug.cgi?id=2402653
https://bugzilla.redhat.com/show_bug.cgi?id=2402660
http://www.nessus.org/u?688681b9
https://access.redhat.com/errata/RHSA-2025:20960

Solution
Update the RHEL xorg-x11-server-Xwayland packages based on the guidance in RHSA-2025:20960.
Risk Factor
High
CVSS v3.0 Base Score
7.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
7.0
EPSS Score
0.0001
CVSS v2.0 Base Score
9.0 (CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-62229
CVE | CVE-2025-62230
CVE | CVE-2025-62231
XREF | RHSA:2025:20960
XREF | CWE:190
XREF | CWE:416

Plugin Information
Published: 2025/11/11, Modified: 2025/11/11
Plugin Output

## tcp/0

Remote package installed : xorg-x11-server-Xwayland-23.2.7-1.el9
Should be : xorg-x11-server-Xwayland-23.2.7-5.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237329 - RHEL 9 : xorg-x11-server-Xwayland (RHSA-2025:7165)
-
Synopsis
The remote Red Hat host is missing one or more security updates for xorg-x11-server-Xwayland.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7165 advisory.
Xwayland is an X server for running X clients under Wayland.
Security Fix(es):
* xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability (CVE-2024-9632)
* X.Org: Xwayland: Use-after-free of the root cursor (CVE-2025-26594)
* xorg: xwayland: Use-after-free in SyncInitTrigger() (CVE-2025-26601)
* xorg: xwayland: Use-after-free in PlayReleasedEvents() (CVE-2025-26600)
* xorg: xwayland: Use of uninitialized pointer in compRedirectWindow() (CVE-2025-26599)
* xorg: xwayland: Out-of-bounds write in CreatePointerBarrierClient() (CVE-2025-26598)
* xorg: xwayland: Buffer overflow in XkbChangeTypesOfKey() (CVE-2025-26597)
* xorg: xwayland: Heap overflow in XkbWriteKeySyms() (CVE-2025-26596)
* Xorg: xwayland: Buffer overflow in XkbVModMaskText() (CVE-2025-26595)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?a7e51e86
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2317233
https://bugzilla.redhat.com/show_bug.cgi?id=2345248
https://bugzilla.redhat.com/show_bug.cgi?id=2345251
https://bugzilla.redhat.com/show_bug.cgi?id=2345252
https://bugzilla.redhat.com/show_bug.cgi?id=2345253
https://bugzilla.redhat.com/show_bug.cgi?id=2345254
https://bugzilla.redhat.com/show_bug.cgi?id=2345255
https://bugzilla.redhat.com/show_bug.cgi?id=2345256
https://bugzilla.redhat.com/show_bug.cgi?id=2345257
http://www.nessus.org/u?4831d881
https://access.redhat.com/errata/RHSA-2025:7165

Solution
Update the RHEL xorg-x11-server-Xwayland packages based on the guidance in RHSA-2025:7165.
Risk Factor
Medium
CVSS v3.0 Base Score
7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0007
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-9632
CVE | CVE-2025-26594
CVE | CVE-2025-26595
CVE | CVE-2025-26596
CVE | CVE-2025-26597
CVE | CVE-2025-26598
CVE | CVE-2025-26599
CVE | CVE-2025-26600
CVE | CVE-2025-26601
XREF | RHSA:2025:7165
XREF | CWE:119
XREF | CWE:121
XREF | CWE:122
XREF | CWE:416
XREF | CWE:787
XREF | CWE:824

Plugin Information
Published: 2025/05/27, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : xorg-x11-server-Xwayland-23.2.7-1.el9
Should be : xorg-x11-server-Xwayland-23.2.7-3.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
272261 - RHEL 9 : xorg-x11-server-Xwayland update (Moderate) (RHSA-2025:19623)
-
Synopsis
The remote Red Hat host is missing one or more security updates.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19623 advisory.
Please update
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2402649
https://bugzilla.redhat.com/show_bug.cgi?id=2402653
https://bugzilla.redhat.com/show_bug.cgi?id=2402660
http://www.nessus.org/u?8876acc7
https://access.redhat.com/errata/RHSA-2025:19623

Solution
Update the affected xorg-x11-server-Xwayland and / or xorg-x11-server-Xwayland-devel packages.
Risk Factor
High
CVSS v3.0 Base Score
7.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
7.0
EPSS Score
0.0001
CVSS v2.0 Base Score
9.0 (CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-62229
CVE | CVE-2025-62230
CVE | CVE-2025-62231
XREF | RHSA:2025:19623
XREF | CWE:190
XREF | CWE:416

Plugin Information
Published: 2025/11/04, Modified: 2025/11/04
Plugin Output

## tcp/0

Remote package installed : xorg-x11-server-Xwayland-23.2.7-1.el9
Should be : xorg-x11-server-Xwayland-23.2.7-5.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237368 - RHEL 9 : yelp (RHSA-2025:7430)
-
Synopsis
The remote Red Hat host is missing a security update for yelp.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7430 advisory.
Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, including traditional man pages, info pages and documentation written in DocBook.
Security Fix(es):
* yelp: Arbitrary file read (CVE-2025-3155)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2357091
http://www.nessus.org/u?10131d3d
https://access.redhat.com/errata/RHSA-2025:7430

Solution
Update the RHEL yelp package based on the guidance in RHSA-2025:7430.
Risk Factor
High
CVSS v3.0 Base Score
7.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
6.4 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.2
EPSS Score
0.0004
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-3155
XREF | RHSA:2025:7430
XREF | CWE:829

Plugin Information
Published: 2025/05/27, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : yelp-40.3-2.el9
Should be : yelp-40.3-2.el9_6.1
Remote package installed : yelp-libs-40.3-2.el9
Should be : yelp-libs-40.3-2.el9_6.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
219126 - Linux Distros Unpatched Vulnerability : CVE-2015-9099
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The lame_init_params function in lame.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted audio file with a negative sample rate. (CVE-2015-9099)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2015-9099

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.004
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2015-9099

Plugin Information
Published: 2025/03/04, Modified: 2025/09/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- lame-libs
219487 - Linux Distros Unpatched Vulnerability : CVE-2015-9100
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted audio file.
(CVE-2015-9100)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2015-9100

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.004
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2015-9100

Plugin Information
Published: 2025/03/04, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- lame-libs
220352 - Linux Distros Unpatched Vulnerability : CVE-2017-1000383
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- GNU Emacs version 25.3.1 (and other versions most likely) ignores umask when creating a backup save file ([ORIGINAL_FILENAME]~) resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the emacs binary. (CVE-2017-1000383)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2017-1000383
https://ubuntu.com/security/CVE-2017-1000383

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2017-1000383

Plugin Information
Published: 2025/03/04, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- emacs-filesystem
220634 - Linux Distros Unpatched Vulnerability : CVE-2017-15018
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- LAME 3.99.5, 3.99.4, 3.99.3, 3.99.2, 3.99.1, 3.99, 3.98.4, 3.98.2 and 3.98 have a heap-based buffer over- read when handling a malformed file in k_34_4 in vbrquantize.c. (CVE-2017-15018)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2017-15018

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0029
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2017-15018

Plugin Information
Published: 2025/03/04, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- lame-libs
220662 - Linux Distros Unpatched Vulnerability : CVE-2017-15045
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- LAME 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4, 3.99.5, 3.98.4, 3.98.2 and 3.98 has a heap-based buffer over- read in fill_buffer in libmp3lame/util.c, related to lame_encode_buffer_sample_t in libmp3lame/lame.c, a different vulnerability than CVE-2017-9410. (CVE-2017-15045)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2017-15045

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0029
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2017-15045

Plugin Information
Published: 2025/03/04, Modified: 2025/09/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- lame-libs
220564 - Linux Distros Unpatched Vulnerability : CVE-2017-15046
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- LAME 3.99.5, 3.99.4, 3.98.4, 3.98.2, 3.98 and 3.97 have a stack-based buffer overflow in unpack_read_samples in frontend/get_audio.c, a different vulnerability than CVE-2017-9412.
(CVE-2017-15046)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2017-15046
https://ubuntu.com/security/CVE-2017-15046

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0018
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2017-15046

Plugin Information
Published: 2025/03/04, Modified: 2025/09/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- lame-libs
221557 - Linux Distros Unpatched Vulnerability : CVE-2017-9412
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted wav file. (CVE-2017-9412)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2017-9412

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0248
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2017-9412

Plugin Information
Published: 2025/03/04, Modified: 2025/09/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- lame-libs
222133 - Linux Distros Unpatched Vulnerability : CVE-2018-13419
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue has been found in libsndfile 1.0.28. There is a memory leak in psf_allocate in common.c, as demonstrated by sndfile-convert. NOTE: The maintainer and third parties were unable to reproduce and closed the issue (CVE-2018-13419)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2018-13419
https://ubuntu.com/security/CVE-2018-13419

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0024
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2018-13419

Plugin Information
Published: 2025/03/04, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libsndfile
277145 - Linux Distros Unpatched Vulnerability : CVE-2018-15853
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Endless recursion exists in xkbcomp/expr.c in xkbcommon and libxkbcommon before 0.8.1, which could be used by local attackers to crash xkbcommon users by supplying a crafted keymap file that triggers boolean negation. (CVE-2018-15853)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2018-15853
https://security-tracker.debian.org/tracker/CVE-2018-15853

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2018-15853

Plugin Information
Published: 2025/12/03, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- xkbcomp
277142 - Linux Distros Unpatched Vulnerability : CVE-2018-15859
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because lookup failures are mishandled. (CVE-2018-15859)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2018-15859
https://security-tracker.debian.org/tracker/CVE-2018-15859

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0007
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2018-15859

Plugin Information
Published: 2025/12/03, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- xkbcomp
277143 - Linux Distros Unpatched Vulnerability : CVE-2018-15861
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file that triggers an xkb_intern_atom failure. (CVE-2018-15861)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2018-15861
https://security-tracker.debian.org/tracker/CVE-2018-15861

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2018-15861

Plugin Information
Published: 2025/12/03, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- xkbcomp
277144 - Linux Distros Unpatched Vulnerability : CVE-2018-15863
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Unchecked NULL pointer usage in ResolveStateAndPredicate in xkbcomp/compat.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with a no-op modmask expression. (CVE-2018-15863)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2018-15863
https://security-tracker.debian.org/tracker/CVE-2018-15863

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2018-15863

Plugin Information
Published: 2025/12/03, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- xkbcomp
222456 - Linux Distros Unpatched Vulnerability : CVE-2019-16089
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in the Linux kernel through 5.2.13. nbd_genl_status in drivers/block/nbd.c does not check the nla_nest_start_noflag return value. (CVE-2019-16089)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2019-16089
https://security-tracker.debian.org/tracker/CVE-2019-16089
https://ubuntu.com/security/CVE-2019-16089

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.1 (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
3.6 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2019-16089

Plugin Information
Published: 2025/03/04, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
222997 - Linux Distros Unpatched Vulnerability : CVE-2020-10134
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Pairing in Bluetooth Core v5.2 and earlier may permit an unauthenticated attacker to acquire credentials with two pairing devices via adjacent access when the unauthenticated user initiates different pairing methods in each peer device and an end-user erroneously completes both pairing procedures with the MITM using the confirmation number of one peer as the passkey of the other. An adjacent, unauthenticated attacker could be able to initiate any Bluetooth operation on either attacked device exposed by the enabled Bluetooth profiles. This exposure may be limited when the user must authorize certain access explicitly, but so long as a user assumes that it is the intended remote device requesting permissions, device-local protections may be weakened. (CVE-2020-10134)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-10134
https://ubuntu.com/security/CVE-2020-10134

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.2
EPSS Score
0.0005
CVSS v2.0 Base Score
4.3 (CVSS2#AV:A/AC:M/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2020-10134

Plugin Information
Published: 2025/03/04, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bluez
- bluez-libs
- bluez-obexd
223278 - Linux Distros Unpatched Vulnerability : CVE-2020-12413
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites. (CVE-2020-12413)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-12413

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0011
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2020-12413

Plugin Information
Published: 2025/03/04, Modified: 2025/09/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- nspr
- nss
- nss-softokn
- nss-softokn-freebl
- nss-sysinit
- nss-tools
- nss-util
223249 - Linux Distros Unpatched Vulnerability : CVE-2020-13844
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Arm Armv8-A core implementations utilizing speculative execution past unconditional changes in control flow may allow unauthorized disclosure of information to an attacker with local user access via a side- channel analysis, aka straight-line speculation. (CVE-2020-13844)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-13844
https://ubuntu.com/security/CVE-2020-13844

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2020-13844

Plugin Information
Published: 2025/03/04, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
223211 - Linux Distros Unpatched Vulnerability : CVE-2020-14304
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A memory disclosure flaw was found in the Linux kernel's ethernet drivers, in the way it read data from the EEPROM of the device. This flaw allows a local user to read uninitialized values from the kernel memory. The highest threat from this vulnerability is to confidentiality. (CVE-2020-14304)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-14304
https://security-tracker.debian.org/tracker/CVE-2020-14304
https://ubuntu.com/security/CVE-2020-14304

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
4.4 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
4.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2020-14304

Plugin Information
Published: 2025/03/04, Modified: 2025/12/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
223320 - Linux Distros Unpatched Vulnerability : CVE-2020-14347
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in the way xserver memory was not properly initialized. This could leak parts of server memory to the X client. In cases where Xorg server runs with elevated privileges, this could result in possible ASLR bypass. Xorg-server before version 1.20.9 is vulnerable. (CVE-2020-14347)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-14347

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2020-14347

Plugin Information
Published: 2025/03/04, Modified: 2025/09/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- xorg-x11-server-Xorg
- xorg-x11-server-common
223405 - Linux Distros Unpatched Vulnerability : CVE-2020-21710
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A divide by zero issue discovered in eps_print_page in gdevepsn.c in Artifex Software GhostScript 9.50 allows remote attackers to cause a denial of service via opening of crafted PDF file. (CVE-2020-21710)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-21710

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0027
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2020-21710

Plugin Information
Published: 2025/03/04, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- ghostscript
- ghostscript-tools-fonts
- ghostscript-tools-printing
- libgs
229920 - Linux Distros Unpatched Vulnerability : CVE-2020-24352
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati_2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service. (CVE-2020-24352)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-24352
https://ubuntu.com/security/CVE-2020-24352

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0014
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2020-24352

Plugin Information
Published: 2025/03/05, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- qemu-guest-agent
229919 - Linux Distros Unpatched Vulnerability : CVE-2020-24386
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages (and path disclosure). (CVE-2020-24386)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-24386

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.8 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.2
EPSS Score
0.0107
CVSS v2.0 Base Score
4.9 (CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2020-24386

Plugin Information
Published: 2025/03/05, Modified: 2025/09/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- dovecot
223490 - Linux Distros Unpatched Vulnerability : CVE-2020-26140
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to inject arbitrary data frames independent of the network configuration. (CVE-2020-26140)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-26140
https://ubuntu.com/security/CVE-2020-26140

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0013
CVSS v2.0 Base Score
3.3 (CVSS2#AV:A/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
2.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2020-26140

Plugin Information
Published: 2025/03/04, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
223467 - Linux Distros Unpatched Vulnerability : CVE-2020-26144
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042 (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets independent of the network configuration. (CVE-2020-26144)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-26144
https://ubuntu.com/security/CVE-2020-26144

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0027
CVSS v2.0 Base Score
3.3 (CVSS2#AV:A/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
2.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2020-26144

Plugin Information
Published: 2025/03/04, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
223527 - Linux Distros Unpatched Vulnerability : CVE-2020-26146
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used. Note that WEP is vulnerable to this attack by design. (CVE-2020-26146)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-26146
https://ubuntu.com/security/CVE-2020-26146

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0064
CVSS v2.0 Base Score
2.9 (CVSS2#AV:A/AC:M/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
2.5 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2020-26146

Plugin Information
Published: 2025/03/04, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
223528 - Linux Distros Unpatched Vulnerability : CVE-2020-26555
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN. (CVE-2020-26555)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-26555
https://ubuntu.com/security/CVE-2020-26555

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.4 (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.3
EPSS Score
0.0021
CVSS v2.0 Base Score
4.8 (CVSS2#AV:A/AC:L/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2020-26555

Plugin Information
Published: 2025/03/04, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bluez
- bluez-libs
- bluez-obexd
223560 - Linux Distros Unpatched Vulnerability : CVE-2020-28200
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension. (CVE-2020-28200)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-28200
https://security-tracker.debian.org/tracker/CVE-2020-28200
https://ubuntu.com/security/CVE-2020-28200

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.01
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2020-28200

Plugin Information
Published: 2025/03/04, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- dovecot
229871 - Linux Distros Unpatched Vulnerability : CVE-2020-36023
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::cvtGlyph function. (CVE-2020-36023)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-36023

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0008
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2020-36023

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- poppler
- poppler-cpp
- poppler-glib
- poppler-utils
223553 - Linux Distros Unpatched Vulnerability : CVE-2020-36024
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::convertToType1 function. (CVE-2020-36024)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-36024

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0011
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2020-36024

Plugin Information
Published: 2025/03/04, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- poppler
- poppler-cpp
- poppler-glib
- poppler-utils
230218 - Linux Distros Unpatched Vulnerability : CVE-2020-36558
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer dereference and general protection fault. (CVE-2020-36558)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-36558
https://ubuntu.com/security/CVE-2020-36558

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.1 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2020-36558

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246065 - Linux Distros Unpatched Vulnerability : CVE-2020-36782
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails The PM reference count is not expected to be incremented on return in lpi2c_imx_master_enable. However, pm_runtime_get_sync will increment the PM reference count even failed.
Forgetting to putting operation will result in a reference leak here. Replace it with pm_runtime_resume_and_get to keep usage counter balanced. (CVE-2020-36782)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-36782
https://ubuntu.com/security/CVE-2020-36782

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2020-36782

Plugin Information
Published: 2025/08/08, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
223621 - Linux Distros Unpatched Vulnerability : CVE-2020-9770
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A logic issue was addressed with improved state management. This issue is fixed in iOS 13.4 and iPadOS 13.4. An attacker in a privileged network position may be able to intercept Bluetooth traffic.
(CVE-2020-9770)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-9770
https://ubuntu.com/security/CVE-2020-9770

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.004
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2020-9770

Plugin Information
Published: 2025/03/04, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bluez
- bluez-libs
- bluez-obexd
223693 - Linux Distros Unpatched Vulnerability : CVE-2021-20197
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users), an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-20197
https://security-tracker.debian.org/tracker/CVE-2021-20197
https://ubuntu.com/security/CVE-2021-20197

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
5.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0017
CVSS v2.0 Base Score
3.3 (CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
2.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-20197

Plugin Information
Published: 2025/03/04, Modified: 2025/09/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
223642 - Linux Distros Unpatched Vulnerability : CVE-2021-20320
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.c in the Linux kernel. In this flaw, a local attacker with special user privilege can circumvent the verifier and may lead to a confidentiality problem. (CVE-2021-20320)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-20320
https://ubuntu.com/security/CVE-2021-20320

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0008
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-20320

Plugin Information
Published: 2025/03/04, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
223750 - Linux Distros Unpatched Vulnerability : CVE-2021-25786
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to Pl_ASCII85Decoder::write parameter in libqpdf. (CVE-2021-25786)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-25786

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.2
EPSS Score
0.003
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2021-25786

Plugin Information
Published: 2025/03/04, Modified: 2025/09/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- qpdf-libs
223749 - Linux Distros Unpatched Vulnerability : CVE-2021-28711
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the ability to run PV backends in regular unprivileged guests, typically referred to as driver domains.
Running PV backends in driver domains has one primary security advantage: if a driver domain gets compromised, it doesn't have the privileges to take over the system. However, a malicious driver domain could try to attack other guests via sending events at a high frequency leading to a Denial of Service in the guest due to trying to service interrupts for elongated amounts of time. There are three affected backends: * blkfront patch 1, CVE-2021-28711 * netfront patch 2, CVE-2021-28712 * hvc_xen (console) patch 3, CVE-2021-28713 (CVE-2021-28711)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-28711
https://ubuntu.com/security/CVE-2021-28711

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-28711

Plugin Information
Published: 2025/03/04, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
223724 - Linux Distros Unpatched Vulnerability : CVE-2021-28712
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the ability to run PV backends in regular unprivileged guests, typically referred to as driver domains.
Running PV backends in driver domains has one primary security advantage: if a driver domain gets compromised, it doesn't have the privileges to take over the system. However, a malicious driver domain could try to attack other guests via sending events at a high frequency leading to a Denial of Service in the guest due to trying to service interrupts for elongated amounts of time. There are three affected backends: * blkfront patch 1, CVE-2021-28711 * netfront patch 2, CVE-2021-28712 * hvc_xen (console) patch 3, CVE-2021-28713 (CVE-2021-28712)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-28712
https://ubuntu.com/security/CVE-2021-28712

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-28712

Plugin Information
Published: 2025/03/04, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
223772 - Linux Distros Unpatched Vulnerability : CVE-2021-28713
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the ability to run PV backends in regular unprivileged guests, typically referred to as driver domains.
Running PV backends in driver domains has one primary security advantage: if a driver domain gets compromised, it doesn't have the privileges to take over the system. However, a malicious driver domain could try to attack other guests via sending events at a high frequency leading to a Denial of Service in the guest due to trying to service interrupts for elongated amounts of time. There are three affected backends: * blkfront patch 1, CVE-2021-28711 * netfront patch 2, CVE-2021-28712 * hvc_xen (console) patch 3, CVE-2021-28713 (CVE-2021-28713)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-28713
https://ubuntu.com/security/CVE-2021-28713

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-28713

Plugin Information
Published: 2025/03/04, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
223916 - Linux Distros Unpatched Vulnerability : CVE-2021-31879
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007. (CVE-2021-31879)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-31879
https://security-tracker.debian.org/tracker/CVE-2021-31879
https://ubuntu.com/security/CVE-2021-31879

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
5.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.0
EPSS Score
0.0008
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-31879

Plugin Information
Published: 2025/03/05, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- wget
223804 - Linux Distros Unpatched Vulnerability : CVE-2021-32256
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.36. It is a stack-overflow issue in demangle_type in rust-demangle.c. (CVE-2021-32256)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-32256
https://security-tracker.debian.org/tracker/CVE-2021-32256
https://ubuntu.com/security/CVE-2021-32256

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0012
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2021-32256

Plugin Information
Published: 2025/03/05, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-12-binutils
- gcc-toolset-12-binutils-devel
- gcc-toolset-12-binutils-gold
- gcc-toolset-12-gdb
- gcc-toolset-13-gdb
223800 - Linux Distros Unpatched Vulnerability : CVE-2021-32815
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The assertion failure is triggered when Exiv2 is used to modify the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when modifying the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `fi`. ### Patches The bug is fixed in version v0.27.5. ### References Regression test and bug fix: #1739 ### For more information Please see our [security policy](https://github.com/Exiv2/exiv2/security/policy) for information about Exiv2 security.
(CVE-2021-32815)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-32815

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-32815

Plugin Information
Published: 2025/03/05, Modified: 2025/09/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- exiv2
- exiv2-libs
223888 - Linux Distros Unpatched Vulnerability : CVE-2021-33117
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Improper access control for some 3rd Generation Intel(R) Xeon(R) Scalable Processors before BIOS version MR7, may allow a local attacker to potentially enable information disclosure via local access.
(CVE-2021-33117)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-33117
https://ubuntu.com/security/CVE-2021-33117

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0008
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-33117

Plugin Information
Published: 2025/03/05, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- microcode_ctl
223843 - Linux Distros Unpatched Vulnerability : CVE-2021-33515
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address. (CVE-2021-33515)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-33515

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
4.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
2.5
EPSS Score
0.1041
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-33515

Plugin Information
Published: 2025/03/05, Modified: 2025/09/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- dovecot
223860 - Linux Distros Unpatched Vulnerability : CVE-2021-33656
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.
(CVE-2021-33656)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-33656
https://ubuntu.com/security/CVE-2021-33656

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
6.8 (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-33656

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
223930 - Linux Distros Unpatched Vulnerability : CVE-2021-34334
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.5.
(CVE-2021-34334)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-34334

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-34334

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- exiv2
- exiv2-libs
223844 - Linux Distros Unpatched Vulnerability : CVE-2021-34335
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A floating point exception (FPE) due to an integer divide by zero was found in Exiv2 versions v0.27.4 and earlier. The FPE is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the interpreted (translated) data, which is a less frequently used Exiv2 operation that requires an extra command line option (`-p t` or `-P t`). The bug is fixed in version v0.27.5. (CVE-2021-34335)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-34335

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-34335

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- exiv2
- exiv2-libs
223865 - Linux Distros Unpatched Vulnerability : CVE-2021-34558
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic. (CVE-2021-34558)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-34558
https://ubuntu.com/security/CVE-2021-34558

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0147
CVSS v2.0 Base Score
2.6 (CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-34558

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
223887 - Linux Distros Unpatched Vulnerability : CVE-2021-34693
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (CVE-2021-34693)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-34693
https://ubuntu.com/security/CVE-2021-34693

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.9 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2021-34693

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224001 - Linux Distros Unpatched Vulnerability : CVE-2021-3572
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1. (CVE-2021-3572)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-3572

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.7 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0023
CVSS v2.0 Base Score
3.5 (CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
2.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-3572

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- python3-pip-wheel
223956 - Linux Distros Unpatched Vulnerability : CVE-2021-36221
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort. (CVE-2021-36221)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-36221
https://ubuntu.com/security/CVE-2021-36221

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0019
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-36221

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
223991 - Linux Distros Unpatched Vulnerability : CVE-2021-3658
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a device is powered down while discoverable, it will be discoverable when powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby attackers. (CVE-2021-3658)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-3658

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
3.3 (CVSS2#AV:A/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
2.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-3658

Plugin Information
Published: 2025/03/05, Modified: 2025/09/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bluez
- bluez-libs
- bluez-obexd
224084 - Linux Distros Unpatched Vulnerability : CVE-2021-3714
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in the Linux kernels memory deduplication mechanism. Previous work has shown that memory deduplication can be attacked via a local exploitation mechanism. The same technique can be used if an attacker can upload page sized files and detect the change in access time from a networked service to determine if the page has been merged. (CVE-2021-3714)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-3714
https://security-tracker.debian.org/tracker/CVE-2021-3714
https://ubuntu.com/security/CVE-2021-3714

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
3.8 (CVSS2#AV:L/AC:H/Au:S/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-3714

Plugin Information
Published: 2025/03/05, Modified: 2025/12/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246090 - Linux Distros Unpatched Vulnerability : CVE-2021-37159
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free.
(CVE-2021-37159)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-37159
https://ubuntu.com/security/CVE-2021-37159

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.4 (CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0003
CVSS v2.0 Base Score
4.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-37159

Plugin Information
Published: 2025/08/08, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224097 - Linux Distros Unpatched Vulnerability : CVE-2021-3735
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a software reset (ahci_reset_port) while handling a host-to-device Register FIS (Frame Information Structure) packet from the guest. A privileged user inside the guest could use this flaw to hang the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. (CVE-2021-3735)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-3735
https://security-tracker.debian.org/tracker/CVE-2021-3735
https://ubuntu.com/security/CVE-2021-3735

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.4 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-3735

Plugin Information
Published: 2025/03/05, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- qemu-guest-agent
223996 - Linux Distros Unpatched Vulnerability : CVE-2021-37615
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A null pointer dereference was found in Exiv2 versions v0.27.4 and earlier. The null pointer dereference is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the interpreted (translated) data, which is a less frequently used Exiv2 operation that requires an extra command line option (`-p t` or `-P t`). The bug is fixed in version v0.27.5. (CVE-2021-37615)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-37615

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-37615

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- exiv2
- exiv2-libs
224005 - Linux Distros Unpatched Vulnerability : CVE-2021-37616
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A null pointer dereference was found in Exiv2 versions v0.27.4 and earlier. The null pointer dereference is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the interpreted (translated) data, which is a less frequently used Exiv2 operation that requires an extra command line option (`-p t` or `-P t`). The bug is fixed in version v0.27.5. (CVE-2021-37616)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-37616

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-37616

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- exiv2
- exiv2-libs
224070 - Linux Distros Unpatched Vulnerability : CVE-2021-37620
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.5. (CVE-2021-37620)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-37620

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0007
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-37620

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- exiv2
- exiv2-libs
224095 - Linux Distros Unpatched Vulnerability : CVE-2021-37621
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found in Exiv2 versions v0.27.4 and earlier. The infinite loop is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the image ICC profile, which is a less frequently used Exiv2 operation that requires an extra command line option (`-p C`). The bug is fixed in version v0.27.5. (CVE-2021-37621)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-37621

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-37621

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- exiv2
- exiv2-libs
224030 - Linux Distros Unpatched Vulnerability : CVE-2021-37622
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found in Exiv2 versions v0.27.4 and earlier. The infinite loop is triggered when Exiv2 is used to modify the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when deleting the IPTC data, which is a less frequently used Exiv2 operation that requires an extra command line option (`-d I rm`). The bug is fixed in version v0.27.5. (CVE-2021-37622)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-37622

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-37622

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- exiv2
- exiv2-libs
224003 - Linux Distros Unpatched Vulnerability : CVE-2021-37623
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found in Exiv2 versions v0.27.4 and earlier. The infinite loop is triggered when Exiv2 is used to modify the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when deleting the IPTC data, which is a less frequently used Exiv2 operation that requires an extra command line option (`-d I rm`). The bug is fixed in version v0.27.5. (CVE-2021-37623)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-37623

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-37623

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- exiv2
- exiv2-libs
224053 - Linux Distros Unpatched Vulnerability : CVE-2021-3782
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause the reference count to overflow if the client creates a large number of wl_shm buffer objects, or if it can coerce the server to create a large number of external references to the buffer storage. With the reference count overflowing, a use-after-free can be constructed on the wl_shm_pool tracking structure, where values may be incremented or decremented; it may also be possible to construct a limited oracle to leak 4 bytes of server-side memory to the attacking client at a time. (CVE-2021-3782)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-3782
https://security-tracker.debian.org/tracker/CVE-2021-3782

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
6.6 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
5.5
EPSS Score
0.0002
CVSS v2.0 Base Score
3.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
2.8 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2021-3782

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libwayland-client
- libwayland-cursor
- libwayland-egl
- libwayland-server
- wayland-devel
223971 - Linux Distros Unpatched Vulnerability : CVE-2021-3826
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in libiberty allows attackers to potentially cause a denial of service (segmentation fault and crash) via a crafted mangled symbol.
(CVE-2021-3826)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-3826
https://security-tracker.debian.org/tracker/CVE-2021-3826
https://ubuntu.com/security/CVE-2021-3826

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0019
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-3826

Plugin Information
Published: 2025/03/05, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
224249 - Linux Distros Unpatched Vulnerability : CVE-2021-41190
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both manifests and layers fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both manifests and layers fields or manifests and config fields if they are unable to update to version 1.0.1 of the spec. (CVE-2021-41190)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-41190
https://ubuntu.com/security/CVE-2021-41190

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.0 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
4.4 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.6
EPSS Score
0.0026
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
3.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-41190

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- podman
224294 - Linux Distros Unpatched Vulnerability : CVE-2021-4135
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device driver in the way user uses BPF for the device such that function nsim_map_alloc_elem being called. A local user could use this flaw to get unauthorized access to some data. (CVE-2021-4135)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-4135
https://ubuntu.com/security/CVE-2021-4135

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-4135

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224210 - Linux Distros Unpatched Vulnerability : CVE-2021-4231
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic.
Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to version 11.0.5 and 11.1.0-next.3 is able to address this issue. The name of the patch is ba8da742e3b243e8f43d4c63aa842b44e14f2b09. It is recommended to upgrade the affected component.
(CVE-2021-4231)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-4231

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.0
EPSS Score
0.0073
CVSS v2.0 Base Score
3.5 (CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
3.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-4231

Plugin Information
Published: 2025/03/05, Modified: 2025/10/13
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
- gjs
224250 - Linux Distros Unpatched Vulnerability : CVE-2021-42739
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandles bounds checking. (CVE-2021-42739)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-42739
https://ubuntu.com/security/CVE-2021-42739

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.7 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0002
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-42739

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224211 - Linux Distros Unpatched Vulnerability : CVE-2021-43975
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. (CVE-2021-43975)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-43975
https://ubuntu.com/security/CVE-2021-43975

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.7 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.3 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2021-43975

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247475 - Linux Distros Unpatched Vulnerability : CVE-2021-4454
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate The conclusion j1939_session_deactivate() should be called with a session ref- count of at least 2 is incorrect. In some concurrent scenarios, j1939_session_deactivate can be called with the session ref-count less than 2. But there is not any problem because it will check the session active state before session putting in j1939_session_deactivate_locked(). Here is the concurrent scenario of the problem reported by syzbot and my reproduction log. cpu0 cpu1 j1939_xtp_rx_eoma j1939_xtp_rx_abort_one j1939_session_get_by_addr [kref == 2] j1939_session_get_by_addr [kref == 3] j1939_session_deactivate [kref == 2] j1939_session_put [kref == 1] j1939_session_completed j1939_session_deactivate WARN_ON_ONCE(kref < 2) ===================================================== WARNING: CPU: 1 PID: 21 at net/can/j1939/transport.c:1088 j1939_session_deactivate+0x5f/0x70 CPU: 1 PID:
21 Comm: ksoftirqd/1 Not tainted 5.14.0-rc7+ #32 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014 RIP: 0010:j1939_session_deactivate+0x5f/0x70 Call Trace:
j1939_session_deactivate_activate_next+0x11/0x28 j1939_xtp_rx_eoma+0x12a/0x180 j1939_tp_recv+0x4a2/0x510 j1939_can_recv+0x226/0x380 can_rcv_filter+0xf8/0x220 can_receive+0x102/0x220 ? process_backlog+0xf0/0x2c0 can_rcv+0x53/0xf0 __netif_receive_skb_one_core+0x67/0x90 ? process_backlog+0x97/0x2c0
__netif_receive_skb+0x22/0x80 (CVE-2021-4454)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-4454
https://ubuntu.com/security/CVE-2021-4454

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-4454

Plugin Information
Published: 2025/08/10, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
259260 - Linux Distros Unpatched Vulnerability : CVE-2021-45261
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service. (CVE-2021-45261)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-45261
https://security-tracker.debian.org/tracker/CVE-2021-45261
https://ubuntu.com/security/CVE-2021-45261

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0009
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2021-45261

Plugin Information
Published: 2025/08/30, Modified: 2025/10/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- patch
224360 - Linux Distros Unpatched Vulnerability : CVE-2021-45402
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not properly update bounds while handling the mov32 instruction, which allows local users to obtain potentially sensitive address information, aka a pointer leak. (CVE-2021-45402)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-45402
https://ubuntu.com/security/CVE-2021-45402

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2021-45402

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247774 - Linux Distros Unpatched Vulnerability : CVE-2021-46904
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: hso: fix null-ptr-deref during tty device unregistration Multiple ttys try to claim the same the minor number causing a double unregistration of the same device. The first unregistration succeeds but the next one results in a null- ptr-deref. The get_free_serial_index() function returns an available minor number but doesn't assign it immediately. The assignment is done by the caller later. But before this assignment, calls to get_free_serial_index() would return the same minor number. Fix this by modifying get_free_serial_index to assign the minor number immediately after one is found to be and rename it to obtain_minor() to better reflect what it does. Similary, rename set_serial_by_index() to release_minor() and modify it to free up the minor number of the given hso_serial. Every obtain_minor() should have corresponding release_minor() call. (CVE-2021-46904)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-46904
https://ubuntu.com/security/CVE-2021-46904

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-46904

Plugin Information
Published: 2025/08/10, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230204 - Linux Distros Unpatched Vulnerability : CVE-2021-46909
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ARM: footbridge: fix PCI interrupt mapping Since commit 30fdfb929e82 (PCI: Add a call to pci_assign_irq() in pci_device_probe()), the PCI code will call the IRQ mapping function whenever a PCI driver is probed. If these are marked as __init, this causes an oops if a PCI driver is loaded or bound after the kernel has initialised. (CVE-2021-46909)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-46909
https://ubuntu.com/security/CVE-2021-46909

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-46909

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248926 - Linux Distros Unpatched Vulnerability : CVE-2021-46910
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ARM: 9063/1: mm: reduce maximum number of CPUs if DEBUG_KMAP_LOCAL is enabled The debugging code for kmap_local() doubles the number of per-CPU fixmap slots allocated for kmap_local(), in order to use half of them as guard regions. This causes the fixmap region to grow downwards beyond the start of its reserved window if the supported number of CPUs is large, and collide with the newly added virtual DT mapping right below it, which is obviously not good.
One manifestation of this is EFI boot on a kernel built with NR_CPUS=32 and CONFIG_DEBUG_KMAP_LOCAL=y, which may pass the FDT in highmem, resulting in block entries below the fixmap region that the fixmap code misidentifies as fixmap table entries, and subsequently tries to dereference using a phys-to-virt translation that is only valid for lowmem. This results in a cryptic splat such as the one below. ftrace:
allocating 45548 entries in 89 pages 8<--- cut here --- Unable to handle kernel paging request at virtual address fc6006f0 pgd = (ptrval) [fc6006f0] *pgd=80000040207003, *pmd=00000000 Internal error: Oops: a06 [#1] SMP ARM Modules linked in: CPU: 0 PID: 0 Comm: swapper Not tainted 5.11.0+ #382 Hardware name:
Generic DT based system PC is at cpu_ca15_set_pte_ext+0x24/0x30 LR is at __set_fixmap+0xe4/0x118 pc :
[<c041ac9c>] lr : [<c04189d8>] psr: 400000d3 sp : c1601ed8 ip : 00400000 fp : 00800000 r10: 0000071f r9 :
00421000 r8 : 00c00000 r7 : 00c00000 r6 : 0000071f r5 : ffade000 r4 : 4040171f r3 : 00c00000 r2 : 4040171f r1 : c041ac78 r0 : fc6006f0 Flags: nZcv IRQs off FIQs off Mode SVC_32 ISA ARM Segment none Control:
30c5387d Table: 40203000 DAC: 00000001 Process swapper (pid: 0, stack limit = 0x(ptrval)) So let's limit CONFIG_NR_CPUS to 16 when CONFIG_DEBUG_KMAP_LOCAL=y. Also, fix the BUILD_BUG_ON() check that was supposed to catch this, by checking whether the region grows below the start address rather than above the end address. (CVE-2021-46910)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-46910
https://ubuntu.com/security/CVE-2021-46910

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-46910

Plugin Information
Published: 2025/08/12, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224431 - Linux Distros Unpatched Vulnerability : CVE-2021-46917
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix wq cleanup of WQCFG registers A pre-release silicon erratum workaround where wq reset does not clear WQCFG registers was leaked into upstream code. Use wq reset command instead of blasting the MMIO region. This also address an issue where we clobber registers in future devices. (CVE-2021-46917)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-46917
https://ubuntu.com/security/CVE-2021-46917

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-46917

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229760 - Linux Distros Unpatched Vulnerability : CVE-2021-46918
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: clear MSIX permission entry on shutdown Add disabling/clearing of MSIX permission entries on device shutdown to mirror the enabling of the MSIX entries on probe. Current code left the MSIX enabled and the pasid entries still programmed at device shutdown. (CVE-2021-46918)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-46918
https://ubuntu.com/security/CVE-2021-46918

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-46918

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230178 - Linux Distros Unpatched Vulnerability : CVE-2021-46920
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix clobbering of SWERR overflow bit on writeback Current code blindly writes over the SWERR and the OVERFLOW bits. Write back the bits actually read instead so the driver avoids clobbering the OVERFLOW bit that comes after the register is read. (CVE-2021-46920)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-46920
https://ubuntu.com/security/CVE-2021-46920

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-46920

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224425 - Linux Distros Unpatched Vulnerability : CVE-2021-46923
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: fs/mount_setattr: always cleanup mount_kattr Make sure that finish_mount_kattr() is called after mount_kattr was succesfully built in both the success and failure case to prevent leaking any references we took when we built it. We returned early if path lookup failed thereby risking to leak an additional reference we took when building mount_kattr when an idmapped mount was requested. (CVE-2021-46923)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-46923
https://ubuntu.com/security/CVE-2021-46923

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-46923

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224371 - Linux Distros Unpatched Vulnerability : CVE-2021-46931
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Wrap the tx reporter dump callback to extract the sq Function mlx5e_tx_reporter_dump_sq() casts its void * argument to struct mlx5e_txqsq *, but in TX-timeout-recovery flow the argument is actually of type struct mlx5e_tx_timeout_ctx *. mlx5_core 0000:08:00.1 enp8s0f1: TX timeout detected mlx5_core 0000:08:00.1 enp8s0f1: TX timeout on queue: 1, SQ: 0x11ec, CQ: 0x146d, SQ Cons: 0x0 SQ Prod: 0x1, usecs since last trans: 21565000 BUG: stack guard page was hit at 0000000093f1a2de (stack is 00000000b66ea0dc..000000004d932dae) kernel stack overflow (page fault): 0000 [#1] SMP NOPTI CPU: 5 PID: 95 Comm: kworker/u20:1 Tainted: G W OE 5.13.0_mlnx #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: mlx5e mlx5e_tx_timeout_work [mlx5_core] RIP: 0010:mlx5e_tx_reporter_dump_sq+0xd3/0x180 [mlx5_core] Call Trace:
mlx5e_tx_reporter_dump+0x43/0x1c0 [mlx5_core] devlink_health_do_dump.part.91+0x71/0xd0 devlink_health_report+0x157/0x1b0 mlx5e_reporter_tx_timeout+0xb9/0xf0 [mlx5_core] ? mlx5e_tx_reporter_err_cqe_recover+0x1d0/0x1d0 [mlx5_core] ? mlx5e_health_queue_dump+0xd0/0xd0 [mlx5_core] ? update_load_avg+0x19b/0x550 ? set_next_entity+0x72/0x80 ? pick_next_task_fair+0x227/0x340 ? finish_task_switch+0xa2/0x280 mlx5e_tx_timeout_work+0x83/0xb0 [mlx5_core] process_one_work+0x1de/0x3a0 worker_thread+0x2d/0x3c0 ? process_one_work+0x3a0/0x3a0 kthread+0x115/0x130 ? kthread_park+0x90/0x90 ret_from_fork+0x1f/0x30 --[ end trace 51ccabea504edaff ]--- RIP: 0010:mlx5e_tx_reporter_dump_sq+0xd3/0x180 PKRU: 55555554 Kernel panic - not syncing: Fatal exception Kernel Offset: disabled end Kernel panic - not syncing: Fatal exception To fix this bug add a wrapper for mlx5e_tx_reporter_dump_sq() which extracts the sq from struct mlx5e_tx_timeout_ctx and set it as the TX-timeout-recovery flow dump callback.
(CVE-2021-46931)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-46931
https://ubuntu.com/security/CVE-2021-46931

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-46931

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230149 - Linux Distros Unpatched Vulnerability : CVE-2021-46937
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm/damon/dbgfs: fix 'struct pid' leaks in 'dbgfs_target_ids_write()' DAMON debugfs interface increases the reference counts of 'struct pid's for targets from the 'target_ids' file write callback ('dbgfs_target_ids_write()'), but decreases the counts only in DAMON monitoring termination callback ('dbgfs_before_terminate()'). Therefore, when 'target_ids' file is repeatedly written without DAMON monitoring start/termination, the reference count is not decreased and therefore memory for the 'struct pid' cannot be freed. This commit fixes this issue by decreasing the reference counts when 'target_ids' is written. (CVE-2021-46937)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-46937
https://security-tracker.debian.org/tracker/CVE-2021-46937
https://ubuntu.com/security/CVE-2021-46937

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0007
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-46937

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244079 - Linux Distros Unpatched Vulnerability : CVE-2021-47020
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: soundwire: stream: fix memory leak in stream config error path When stream config is failed, master runtime will release all slave runtime in the slave_rt_list, but slave runtime is not added to the list at this time. This patch frees slave runtime in the config error path to fix the memory leak. (CVE-2021-47020)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47020
https://ubuntu.com/security/CVE-2021-47020

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47020

Plugin Information
Published: 2025/08/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230109 - Linux Distros Unpatched Vulnerability : CVE-2021-47033
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mt76: mt7615: fix tx skb dma unmap The first pointer in the txp needs to be unmapped as well, otherwise it will leak DMA mapping entries (CVE-2021-47033)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47033
https://ubuntu.com/security/CVE-2021-47033

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47033

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230198 - Linux Distros Unpatched Vulnerability : CVE-2021-47041
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix incorrect locking in state_change sk callback We are not changing anything in the TCP connection state so we should not take a write_lock but rather a read lock. This caused a deadlock when running nvmet-tcp and nvme-tcp on the same system, where state_change callbacks on the host and on the controller side have causal relationship and made lockdep report on this with blktests: ================================ WARNING: inconsistent lock state 5.12.0-rc3 #1 Tainted: G I -------------------------------- inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ- ON-R} usage. nvme/1324 [HC0[0]:SC0[0]:HE1:SE1] takes: ffff888363151000 (clock-AF_INET){++-?}-{2:2}, at:
nvme_tcp_state_change+0x21/0x150 [nvme_tcp] {IN-SOFTIRQ-W} state was registered at:
__lock_acquire+0x79b/0x18d0 lock_acquire+0x1ca/0x480 _raw_write_lock_bh+0x39/0x80 nvmet_tcp_state_change+0x21/0x170 [nvmet_tcp] tcp_fin+0x2a8/0x780 tcp_data_queue+0xf94/0x1f20 tcp_rcv_established+0x6ba/0x1f00 tcp_v4_do_rcv+0x502/0x760 tcp_v4_rcv+0x257e/0x3430 ip_protocol_deliver_rcu+0x69/0x6a0 ip_local_deliver_finish+0x1e2/0x2f0 ip_local_deliver+0x1a2/0x420 ip_rcv+0x4fb/0x6b0 __netif_receive_skb_one_core+0x162/0x1b0 process_backlog+0x1ff/0x770
__napi_poll.constprop.0+0xa9/0x5c0 net_rx_action+0x7b3/0xb30 __do_softirq+0x1f0/0x940 do_softirq+0xa1/0xd0
__local_bh_enable_ip+0xd8/0x100 ip_finish_output2+0x6b7/0x18a0 __ip_queue_xmit+0x706/0x1aa0
__tcp_transmit_skb+0x2068/0x2e20 tcp_write_xmit+0xc9e/0x2bb0 __tcp_push_pending_frames+0x92/0x310 inet_shutdown+0x158/0x300 __nvme_tcp_stop_queue+0x36/0x270 [nvme_tcp] nvme_tcp_stop_queue+0x87/0xb0 [nvme_tcp] nvme_tcp_teardown_admin_queue+0x69/0xe0 [nvme_tcp] nvme_do_delete_ctrl+0x100/0x10c [nvme_core] nvme_sysfs_delete.cold+0x8/0xd [nvme_core] kernfs_fop_write_iter+0x2c7/0x460 new_sync_write+0x36c/0x610 vfs_write+0x5c0/0x870 ksys_write+0xf9/0x1d0 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xae irq event stamp: 10687 hardirqs last enabled at (10687):
[<ffffffff9ec376bd>] _raw_spin_unlock_irqrestore+0x2d/0x40 hardirqs last disabled at (10686):
[<ffffffff9ec374d8>] _raw_spin_lock_irqsave+0x68/0x90 softirqs last enabled at (10684):
[<ffffffff9f000608>] __do_softirq+0x608/0x940 softirqs last disabled at (10649): [<ffffffff9cdedd31>] do_softirq+0xa1/0xd0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(clock-AF_INET); <Interrupt> lock(clock-AF_INET); *** DEADLOCK *** 5 locks held by nvme/1324: #0:
ffff8884a01fe470 (sb_writers#4){.+.+}-{0:0}, at: ksys_write+0xf9/0x1d0 #1: ffff8886e435c090 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x216/0x460 #2: ffff888104d90c38 (kn->active#255){++++}-{0:0}, at: kernfs_remove_self+0x22d/0x330 #3: ffff8884634538d0 (&queue->queue_lock){+.+.}-{3:3}, at: nvme_tcp_stop_queue+0x52/0xb0 [nvme_tcp] #4: ffff888363150d30 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_shutdown+0x59/0x300 stack backtrace: CPU: 26 PID: 1324 Comm: nvme Tainted: G I 5.12.0-rc3 #1 Hardware name: Dell Inc. PowerEdge R640/06NR82, BIOS 2.10.0 11/12/2020 Call Trace: dump_stack+0x93/0xc2 mark_lock_irq.cold+0x2c/0xb3 ? verify_lock_unused+0x390/0x390 ? stack_trace_consume_entry+0x160/0x160 ? lock_downgrade+0x100/0x100 ? save_trace+0x88/0x5e0 ?
_raw_spin_unlock_irqrestore+0x2d/0x40 mark_lock+0x530/0x1470 ? mark_lock_irq+0x1d10/0x1d10 ? enqueue_timer+0x660/0x660 mark_usage+0x215/0x2a0 __lock_acquire+0x79b/0x18d0 ? tcp_schedule_loss_probe.part.0+0x38c/0x520 lock_acquire+0x1ca/0x480 ? nvme_tcp_state_change+0x21/0x150 [nvme_tcp] ? rcu_read_unlock+0x40/0x40 ? tcp_mtu_probe+0x1ae0/0x1ae0 ? kmalloc_reserve+0xa0/0xa0 ? sysfs_file_ops+0x170/0x170 _raw_read_lock+0x3d/0xa0 ? nvme_tcp_state_change+0x21/0x150 [nvme_tcp] nvme_tcp_state_change+0x21/0x150 [nvme_tcp] ? sysfs_file_ops ---truncated--- (CVE-2021-47041)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47041
https://ubuntu.com/security/CVE-2021-47041

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47041

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
253772 - Linux Distros Unpatched Vulnerability : CVE-2021-47079
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: platform/x86: ideapad-laptop: fix a NULL pointer dereference The third parameter of dytc_cql_command should not be NULL since it will be dereferenced immediately. (CVE-2021-47079)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47079
https://ubuntu.com/security/CVE-2021-47079

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47079

Plugin Information
Published: 2025/08/24, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224394 - Linux Distros Unpatched Vulnerability : CVE-2021-47092
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Always clear vmx->fail on emulation_required Revert a relatively recent change that set vmx->fail if the vCPU is in L2 and emulation_required is true, as that behavior is completely bogus. Setting vmx->fail and synthesizing a VM- Exit is contradictory and wrong: (a) it's impossible to have both a VM-Fail and VM-Exit (b) vmcs.EXIT_REASON is not modified on VM-Fail (c) emulation_required refers to guest state and guest state checks are always VM-Exits, not VM-Fails. For KVM specifically, emulation_required is handled before nested exits in __vmx_handle_exit(), thus setting vmx->fail has no immediate effect, i.e. KVM calls into handle_invalid_guest_state() and vmx->fail is ignored. Setting vmx->fail can ultimately result in a WARN in nested_vmx_vmexit() firing when tearing down the VM as KVM never expects vmx->fail to be set when L2 is active, KVM always reflects those errors into L1. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 21158 at arch/x86/kvm/vmx/nested.c:4548 nested_vmx_vmexit+0x16bd/0x17e0 arch/x86/kvm/vmx/nested.c:4547 Modules linked in: CPU: 0 PID: 21158 Comm: syz-executor.1 Not tainted 5.16.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:nested_vmx_vmexit+0x16bd/0x17e0 arch/x86/kvm/vmx/nested.c:4547 Code: <0f> 0b e9 2e f8 ff ff e8 57 b3 5d 00 0f 0b e9 00 f1 ff ff 89 e9 80 Call Trace: vmx_leave_nested arch/x86/kvm/vmx/nested.c:6220 [inline] nested_vmx_free_vcpu+0x83/0xc0 arch/x86/kvm/vmx/nested.c:330 vmx_free_vcpu+0x11f/0x2a0 arch/x86/kvm/vmx/vmx.c:6799 kvm_arch_vcpu_destroy+0x6b/0x240 arch/x86/kvm/x86.c:10989 kvm_vcpu_destroy+0x29/0x90 arch/x86/kvm/../../../virt/kvm/kvm_main.c:441 kvm_free_vcpus arch/x86/kvm/x86.c:11426 [inline] kvm_arch_destroy_vm+0x3ef/0x6b0 arch/x86/kvm/x86.c:11545 kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:1189 [inline] kvm_put_kvm+0x751/0xe40 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1220 kvm_vcpu_release+0x53/0x60 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3489 __fput+0x3fc/0x870 fs/file_table.c:280 task_work_run+0x146/0x1c0 kernel/task_work.c:164 exit_task_work include/linux/task_work.h:32 [inline] do_exit+0x705/0x24f0 kernel/exit.c:832 do_group_exit+0x168/0x2d0 kernel/exit.c:929 get_signal+0x1740/0x2120 kernel/signal.c:2852 arch_do_signal_or_restart+0x9c/0x730 arch/x86/kernel/signal.c:868 handle_signal_work kernel/entry/common.c:148 [inline] exit_to_user_mode_loop kernel/entry/common.c:172 [inline] exit_to_user_mode_prepare+0x191/0x220 kernel/entry/common.c:207
__syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline] syscall_exit_to_user_mode+0x2e/0x70 kernel/entry/common.c:300 do_syscall_64+0x53/0xd0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae (CVE-2021-47092)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47092
https://ubuntu.com/security/CVE-2021-47092

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2021-47092

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229813 - Linux Distros Unpatched Vulnerability : CVE-2021-47182
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: core: Fix scsi_mode_sense() buffer length handling Several problems exist with scsi_mode_sense() buffer length handling: 1) The allocation length field of the MODE SENSE(10) command is 16-bits, occupying bytes 7 and 8 of the CDB. With this command, access to mode pages larger than 255 bytes is thus possible.
However, the CDB allocation length field is set by assigning len to byte 8 only, thus truncating buffer length larger than 255. 2) If scsi_mode_sense() is called with len smaller than 8 with sdev->use_10_for_ms set, or smaller than 4 otherwise, the buffer length is increased to 8 and 4 respectively, and the buffer is zero filled with these increased values, thus corrupting the memory following the buffer. Fix these 2 problems by using put_unaligned_be16() to set the allocation length field of MODE SENSE(10) CDB and by returning an error when len is too small. Furthermore, if len is larger than 255B, always try MODE SENSE(10) first, even if the device driver did not set sdev->use_10_for_ms. In case of invalid opcode error for MODE SENSE(10), access to mode pages larger than 255 bytes are not retried using MODE SENSE(6).
To avoid buffer length overflows for the MODE_SENSE(10) case, check that len is smaller than 65535 bytes.
While at it, also fix the folowing: * Use get_unaligned_be16() to retrieve the mode data length and block descriptor length fields of the mode sense reply header instead of using an open coded calculation. * Fix the kdoc dbd argument explanation: the DBD bit stands for Disable Block Descriptor, which is the opposite of what the dbd argument description was. (CVE-2021-47182)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47182
https://security-tracker.debian.org/tracker/CVE-2021-47182
https://ubuntu.com/security/CVE-2021-47182

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47182

Plugin Information
Published: 2025/03/05, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245952 - Linux Distros Unpatched Vulnerability : CVE-2021-47190
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: perf bpf: Avoid memory leak from perf_env__insert_btf() perf_env__insert_btf() doesn't insert if a duplicate BTF id is encountered and this causes a memory leak. Modify the function to return a success/error value and then free the memory if insertion didn't happen. v2. Adds a return -1 when the insertion error occurs in perf_env__fetch_btf. This doesn't affect anything as the result is never checked. (CVE-2021-47190)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47190
https://ubuntu.com/security/CVE-2021-47190

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47190

Plugin Information
Published: 2025/08/08, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229778 - Linux Distros Unpatched Vulnerability : CVE-2021-47197
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() Prior to this patch in case mlx5_core_destroy_cq() failed it proceeds to rest of destroy operations. mlx5_core_destroy_cq() could be called again by user and cause additional call of mlx5_debug_cq_remove(). cq->dbg was not nullify in previous call and cause the crash. Fix it by nullify cq->dbg pointer after removal. Also proceed to destroy operations only if FW return 0 for MLX5_CMD_OP_DESTROY_CQ command. general protection fault, probably for non-canonical address 0x2000300004058: 0000 [#1] SMP PTI CPU: 5 PID: 1228 Comm: python Not tainted 5.15.0-rc5_for_upstream_min_debug_2021_10_14_11_06 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:lockref_get+0x1/0x60 Code: 5d e9 53 ff ff ff 48 8d 7f 70 e8 0a 2e 48 00 c7 85 d0 00 00 00 02 00 00 00 c6 45 70 00 fb 5d c3 c3 cc cc cc cc cc cc cc cc 53 <48> 8b 17 48 89 fb 85 d2 75 3d 48 89 d0 bf 64 00 00 00 48 89 c1 48 RSP: 0018:ffff888137dd7a38 EFLAGS: 00010206 RAX: 0000000000000000 RBX: ffff888107d5f458 RCX: 00000000fffffffe RDX: 000000000002c2b0 RSI: ffffffff8155e2e0 RDI: 0002000300004058 RBP: ffff888137dd7a88 R08: 0002000300004058 R09:
ffff8881144a9f88 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8881141d4000 R13: ffff888137dd7c68 R14: ffff888137dd7d58 R15: ffff888137dd7cc0 FS: 00007f4644f2a4c0(0000) GS:ffff8887a2d40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055b4500f4380 CR3:
0000000114f7a003 CR4: 0000000000170ea0 Call Trace: simple_recursive_removal+0x33/0x2e0 ? debugfs_remove+0x60/0x60 debugfs_remove+0x40/0x60 mlx5_debug_cq_remove+0x32/0x70 [mlx5_core] mlx5_core_destroy_cq+0x41/0x1d0 [mlx5_core] devx_obj_cleanup+0x151/0x330 [mlx5_ib] ? __pollwait+0xd0/0xd0 ? xas_load+0x5/0x70 ? xa_load+0x62/0xa0 destroy_hw_idr_uobject+0x20/0x80 [ib_uverbs] uverbs_destroy_uobject+0x3b/0x360 [ib_uverbs] uobj_destroy+0x54/0xa0 [ib_uverbs] ib_uverbs_cmd_verbs+0xaf2/0x1160 [ib_uverbs] ? uverbs_finalize_object+0xd0/0xd0 [ib_uverbs] ib_uverbs_ioctl+0xc4/0x1b0 [ib_uverbs] __x64_sys_ioctl+0x3e4/0x8e0 (CVE-2021-47197)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47197
https://ubuntu.com/security/CVE-2021-47197

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47197

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229751 - Linux Distros Unpatched Vulnerability : CVE-2021-47199
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mlx5e: CT, Fix multiple allocations and memleak of mod acts CT clear action offload adds additional mod hdr actions to the flow's original mod actions in order to clear the registers which hold ct_state.
When such flow also includes encap action, a neigh update event can cause the driver to unoffload the flow and then reoffload it. Each time this happens, the ct clear handling adds that same set of mod hdr actions to reset ct_state until the max of mod hdr actions is reached. Also the driver never releases the allocated mod hdr actions and causing a memleak. Fix above two issues by moving CT clear mod acts allocation into the parsing actions phase and only use it when offloading the rule. The release of mod acts will be done in the normal flow_put(). backtrace: [<000000007316e2f3>] krealloc+0x83/0xd0 [<00000000ef157de1>] mlx5e_mod_hdr_alloc+0x147/0x300 [mlx5_core] [<00000000970ce4ae>] mlx5e_tc_match_to_reg_set_and_get_id+0xd7/0x240 [mlx5_core] [<0000000067c5fa17>] mlx5e_tc_match_to_reg_set+0xa/0x20 [mlx5_core] [<00000000d032eb98>] mlx5_tc_ct_entry_set_registers.isra.0+0x36/0xc0 [mlx5_core] [<00000000fd23b869>] mlx5_tc_ct_flow_offload+0x272/0x1f10 [mlx5_core] [<000000004fc24acc>] mlx5e_tc_offload_fdb_rules.part.0+0x150/0x620 [mlx5_core] [<00000000dc741c17>] mlx5e_tc_encap_flows_add+0x489/0x690 [mlx5_core] [<00000000e92e49d7>] mlx5e_rep_update_flows+0x6e4/0x9b0 [mlx5_core] [<00000000f60f5602>] mlx5e_rep_neigh_update+0x39a/0x5d0 [mlx5_core] (CVE-2021-47199)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47199
https://security-tracker.debian.org/tracker/CVE-2021-47199
https://ubuntu.com/security/CVE-2021-47199

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47199

Plugin Information
Published: 2025/03/05, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229805 - Linux Distros Unpatched Vulnerability : CVE-2021-47202
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- thermal: Fix NULL pointer dereferences in of_thermal_ functions of_parse_thermal_zones() parses the thermal-zones node and registers a thermal_zone device for each subnode. However, if a thermal zone is consuming a thermal sensor and that thermal sensor device hasn't probed yet, an attempt to set trip_point_*_temp for that thermal zone device can cause a NULL pointer dereference. Fix it.
console:/sys/class/thermal/thermal_zone87 # echo 120000 > trip_point_0_temp ... Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 ... Call trace:
of_thermal_set_trip_temp+0x40/0xc4 trip_point_temp_store+0xc0/0x1dc dev_attr_store+0x38/0x88 sysfs_kf_write+0x64/0xc0 kernfs_fop_write_iter+0x108/0x1d0 vfs_write+0x2f4/0x368 ksys_write+0x7c/0xec
__arm64_sys_write+0x20/0x30 el0_svc_common.llvm.7279915941325364641+0xbc/0x1bc do_el0_svc+0x28/0xa0 el0_svc+0x14/0x24 el0_sync_handler+0x88/0xec el0_sync+0x1c0/0x200 While at it, fix the possible NULL pointer dereference in other functions as well: of_thermal_get_temp(), of_thermal_set_emul_temp(), of_thermal_get_trend(). (CVE-2021-47202)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47202
https://ubuntu.com/security/CVE-2021-47202

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47202

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229860 - Linux Distros Unpatched Vulnerability : CVE-2021-47210
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: typec: tipd: Remove WARN_ON in tps6598x_block_read Calling tps6598x_block_read with a higher than allowed len can be handled by just returning an error. There's no need to crash systems with panic-on-warn enabled. (CVE-2021-47210)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47210
https://ubuntu.com/security/CVE-2021-47210

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0008
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47210

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229815 - Linux Distros Unpatched Vulnerability : CVE-2021-47214
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: hugetlb, userfaultfd: fix reservation restore on userfaultfd error Currently in the is_continue case in hugetlb_mcopy_atomic_pte(), if we bail out using goto out_release_unlock; in the cases where idx >= size, or !huge_pte_none(), the code will detect that new_pagecache_page == false, and so call restore_reserve_on_error(). In this case I see restore_reserve_on_error() delete the reservation, and the following call to remove_inode_hugepages() will increment h->resv_hugepages causing a 100% reproducible leak. We should treat the is_continue case similar to adding a page into the pagecache and set new_pagecache_page to true, to indicate that there is no reservation to restore on the error path, and we need not call restore_reserve_on_error(). Rename new_pagecache_page to page_in_pagecache to make that clear. (CVE-2021-47214)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47214
https://ubuntu.com/security/CVE-2021-47214

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47214

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229783 - Linux Distros Unpatched Vulnerability : CVE-2021-47215
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: kTLS, Fix crash in RX resync flow For the TLS RX resync flow, we maintain a list of TLS contexts that require some attention, to communicate their resync information to the HW. Here we fix list corruptions, by protecting the entries against movements coming from resync_handle_seq_match(), until their resync handling in napi is fully completed. (CVE-2021-47215)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47215
https://ubuntu.com/security/CVE-2021-47215

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47215

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224366 - Linux Distros Unpatched Vulnerability : CVE-2021-47217
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails Check for a valid hv_vp_index array prior to derefencing hv_vp_index when setting Hyper-V's TSC change callback. If Hyper-V setup failed in hyperv_init(), the kernel will still report that it's running under Hyper-V, but will have silently disabled nearly all functionality. BUG: kernel NULL pointer dereference, address: 0000000000000010 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP CPU: 4 PID: 1 Comm: swapper/0 Not tainted 5.15.0-rc2+ #75 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:set_hv_tscchange_cb+0x15/0xa0 Code: <8b> 04 82 8b 15 12 17 85 01 48 c1 e0 20 48 0d ee 00 01 00 f6 c6 08 ... Call Trace: kvm_arch_init+0x17c/0x280 kvm_init+0x31/0x330 vmx_init+0xba/0x13a do_one_initcall+0x41/0x1c0 kernel_init_freeable+0x1f2/0x23b kernel_init+0x16/0x120 ret_from_fork+0x22/0x30 (CVE-2021-47217)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47217
https://ubuntu.com/security/CVE-2021-47217

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47217

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230194 - Linux Distros Unpatched Vulnerability : CVE-2021-47223
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix vlan tunnel dst null pointer dereference This patch fixes a tunnel_dst null pointer dereference due to lockless access in the tunnel egress path. When deleting a vlan tunnel the tunnel_dst pointer is set to NULL without waiting a grace period (i.e. while it's still usable) and packets egressing are dereferencing it without checking.
Use READ/WRITE_ONCE to annotate the lockless use of tunnel_id, use RCU for accessing tunnel_dst and make sure it is read only once and checked in the egress path. The dst is already properly RCU protected so we don't need to do anything fancy than to make sure tunnel_id and tunnel_dst are read only once and checked in the egress path. (CVE-2021-47223)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47223
https://ubuntu.com/security/CVE-2021-47223

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47223

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229818 - Linux Distros Unpatched Vulnerability : CVE-2021-47227
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Prevent state corruption in
__fpu__restore_sig() The non-compacted slowpath uses __copy_from_user() and copies the entire user buffer into the kernel buffer, verbatim. This means that the kernel buffer may now contain entirely invalid state on which XRSTOR will #GP. validate_user_xstate_header() can detect some of that corruption, but that leaves the onus on callers to clear the buffer. Prior to XSAVES support, it was possible just to reinitialize the buffer, completely, but with supervisor states that is not longer possible as the buffer clearing code split got it backwards. Fixing that is possible but not corrupting the state in the first place is more robust. Avoid corruption of the kernel XSAVE buffer by using copy_user_to_xstate() which validates the XSAVE header contents before copying the actual states to the kernel. copy_user_to_xstate() was previously only called for compacted-format kernel buffers, but it works for both compacted and non- compacted forms. Using it for the non-compacted form is slower because of multiple __copy_from_user() operations, but that cost is less important than robust code in an already slow path. [ Changelog polished by Dave Hansen ] (CVE-2021-47227)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47227
https://ubuntu.com/security/CVE-2021-47227

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47227

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230107 - Linux Distros Unpatched Vulnerability : CVE-2021-47230
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Immediately reset the MMU context when the SMM flag is cleared Immediately reset the MMU context when the vCPU's SMM flag is cleared so that the SMM flag in the MMU role is always synchronized with the vCPU's flag. If RSM fails (which isn't correctly emulated), KVM will bail without calling post_leave_smm() and leave the MMU in a bad state. The bad MMU role can lead to a NULL pointer dereference when grabbing a shadow page's rmap for a page fault as the initial lookups for the gfn will happen with the vCPU's SMM flag (=0), whereas the rmap lookup will use the shadow page's SMM flag, which comes from the MMU (=1). SMM has an entirely different set of memslots, and so the initial lookup can find a memslot (SMM=0) and then explode on the rmap memslot lookup (SMM=1). general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 PID: 8410 Comm: syz-executor382 Not tainted 5.13.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__gfn_to_rmap arch/x86/kvm/mmu/mmu.c:935 [inline] RIP: 0010:gfn_to_rmap+0x2b0/0x4d0 arch/x86/kvm/mmu/mmu.c:947 Code: <42> 80 3c 20 00 74 08 4c 89 ff e8 f1 79 a9 00 4c 89 fb 4d 8b 37 44 RSP: 0018:ffffc90000ffef98 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888015b9f414 RCX: ffff888019669c40 RDX: 0000000000000000 RSI: 0000000000000001 RDI:
0000000000000001 RBP: 0000000000000001 R08: ffffffff811d9cdb R09: ffffed10065a6002 R10: ffffed10065a6002 R11: 0000000000000000 R12: dffffc0000000000 R13: 0000000000000003 R14: 0000000000000001 R15:
0000000000000000 FS: 000000000124b300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS:
0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000028e31000 CR4: 00000000001526e0 DR0:
0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rmap_add arch/x86/kvm/mmu/mmu.c:965 [inline] mmu_set_spte+0x862/0xe60 arch/x86/kvm/mmu/mmu.c:2604 __direct_map arch/x86/kvm/mmu/mmu.c:2862 [inline] direct_page_fault+0x1f74/0x2b70 arch/x86/kvm/mmu/mmu.c:3769 kvm_mmu_do_page_fault arch/x86/kvm/mmu.h:124 [inline] kvm_mmu_page_fault+0x199/0x1440 arch/x86/kvm/mmu/mmu.c:5065 vmx_handle_exit+0x26/0x160 arch/x86/kvm/vmx/vmx.c:6122 vcpu_enter_guest+0x3bdd/0x9630 arch/x86/kvm/x86.c:9428 vcpu_run+0x416/0xc20 arch/x86/kvm/x86.c:9494 kvm_arch_vcpu_ioctl_run+0x4e8/0xa40 arch/x86/kvm/x86.c:9722 kvm_vcpu_ioctl+0x70f/0xbb0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3460 vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:1069 [inline] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:1055 do_syscall_64+0x3f/0xb0 arch/x86/entry/common.c:47 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x440ce9 (CVE-2021-47230)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47230
https://ubuntu.com/security/CVE-2021-47230

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.6 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
6.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0004
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47230

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224314 - Linux Distros Unpatched Vulnerability : CVE-2021-47237
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: hamradio: fix memory leak in mkiss_close My local syzbot instance hit memory leak in mkiss_open()[1].
The problem was in missing free_netdev() in mkiss_close(). In mkiss_open() netdevice is allocated and then registered, but in mkiss_close() netdevice was only unregistered, but not freed. Fail log: BUG: memory leak unreferenced object 0xffff8880281ba000 (size 4096): comm syz-executor.1, pid 11443, jiffies 4295046091 (age 17.660s) hex dump (first 32 bytes): 61 78 30 00 00 00 00 00 00 00 00 00 00 00 00 00 ax0............. 00 27 fa 2a 80 88 ff ff 00 00 00 00 00 00 00 00 .'.*............ backtrace:
[<ffffffff81a27201>] kvmalloc_node+0x61/0xf0 [<ffffffff8706e7e8>] alloc_netdev_mqs+0x98/0xe80 [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1] [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110 [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670 [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440 [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200 [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0 [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae BUG: memory leak unreferenced object 0xffff8880141a9a00 (size 96): comm syz-executor.1, pid 11443, jiffies 4295046091 (age 17.660s) hex dump (first 32 bytes): e8 a2 1b 28 80 88 ff ff e8 a2 1b 28 80 88 ff ff ...(.......(.... 98 92 9c aa b0 40 02 00 00 00 00 00 00 00 00 00 .....@.......... backtrace: [<ffffffff8709f68b>] __hw_addr_create_ex+0x5b/0x310 [<ffffffff8709fb38>] __hw_addr_add_ex+0x1f8/0x2b0 [<ffffffff870a0c7b>] dev_addr_init+0x10b/0x1f0 [<ffffffff8706e88b>] alloc_netdev_mqs+0x13b/0xe80 [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1] [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110 [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670 [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440 [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200 [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0 [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae BUG: memory leak unreferenced object 0xffff8880219bfc00 (size 512): comm syz-executor.1, pid 11443, jiffies 4295046091 (age 17.660s) hex dump (first 32 bytes): 00 a0 1b 28 80 88 ff ff 80 8f b1 8d ff ff ff ff ...(............ 80 8f b1 8d ff ff ff ff 00 00 00 00 00 00 00 00 ................ backtrace:
[<ffffffff81a27201>] kvmalloc_node+0x61/0xf0 [<ffffffff8706eec7>] alloc_netdev_mqs+0x777/0xe80 [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1] [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110 [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670 [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440 [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200 [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0 [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae BUG: memory leak unreferenced object 0xffff888029b2b200 (size 256): comm syz-executor.1, pid 11443, jiffies 4295046091 (age 17.660s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff81a27201>] kvmalloc_node+0x61/0xf0 [<ffffffff8706f062>] alloc_netdev_mqs+0x912/0xe80 [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1] [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110 [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670 [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440 [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200 [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0 [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae (CVE-2021-47237)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47237
https://ubuntu.com/security/CVE-2021-47237

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47237

Plugin Information
Published: 2025/03/05, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224317 - Linux Distros Unpatched Vulnerability : CVE-2021-47238
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix memory leak in ip_mc_add1_src BUG: memory leak unreferenced object 0xffff888101bc4c00 (size 32): comm syz-executor527, pid 360, jiffies 4294807421 (age 19.329s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01 00 00 00 00 00 00 00 ac 14 14 bb 00 00 02 00 ................ backtrace:
[<00000000f17c5244>] kmalloc include/linux/slab.h:558 [inline] [<00000000f17c5244>] kzalloc include/linux/slab.h:688 [inline] [<00000000f17c5244>] ip_mc_add1_src net/ipv4/igmp.c:1971 [inline] [<00000000f17c5244>] ip_mc_add_src+0x95f/0xdb0 net/ipv4/igmp.c:2095 [<000000001cb99709>] ip_mc_source+0x84c/0xea0 net/ipv4/igmp.c:2416 [<0000000052cf19ed>] do_ip_setsockopt net/ipv4/ip_sockglue.c:1294 [inline] [<0000000052cf19ed>] ip_setsockopt+0x114b/0x30c0 net/ipv4/ip_sockglue.c:1423 [<00000000477edfbc>] raw_setsockopt+0x13d/0x170 net/ipv4/raw.c:857 [<00000000e75ca9bb>] __sys_setsockopt+0x158/0x270 net/socket.c:2117 [<00000000bdb993a8>]
__do_sys_setsockopt net/socket.c:2128 [inline] [<00000000bdb993a8>] __se_sys_setsockopt net/socket.c:2125 [inline] [<00000000bdb993a8>] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2125 [<000000006a1ffdbd>] do_syscall_64+0x40/0x80 arch/x86/entry/common.c:47 [<00000000b11467c4>] entry_SYSCALL_64_after_hwframe+0x44/0xae In commit 24803f38a5c0 (igmp: do not remove igmp souce list info when set link down), the ip_mc_clear_src() in ip_mc_destroy_dev() was removed, because it was also called in igmpv3_clear_delrec(). Rough callgraph: inetdev_destroy -> ip_mc_destroy_dev -> igmpv3_clear_delrec ->
ip_mc_clear_src -> RCU_INIT_POINTER(dev->ip_ptr, NULL) However, ip_mc_clear_src() called in igmpv3_clear_delrec() doesn't release in_dev->mc_list->sources. And RCU_INIT_POINTER() assigns the NULL to dev->ip_ptr. As a result, in_dev cannot be obtained through inetdev_by_index() and then in_dev->mc_list->sources cannot be released by ip_mc_del1_src() in the sock_close. Rough call sequence goes like: sock_close -> __sock_release -> inet_release -> ip_mc_drop_socket -> inetdev_by_index ->
ip_mc_leave_src -> ip_mc_del_src -> ip_mc_del1_src So we still need to call ip_mc_clear_src() in ip_mc_destroy_dev() to free in_dev->mc_list->sources. (CVE-2021-47238)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47238
https://ubuntu.com/security/CVE-2021-47238

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47238

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230145 - Linux Distros Unpatched Vulnerability : CVE-2021-47250
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: ipv4: fix memory leak in netlbl_cipsov4_add_std Reported by syzkaller: BUG: memory leak unreferenced object 0xffff888105df7000 (size 64): comm syz-executor842, pid 360, jiffies 4294824824 (age 22.546s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000e67ed558>] kmalloc include/linux/slab.h:590 [inline] [<00000000e67ed558>] kzalloc include/linux/slab.h:720 [inline] [<00000000e67ed558>] netlbl_cipsov4_add_std net/netlabel/netlabel_cipso_v4.c:145 [inline] [<00000000e67ed558>] netlbl_cipsov4_add+0x390/0x2340 net/netlabel/netlabel_cipso_v4.c:416 [<0000000006040154>] genl_family_rcv_msg_doit.isra.0+0x20e/0x320 net/netlink/genetlink.c:739 [<00000000204d7a1c>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline] [<00000000204d7a1c>] genl_rcv_msg+0x2bf/0x4f0 net/netlink/genetlink.c:800 [<00000000c0d6a995>] netlink_rcv_skb+0x134/0x3d0 net/netlink/af_netlink.c:2504 [<00000000d78b9d2c>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:811 [<000000009733081b>] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] [<000000009733081b>] netlink_unicast+0x4a0/0x6a0 net/netlink/af_netlink.c:1340 [<00000000d5fd43b8>] netlink_sendmsg+0x789/0xc70 net/netlink/af_netlink.c:1929 [<000000000a2d1e40>] sock_sendmsg_nosec net/socket.c:654 [inline] [<000000000a2d1e40>] sock_sendmsg+0x139/0x170 net/socket.c:674 [<00000000321d1969>]
____sys_sendmsg+0x658/0x7d0 net/socket.c:2350 [<00000000964e16bc>] ___sys_sendmsg+0xf8/0x170 net/socket.c:2404 [<000000001615e288>] __sys_sendmsg+0xd3/0x190 net/socket.c:2433 [<000000004ee8b6a5>] do_syscall_64+0x37/0x90 arch/x86/entry/common.c:47 [<00000000171c7cee>] entry_SYSCALL_64_after_hwframe+0x44/0xae The memory of doi_def->map.std pointing is allocated in netlbl_cipsov4_add_std, but no place has freed it. It should be freed in cipso_v4_doi_free which frees the cipso DOI resource. (CVE-2021-47250)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47250
https://ubuntu.com/security/CVE-2021-47250

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47250

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229865 - Linux Distros Unpatched Vulnerability : CVE-2021-47266
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/ipoib: Fix warning caused by destroying non-initial netns After the commit 5ce2dced8e95 (RDMA/ipoib: Set rtnl_link_ops for ipoib interfaces), if the IPoIB device is moved to non-initial netns, destroying that netns lets the device vanish instead of moving it back to the initial netns, This is happening because default_device_exit() skips the interfaces due to having rtnl_link_ops set. Steps to reporoduce: ip netns add foo ip link set mlx5_ib0 netns foo ip netns delete foo WARNING: CPU: 1 PID: 704 at net/core/dev.c:11435 netdev_exit+0x3f/0x50 Modules linked in: xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_counter nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink tun d fuse CPU: 1 PID: 704 Comm: kworker/u64:3 Tainted: G S W 5.13.0-rc1+ #1 Hardware name: Dell Inc.
PowerEdge R630/02C2CP, BIOS 2.1.5 04/11/2016 Workqueue: netns cleanup_net RIP: 0010:netdev_exit+0x3f/0x50 Code: 48 8b bb 30 01 00 00 e8 ef 81 b1 ff 48 81 fb c0 3a 54 a1 74 13 48 8b 83 90 00 00 00 48 81 c3 90 00 00 00 48 39 d8 75 02 5b c3 <0f> 0b 5b c3 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 0f 1f 44 00 RSP:
0018:ffffb297079d7e08 EFLAGS: 00010206 RAX: ffff8eb542c00040 RBX: ffff8eb541333150 RCX: 000000008010000d RDX: 000000008010000e RSI: 000000008010000d RDI: ffff8eb440042c00 RBP: ffffb297079d7e48 R08:
0000000000000001 R09: ffffffff9fdeac00 R10: ffff8eb5003be000 R11: 0000000000000001 R12: ffffffffa1545620 R13: ffffffffa1545628 R14: 0000000000000000 R15: ffffffffa1543b20 FS: 0000000000000000(0000) GS:ffff8ed37fa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
00005601b5f4c2e8 CR3: 0000001fc8c10002 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace:
ops_exit_list.isra.9+0x36/0x70 cleanup_net+0x234/0x390 process_one_work+0x1cb/0x360 ? process_one_work+0x360/0x360 worker_thread+0x30/0x370 ? process_one_work+0x360/0x360 kthread+0x116/0x130 ? kthread_park+0x80/0x80 ret_from_fork+0x22/0x30 To avoid the above warning and later on the kernel panic that could happen on shutdown due to a NULL pointer dereference, make sure to set the netns_refund flag that was introduced by commit 3a5ca857079e (can: dev: Move device back to init netns on owning netns delete) to properly restore the IPoIB interfaces to the initial netns. (CVE-2021-47266)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47266
https://ubuntu.com/security/CVE-2021-47266

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47266

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229869 - Linux Distros Unpatched Vulnerability : CVE-2021-47272
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Bail from dwc3_gadget_exit() if dwc->gadget is NULL There exists a possible scenario in which dwc3_gadget_init() can fail: during during host -> peripheral mode switch in dwc3_set_mode(), and a pending gadget driver fails to bind. Then, if the DRD undergoes another mode switch from peripheral->host the resulting dwc3_gadget_exit() will attempt to reference an invalid and dangling dwc->gadget pointer as well as call dma_free_coherent() on unmapped DMA pointers. The exact scenario can be reproduced as follows: - Start DWC3 in peripheral mode - Configure ConfigFS gadget with FunctionFS instance (or use g_ffs) - Run FunctionFS userspace application (open EPs, write descriptors, etc) - Bind gadget driver to DWC3's UDC - Switch DWC3 to host mode => dwc3_gadget_exit() is called. usb_del_gadget() will put the ConfigFS driver instance on the gadget_driver_pending_list - Stop FunctionFS application (closes the ep files) - Switch DWC3 to peripheral mode => dwc3_gadget_init() fails as usb_add_gadget() calls check_pending_gadget_drivers() and attempts to rebind the UDC to the ConfigFS gadget but fails with -19 (-ENODEV) because the FFS instance is not in FFS_ACTIVE state (userspace has not re-opened and written the descriptors yet, i.e. desc_ready!=0). - Switch DWC3 back to host mode => dwc3_gadget_exit() is called again, but this time dwc->gadget is invalid. Although it can be argued that userspace should take responsibility for ensuring that the FunctionFS application be ready prior to allowing the composite driver bind to the UDC, failure to do so should not result in a panic from the kernel driver. Fix this by setting dwc->gadget to NULL in the failure path of dwc3_gadget_init() and add a check to dwc3_gadget_exit() to bail out unless the gadget pointer is valid. (CVE-2021-47272)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47272
https://ubuntu.com/security/CVE-2021-47272

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47272

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230174 - Linux Distros Unpatched Vulnerability : CVE-2021-47275
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bcache: avoid oversized read request in cache missing code path In the cache missing code path of cached device, if a proper location from the internal B+ tree is matched for a cache miss range, function cached_dev_cache_miss() will be called in cache_lookup_fn() in the following code block, [code block 1] 526 unsigned int sectors = KEY_INODE(k) == s->iop.inode 527 ? min_t(uint64_t, INT_MAX, 528 KEY_START(k) - bio->bi_iter.bi_sector) 529 : INT_MAX; 530 int ret = s->d->cache_miss(b, s, bio, sectors); Here s->d->cache_miss() is the call backfunction pointer initialized as cached_dev_cache_miss(), the last parameter 'sectors' is an important hint to calculate the size of read request to backing device of the missing cache data. Current calculation in above code block may generate oversized value of 'sectors', which consequently may trigger 2 different potential kernel panics by BUG() or BUG_ON() as listed below, 1) BUG_ON() inside bch_btree_insert_key(), [code block 2] 886 BUG_ON(b->ops->is_extents && !KEY_SIZE(k));
2) BUG() inside biovec_slab(), [code block 3] 51 default: 52 BUG(); 53 return NULL; All the above panics are original from cached_dev_cache_miss() by the oversized parameter 'sectors'. Inside cached_dev_cache_miss(), parameter 'sectors' is used to calculate the size of data read from backing device for the cache missing. This size is stored in s->insert_bio_sectors by the following lines of code, [code block 4] 909 s->insert_bio_sectors = min(sectors, bio_sectors(bio) + reada); Then the actual key inserting to the internal B+ tree is generated and stored in s->iop.replace_key by the following lines of code, [code block 5] 911 s->iop.replace_key = KEY(s->iop.inode, 912 bio->bi_iter.bi_sector + s->insert_bio_sectors, 913 s->insert_bio_sectors); The oversized parameter 'sectors' may trigger panic 1) by BUG_ON() from the above code block. And the bio sending to backing device for the missing data is allocated with hint from s->insert_bio_sectors by the following lines of code, [code block 6] 926 cache_bio = bio_alloc_bioset(GFP_NOWAIT, 927 DIV_ROUND_UP(s->insert_bio_sectors, PAGE_SECTORS), 928 &dc->disk.bio_split); The oversized parameter 'sectors' may trigger panic 2) by BUG() from the agove code block. Now let me explain how the panics happen with the oversized 'sectors'. In code block 5, replace_key is generated by macro KEY(). From the definition of macro KEY(), [code block 7] 71 #define KEY(inode, offset, size) \ 72 ((struct bkey) { \ 73 .high = (1ULL << 63) | ((__u64) (size) << 20) | (inode), \ 74 .low = (offset) \ 75 }) Here 'size' is 16bits width embedded in 64bits member 'high' of struct bkey. But in code block 1, if KEY_START(k) - bio->bi_iter.bi_sector is very probably to be larger than (1<<16) - 1, which makes the bkey size calculation in code block 5 is overflowed. In one bug report the value of parameter 'sectors' is 131072 (= 1 << 17), the overflowed 'sectors' results the overflowed s->insert_bio_sectors in code block 4, then makes size field of s->iop.replace_key to be 0 in code block 5. Then the 0- sized s->iop.replace_key is inserted into the internal B+ tree as cache missing check key (a special key to detect and avoid a racing between normal write request and cache missing read request) as, [code block 8] 915 ret = bch_btree_insert_check_key(b, &s->op, &s->iop.replace_key); Then the 0-sized s->iop.replace_key as 3rd parameter triggers the bkey size check BUG_ON() in code block 2, and causes the kernel panic 1). Another ke ---truncated--- (CVE-2021-47275)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47275
https://security-tracker.debian.org/tracker/CVE-2021-47275
https://ubuntu.com/security/CVE-2021-47275

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47275

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229840 - Linux Distros Unpatched Vulnerability : CVE-2021-47308
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: libfc: Fix array index out of bound exception Fix array index out of bound exception in fc_rport_prli_resp(). (CVE-2021-47308)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47308
https://ubuntu.com/security/CVE-2021-47308

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.5
EPSS Score
0.0046
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47308

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230099 - Linux Distros Unpatched Vulnerability : CVE-2021-47316
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: nfsd: fix NULL dereference in nfs3svc_encode_getaclres In error cases the dentry may be NULL. Before 20798dfe249a, the encoder also checked dentry and d_really_is_positive(dentry), but that looks like overkill to me--zero status should be enough to guarantee a positive dentry. This isn't the first time we've seen an error-case NULL dereference hidden in the initialization of a local variable in an xdr encoder. But I went back through the other recent rewrites and didn't spot any similar bugs. (CVE-2021-47316)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47316
https://ubuntu.com/security/CVE-2021-47316

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47316

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224439 - Linux Distros Unpatched Vulnerability : CVE-2021-47325
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- iommu/arm-smmu: Fix arm_smmu_device refcount leak in address translation The reference counting issue happens in several exception handling paths of arm_smmu_iova_to_phys_hard(). When those error scenarios occur, the function forgets to decrease the refcount of smmu increased by arm_smmu_rpm_get(), causing a refcount leak. Fix this issue by jumping to out label when those error scenarios occur. (CVE-2021-47325)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47325
https://ubuntu.com/security/CVE-2021-47325

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47325

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224461 - Linux Distros Unpatched Vulnerability : CVE-2021-47343
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dm btree remove: assign new_root only when removal succeeds remove_raw() in dm_btree_remove() may fail due to IO read error (e.g. read the content of origin block fails during shadowing), and the value of shadow_spine::root is uninitialized, but the uninitialized value is still assign to new_root in the end of dm_btree_remove(). For dm-thin, the value of pmd->details_root or pmd->root will become an uninitialized value, so if trying to read details_info tree again out-of-bound memory may occur as showed below: general protection fault, probably for non-canonical address 0x3fdcb14c8d7520 CPU: 4 PID: 515 Comm: dmsetup Not tainted 5.13.0-rc6 Hardware name: QEMU Standard PC RIP: 0010:metadata_ll_load_ie+0x14/0x30 Call Trace:
sm_metadata_count_is_more_than_one+0xb9/0xe0 dm_tm_shadow_block+0x52/0x1c0 shadow_step+0x59/0xf0 remove_raw+0xb2/0x170 dm_btree_remove+0xf4/0x1c0 dm_pool_delete_thin_device+0xc3/0x140 pool_message+0x218/0x2b0 target_message+0x251/0x290 ctl_ioctl+0x1c4/0x4d0 dm_ctl_ioctl+0xe/0x20
__x64_sys_ioctl+0x7b/0xb0 do_syscall_64+0x40/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixing it by only assign new_root when removal succeeds (CVE-2021-47343)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47343
https://ubuntu.com/security/CVE-2021-47343

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0015
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47343

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230143 - Linux Distros Unpatched Vulnerability : CVE-2021-47349
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mwifiex: bring down link before deleting interface We can deadlock when rmmod'ing the driver or going through firmware reset, because the cfg80211_unregister_wdev() has to bring down the link for us, ... which then grab the same wiphy lock.
nl80211_del_interface() already handles a very similar case, with a nice description: /* * We hold RTNL, so this is safe, without RTNL opencount cannot * reach 0, and thus the rdev cannot be deleted. * * We need to do it for the dev_close(), since that will call * the netdev notifiers, and we need to acquire the mutex there * but don't know if we get there from here or from some other * place (e.g. ip link set ...
down). */ mutex_unlock(&rdev->wiphy.mtx); ... Do similarly for mwifiex teardown, by ensuring we bring the link down first. Sample deadlock trace: [ 247.103516] INFO: task rmmod:2119 blocked for more than 123 seconds. [ 247.110630] Not tainted 5.12.4 #5 [ 247.115796] echo 0 >
/proc/sys/kernel/hung_task_timeout_secs disables this message. [ 247.124557] task:rmmod state:D stack: 0 pid: 2119 ppid: 2114 flags:0x00400208 [ 247.133905] Call trace: [ 247.136644] __switch_to+0x130/0x170 [ 247.140643] __schedule+0x714/0xa0c [ 247.144548] schedule_preempt_disabled+0x88/0xf4 [ 247.149714]
__mutex_lock_common+0x43c/0x750 [ 247.154496] mutex_lock_nested+0x5c/0x68 [ 247.158884] cfg80211_netdev_notifier_call+0x280/0x4e0 [cfg80211] [ 247.165769] raw_notifier_call_chain+0x4c/0x78 [ 247.170742] call_netdevice_notifiers_info+0x68/0xa4 [ 247.176305] __dev_close_many+0x7c/0x138 [ 247.180693] dev_close_many+0x7c/0x10c [ 247.184893] unregister_netdevice_many+0xfc/0x654 [ 247.190158] unregister_netdevice_queue+0xb4/0xe0 [ 247.195424] _cfg80211_unregister_wdev+0xa4/0x204 [cfg80211] [ 247.201816] cfg80211_unregister_wdev+0x20/0x2c [cfg80211] [ 247.208016] mwifiex_del_virtual_intf+0xc8/0x188 [mwifiex] [ 247.214174] mwifiex_uninit_sw+0x158/0x1b0 [mwifiex] [ 247.219747] mwifiex_remove_card+0x38/0xa0 [mwifiex] [ 247.225316] mwifiex_pcie_remove+0xd0/0xe0 [mwifiex_pcie] [ 247.231451] pci_device_remove+0x50/0xe0 [ 247.235849] device_release_driver_internal+0x110/0x1b0 [ 247.241701] driver_detach+0x5c/0x9c [ 247.245704] bus_remove_driver+0x84/0xb8 [ 247.250095] driver_unregister+0x3c/0x60 [ 247.254486] pci_unregister_driver+0x2c/0x90 [ 247.259267] cleanup_module+0x18/0xcdc [mwifiex_pcie] (CVE-2021-47349)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47349
https://ubuntu.com/security/CVE-2021-47349

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47349

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224301 - Linux Distros Unpatched Vulnerability : CVE-2021-47360
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: binder: make sure fd closes complete During BC_FREE_BUFFER processing, the BINDER_TYPE_FDA object cleanup may close 1 or more fds. The close operations are completed using the task work mechanism -- which means the thread needs to return to userspace or the file object may never be dereferenced -- which can lead to hung processes. Force the binder thread back to userspace if an fd is closed during BC_FREE_BUFFER handling. (CVE-2021-47360)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47360
https://ubuntu.com/security/CVE-2021-47360

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47360

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229837 - Linux Distros Unpatched Vulnerability : CVE-2021-47365
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: afs: Fix page leak There's a loop in afs_extend_writeback() that adds extra pages to a write we want to make to improve the efficiency of the writeback by making it larger. This loop stops, however, if we hit a page we can't write back from immediately, but it doesn't get rid of the page ref we speculatively acquired. This was caused by the removal of the cleanup loop when the code switched from using find_get_pages_contig() to xarray scanning as the latter only gets a single page at a time, not a batch. Fix this by putting the page on a ref on an early break from the loop. Unfortunately, we can't just add that page to the pagevec we're employing as we'll go through that and add those pages to the RPC call. This was found by the generic/074 test. It leaks ~4GiB of RAM each time it is run - which can be observed with top. (CVE-2021-47365)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47365
https://ubuntu.com/security/CVE-2021-47365

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47365

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230199 - Linux Distros Unpatched Vulnerability : CVE-2021-47380
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: HID: amd_sfh: Fix potential NULL pointer dereference devm_add_action_or_reset() can suddenly invoke amd_mp2_pci_remove() at registration that will cause NULL pointer dereference since corresponding data is not initialized yet. The patch moves initialization of data before devm_add_action_or_reset(). Found by Linux Driver Verification project (linuxtesting.org). [jkosina@suse.cz: rebase] (CVE-2021-47380)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47380
https://ubuntu.com/security/CVE-2021-47380

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47380

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224393 - Linux Distros Unpatched Vulnerability : CVE-2021-47420
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix a potential ttm->sg memory leak Memory is allocated for ttm->sg by kmalloc in kfd_mem_dmamap_userptr, but isn't freed by kfree in kfd_mem_dmaunmap_userptr. Free it! (CVE-2021-47420)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47420
https://ubuntu.com/security/CVE-2021-47420

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47420

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229834 - Linux Distros Unpatched Vulnerability : CVE-2021-47422
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/kms/nv50-: fix file release memory leak When using single_open() for opening, single_release() should be called, otherwise the 'op' allocated in single_open() will be leaked. (CVE-2021-47422)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47422
https://ubuntu.com/security/CVE-2021-47422

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47422

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243746 - Linux Distros Unpatched Vulnerability : CVE-2021-47426
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf, s390: Fix potential memory leak about jit_data Make sure to free jit_data through kfree() in the error path. (CVE-2021-47426)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47426
https://ubuntu.com/security/CVE-2021-47426

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47426

Plugin Information
Published: 2025/08/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245856 - Linux Distros Unpatched Vulnerability : CVE-2021-47430
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: x86/entry: Clear X86_FEATURE_SMAP when CONFIG_X86_SMAP=n Commit 3c73b81a9164 (x86/entry, selftests: Further improve user entry sanity checks) added a warning if AC is set when in the kernel. Commit 662a0221893a3d (x86/entry: Fix AC assertion) changed the warning to only fire if the CPU supports SMAP. However, the warning can still trigger on a machine that supports SMAP but where it's disabled in the kernel config and when running the syscall_nt selftest, for example: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 49 at irqentry_enter_from_user_mode CPU: 0 PID: 49 Comm: init Tainted: G T 5.15.0-rc4+ #98 e6202628ee053b4f310759978284bd8bb0ce6905 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 RIP: 0010:irqentry_enter_from_user_mode ... Call Trace: ? irqentry_enter ? exc_general_protection ? asm_exc_general_protection ? asm_exc_general_protectio IS_ENABLED(CONFIG_X86_SMAP) could be added to the warning condition, but even this would not be enough in case SMAP is disabled at boot time with the nosmap parameter. To be consistent with nosmap behaviour, clear X86_FEATURE_SMAP when !CONFIG_X86_SMAP. Found using entry-fuzz + satrandconfig. [ bp: Massage commit message. ] (CVE-2021-47430)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47430
https://ubuntu.com/security/CVE-2021-47430

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
2.2
EPSS Score
0.0006
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47430

Plugin Information
Published: 2025/08/08, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230192 - Linux Distros Unpatched Vulnerability : CVE-2021-47438
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path Prior to this patch in case mlx5_core_destroy_cq() failed it returns without completing all destroy operations and that leads to memory leak. Instead, complete the destroy flow before return error. Also move mlx5_debug_cq_remove() to the beginning of mlx5_core_destroy_cq() to be symmetrical with mlx5_core_create_cq(). kmemleak complains on: unreferenced object 0xc000000038625100 (size 64): comm ethtool, pid 28301, jiffies 4298062946 (age 785.380s) hex dump (first 32 bytes): 60 01 48 94 00 00 00 c0 b8 05 34 c3 00 00 00 c0 `.H.......4..... 02 00 00 00 00 00 00 00 00 db 7d c1 00 00 00 c0 ..........}..... backtrace: [<000000009e8643cb>] add_res_tree+0xd0/0x270 [mlx5_core] [<00000000e7cb8e6c>] mlx5_debug_cq_add+0x5c/0xc0 [mlx5_core] [<000000002a12918f>] mlx5_core_create_cq+0x1d0/0x2d0 [mlx5_core] [<00000000cef0a696>] mlx5e_create_cq+0x210/0x3f0 [mlx5_core] [<000000009c642c26>] mlx5e_open_cq+0xb4/0x130 [mlx5_core] [<0000000058dfa578>] mlx5e_ptp_open+0x7f4/0xe10 [mlx5_core] [<0000000081839561>] mlx5e_open_channels+0x9cc/0x13e0 [mlx5_core] [<0000000009cf05d4>] mlx5e_switch_priv_channels+0xa4/0x230 [mlx5_core] [<0000000042bbedd8>] mlx5e_safe_switch_params+0x14c/0x300 [mlx5_core] [<0000000004bc9db8>] set_pflag_tx_port_ts+0x9c/0x160 [mlx5_core] [<00000000a0553443>] mlx5e_set_priv_flags+0xd0/0x1b0 [mlx5_core] [<00000000a8f3d84b>] ethnl_set_privflags+0x234/0x2d0 [<00000000fd27f27c>] genl_family_rcv_msg_doit+0x108/0x1d0 [<00000000f495e2bb>] genl_family_rcv_msg+0xe4/0x1f0 [<00000000646c5c2c>] genl_rcv_msg+0x78/0x120 [<00000000d53e384e>] netlink_rcv_skb+0x74/0x1a0 (CVE-2021-47438)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47438
https://ubuntu.com/security/CVE-2021-47438

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47438

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229838 - Linux Distros Unpatched Vulnerability : CVE-2021-47465
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest() In commit 10d91611f426 (powerpc/64s: Reimplement book3s idle code in C) kvm_start_guest() became idle_kvm_start_guest(). The old code allocated a stack frame on the emergency stack, but didn't use the frame to store anything, and also didn't store anything in its caller's frame.
idle_kvm_start_guest() on the other hand is written more like a normal C function, it creates a frame on entry, and also stores CR/LR into its callers frame (per the ABI). The problem is that there is no caller frame on the emergency stack. The emergency stack for a given CPU is allocated with:
paca_ptrs[i]->emergency_sp = alloc_stack(limit, i) + THREAD_SIZE; So emergency_sp actually points to the first address above the emergency stack allocation for a given CPU, we must not store above it without first decrementing it to create a frame. This is different to the regular kernel stack, paca->kstack, which is initialised to point at an initial frame that is ready to use. idle_kvm_start_guest() stores the backchain, CR and LR all of which write outside the allocation for the emergency stack. It then creates a stack frame and saves the non-volatile registers. Unfortunately the frame it creates is not large enough to fit the non-volatiles, and so the saving of the non-volatile registers also writes outside the emergency stack allocation. The end result is that we corrupt whatever is at 0-24 bytes, and 112-248 bytes above the emergency stack allocation. In practice this has gone unnoticed because the memory immediately above the emergency stack happens to be used for other stack allocations, either another CPUs mc_emergency_sp or an IRQ stack. See the order of calls to irqstack_early_init() and emergency_stack_init(). The low addresses of another stack are the top of that stack, and so are only used if that stack is under extreme pressue, which essentially never happens in practice - and if it did there's a high likelyhood we'd crash due to that stack overflowing. Still, we shouldn't be corrupting someone else's stack, and it is purely luck that we aren't corrupting something else. To fix it we save CR/LR into the caller's frame using the existing r1 on entry, we then create a SWITCH_FRAME_SIZE frame (which has space for pt_regs) on the emergency stack with the backchain pointing to the existing stack, and then finally we switch to the new frame on the emergency stack. (CVE-2021-47465)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47465
https://ubuntu.com/security/CVE-2021-47465

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47465

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224475 - Linux Distros Unpatched Vulnerability : CVE-2021-47481
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Initialize the ODP xarray when creating an ODP MR Normally the zero fill would hide the missing initialization, but an errant set to desc_size in reg_create() causes a crash: BUG: unable to handle page fault for address: 0000000800000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 5 PID: 890 Comm: ib_write_bw Not tainted 5.15.0-rc4+ #47 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5_ib_dereg_mr+0x14/0x3b0 [mlx5_ib] Code: 48 63 cd 4c 89 f7 48 89 0c 24 e8 37 30 03 e1 48 8b 0c 24 eb a0 90 0f 1f 44 00 00 41 56 41 55 41 54 55 53 48 89 fb 48 83 ec 30 <48> 8b 2f 65 48 8b 04 25 28 00 00 00 48 89 44 24 28 31 c0 8b 87 c8 RSP: 0018:ffff88811afa3a60 EFLAGS: 00010286 RAX: 000000000000001c RBX:
0000000800000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000800000000 RBP: 0000000800000000 R08: 0000000000000000 R09: c0000000fffff7ff R10: ffff88811afa38f8 R11:
ffff88811afa38f0 R12: ffffffffa02c7ac0 R13: 0000000000000000 R14: ffff88811afa3cd8 R15: ffff88810772fa00 FS: 00007f47b9080740(0000) GS:ffff88852cd40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000800000000 CR3: 000000010761e003 CR4: 0000000000370ea0 DR0:
0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mlx5_ib_free_odp_mr+0x95/0xc0 [mlx5_ib] mlx5_ib_dereg_mr+0x128/0x3b0 [mlx5_ib] ib_dereg_mr_user+0x45/0xb0 [ib_core] ? xas_load+0x8/0x80 destroy_hw_idr_uobject+0x1a/0x50 [ib_uverbs] uverbs_destroy_uobject+0x2f/0x150 [ib_uverbs] uobj_destroy+0x3c/0x70 [ib_uverbs] ib_uverbs_cmd_verbs+0x467/0xb00 [ib_uverbs] ? uverbs_finalize_object+0x60/0x60 [ib_uverbs] ? ttwu_queue_wakelist+0xa9/0xe0 ? pty_write+0x85/0x90 ? file_tty_write.isra.33+0x214/0x330 ? process_echoes+0x60/0x60 ib_uverbs_ioctl+0xa7/0x110 [ib_uverbs] __x64_sys_ioctl+0x10d/0x8e0 ? vfs_write+0x17f/0x260 do_syscall_64+0x3c/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Add the missing xarray initialization and remove the desc_size set. (CVE-2021-47481)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47481
https://ubuntu.com/security/CVE-2021-47481

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47481

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224361 - Linux Distros Unpatched Vulnerability : CVE-2021-47490
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/ttm: fix memleak in ttm_transfered_destroy We need to cleanup the fences for ghost objects as well.
Bug: https://bugzilla.kernel.org/show_bug.cgi?id=214029 Bug:
https://bugzilla.kernel.org/show_bug.cgi?id=214447 (CVE-2021-47490)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47490
https://ubuntu.com/security/CVE-2021-47490

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47490

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247431 - Linux Distros Unpatched Vulnerability : CVE-2021-47499
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove When ACPI type is ACPI_SMO8500, the data->dready_trig will not be set, the memory allocated by iio_triggered_buffer_setup() will not be freed, and cause memory leak as follows: unreferenced object 0xffff888009551400 (size 512): comm i2c-SMO8500-125, pid 911, jiffies 4294911787 (age 83.852s) hex dump (first 32 bytes): 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 20 e2 e5 c0 ff ff ff ff ........
....... backtrace: [<0000000041ce75ee>] kmem_cache_alloc_trace+0x16d/0x360 [<000000000aeb17b0>] iio_kfifo_allocate+0x41/0x130 [kfifo_buf] [<000000004b40c1f5>] iio_triggered_buffer_setup_ext+0x2c/0x210 [industrialio_triggered_buffer] [<000000004375b15f>] kxcjk1013_probe+0x10c3/0x1d81 [kxcjk_1013] Fix it by remove data->dready_trig condition in probe and remove. (CVE-2021-47499)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47499
https://ubuntu.com/security/CVE-2021-47499

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47499

Plugin Information
Published: 2025/08/10, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224382 - Linux Distros Unpatched Vulnerability : CVE-2021-47504
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- io_uring: ensure task_work gets run as part of cancelations If we successfully cancel a work item but that work item needs to be processed through task_work, then we can be sleeping uninterruptibly in io_uring_cancel_generic() and never process it. Hence we don't make forward progress and we end up with an uninterruptible sleep warning. While in there, correct a comment that should be IFF, not IIF.
(CVE-2021-47504)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47504
https://security-tracker.debian.org/tracker/CVE-2021-47504
https://ubuntu.com/security/CVE-2021-47504

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47504

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230114 - Linux Distros Unpatched Vulnerability : CVE-2021-47516
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: nfp: Fix memory leak in nfp_cpp_area_cache_add() In line 800 (#1), nfp_cpp_area_alloc() allocates and initializes a CPP area structure. But in line 807 (#2), when the cache is allocated failed, this CPP area structure is not freed, which will result in memory leak. We can fix it by freeing the CPP area when the cache is allocated failed (#2). 792 int nfp_cpp_area_cache_add(struct nfp_cpp *cpp, size_t size) 793 { 794 struct nfp_cpp_area_cache
*cache; 795 struct nfp_cpp_area *area; 800 area = nfp_cpp_area_alloc(cpp, NFP_CPP_ID(7, NFP_CPP_ACTION_RW, 0), 801 0, size); // #1: allocates and initializes 802 if (!area) 803 return -ENOMEM; 805 cache = kzalloc(sizeof(*cache), GFP_KERNEL); 806 if (!cache) 807 return -ENOMEM; // #2: missing free 817 return 0;
818 } (CVE-2021-47516)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47516
https://ubuntu.com/security/CVE-2021-47516

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47516

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224341 - Linux Distros Unpatched Vulnerability : CVE-2021-47527
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: serial: core: fix transmit-buffer reset and memleak Commit 761ed4a94582 (tty: serial_core: convert uart_close to use tty_port_close) converted serial core to use tty_port_close() but failed to notice that the transmit buffer still needs to be freed on final close. Not freeing the transmit buffer means that the buffer is no longer cleared on next open so that any ioctl() waiting for the buffer to drain might wait indefinitely (e.g. on termios changes) or that stale data can end up being transmitted in case tx is restarted. Furthermore, the buffer of any port that has been opened would leak on driver unbind. Note that the port lock is held when clearing the buffer pointer due to the ldisc race worked around by commit a5ba1d95e46e (uart: fix race between uart_put_char() and uart_shutdown()). Also note that the tty-port shutdown() callback is not called for console ports so it is not strictly necessary to free the buffer page after releasing the lock (cf. d72402145ace (tty/serial: do not free trasnmit buffer page under port lock)). (CVE-2021-47527)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47527
https://ubuntu.com/security/CVE-2021-47527

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0014
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47527

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224316 - Linux Distros Unpatched Vulnerability : CVE-2021-47537
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Fix a memleak bug in rvu_mbox_init() In rvu_mbox_init(), mbox_regions is not freed or passed out under the switch-default region, which could lead to a memory leak. Fix this bug by changing 'return err' to 'goto free_regions'.
This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs.
Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_OCTEONTX2_AF=y show no new warnings, and our static analyzer no longer warns about this code. (CVE-2021-47537)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47537
https://ubuntu.com/security/CVE-2021-47537

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47537

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224459 - Linux Distros Unpatched Vulnerability : CVE-2021-47538
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() Need to call rxrpc_put_local() for peer candidate before kfree() as it holds a ref to rxrpc_local. [DH: v2: Changed to abstract the peer freeing code out into a function] (CVE-2021-47538)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47538
https://ubuntu.com/security/CVE-2021-47538

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0007
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47538

Plugin Information
Published: 2025/03/05, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229786 - Linux Distros Unpatched Vulnerability : CVE-2021-47550
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/amd/amdgpu: fix potential memleak In function amdgpu_get_xgmi_hive, when kobject_init_and_add failed There is a potential memleak if not call kobject_put. (CVE-2021-47550)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47550
https://ubuntu.com/security/CVE-2021-47550

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47550

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224408 - Linux Distros Unpatched Vulnerability : CVE-2021-47558
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: stmmac: Disable Tx queues when reconfiguring the interface The Tx queues were not disabled in situations where the driver needed to stop the interface to apply a new configuration. This could result in a kernel panic when doing any of the 3 following actions: * reconfiguring the number of queues (ethtool
-L) * reconfiguring the size of the ring buffers (ethtool -G) * installing/removing an XDP program (ip l set dev ethX xdp) Prevent the panic by making sure netif_tx_disable is called when stopping an interface.
Without this patch, the following kernel panic can be observed when doing any of the actions above: Unable to handle kernel paging request at virtual address ffff80001238d040 [....] Call trace:
dwmac4_set_addr+0x8/0x10 dev_hard_start_xmit+0xe4/0x1ac sch_direct_xmit+0xe8/0x39c
__dev_queue_xmit+0x3ec/0xaf0 dev_queue_xmit+0x14/0x20 [...] [ end trace 0000000000000002 ]--- (CVE-2021-47558)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47558
https://security-tracker.debian.org/tracker/CVE-2021-47558
https://ubuntu.com/security/CVE-2021-47558

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47558

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230155 - Linux Distros Unpatched Vulnerability : CVE-2021-47559
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk() Coverity reports a possible NULL dereferencing problem: in smc_vlan_by_tcpsk(): 6. returned_null: netdev_lower_get_next returns NULL (checked 29 out of 30 times). 7. var_assigned: Assigning: ndev = NULL return value from netdev_lower_get_next. 1623 ndev = (struct net_device *)netdev_lower_get_next(ndev, &lower); CID 1468509 (#1 of 1): Dereference null return value (NULL_RETURNS) 8. dereference: Dereferencing a pointer that might be NULL ndev when calling is_vlan_dev. 1624 if (is_vlan_dev(ndev)) { Remove the manual implementation and use netdev_walk_all_lower_dev() to iterate over the lower devices. While on it remove an obsolete function parameter comment. (CVE-2021-47559)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47559
https://ubuntu.com/security/CVE-2021-47559

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47559

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229866 - Linux Distros Unpatched Vulnerability : CVE-2021-47578
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Don't call kcalloc() if size arg is zero If the size arg to kcalloc() is zero, it returns ZERO_SIZE_PTR. Because of that, for a following NULL pointer check to work on the returned pointer, kcalloc() must not be called with the size arg equal to zero. Return early without error before the kcalloc() call if size arg is zero. BUG: KASAN:
null-ptr-deref in memcpy include/linux/fortify-string.h:191 [inline] BUG: KASAN: null-ptr-deref in sg_copy_buffer+0x138/0x240 lib/scatterlist.c:974 Write of size 4 at addr 0000000000000010 by task syz- executor.1/22789 CPU: 1 PID: 22789 Comm: syz-executor.1 Not tainted 5.15.0-syzk #1 Hardware name: Red Hat KVM, BIOS 1.13.0-2 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106 __kasan_report mm/kasan/report.c:446 [inline] kasan_report.cold.14+0x112/0x117 mm/kasan/report.c:459 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x1a3/0x210 mm/kasan/generic.c:189 memcpy+0x3b/0x60 mm/kasan/shadow.c:66 memcpy include/linux/fortify-string.h:191 [inline] sg_copy_buffer+0x138/0x240 lib/scatterlist.c:974 do_dout_fetch drivers/scsi/scsi_debug.c:2954 [inline] do_dout_fetch drivers/scsi/scsi_debug.c:2946 [inline] resp_verify+0x49e/0x930 drivers/scsi/scsi_debug.c:4276 schedule_resp+0x4d8/0x1a70 drivers/scsi/scsi_debug.c:5478 scsi_debug_queuecommand+0x8c9/0x1ec0 drivers/scsi/scsi_debug.c:7533 scsi_dispatch_cmd drivers/scsi/scsi_lib.c:1520 [inline] scsi_queue_rq+0x16b0/0x2d40 drivers/scsi/scsi_lib.c:1699 blk_mq_dispatch_rq_list+0xb9b/0x2700 block/blk-mq.c:1639 __blk_mq_sched_dispatch_requests+0x28f/0x590 block/blk-mq-sched.c:325 blk_mq_sched_dispatch_requests+0x105/0x190 block/blk-mq-sched.c:358
__blk_mq_run_hw_queue+0xe5/0x150 block/blk-mq.c:1761 __blk_mq_delay_run_hw_queue+0x4f8/0x5c0 block/blk- mq.c:1838 blk_mq_run_hw_queue+0x18d/0x350 block/blk-mq.c:1891 blk_mq_sched_insert_request+0x3db/0x4e0 block/blk-mq-sched.c:474 blk_execute_rq_nowait+0x16b/0x1c0 block/blk-exec.c:62 blk_execute_rq+0xdb/0x360 block/blk-exec.c:102 sg_scsi_ioctl drivers/scsi/scsi_ioctl.c:621 [inline] scsi_ioctl+0x8bb/0x15c0 drivers/scsi/scsi_ioctl.c:930 sg_ioctl_common+0x172d/0x2710 drivers/scsi/sg.c:1112 sg_ioctl+0xa2/0x180 drivers/scsi/sg.c:1165 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline] __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae (CVE-2021-47578)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47578
https://ubuntu.com/security/CVE-2021-47578

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47578

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230117 - Linux Distros Unpatched Vulnerability : CVE-2021-47582
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- USB: core: Make do_proc_control() and do_proc_bulk() killable The USBDEVFS_CONTROL and USBDEVFS_BULK ioctls invoke usb_start_wait_urb(), which contains an uninterruptible wait with a user-specified timeout value. If timeout value is very large and the device being accessed does not respond in a reasonable amount of time, the kernel will complain about Task X blocked for more than N seconds, as found in testing by syzbot: INFO: task syz-executor.0:8700 blocked for more than 143 seconds. Not tainted 5.14.0-rc7-syzkaller #0 echo 0 > /proc/sys/kernel/hung_task_timeout_secs disables this message.
task:syz-executor.0 state:D stack:23192 pid: 8700 ppid: 8455 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:4681 [inline] __schedule+0xc07/0x11f0 kernel/sched/core.c:5938 schedule+0x14b/0x210 kernel/sched/core.c:6017 schedule_timeout+0x98/0x2f0 kernel/time/timer.c:1857 do_wait_for_common+0x2da/0x480 kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion_timeout+0x46/0x60 kernel/sched/completion.c:157 usb_start_wait_urb+0x167/0x550 drivers/usb/core/message.c:63 do_proc_bulk+0x978/0x1080 drivers/usb/core/devio.c:1236 proc_bulk drivers/usb/core/devio.c:1273 [inline] usbdev_do_ioctl drivers/usb/core/devio.c:2547 [inline] usbdev_ioctl+0x3441/0x6b10 drivers/usb/core/devio.c:2713 ... To fix this problem, this patch replaces usbfs's calls to usb_control_msg() and usb_bulk_msg() with special-purpose code that does essentially the same thing (as recommended in the comment for usb_start_wait_urb()), except that it always uses a killable wait and it uses GFP_KERNEL rather than GFP_NOIO. (CVE-2021-47582)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47582
https://security-tracker.debian.org/tracker/CVE-2021-47582
https://ubuntu.com/security/CVE-2021-47582

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47582

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224390 - Linux Distros Unpatched Vulnerability : CVE-2021-47601
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tee: amdtee: fix an IS_ERR() vs NULL bug The __get_free_pages() function does not return error pointers it returns NULL so fix this condition to avoid a NULL dereference. (CVE-2021-47601)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47601
https://ubuntu.com/security/CVE-2021-47601

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47601

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224418 - Linux Distros Unpatched Vulnerability : CVE-2021-47607
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf: Fix kernel address leakage in atomic cmpxchg's r0 aux reg The implementation of BPF_CMPXCHG on a high level has the following parameters: .-[old-val] .-[new-val] BPF_R0 = cmpxchg{32,64}(DST_REG + insn->off, BPF_R0, SRC_REG) `-[mem- loc] `-[old-val] Given a BPF insn can only have two registers (dst, src), the R0 is fixed and used as an auxilliary register for input (old value) as well as output (returning old value from memory location).
While the verifier performs a number of safety checks, it misses to reject unprivileged programs where R0 contains a pointer as old value. Through brute-forcing it takes about ~16sec on my machine to leak a kernel pointer with BPF_CMPXCHG. The PoC is basically probing for kernel addresses by storing the guessed address into the map slot as a scalar, and using the map value pointer as R0 while SRC_REG has a canary value to detect a matching address. Fix it by checking R0 for pointers, and reject if that's the case for unprivileged programs. (CVE-2021-47607)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47607
https://ubuntu.com/security/CVE-2021-47607

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47607

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230095 - Linux Distros Unpatched Vulnerability : CVE-2021-47617
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: PCI: pciehp: Fix infinite loop in IRQ handler upon power fault The Power Fault Detected bit in the Slot Status register differs from all other hotplug events in that it is sticky: It can only be cleared after turning off slot power. Per PCIe r5.0, sec. 6.7.1.8: If a power controller detects a main power fault on the hot-plug slot, it must automatically set its internal main power fault latch [...]. The main power fault latch is cleared when software turns off power to the hot-plug slot. The stickiness used to cause interrupt storms and infinite loops which were fixed in 2009 by commits 5651c48cfafe (PCI pciehp: fix power fault interrupt storm problem) and 99f0169c17f3 (PCI: pciehp: enable software notification on empty slots). Unfortunately in 2020 the infinite loop issue was inadvertently reintroduced by commit 8edf5332c393 (PCI: pciehp: Fix MSI interrupt race): The hardirq handler pciehp_isr() clears the PFD bit until pciehp's power_fault_detected flag is set. That happens in the IRQ thread pciehp_ist(), which never learns of the event because the hardirq handler is stuck in an infinite loop. Fix by setting the power_fault_detected flag already in the hardirq handler. (CVE-2021-47617)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47617
https://ubuntu.com/security/CVE-2021-47617

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47617

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224368 - Linux Distros Unpatched Vulnerability : CVE-2021-47620
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: refactor malicious adv data check Check for out-of-bound read was being performed at the end of while num_reports loop, and would fill journal with false positives. Added check to beginning of loop processing so that it doesn't get checked after ptr has been advanced. (CVE-2021-47620)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47620
https://ubuntu.com/security/CVE-2021-47620

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47620

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230167 - Linux Distros Unpatched Vulnerability : CVE-2021-47622
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: ufs: Fix a deadlock in the error handler The following deadlock has been observed on a test setup: - All tags allocated - The SCSI error handler calls ufshcd_eh_host_reset_handler() - ufshcd_eh_host_reset_handler() queues work that calls ufshcd_err_handler() - ufshcd_err_handler() locks up as follows: Workqueue: ufs_eh_wq_0 ufshcd_err_handler.cfi_jt Call trace: __switch_to+0x298/0x5d8
__schedule+0x6cc/0xa94 schedule+0x12c/0x298 blk_mq_get_tag+0x210/0x480 __blk_mq_alloc_request+0x1c8/0x284 blk_get_request+0x74/0x134 ufshcd_exec_dev_cmd+0x68/0x640 ufshcd_verify_dev_init+0x68/0x35c ufshcd_probe_hba+0x12c/0x1cb8 ufshcd_host_reset_and_restore+0x88/0x254 ufshcd_reset_and_restore+0xd0/0x354 ufshcd_err_handler+0x408/0xc58 process_one_work+0x24c/0x66c worker_thread+0x3e8/0xa4c kthread+0x150/0x1b4 ret_from_fork+0x10/0x30 Fix this lockup by making ufshcd_exec_dev_cmd() allocate a reserved request.
(CVE-2021-47622)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47622
https://security-tracker.debian.org/tracker/CVE-2021-47622
https://ubuntu.com/security/CVE-2021-47622

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47622

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230164 - Linux Distros Unpatched Vulnerability : CVE-2021-47623
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- powerpc/fixmap: Fix VM debug warning on unmap Unmapping a fixmap entry is done by calling __set_fixmap() with FIXMAP_PAGE_CLEAR as flags. Today, powerpc __set_fixmap() calls map_kernel_page(). map_kernel_page() is not happy when called a second time for the same page. WARNING: CPU: 0 PID: 1 at arch/powerpc/mm/pgtable.c:194 set_pte_at+0xc/0x1e8 CPU: 0 PID: 1 Comm: swapper Not tainted 5.16.0-rc3-s3k-dev-01993-g350ff07feb7d-dirty #682 NIP: c0017cd4 LR: c00187f0 CTR: 00000010 REGS: e1011d50 TRAP: 0700 Not tainted (5.16.0-rc3-s3k-dev-01993-g350ff07feb7d-dirty) MSR: 00029032 <EE,ME,IR,DR,RI> CR:
42000208 XER: 00000000 GPR00: c0165fec e1011e10 c14c0000 c0ee2550 ff800000 c0f3d000 00000000 c001686c GPR08: 00001000 b00045a9 00000001 c0f58460 c0f50000 00000000 c0007e10 00000000 GPR16: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 GPR24: 00000000 00000000 c0ee2550 00000000 c0f57000 00000ff8 00000000 ff800000 NIP [c0017cd4] set_pte_at+0xc/0x1e8 LR [c00187f0] map_kernel_page+0x9c/0x100 Call Trace: [e1011e10] [c0736c68] vsnprintf+0x358/0x6c8 (unreliable) [e1011e30] [c0165fec]
__set_fixmap+0x30/0x44 [e1011e40] [c0c13bdc] early_iounmap+0x11c/0x170 [e1011e70] [c0c06cb0] ioremap_legacy_serial_console+0x88/0xc0 [e1011e90] [c0c03634] do_one_initcall+0x80/0x178 [e1011ef0] [c0c0385c] kernel_init_freeable+0xb4/0x250 [e1011f20] [c0007e34] kernel_init+0x24/0x140 [e1011f30] [c0016268] ret_from_kernel_thread+0x5c/0x64 Instruction dump: 7fe3fb78 48019689 80010014 7c630034 83e1000c 5463d97e 7c0803a6 38210010 4e800020 81250000 712a0001 41820008 <0fe00000> 9421ffe0 93e1001c 48000030 Implement unmap_kernel_page() which clears an existing pte. (CVE-2021-47623)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47623
https://ubuntu.com/security/CVE-2021-47623

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47623

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230092 - Linux Distros Unpatched Vulnerability : CVE-2021-47632
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- powerpc/set_memory: Avoid spinlock recursion in change_page_attr() Commit 1f9ad21c3b38 (powerpc/mm:
Implement set_memory() routines) included a spin_lock() to change_page_attr() in order to safely perform the three step operations. But then commit 9f7853d7609d (powerpc/mm: Fix set_memory_*() against concurrent accesses) modify it to use pte_update() and do the operation safely against concurrent access.
In the meantime, Maxime reported some spinlock recursion. [ 15.351649] BUG: spinlock recursion on CPU#0, kworker/0:2/217 [ 15.357540] lock: init_mm+0x3c/0x420, .magic: dead4ead, .owner: kworker/0:2/217, .owner_cpu: 0 [ 15.366563] CPU: 0 PID: 217 Comm: kworker/0:2 Not tainted 5.15.0+ #523 [ 15.373350] Workqueue: events do_free_init [ 15.377615] Call Trace: [ 15.380232] [e4105ac0] [800946a4] do_raw_spin_lock+0xf8/0x120 (unreliable) [ 15.387340] [e4105ae0] [8001f4ec] change_page_attr+0x40/0x1d4 [ 15.393413] [e4105b10] [801424e0] __apply_to_page_range+0x164/0x310 [ 15.400009] [e4105b60] [80169620] free_pcp_prepare+0x1e4/0x4a0 [ 15.406045] [e4105ba0] [8016c5a0] free_unref_page+0x40/0x2b8 [ 15.411979] [e4105be0] [8018724c] kasan_depopulate_vmalloc_pte+0x6c/0x94 [ 15.418989] [e4105c00] [801424e0]
__apply_to_page_range+0x164/0x310 [ 15.425451] [e4105c50] [80187834] kasan_release_vmalloc+0xbc/0x134 [ 15.431898] [e4105c70] [8015f7a8] __purge_vmap_area_lazy+0x4e4/0xdd8 [ 15.438560] [e4105d30] [80160d10]
_vm_unmap_aliases.part.0+0x17c/0x24c [ 15.445283] [e4105d60] [801642d0] __vunmap+0x2f0/0x5c8 [ 15.450684] [e4105db0] [800e32d0] do_free_init+0x68/0x94 [ 15.456181] [e4105dd0] [8005d094] process_one_work+0x4bc/0x7b8 [ 15.462283] [e4105e90] [8005d614] worker_thread+0x284/0x6e8 [ 15.468227] [e4105f00] [8006aaec] kthread+0x1f0/0x210 [ 15.473489] [e4105f40] [80017148] ret_from_kernel_thread+0x14/0x1c Remove the read / modify / write sequence to make the operation atomic and remove the spin_lock() in change_page_attr(). To do the operation atomically, we can't use pte modification helpers anymore. Because all platforms have different combination of bits, it is not easy to use those bits directly. But all have the _PAGE_KERNEL_{RO/ROX/RW/RWX} set of flags. All we need it to compare two sets to know which bits are set or cleared. For instance, by comparing _PAGE_KERNEL_ROX and
_PAGE_KERNEL_RO you know which bit gets cleared and which bit get set when changing exec permission.
(CVE-2021-47632)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47632
https://ubuntu.com/security/CVE-2021-47632

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
References

CVE | CVE-2021-47632

Plugin Information
Published: 2025/03/05, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229766 - Linux Distros Unpatched Vulnerability : CVE-2021-47648
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- gpu: host1x: Fix a memory leak in 'host1x_remove()' Add a missing 'host1x_channel_list_free()' call in the remove function, as already done in the error handling path of the probe function. (CVE-2021-47648)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47648
https://ubuntu.com/security/CVE-2021-47648

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47648

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224303 - Linux Distros Unpatched Vulnerability : CVE-2021-47650
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-compress: prevent the potentially use of null pointer There is one call trace that snd_soc_register_card()
->snd_soc_bind_card()->soc_init_pcm_runtime() ->snd_soc_dai_compress_new()->snd_soc_new_compress(). In the trace the 'codec_dai' transfers from card->dai_link, and we can see from the snd_soc_add_pcm_runtime() in snd_soc_bind_card() that, if value of card->dai_link->num_codecs is 0, then 'codec_dai' could be null pointer caused by index out of bound in 'asoc_rtd_to_codec(rtd, 0)'. And snd_soc_register_card() is called by various platforms. Therefore, it is better to add the check in the case of misusing. And because 'cpu_dai' has already checked in soc_init_pcm_runtime(), there is no need to check again. Adding the check as follow, then if 'codec_dai' is null, snd_soc_new_compress() will not pass through the check 'if (playback + capture != 1)', avoiding the leftover use of 'codec_dai'. (CVE-2021-47650)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47650
https://ubuntu.com/security/CVE-2021-47650

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47650

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230159 - Linux Distros Unpatched Vulnerability : CVE-2021-47659
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/plane: Move range check for format_count earlier While the check for format_count > 64 in
__drm_universal_plane_init() shouldn't be hit (it's a WARN_ON), in its current position it will then leak the plane->format_types array and fail to call drm_mode_object_unregister() leaking the modeset identifier. Move it to the start of the function to avoid allocating those resources in the first place.
(CVE-2021-47659)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47659
https://ubuntu.com/security/CVE-2021-47659

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-47659

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224426 - Linux Distros Unpatched Vulnerability : CVE-2022-0171
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD CPU that supports Secure Encrypted Virtualization (SEV). (CVE-2022-0171)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-0171
https://ubuntu.com/security/CVE-2022-0171

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-0171

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229858 - Linux Distros Unpatched Vulnerability : CVE-2022-0213
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vim is vulnerable to Heap-based Buffer Overflow (CVE-2022-0213)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-0213
https://security-tracker.debian.org/tracker/CVE-2022-0213

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.6 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
5.5
EPSS Score
0.0017
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-0213

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
230040 - Linux Distros Unpatched Vulnerability : CVE-2022-0235
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor (CVE-2022-0235)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-0235

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
5.5 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
3.8
EPSS Score
0.0053
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-0235

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- polkit
- polkit-libs
260225 - Linux Distros Unpatched Vulnerability : CVE-2022-0529
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution. (CVE-2022-0529)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-0529

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0071
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2022-0529

Plugin Information
Published: 2025/09/01, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- unzip
260226 - Linux Distros Unpatched Vulnerability : CVE-2022-0530
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution. (CVE-2022-0530)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-0530

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0034
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-0530

Plugin Information
Published: 2025/09/01, Modified: 2025/09/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- unzip
230081 - Linux Distros Unpatched Vulnerability : CVE-2022-1056
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 46dc8fcd.
(CVE-2022-1056)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-1056
https://security-tracker.debian.org/tracker/CVE-2022-1056

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-1056

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libtiff
- libtiff-devel
230014 - Linux Distros Unpatched Vulnerability : CVE-2022-1674
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in GitHub repository vim/vim prior to 8.2.4938. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 allows attackers to cause a denial of service (application crash) via a crafted input. (CVE-2022-1674)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-1674
https://security-tracker.debian.org/tracker/CVE-2022-1674

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0012
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-1674

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
229980 - Linux Distros Unpatched Vulnerability : CVE-2022-1705
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid. (CVE-2022-1705)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-1705
https://security-tracker.debian.org/tracker/CVE-2022-1705

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
3.3
EPSS Score
0.0004
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-1705

Plugin Information
Published: 2025/03/05, Modified: 2025/08/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- containernetworking-plugins
- podman
229659 - Linux Distros Unpatched Vulnerability : CVE-2022-1725
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4959. (CVE-2022-1725)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-1725
https://security-tracker.debian.org/tracker/CVE-2022-1725

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-1725

Plugin Information
Published: 2025/03/05, Modified: 2025/09/06
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
229731 - Linux Distros Unpatched Vulnerability : CVE-2022-1962
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations. (CVE-2022-1962)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-1962
https://security-tracker.debian.org/tracker/CVE-2022-1962

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-1962

Plugin Information
Published: 2025/03/05, Modified: 2025/08/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- podman
230083 - Linux Distros Unpatched Vulnerability : CVE-2022-1974
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A use-after-free flaw was found in the Linux kernel's NFC core functionality due to a race condition between kobject creation and delete. This vulnerability allows a local attacker with CAP_NET_ADMIN privilege to leak kernel information. (CVE-2022-1974)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-1974
https://ubuntu.com/security/CVE-2022-1974

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.1 (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
3.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-1974

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230033 - Linux Distros Unpatched Vulnerability : CVE-2022-20153
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In rcu_cblist_dequeue of rcu_segcblist.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
A-222091980References: Upstream kernel (CVE-2022-20153)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-20153
https://ubuntu.com/security/CVE-2022-20153

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
6.7 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-20153

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229700 - Linux Distros Unpatched Vulnerability : CVE-2022-20154
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream kernel (CVE-2022-20154)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-20154
https://ubuntu.com/security/CVE-2022-20154

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.4 (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0002
CVSS v2.0 Base Score
4.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-20154

Plugin Information
Published: 2025/03/05, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230050 - Linux Distros Unpatched Vulnerability : CVE-2022-2097
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of in place encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p). (CVE-2022-2097)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2097
https://ubuntu.com/security/CVE-2022-2097

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
4.6 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
2.2
EPSS Score
0.0053
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-2097

Plugin Information
Published: 2025/03/05, Modified: 2025/09/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- compat-openssl11
229737 - Linux Distros Unpatched Vulnerability : CVE-2022-21123
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. (CVE-2022-21123)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-21123
https://ubuntu.com/security/CVE-2022-21123

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-21123

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- microcode_ctl
230045 - Linux Distros Unpatched Vulnerability : CVE-2022-21125
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. (CVE-2022-21125)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-21125
https://ubuntu.com/security/CVE-2022-21125

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0012
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-21125

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- microcode_ctl
230076 - Linux Distros Unpatched Vulnerability : CVE-2022-21127
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. (CVE-2022-21127)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-21127
https://ubuntu.com/security/CVE-2022-21127

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0024
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-21127

Plugin Information
Published: 2025/03/05, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- microcode_ctl
229617 - Linux Distros Unpatched Vulnerability : CVE-2022-21131
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Improper access control for some Intel(R) Xeon(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. (CVE-2022-21131)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-21131

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-21131

Plugin Information
Published: 2025/03/05, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- microcode_ctl
230003 - Linux Distros Unpatched Vulnerability : CVE-2022-21233
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Improper isolation of shared resources in some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access. (CVE-2022-21233)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-21233
https://ubuntu.com/security/CVE-2022-21233

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-21233

Plugin Information
Published: 2025/03/05, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- microcode_ctl
230051 - Linux Distros Unpatched Vulnerability : CVE-2022-2208
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.5163. (CVE-2022-2208)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2208
https://security-tracker.debian.org/tracker/CVE-2022-2208
https://ubuntu.com/security/CVE-2022-2208

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2208

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
230017 - Linux Distros Unpatched Vulnerability : CVE-2022-23960
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive information. (CVE-2022-23960)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-23960
https://ubuntu.com/security/CVE-2022-23960

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.6 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0011
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-23960

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224544 - Linux Distros Unpatched Vulnerability : CVE-2022-2476
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log:
AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux- gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING (CVE-2022-2476)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2476
https://security-tracker.debian.org/tracker/CVE-2022-2476
https://ubuntu.com/security/CVE-2022-2476

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.7 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2022-2476

Plugin Information
Published: 2025/03/05, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- wavpack
224493 - Linux Distros Unpatched Vulnerability : CVE-2022-25313
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element. (CVE-2022-25313)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-25313
https://security-tracker.debian.org/tracker/CVE-2022-25313
https://ubuntu.com/security/CVE-2022-25313

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.001
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-25313

Plugin Information
Published: 2025/03/05, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
248144 - Linux Distros Unpatched Vulnerability : CVE-2022-26878
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drivers/bluetooth/virtio_bt.c in the Linux kernel before 5.16.3 has a memory leak (socket buffers have memory allocated but not freed). (CVE-2022-26878)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-26878
https://ubuntu.com/security/CVE-2022-26878

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-26878

Plugin Information
Published: 2025/08/11, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224492 - Linux Distros Unpatched Vulnerability : CVE-2022-26966
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from heap memory via crafted frame lengths from a device. (CVE-2022-26966)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-26966
https://ubuntu.com/security/CVE-2022-26966

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-26966

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224589 - Linux Distros Unpatched Vulnerability : CVE-2022-27672
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch potentially resulting in information disclosure. (CVE-2022-27672)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-27672
https://security-tracker.debian.org/tracker/CVE-2022-27672
https://ubuntu.com/security/CVE-2022-27672

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0015
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-27672

Plugin Information
Published: 2025/03/05, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247496 - Linux Distros Unpatched Vulnerability : CVE-2022-2785
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- There exists an arbitrary memory read within the Linux Kernel BPF - Constants provided to fill pointers in structs passed in to bpf_sys_bpf are not verified and can point anywhere, including memory not owned by BPF. An attacker with CAP_BPF can arbitrarily read memory from anywhere on the system. We recommend upgrading past commit 86f44fcec22c (CVE-2022-2785)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2785
https://ubuntu.com/security/CVE-2022-2785

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-2785

Plugin Information
Published: 2025/08/10, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
258505 - Linux Distros Unpatched Vulnerability : CVE-2022-27943
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new. (CVE-2022-27943)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-27943
https://security-tracker.debian.org/tracker/CVE-2022-27943
https://ubuntu.com/security/CVE-2022-27943

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2022-27943

Plugin Information
Published: 2025/08/30, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- cpp
- gcc
- gcc-c++
- gcc-gfortran
- gcc-offload-nvptx
- gcc-plugin-annobin
- libasan
- libatomic
- libgcc
- libgfortran
- libgomp
- libgomp-offload-nvptx
- libitm
- liblsan
- libquadmath
- libquadmath-devel
- libstdc++
- libstdc++-devel
- libubsan
224714 - Linux Distros Unpatched Vulnerability : CVE-2022-2874
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224. (CVE-2022-2874)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2874
https://security-tracker.debian.org/tracker/CVE-2022-2874

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2874

Plugin Information
Published: 2025/03/05, Modified: 2025/09/06
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224621 - Linux Distros Unpatched Vulnerability : CVE-2022-2905
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data. (CVE-2022-2905)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2905
https://ubuntu.com/security/CVE-2022-2905

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2905

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224719 - Linux Distros Unpatched Vulnerability : CVE-2022-2923
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240. (CVE-2022-2923)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2923
https://security-tracker.debian.org/tracker/CVE-2022-2923

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2923

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224682 - Linux Distros Unpatched Vulnerability : CVE-2022-2980
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0259. (CVE-2022-2980)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-2980
https://security-tracker.debian.org/tracker/CVE-2022-2980

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-2980

Plugin Information
Published: 2025/03/05, Modified: 2025/10/08
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224606 - Linux Distros Unpatched Vulnerability : CVE-2022-29869
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) characters but is not a valid credentials file. (CVE-2022-29869)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-29869

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0063
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-29869

Plugin Information
Published: 2025/03/05, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- cifs-utils
224782 - Linux Distros Unpatched Vulnerability : CVE-2022-3153
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. (CVE-2022-3153)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-3153
https://security-tracker.debian.org/tracker/CVE-2022-3153

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-3153

Plugin Information
Published: 2025/03/05, Modified: 2025/09/06
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224740 - Linux Distros Unpatched Vulnerability : CVE-2022-31783
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Liblouis 3.21.0 has an out-of-bounds write in compileRule in compileTranslationTable.c, as demonstrated by lou_trace. (CVE-2022-31783)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-31783
https://security-tracker.debian.org/tracker/CVE-2022-31783

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2022-31783

Plugin Information
Published: 2025/03/05, Modified: 2025/10/13
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- liblouis
- python3-louis
224795 - Linux Distros Unpatched Vulnerability : CVE-2022-32148
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header. (CVE-2022-32148)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-32148
https://security-tracker.debian.org/tracker/CVE-2022-32148

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
3.3
EPSS Score
0.0005
References

CVE | CVE-2022-32148

Plugin Information
Published: 2025/03/05, Modified: 2025/08/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- podman
224772 - Linux Distros Unpatched Vulnerability : CVE-2022-3278
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0552. (CVE-2022-3278)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-3278
https://security-tracker.debian.org/tracker/CVE-2022-3278

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-3278

Plugin Information
Published: 2025/03/05, Modified: 2025/09/07
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224764 - Linux Distros Unpatched Vulnerability : CVE-2022-33070
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors. (CVE-2022-33070)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-33070
https://security-tracker.debian.org/tracker/CVE-2022-33070
https://ubuntu.com/security/CVE-2022-33070

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2022-33070

Plugin Information
Published: 2025/03/05, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- protobuf-c
224776 - Linux Distros Unpatched Vulnerability : CVE-2022-3344
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in the KVM's AMD nested virtualization (SVM). A malicious L1 guest could purposely fail to intercept the shutdown of a cooperative nested guest (L2), possibly leading to a page fault and kernel panic in the host (L0). (CVE-2022-3344)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-3344
https://security-tracker.debian.org/tracker/CVE-2022-3344
https://ubuntu.com/security/CVE-2022-3344

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-3344

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224739 - Linux Distros Unpatched Vulnerability : CVE-2022-33972
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Incorrect calculation in microcode keying mechanism for some 3rd Generation Intel(R) Xeon(R) Scalable Processors may allow a privileged user to potentially enable information disclosure via local access.
(CVE-2022-33972)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-33972
https://ubuntu.com/security/CVE-2022-33972

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
4.4 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
3.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-33972

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- microcode_ctl
224730 - Linux Distros Unpatched Vulnerability : CVE-2022-33987
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
(CVE-2022-33987)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-33987
https://ubuntu.com/security/CVE-2022-33987

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0068
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-33987

Plugin Information
Published: 2025/03/05, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gjs
224841 - Linux Distros Unpatched Vulnerability : CVE-2022-3563
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function read_50_controller_cap_complete of the file tools/mgmt-tester.c of the component BlueZ. The manipulation of the argument cap_len leads to null pointer dereference. It is recommended to apply a patch to fix this issue. VDB-211086 is the identifier assigned to this vulnerability. (CVE-2022-3563)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-3563

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.7 (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-3563

Plugin Information
Published: 2025/03/05, Modified: 2025/09/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bluez
- bluez-libs
- bluez-obexd
224860 - Linux Distros Unpatched Vulnerability : CVE-2022-3606
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the function find_prog_by_sec_insn of the file tools/lib/bpf/libbpf.c of the component BPF. The manipulation leads to null pointer dereference. It is recommended to apply a patch to fix this issue. The identifier VDB-211749 was assigned to this vulnerability. (CVE-2022-3606)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-3606
https://ubuntu.com/security/CVE-2022-3606

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-3606

Plugin Information
Published: 2025/03/05, Modified: 2025/09/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224870 - Linux Distros Unpatched Vulnerability : CVE-2022-3637
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function jlink_init of the file monitor/jlink.c of the component BlueZ. The manipulation leads to denial of service. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211936. (CVE-2022-3637)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-3637
https://ubuntu.com/security/CVE-2022-3637

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-3637

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bluez
- bluez-libs
- bluez-obexd
224875 - Linux Distros Unpatched Vulnerability : CVE-2022-37050
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662. (CVE-2022-37050)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-37050

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0008
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-37050

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- poppler
- poppler-cpp
- poppler-glib
- poppler-utils
224826 - Linux Distros Unpatched Vulnerability : CVE-2022-37051
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.
(CVE-2022-37051)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-37051

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-37051

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- poppler
- poppler-cpp
- poppler-glib
- poppler-utils
224894 - Linux Distros Unpatched Vulnerability : CVE-2022-37052
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject. (CVE-2022-37052)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-37052

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-37052

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- poppler
- poppler-cpp
- poppler-glib
- poppler-utils
224866 - Linux Distros Unpatched Vulnerability : CVE-2022-37290
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive. (CVE-2022-37290)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-37290
https://security-tracker.debian.org/tracker/CVE-2022-37290
https://ubuntu.com/security/CVE-2022-37290

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2022-37290

Plugin Information
Published: 2025/03/05, Modified: 2025/10/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- nautilus
- nautilus-extensions
224831 - Linux Distros Unpatched Vulnerability : CVE-2022-38090
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged user to potentially enable information disclosure via local access.
(CVE-2022-38090)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-38090
https://ubuntu.com/security/CVE-2022-38090

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
4.4 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
3.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-38090

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- microcode_ctl
224881 - Linux Distros Unpatched Vulnerability : CVE-2022-38533
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfd_getl32 when called from the strip_main function in strip-new via a crafted file. (CVE-2022-38533)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-38533
https://security-tracker.debian.org/tracker/CVE-2022-38533

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-38533

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-12-binutils
- gcc-toolset-12-binutils-devel
- gcc-toolset-12-binutils-gold
224957 - Linux Distros Unpatched Vulnerability : CVE-2022-3903
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux kernel. This issue occurs when a user attaches a malicious USB device. A local user could use this flaw to starve the resources, causing denial of service or potentially crashing the system. (CVE-2022-3903)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-3903
https://ubuntu.com/security/CVE-2022-3903

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.6 (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.2 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-3903

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224965 - Linux Distros Unpatched Vulnerability : CVE-2022-4285
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt symbol version information may result in a denial of service. This issue is the result of an incomplete fix for CVE-2020-16599. (CVE-2022-4285)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-4285
https://security-tracker.debian.org/tracker/CVE-2022-4285
https://ubuntu.com/security/CVE-2022-4285

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2022-4285

Plugin Information
Published: 2025/03/05, Modified: 2025/11/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gcc-toolset-12-gdb
225023 - Linux Distros Unpatched Vulnerability : CVE-2022-4293
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
(CVE-2022-4293)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-4293
https://security-tracker.debian.org/tracker/CVE-2022-4293

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0014
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-4293

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
224919 - Linux Distros Unpatched Vulnerability : CVE-2022-4304
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption.
The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. (CVE-2022-4304)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-4304
https://ubuntu.com/security/CVE-2022-4304

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0025
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-4304

Plugin Information
Published: 2025/03/05, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- compat-openssl11
- shim-x64
225121 - Linux Distros Unpatched Vulnerability : CVE-2022-4543
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw named EntryBleed was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local attacker to leak KASLR base via prefetch side-channels based on TLB timing for Intel systems. (CVE-2022-4543)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-4543
https://security-tracker.debian.org/tracker/CVE-2022-4543
https://ubuntu.com/security/CVE-2022-4543

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0013
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2022-4543

Plugin Information
Published: 2025/03/05, Modified: 2025/12/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225110 - Linux Distros Unpatched Vulnerability : CVE-2022-47007
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered function stab_demangle_v3_arg in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. (CVE-2022-47007)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-47007
https://security-tracker.debian.org/tracker/CVE-2022-47007

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-47007

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-12-binutils
- gcc-toolset-12-binutils-devel
- gcc-toolset-12-binutils-gold
- gcc-toolset-13-binutils
- gcc-toolset-13-binutils-devel
- gcc-toolset-13-binutils-gold
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
225070 - Linux Distros Unpatched Vulnerability : CVE-2022-47008
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered function make_tempdir, and make_tempname in bucomm.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. (CVE-2022-47008)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-47008
https://security-tracker.debian.org/tracker/CVE-2022-47008

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-47008

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-12-binutils
- gcc-toolset-12-binutils-devel
- gcc-toolset-12-binutils-gold
- gcc-toolset-13-binutils
- gcc-toolset-13-binutils-devel
- gcc-toolset-13-binutils-gold
225050 - Linux Distros Unpatched Vulnerability : CVE-2022-47010
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered function pr_function_type in prdbg.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. (CVE-2022-47010)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-47010
https://security-tracker.debian.org/tracker/CVE-2022-47010

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-47010

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-12-binutils
- gcc-toolset-12-binutils-devel
- gcc-toolset-12-binutils-gold
- gcc-toolset-13-binutils
- gcc-toolset-13-binutils-devel
- gcc-toolset-13-binutils-gold
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
225075 - Linux Distros Unpatched Vulnerability : CVE-2022-47011
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered function parse_stab_struct_fields in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. (CVE-2022-47011)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-47011
https://security-tracker.debian.org/tracker/CVE-2022-47011

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2022-47011

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-12-binutils
- gcc-toolset-12-binutils-devel
- gcc-toolset-12-binutils-gold
- gcc-toolset-13-binutils
- gcc-toolset-13-binutils-devel
- gcc-toolset-13-binutils-gold
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
225589 - Linux Distros Unpatched Vulnerability : CVE-2022-48628
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ceph: drop messages from MDS when unmounting When unmounting all the dirty buffers will be flushed and after the last osd request is finished the last reference of the i_count will be released. Then it will flush the dirty cap/snap to MDSs, and the unmounting won't wait the possible acks, which will ihold the inodes when updating the metadata locally but makes no sense any more, of this. This will make the evict_inodes() to skip these inodes. If encrypt is enabled the kernel generate a warning when removing the encrypt keys when the skipped inodes still hold the keyring: WARNING: CPU: 4 PID: 168846 at fs/crypto/keyring.c:242 fscrypt_destroy_keyring+0x7e/0xd0 CPU: 4 PID: 168846 Comm: umount Tainted: G S 6.1.0-rc5-ceph-g72ead199864c #1 Hardware name: Supermicro SYS-5018R-WR/X10SRW-F, BIOS 2.0 12/17/2015 RIP:
0010:fscrypt_destroy_keyring+0x7e/0xd0 RSP: 0018:ffffc9000b277e28 EFLAGS: 00010202 RAX: 0000000000000002 RBX: ffff88810d52ac00 RCX: ffff88810b56aa00 RDX: 0000000080000000 RSI: ffffffff822f3a09 RDI:
ffff888108f59000 RBP: ffff8881d394fb88 R08: 0000000000000028 R09: 0000000000000000 R10: 0000000000000001 R11: 11ff4fe6834fcd91 R12: ffff8881d394fc40 R13: ffff888108f59000 R14: ffff8881d394f800 R15:
0000000000000000 FS: 00007fd83f6f1080(0000) GS:ffff88885fd00000(0000) knlGS:0000000000000000 CS: 0010 DS:
0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f918d417000 CR3: 000000017f89a005 CR4: 00000000003706e0 DR0:
0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> generic_shutdown_super+0x47/0x120 kill_anon_super+0x14/0x30 ceph_kill_sb+0x36/0x90 [ceph] deactivate_locked_super+0x29/0x60 cleanup_mnt+0xb8/0x140 task_work_run+0x67/0xb0 exit_to_user_mode_prepare+0x23d/0x240 syscall_exit_to_user_mode+0x25/0x60 do_syscall_64+0x40/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fd83dc39e9b Later the kernel will crash when iput() the inodes and dereferencing the sb->s_master_keys, which has been released by the generic_shutdown_super(). (CVE-2022-48628)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48628
https://security-tracker.debian.org/tracker/CVE-2022-48628
https://ubuntu.com/security/CVE-2022-48628

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48628

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225237 - Linux Distros Unpatched Vulnerability : CVE-2022-48635
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: fsdax: Fix infinite loop in dax_iomap_rw() I got an infinite loop and a WARNING report when executing a tail command in virtiofs.
WARNING: CPU: 10 PID: 964 at fs/iomap/iter.c:34 iomap_iter+0x3a2/0x3d0 Modules linked in: CPU: 10 PID: 964 Comm: tail Not tainted 5.19.0-rc7 Call Trace: <TASK> dax_iomap_rw+0xea/0x620 ?
__this_cpu_preempt_check+0x13/0x20 fuse_dax_read_iter+0x47/0x80 fuse_file_read_iter+0xae/0xd0 new_sync_read+0xfe/0x180 ? 0xffffffff81000000 vfs_read+0x14d/0x1a0 ksys_read+0x6d/0xf0
__x64_sys_read+0x1a/0x20 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd The tail command will call read() with a count of 0. In this case, iomap_iter() will report this WARNING, and always return 1 which casuing the infinite loop in dax_iomap_rw(). Fixing by checking count whether is 0 in dax_iomap_rw(). (CVE-2022-48635)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48635
https://ubuntu.com/security/CVE-2022-48635

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.4 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48635

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225276 - Linux Distros Unpatched Vulnerability : CVE-2022-48638
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cgroup: cgroup_get_from_id() must check the looked-up kn is a directory cgroup has to be one kernfs dir, otherwise kernel panic is caused, especially cgroup id is provide from userspace. (CVE-2022-48638)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48638
https://ubuntu.com/security/CVE-2022-48638

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
4.6 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48638

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225359 - Linux Distros Unpatched Vulnerability : CVE-2022-48639
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: sched: fix possible refcount leak in tc_new_tfilter() tfilter_put need to be called to put the refount got by tp->ops->get to avoid possible refcount leak when chain->tmplt_ops != NULL and chain->tmplt_ops != tp->ops. (CVE-2022-48639)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48639
https://ubuntu.com/security/CVE-2022-48639

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48639

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225685 - Linux Distros Unpatched Vulnerability : CVE-2022-48640
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bonding: fix NULL deref in bond_rr_gen_slave_id Fix a NULL dereference of the struct bonding.rr_tx_counter member because if a bond is initially created with an initial mode != zero (Round Robin) the memory required for the counter is never created and when the mode is changed there is never any attempt to verify the memory is allocated upon switching modes. This causes the following Oops on an aarch64 machine: [ 334.686773] Unable to handle kernel paging request at virtual address ffff2c91ac905000 [ 334.694703] Mem abort info: [ 334.697486] ESR = 0x0000000096000004 [ 334.701234] EC = 0x25: DABT (current EL), IL = 32 bits [ 334.706536] SET = 0, FnV = 0 [ 334.709579] EA = 0, S1PTW = 0 [ 334.712719] FSC = 0x04: level 0 translation fault [ 334.717586] Data abort info: [ 334.720454] ISV = 0, ISS = 0x00000004 [ 334.724288] CM = 0, WnR = 0 [ 334.727244] swapper pgtable: 4k pages, 48-bit VAs, pgdp=000008044d662000 [ 334.733944] [ffff2c91ac905000] pgd=0000000000000000, p4d=0000000000000000 [ 334.740734] Internal error: Oops: 96000004 [#1] SMP [ 334.745602] Modules linked in: bonding tls veth rfkill sunrpc arm_spe_pmu vfat fat acpi_ipmi ipmi_ssif ixgbe igb i40e mdio ipmi_devintf ipmi_msghandler arm_cmn arm_dsu_pmu cppc_cpufreq acpi_tad fuse zram crct10dif_ce ast ghash_ce sbsa_gwdt nvme drm_vram_helper drm_ttm_helper nvme_core ttm xgene_hwmon [ 334.772217] CPU: 7 PID: 2214 Comm: ping Not tainted 6.0.0-rc4-00133-g64ae13ed4784 #4 [ 334.779950] Hardware name: GIGABYTE R272-P31-00/MP32-AR1-00, BIOS F18v (SCP: 1.08.20211002) 12/01/2021 [ 334.789244] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 334.796196] pc :
bond_rr_gen_slave_id+0x40/0x124 [bonding] [ 334.801691] lr : bond_xmit_roundrobin_slave_get+0x38/0xdc [bonding] [ 334.807962] sp : ffff8000221733e0 [ 334.811265] x29: ffff8000221733e0 x28: ffffdbac8572d198 x27: ffff80002217357c [ 334.818392] x26: 000000000000002a x25: ffffdbacb33ee000 x24: ffff07ff980fa000 [ 334.825519] x23: ffffdbacb2e398ba x22: ffff07ff98102000 x21: ffff07ff981029c0 [ 334.832646] x20:
0000000000000001 x19: ffff07ff981029c0 x18: 0000000000000014 [ 334.839773] x17: 0000000000000000 x16:
ffffdbacb1004364 x15: 0000aaaabe2f5a62 [ 334.846899] x14: ffff07ff8e55d968 x13: ffff07ff8e55db30 x12:
0000000000000000 [ 334.854026] x11: ffffdbacb21532e8 x10: 0000000000000001 x9 : ffffdbac857178ec [ 334.861153] x8 : ffff07ff9f6e5a28 x7 : 0000000000000000 x6 : 000000007c2b3742 [ 334.868279] x5 :
ffff2c91ac905000 x4 : ffff2c91ac905000 x3 : ffff07ff9f554400 [ 334.875406] x2 : ffff2c91ac905000 x1 :
0000000000000001 x0 : ffff07ff981029c0 [ 334.882532] Call trace: [ 334.884967] bond_rr_gen_slave_id+0x40/0x124 [bonding] [ 334.890109] bond_xmit_roundrobin_slave_get+0x38/0xdc [bonding] [ 334.896033] __bond_start_xmit+0x128/0x3a0 [bonding] [ 334.901001] bond_start_xmit+0x54/0xb0 [bonding] [ 334.905622] dev_hard_start_xmit+0xb4/0x220 [ 334.909798] __dev_queue_xmit+0x1a0/0x720 [ 334.913799] arp_xmit+0x3c/0xbc [ 334.916932] arp_send_dst+0x98/0xd0 [ 334.920410] arp_solicit+0xe8/0x230 [ 334.923888] neigh_probe+0x60/0xb0 [ 334.927279] __neigh_event_send+0x3b0/0x470 [ 334.931453] neigh_resolve_output+0x70/0x90 [ 334.935626] ip_finish_output2+0x158/0x514 [ 334.939714]
__ip_finish_output+0xac/0x1a4 [ 334.943800] ip_finish_output+0x40/0xfc [ 334.947626] ip_output+0xf8/0x1a4 [ 334.950931] ip_send_skb+0x5c/0x100 [ 334.954410] ip_push_pending_frames+0x3c/0x60 [ 334.958758] raw_sendmsg+0x458/0x6d0 [ 334.962325] inet_sendmsg+0x50/0x80 [ 334.965805] sock_sendmsg+0x60/0x6c [ 334.969286] __sys_sendto+0xc8/0x134 [ 334.972853] __arm64_sys_sendto+0x34/0x4c ---truncated--- (CVE-2022-48640)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48640
https://ubuntu.com/security/CVE-2022-48640

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0012
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48640

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225372 - Linux Distros Unpatched Vulnerability : CVE-2022-48641
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: fix memory leak when blob is malformed The bug fix was incomplete, it replaced crash with a memory leak. The old code had an assignment to ret embedded into the conditional, restore this. (CVE-2022-48641)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48641
https://ubuntu.com/security/CVE-2022-48641

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48641

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225696 - Linux Distros Unpatched Vulnerability : CVE-2022-48644
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: avoid disabling offload when it was never enabled In an incredibly strange API design decision, qdisc->destroy() gets called even if qdisc->init() never succeeded, not exclusively since commit 87b60cfacf9f (net_sched: fix error recovery at qdisc creation), but apparently also earlier (in the case of qdisc_create_dflt()). The taprio qdisc does not fully acknowledge this when it attempts full offload, because it starts off with q->flags = TAPRIO_FLAGS_INVALID in taprio_init(), then it replaces q->flags with TCA_TAPRIO_ATTR_FLAGS parsed from netlink (in taprio_change(), tail called from taprio_init()). But in taprio_destroy(), we call taprio_disable_offload(), and this determines what to do based on FULL_OFFLOAD_IS_ENABLED(q->flags). But looking at the implementation of FULL_OFFLOAD_IS_ENABLED() (a bitwise check of bit 1 in q->flags), it is invalid to call this macro on q->flags when it contains TAPRIO_FLAGS_INVALID, because that is set to U32_MAX, and therefore FULL_OFFLOAD_IS_ENABLED() will return true on an invalid set of flags. As a result, it is possible to crash the kernel if user space forces an error between setting q->flags = TAPRIO_FLAGS_INVALID, and the calling of taprio_enable_offload(). This is because drivers do not expect the offload to be disabled when it was never enabled. The error that we force here is to attach taprio as a non-root qdisc, but instead as child of an mqprio root qdisc: $ tc qdisc add dev swp0 root handle 1: \ mqprio num_tc 8 map 0 1 2 3 4 5 6 7 \ queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 hw 0 $ tc qdisc replace dev swp0 parent 1:1 \ taprio num_tc 8 map 0 1 2 3 4 5 6 7 \ queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 base-time 0 \ sched-entry S 0x7f 990000 sched-entry S 0x80 100000 \ flags 0x0 clockid CLOCK_TAI Unable to handle kernel paging request at virtual address fffffffffffffff8 [fffffffffffffff8] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 96000004 [#1] PREEMPT SMP Call trace: taprio_dump+0x27c/0x310 vsc9959_port_setup_tc+0x1f4/0x460 felix_port_setup_tc+0x24/0x3c dsa_slave_setup_tc+0x54/0x27c taprio_disable_offload.isra.0+0x58/0xe0 taprio_destroy+0x80/0x104 qdisc_create+0x240/0x470 tc_modify_qdisc+0x1fc/0x6b0 rtnetlink_rcv_msg+0x12c/0x390 netlink_rcv_skb+0x5c/0x130 rtnetlink_rcv+0x1c/0x2c Fix this by keeping track of the operations we made, and undo the offload only if we actually did it. I've added bool offloaded inside a 4 byte hole between int clockid and atomic64_t picos_per_byte. Now the first cache line looks like below: $ pahole -C taprio_sched net/sched/sch_taprio.o struct taprio_sched { struct Qdisc * * qdiscs; /* 0 8 */ struct Qdisc * root; /* 8 8 */ u32 flags; /* 16 4 */ enum tk_offsets tk_offset; /* 20 4 */ int clockid; /* 24 4 */ bool offloaded;
/* 28 1 */ /* XXX 3 bytes hole, try to pack */ atomic64_t picos_per_byte; /* 32 0 */ /* XXX 8 bytes hole, try to pack */ spinlock_t current_entry_lock; /* 40 0 */ /* XXX 8 bytes hole, try to pack */ struct sched_entry * current_entry; /* 48 8 */ struct sched_gate_list * oper_sched; /* 56 8 */ /* --- cacheline 1 boundary (64 bytes) --- */ (CVE-2022-48644)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48644
https://ubuntu.com/security/CVE-2022-48644

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0013
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48644

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225179 - Linux Distros Unpatched Vulnerability : CVE-2022-48653
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ice: Don't double unplug aux on peer initiated reset In the IDC callback that is accessed when the aux drivers request a reset, the function to unplug the aux devices is called. This function is also called in the ice_prepare_for_reset function. This double call is causing a scheduling while atomic BUG. [ 662.676430] ice 0000:4c:00.0 rocep76s0: cqp opcode = 0x1 maj_err_code = 0xffff min_err_code = 0x8003 [ 662.676609] ice 0000:4c:00.0 rocep76s0: [Modify QP Cmd Error][op_code=8] status=-29 waiting=1 completion_err=1 maj=0xffff min=0x8003 [ 662.815006] ice 0000:4c:00.0 rocep76s0: ICE OICR event notification: oicr = 0x10000003 [ 662.815014] ice 0000:4c:00.0 rocep76s0: critical PE Error, GLPE_CRITERR=0x00011424 [ 662.815017] ice 0000:4c:00.0 rocep76s0: Requesting a reset [ 662.815475] BUG: scheduling while atomic: swapper/37/0/0x00010002 [ 662.815475] BUG: scheduling while atomic: swapper/37/0/0x00010002 [ 662.815477] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs rfkill 8021q garp mrp stp llc vfat fat rpcrdma intel_rapl_msr intel_rapl_common sunrpc i10nm_edac rdma_ucm nfit ib_srpt libnvdimm ib_isert iscsi_target_mod x86_pkg_temp_thermal intel_powerclamp coretemp target_core_mod snd_hda_intel ib_iser snd_intel_dspcfg libiscsi snd_intel_sdw_acpi scsi_transport_iscsi kvm_intel iTCO_wdt rdma_cm snd_hda_codec kvm iw_cm ipmi_ssif iTCO_vendor_support snd_hda_core irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hwdep snd_seq snd_seq_device rapl snd_pcm snd_timer isst_if_mbox_pci pcspkr isst_if_mmio irdma intel_uncore idxd acpi_ipmi joydev isst_if_common snd mei_me idxd_bus ipmi_si soundcore i2c_i801 mei ipmi_devintf i2c_smbus i2c_ismt ipmi_msghandler acpi_power_meter acpi_pad rv(OE) ib_uverbs ib_cm ib_core xfs libcrc32c ast i2c_algo_bit drm_vram_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm_ttm_helpe r ttm [ 662.815546] nvme nvme_core ice drm crc32c_intel i40e t10_pi wmi pinctrl_emmitsburg dm_mirror dm_region_hash dm_log dm_mod fuse [ 662.815557] Preemption disabled at: [ 662.815558] [<0000000000000000>] 0x0 [ 662.815563] CPU: 37 PID: 0 Comm: swapper/37 Kdump: loaded Tainted:
G S OE 5.17.1 #2 [ 662.815566] Hardware name: Intel Corporation D50DNP/D50DNP, BIOS SE5C6301.86B.6624.D18.2111021741 11/02/2021 [ 662.815568] Call Trace: [ 662.815572] <IRQ> [ 662.815574] dump_stack_lvl+0x33/0x42 [ 662.815581] __schedule_bug.cold.147+0x7d/0x8a [ 662.815588]
__schedule+0x798/0x990 [ 662.815595] schedule+0x44/0xc0 [ 662.815597] schedule_preempt_disabled+0x14/0x20 [ 662.815600] __mutex_lock.isra.11+0x46c/0x490 [ 662.815603] ? __ibdev_printk+0x76/0xc0 [ib_core] [ 662.815633] device_del+0x37/0x3d0 [ 662.815639] ice_unplug_aux_dev+0x1a/0x40 [ice] [ 662.815674] ice_schedule_reset+0x3c/0xd0 [ice] [ 662.815693] irdma_iidc_event_handler.cold.7+0xb6/0xd3 [irdma] [ 662.815712] ? bitmap_find_next_zero_area_off+0x45/0xa0 [ 662.815719] ice_send_event_to_aux+0x54/0x70 [ice] [ 662.815741] ice_misc_intr+0x21d/0x2d0 [ice] [ 662.815756] __handle_irq_event_percpu+0x4c/0x180 [ 662.815762] handle_irq_event_percpu+0xf/0x40 [ 662.815764] handle_irq_event+0x34/0x60 [ 662.815766] handle_edge_irq+0x9a/0x1c0 [ 662.815770] __common_interrupt+0x62/0x100 [ 662.815774] common_interrupt+0xb4/0xd0 [ 662.815779] </IRQ> [ 662.815780] <TASK> [ 662.815780] asm_common_interrupt+0x1e/0x40 [ 662.815785] RIP: 0010:cpuidle_enter_state+0xd6/0x380 [ 662.815789] Code:
49 89 c4 0f 1f 44 00 00 31 ff e8 65 d7 95 ff 45 84 ff 74 12 9c 58 f6 c4 02 0f 85 64 02 00 00 31 ff e8 ae c5 9c ff fb 45 85 f6 <0f> 88 12 01 00 00 49 63 d6 4c 2b 24 24 48 8d 04 52 48 8d 04 82 49 [ 662.815791] RSP: 0018:ff2c2c4f18edbe80 EFLAGS: 00000202 [ 662.815793] RAX: ff280805df140000 RBX: 0000000000000002 RCX:
000000000000001f [ 662.815795] RDX: 0000009a52da2d08 R ---truncated--- (CVE-2022-48653)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48653
https://ubuntu.com/security/CVE-2022-48653

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0013
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48653

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225135 - Linux Distros Unpatched Vulnerability : CVE-2022-48660
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully When running gpio test on nxp-ls1028 platform with below command gpiomon --num-events=3 --rising-edge gpiochip1 25 There will be a warning trace as below:
Call trace: free_irq+0x204/0x360 lineevent_free+0x64/0x70 gpio_ioctl+0x598/0x6a0
__arm64_sys_ioctl+0xb4/0x100 invoke_syscall+0x5c/0x130 ...... el0t_64_sync+0x1a0/0x1a4 The reason of this issue is that calling request_threaded_irq() function failed, and then lineevent_free() is invoked to release the resource. Since the lineevent_state::irq was already set, so the subsequent invocation of free_irq() would trigger the above warning call trace. To fix this issue, set the lineevent_state::irq after the IRQ register successfully. (CVE-2022-48660)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48660
https://ubuntu.com/security/CVE-2022-48660

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48660

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225740 - Linux Distros Unpatched Vulnerability : CVE-2022-48673
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/smc: Fix possible access to freed memory in link clear After modifying the QP to the Error state, all RX WR would be completed with WC in IB_WC_WR_FLUSH_ERR status. Current implementation does not wait for it is done, but destroy the QP and free the link group directly. So there is a risk that accessing the freed memory in tasklet context. Here is a crash example: BUG: unable to handle page fault for address:
ffffffff8f220860 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD f7300e067 P4D f7300e067 PUD f7300f063 PMD 8c4e45063 PTE 800ffff08c9df060 Oops: 0002 [#1] SMP PTI CPU:
1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: G S OE 5.10.0-0607+ #23 Hardware name: Inspur NF5280M4/YZMB-00689-101, BIOS 4.1.20 07/09/2018 RIP: 0010:native_queued_spin_lock_slowpath+0x176/0x1b0 Code: f3 90 48 8b 32 48 85 f6 74 f6 eb d5 c1 ee 12 83 e0 03 83 ee 01 48 c1 e0 05 48 63 f6 48 05 00 c8 02 00 48 03 04 f5 00 09 98 8e <48> 89 10 8b 42 08 85 c0 75 09 f3 90 8b 42 08 85 c0 74 f7 48 8b 32 RSP:
0018:ffffb3b6c001ebd8 EFLAGS: 00010086 RAX: ffffffff8f220860 RBX: 0000000000000246 RCX: 0000000000080000 RDX: ffff91db1f86c800 RSI: 000000000000173c RDI: ffff91db62bace00 RBP: ffff91db62bacc00 R08:
0000000000000000 R09: c00000010000028b R10: 0000000000055198 R11: ffffb3b6c001ea58 R12: ffff91db80e05010 R13: 000000000000000a R14: 0000000000000006 R15: 0000000000000040 FS: 0000000000000000(0000) GS:ffff91db1f840000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
ffffffff8f220860 CR3: 00000001f9580004 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ>
_raw_spin_lock_irqsave+0x30/0x40 mlx5_ib_poll_cq+0x4c/0xc50 [mlx5_ib] smc_wr_rx_tasklet_fn+0x56/0xa0 [smc] tasklet_action_common.isra.21+0x66/0x100 __do_softirq+0xd5/0x29c asm_call_irq_on_stack+0x12/0x20 </IRQ>
do_softirq_own_stack+0x37/0x40 irq_exit_rcu+0x9d/0xa0 sysvec_call_function_single+0x34/0x80 asm_sysvec_call_function_single+0x12/0x20 (CVE-2022-48673)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48673
https://security-tracker.debian.org/tracker/CVE-2022-48673
https://ubuntu.com/security/CVE-2022-48673

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48673

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225148 - Linux Distros Unpatched Vulnerability : CVE-2022-48675
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: IB/core: Fix a nested dead lock as part of ODP flow Fix a nested dead lock as part of ODP flow by using mmput_async(). From the below call trace [1] can see that calling mmput() once we have the umem_odp->umem_mutex locked as required by ib_umem_odp_map_dma_and_lock() might trigger in the same task the exit_mmap()->__mmu_notifier_release()->mlx5_ib_invalidate_range() which may dead lock when trying to lock the same mutex. Moving to use mmput_async() will solve the problem as the above exit_mmap() flow will be called in other task and will be executed once the lock will be available. [1] [64843.077665] task:kworker/u133:2 state:D stack: 0 pid:80906 ppid: 2 flags:0x00004000 [64843.077672] Workqueue:
mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib] [64843.077719] Call Trace: [64843.077722] <TASK>
[64843.077724] __schedule+0x23d/0x590 [64843.077729] schedule+0x4e/0xb0 [64843.077735] schedule_preempt_disabled+0xe/0x10 [64843.077740] __mutex_lock.constprop.0+0x263/0x490 [64843.077747]
__mutex_lock_slowpath+0x13/0x20 [64843.077752] mutex_lock+0x34/0x40 [64843.077758] mlx5_ib_invalidate_range+0x48/0x270 [mlx5_ib] [64843.077808] __mmu_notifier_release+0x1a4/0x200 [64843.077816] exit_mmap+0x1bc/0x200 [64843.077822] ? walk_page_range+0x9c/0x120 [64843.077828] ?
__cond_resched+0x1a/0x50 [64843.077833] ? mutex_lock+0x13/0x40 [64843.077839] ? uprobe_clear_state+0xac/0x120 [64843.077860] mmput+0x5f/0x140 [64843.077867] ib_umem_odp_map_dma_and_lock+0x21b/0x580 [ib_core] [64843.077931] pagefault_real_mr+0x9a/0x140 [mlx5_ib] [64843.077962] pagefault_mr+0xb4/0x550 [mlx5_ib] [64843.077992] pagefault_single_data_segment.constprop.0+0x2ac/0x560 [mlx5_ib] [64843.078022] mlx5_ib_eqe_pf_action+0x528/0x780 [mlx5_ib] [64843.078051] process_one_work+0x22b/0x3d0 [64843.078059] worker_thread+0x53/0x410 [64843.078065] ? process_one_work+0x3d0/0x3d0 [64843.078073] kthread+0x12a/0x150 [64843.078079] ? set_kthread_struct+0x50/0x50 [64843.078085] ret_from_fork+0x22/0x30 [64843.078093] </TASK> (CVE-2022-48675)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48675
https://ubuntu.com/security/CVE-2022-48675

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48675

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225610 - Linux Distros Unpatched Vulnerability : CVE-2022-48691
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: clean up hook list when offload flags check fails splice back the hook list so nft_chain_release_hook() has a chance to release the hooks. BUG: memory leak unreferenced object 0xffff88810180b100 (size 96): comm syz- executor133, pid 3619, jiffies 4294945714 (age 12.690s) hex dump (first 32 bytes): 28 64 23 02 81 88 ff ff 28 64 23 02 81 88 ff ff (d#.....(d#..... 90 a8 aa 83 ff ff ff ff 00 00 b5 0f 81 88 ff ff ................ backtrace: [<ffffffff83a8c59b>] kmalloc include/linux/slab.h:600 [inline] [<ffffffff83a8c59b>] nft_netdev_hook_alloc+0x3b/0xc0 net/netfilter/nf_tables_api.c:1901 [<ffffffff83a9239a>] nft_chain_parse_netdev net/netfilter/nf_tables_api.c:1998 [inline] [<ffffffff83a9239a>] nft_chain_parse_hook+0x33a/0x530 net/netfilter/nf_tables_api.c:2073 [<ffffffff83a9b14b>] nf_tables_addchain.constprop.0+0x10b/0x950 net/netfilter/nf_tables_api.c:2218 [<ffffffff83a9c41b>] nf_tables_newchain+0xa8b/0xc60 net/netfilter/nf_tables_api.c:2593 [<ffffffff83a3d6a6>] nfnetlink_rcv_batch+0xa46/0xd20 net/netfilter/nfnetlink.c:517 [<ffffffff83a3db79>] nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:638 [inline] [<ffffffff83a3db79>] nfnetlink_rcv+0x1f9/0x220 net/netfilter/nfnetlink.c:656 [<ffffffff83a13b17>] netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] [<ffffffff83a13b17>] netlink_unicast+0x397/0x4c0 net/netlink/af_netlink.c:1345 [<ffffffff83a13fd6>] netlink_sendmsg+0x396/0x710 net/netlink/af_netlink.c:1921 [<ffffffff83865ab6>] sock_sendmsg_nosec net/socket.c:714 [inline] [<ffffffff83865ab6>] sock_sendmsg+0x56/0x80 net/socket.c:734 [<ffffffff8386601c>]
____sys_sendmsg+0x36c/0x390 net/socket.c:2482 [<ffffffff8386a918>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2536 [<ffffffff8386aaa8>] __sys_sendmsg+0x88/0x100 net/socket.c:2565 [<ffffffff845e5955>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<ffffffff845e5955>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [<ffffffff84800087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd (CVE-2022-48691)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48691
https://ubuntu.com/security/CVE-2022-48691

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48691

Plugin Information
Published: 2025/03/05, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225519 - Linux Distros Unpatched Vulnerability : CVE-2022-48697
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: nvmet: fix a use-after-free Fix the following use-after-free complaint triggered by blktests nvme/004: BUG: KASAN: user-memory-access in blk_mq_complete_request_remote+0xac/0x350 Read of size 4 at addr 0000607bd1835943 by task kworker/13:1/460 Workqueue: nvmet-wq nvme_loop_execute_work [nvme_loop] Call Trace: show_stack+0x52/0x58 dump_stack_lvl+0x49/0x5e print_report.cold+0x36/0x1e2 kasan_report+0xb9/0xf0 __asan_load4+0x6b/0x80 blk_mq_complete_request_remote+0xac/0x350 nvme_loop_queue_response+0x1df/0x275 [nvme_loop]
__nvmet_req_complete+0x132/0x4f0 [nvmet] nvmet_req_complete+0x15/0x40 [nvmet] nvmet_execute_io_connect+0x18a/0x1f0 [nvmet] nvme_loop_execute_work+0x20/0x30 [nvme_loop] process_one_work+0x56e/0xa70 worker_thread+0x2d1/0x640 kthread+0x183/0x1c0 ret_from_fork+0x1f/0x30 (CVE-2022-48697)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48697
https://ubuntu.com/security/CVE-2022-48697

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.4
EPSS Score
0.0006
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48697

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225633 - Linux Distros Unpatched Vulnerability : CVE-2022-48704
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/radeon: add a force flush to delay work when radeon Although radeon card fence and wait for gpu to finish processing current batch rings, there is still a corner case that radeon lockup work queue may not be fully flushed, and meanwhile the radeon_suspend_kms() function has called pci_set_power_state() to put device in D3hot state. Per PCI spec rev 4.0 on 5.3.1.4.1 D3hot State. > Configuration and Message requests are the only TLPs accepted by a Function in > the D3hot state. All other received Requests must be handled as Unsupported Requests, > and all received Completions may optionally be handled as Unexpected Completions. This issue will happen in following logs: Unable to handle kernel paging request at virtual address 00008800e0008010 CPU 0 kworker/0:3(131): Oops 0 pc = [<ffffffff811bea5c>] ra = [<ffffffff81240844>] ps = 0000 Tainted: G W pc is at si_gpu_check_soft_reset+0x3c/0x240 ra is at si_dma_is_lockup+0x34/0xd0 v0 = 0000000000000000 t0 = fff08800e0008010 t1 = 0000000000010000 t2 = 0000000000008010 t3 = fff00007e3c00000 t4 = fff00007e3c00258 t5 = 000000000000ffff t6 = 0000000000000001 t7 = fff00007ef078000 s0 = fff00007e3c016e8 s1 = fff00007e3c00000 s2 = fff00007e3c00018 s3 = fff00007e3c00000 s4 = fff00007fff59d80 s5 = 0000000000000000 s6 = fff00007ef07bd98 a0 = fff00007e3c00000 a1 = fff00007e3c016e8 a2 = 0000000000000008 a3 = 0000000000000001 a4 = 8f5c28f5c28f5c29 a5 = ffffffff810f4338 t8 = 0000000000000275 t9 = ffffffff809b66f8 t10 = ff6769c5d964b800 t11= 000000000000b886 pv = ffffffff811bea20 at = 0000000000000000 gp = ffffffff81d89690 sp = 00000000aa814126 Disabling lock debugging due to kernel taint Trace: [<ffffffff81240844>] si_dma_is_lockup+0x34/0xd0 [<ffffffff81119610>] radeon_fence_check_lockup+0xd0/0x290 [<ffffffff80977010>] process_one_work+0x280/0x550 [<ffffffff80977350>] worker_thread+0x70/0x7c0 [<ffffffff80977410>] worker_thread+0x130/0x7c0 [<ffffffff80982040>] kthread+0x200/0x210 [<ffffffff809772e0>] worker_thread+0x0/0x7c0 [<ffffffff80981f8c>] kthread+0x14c/0x210 [<ffffffff80911658>] ret_from_kernel_thread+0x18/0x20 [<ffffffff80981e40>] kthread+0x0/0x210 Code: ad3e0008 43f0074a ad7e0018 ad9e0020 8c3001e8 40230101 <88210000> 4821ed21 So force lockup work queue flush to fix this problem. (CVE-2022-48704)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48704
https://ubuntu.com/security/CVE-2022-48704

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0013
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48704

Plugin Information
Published: 2025/03/05, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225734 - Linux Distros Unpatched Vulnerability : CVE-2022-48705
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921e: fix crash in chip reset fail In case of drv own fail in reset, we may need to run mac_reset several times. The sequence would trigger system crash as the log below. Because we do not re-enable/schedule tx_napi before disable it again, the process would keep waiting for state change in napi_diable(). To avoid the problem and keep status synchronize for each run, goto final resource handling if drv own failed. [ 5857.353423] mt7921e 0000:3b:00.0: driver own failed [ 5858.433427] mt7921e 0000:3b:00.0: Timeout for driver own [ 5859.633430] mt7921e 0000:3b:00.0: driver own failed [ 5859.633444] ------------[ cut here ]------------ [ 5859.633446] WARNING: CPU: 6 at kernel/kthread.c:659 kthread_park+0x11d [ 5859.633717] Workqueue: mt76 mt7921_mac_reset_work [mt7921_common] [ 5859.633728] RIP: 0010:kthread_park+0x11d/0x150 [ 5859.633736] RSP: 0018:ffff8881b676fc68 EFLAGS: 00010202 ...... [ 5859.633766] Call Trace: [ 5859.633768] <TASK> [ 5859.633771] mt7921e_mac_reset+0x176/0x6f0 [mt7921e] [ 5859.633778] mt7921_mac_reset_work+0x184/0x3a0 [mt7921_common] [ 5859.633785] ? mt7921_mac_set_timing+0x520/0x520 [mt7921_common] [ 5859.633794] ?
__kasan_check_read+0x11/0x20 [ 5859.633802] process_one_work+0x7ee/0x1320 [ 5859.633810] worker_thread+0x53c/0x1240 [ 5859.633818] kthread+0x2b8/0x370 [ 5859.633824] ? process_one_work+0x1320/0x1320 [ 5859.633828] ? kthread_complete_and_exit+0x30/0x30 [ 5859.633834] ret_from_fork+0x1f/0x30 [ 5859.633842] </TASK> (CVE-2022-48705)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48705
https://ubuntu.com/security/CVE-2022-48705

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48705

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225209 - Linux Distros Unpatched Vulnerability : CVE-2022-48706
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vdpa: ifcvf: Do proper cleanup if IFCVF init fails ifcvf_mgmt_dev leaks memory if it is not freed before returning. Call is made to correct return statement so memory does not leak. ifcvf_init_hw does not take care of this so it is needed to do it here. (CVE-2022-48706)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48706
https://ubuntu.com/security/CVE-2022-48706

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48706

Plugin Information
Published: 2025/03/05, Modified: 2025/12/23
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225390 - Linux Distros Unpatched Vulnerability : CVE-2022-48707
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix null pointer dereference for resetting decoder Not all decoders have a reset callback. The CXL specification allows a host bridge with a single root port to have no explicit HDM decoders. Currently the region driver assumes there are none. As such the CXL core creates a special pass through decoder instance without a commit/reset callback. Prior to this patch, the ->reset() callback was called unconditionally when calling cxl_region_decode_reset. Thus a configuration with 1 Host Bridge, 1 Root Port, and one directly attached CXL type 3 device or multiple CXL type 3 devices attached to downstream ports of a switch can cause a null pointer dereference. Before the fix, a kernel crash was observed when we destroy the region, and a pass through decoder is reset. The issue can be reproduced as below, 1) create a region with a CXL setup which includes a HB with a single root port under which a memdev is attached directly. 2) destroy the region with cxl destroy-region regionX -f. (CVE-2022-48707)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48707
https://ubuntu.com/security/CVE-2022-48707

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48707

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225525 - Linux Distros Unpatched Vulnerability : CVE-2022-48709
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ice: switch: fix potential memleak in ice_add_adv_recipe() When ice_add_special_words() fails, the 'rm' is not released, which will lead to a memory leak. Fix this up by going to 'err_unroll' label. Compile tested only. (CVE-2022-48709)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48709
https://ubuntu.com/security/CVE-2022-48709

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48709

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225479 - Linux Distros Unpatched Vulnerability : CVE-2022-48710
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/radeon: fix a possible null pointer dereference In radeon_fp_native_mode(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. The failure status of drm_cvt_mode() on the other path is checked too. (CVE-2022-48710)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48710
https://ubuntu.com/security/CVE-2022-48710

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48710

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225623 - Linux Distros Unpatched Vulnerability : CVE-2022-48713
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/pt: Fix crash with stop filters in single-range mode Add a check for !buf->single before calling pt_buffer_region_size in a place where a missing check can cause a kernel crash. Fixes a bug introduced by commit 670638477aed (perf/x86/intel/pt: Opportunistically use single range output mode), which added a support for PT single-range output mode. Since that commit if a PT stop filter range is hit while tracing, the kernel will crash because of a null pointer dereference in pt_handle_status due to calling pt_buffer_region_size without a ToPA configured. The commit which introduced single-range mode guarded almost all uses of the ToPA buffer variables with checks of the buf->single variable, but missed the case where tracing was stopped by the PT hardware, which happens when execution hits a configured stop filter. Tested that hitting a stop filter while PT recording successfully records a trace with this patch but crashes without this patch. (CVE-2022-48713)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48713
https://ubuntu.com/security/CVE-2022-48713

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48713

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225340 - Linux Distros Unpatched Vulnerability : CVE-2022-48719
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net, neigh: Do not trigger immediate probes on NUD_FAILED from neigh_managed_work syzkaller was able to trigger a deadlock for NTF_MANAGED entries [0]: kworker/0:16/14617 is trying to acquire lock: ffffffff8d4dd370 (&tbl->lock){++-.}-{2:2}, at:
___neigh_create+0x9e1/0x2990 net/core/neighbour.c:652 [...] but task is already holding lock:
ffffffff8d4dd370 (&tbl->lock){++-.}-{2:2}, at: neigh_managed_work+0x35/0x250 net/core/neighbour.c:1572 The neighbor entry turned to NUD_FAILED state, where __neigh_event_send() triggered an immediate probe as per commit cd28ca0a3dd1 (neigh: reduce arp latency) via neigh_probe() given table lock was held. One option to fix this situation is to defer the neigh_probe() back to the neigh_timer_handler() similarly as pre cd28ca0a3dd1. For the case of NTF_MANAGED, this deferral is acceptable given this only happens on actual failure state and regular / expected state is NUD_VALID with the entry already present. The fix adds a parameter to __neigh_event_send() in order to communicate whether immediate probe is allowed or disallowed. Existing call-sites of neigh_event_send() default as-is to immediate probe. However, the neigh_managed_work() disables it via use of neigh_event_send_probe(). [0] <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_deadlock_bug kernel/locking/lockdep.c:2956 [inline] check_deadlock kernel/locking/lockdep.c:2999 [inline] validate_chain kernel/locking/lockdep.c:3788 [inline] __lock_acquire.cold+0x149/0x3ab kernel/locking/lockdep.c:5027 lock_acquire kernel/locking/lockdep.c:5639 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5604 __raw_write_lock_bh include/linux/rwlock_api_smp.h:202 [inline]
_raw_write_lock_bh+0x2f/0x40 kernel/locking/spinlock.c:334 ___neigh_create+0x9e1/0x2990 net/core/neighbour.c:652 ip6_finish_output2+0x1070/0x14f0 net/ipv6/ip6_output.c:123 __ip6_finish_output net/ipv6/ip6_output.c:191 [inline] __ip6_finish_output+0x61e/0xe90 net/ipv6/ip6_output.c:170 ip6_finish_output+0x32/0x200 net/ipv6/ip6_output.c:201 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip6_output+0x1e4/0x530 net/ipv6/ip6_output.c:224 dst_output include/net/dst.h:451 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] ndisc_send_skb+0xa99/0x17f0 net/ipv6/ndisc.c:508 ndisc_send_ns+0x3a9/0x840 net/ipv6/ndisc.c:650 ndisc_solicit+0x2cd/0x4f0 net/ipv6/ndisc.c:742 neigh_probe+0xc2/0x110 net/core/neighbour.c:1040 __neigh_event_send+0x37d/0x1570 net/core/neighbour.c:1201 neigh_event_send include/net/neighbour.h:470 [inline] neigh_managed_work+0x162/0x250 net/core/neighbour.c:1574 process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307 worker_thread+0x657/0x1110 kernel/workqueue.c:2454 kthread+0x2e9/0x3a0 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 </TASK> (CVE-2022-48719)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48719
https://ubuntu.com/security/CVE-2022-48719

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48719

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225363 - Linux Distros Unpatched Vulnerability : CVE-2022-48720
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: macsec: Fix offload support for NETDEV_UNREGISTER event Current macsec netdev notify handler handles NETDEV_UNREGISTER event by releasing relevant SW resources only, this causes resources leak in case of macsec HW offload, as the underlay driver was not notified to clean it's macsec offload resources. Fix by calling the underlay driver to clean it's relevant resources by moving offload handling from macsec_dellink() to macsec_common_dellink() when handling NETDEV_UNREGISTER event. (CVE-2022-48720)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48720
https://ubuntu.com/security/CVE-2022-48720

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48720

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225626 - Linux Distros Unpatched Vulnerability : CVE-2022-48721
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/smc: Forward wakeup to smc socket waitqueue after fallback When we replace TCP with SMC and a fallback occurs, there may be some socket waitqueue entries remaining in smc socket->wq, such as eppoll_entries inserted by userspace applications. After the fallback, data flows over TCP/IP and only clcsocket->wq will be woken up. Applications can't be notified by the entries which were inserted in smc socket->wq before fallback. So we need a mechanism to wake up smc socket->wq at the same time if some entries remaining in it. The current workaround is to transfer the entries from smc socket->wq to clcsock->wq during the fallback. But this may cause a crash like this: general protection fault, probably for non-canonical address 0xdead000000000100: 0000 [#1] PREEMPT SMP PTI CPU: 3 PID: 0 Comm: swapper/3 Kdump: loaded Tainted:
G E 5.16.0+ #107 RIP: 0010:__wake_up_common+0x65/0x170 Call Trace: <IRQ> __wake_up_common_lock+0x7a/0xc0 sock_def_readable+0x3c/0x70 tcp_data_queue+0x4a7/0xc40 tcp_rcv_established+0x32f/0x660 ? sk_filter_trim_cap+0xcb/0x2e0 tcp_v4_do_rcv+0x10b/0x260 tcp_v4_rcv+0xd2a/0xde0 ip_protocol_deliver_rcu+0x3b/0x1d0 ip_local_deliver_finish+0x54/0x60 ip_local_deliver+0x6a/0x110 ? tcp_v4_early_demux+0xa2/0x140 ? tcp_v4_early_demux+0x10d/0x140 ip_sublist_rcv_finish+0x49/0x60 ip_sublist_rcv+0x19d/0x230 ip_list_rcv+0x13e/0x170 __netif_receive_skb_list_core+0x1c2/0x240 netif_receive_skb_list_internal+0x1e6/0x320 napi_complete_done+0x11d/0x190 mlx5e_napi_poll+0x163/0x6b0 [mlx5_core] __napi_poll+0x3c/0x1b0 net_rx_action+0x27c/0x300 __do_softirq+0x114/0x2d2 irq_exit_rcu+0xb4/0xe0 common_interrupt+0xba/0xe0 </IRQ> <TASK> The crash is caused by privately transferring waitqueue entries from smc socket->wq to clcsock->wq. The owners of these entries, such as epoll, have no idea that the entries have been transferred to a different socket wait queue and still use original waitqueue spinlock (smc socket->wq.wait.lock) to make the entries operation exclusive, but it doesn't work. The operations to the entries, such as removing from the waitqueue (now is clcsock->wq after fallback), may cause a crash when clcsock waitqueue is being iterated over at the moment. This patch tries to fix this by no longer transferring wait queue entries privately, but introducing own implementations of clcsock's callback functions in fallback situation. The callback functions will forward the wakeup to smc socket->wq if clcsock->wq is actually woken up and smc socket->wq has remaining entries. (CVE-2022-48721)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48721
https://security-tracker.debian.org/tracker/CVE-2022-48721
https://ubuntu.com/security/CVE-2022-48721

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48721

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225281 - Linux Distros Unpatched Vulnerability : CVE-2022-48724
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping() After commit e3beca48a45b (irqdomain/treewide: Keep firmware node unconditionally allocated). For tear down scenario, fn is only freed after fail to allocate ir_domain, though it also should be freed in case dmar_enable_qi returns error. Besides free fn, irq_domain and ir_msi_domain need to be removed as well if intel_setup_irq_remapping fails to enable queued invalidation.
Improve the rewinding path by add out_free_ir_domain and out_free_fwnode lables per Baolu's suggestion.
(CVE-2022-48724)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48724
https://ubuntu.com/security/CVE-2022-48724

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48724

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225562 - Linux Distros Unpatched Vulnerability : CVE-2022-48725
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix refcounting leak in siw_create_qp() The atomic_inc() needs to be paired with an atomic_dec() on the error path.
(CVE-2022-48725)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48725
https://ubuntu.com/security/CVE-2022-48725

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48725

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225355 - Linux Distros Unpatched Vulnerability : CVE-2022-48727
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Avoid consuming a stale esr value when SError occur When any exception other than an IRQ occurs, the CPU updates the ESR_EL2 register with the exception syndrome. An SError may also become pending, and will be synchronised by KVM.
KVM notes the exception type, and whether an SError was synchronised in exit_code. When an exception other than an IRQ occurs, fixup_guest_exit() updates vcpu->arch.fault.esr_el2 from the hardware register. When an SError was synchronised, the vcpu esr value is used to determine if the exception was due to an HVC. If so, ELR_EL2 is moved back one instruction. This is so that KVM can process the SError first, and re- execute the HVC if the guest survives the SError. But if an IRQ synchronises an SError, the vcpu's esr value is stale. If the previous non-IRQ exception was an HVC, KVM will corrupt ELR_EL2, causing an unrelated guest instruction to be executed twice. Check ARM_EXCEPTION_CODE() before messing with ELR_EL2, IRQs don't update this register so don't need to check. (CVE-2022-48727)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48727
https://ubuntu.com/security/CVE-2022-48727

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48727

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225694 - Linux Distros Unpatched Vulnerability : CVE-2022-48728
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix AIP early init panic An early failure in hfi1_ipoib_setup_rn() can lead to the following panic: BUG: unable to handle kernel NULL pointer dereference at 00000000000001b0 PGD 0 P4D 0 Oops: 0002 [#1] SMP NOPTI Workqueue: events work_for_cpu_fn RIP: 0010:try_to_grab_pending+0x2b/0x140 Code: 1f 44 00 00 41 55 41 54 55 48 89 d5 53 48 89 fb 9c 58 0f 1f 44 00 00 48 89 c2 fa 66 0f 1f 44 00 00 48 89 55 00 40 84 f6 75 77 <f0> 48 0f ba 2b 00 72 09 31 c0 5b 5d 41 5c 41 5d c3 48 89 df e8 6c RSP: 0018:ffffb6b3cf7cfa48 EFLAGS: 00010046 RAX:
0000000000000246 RBX: 00000000000001b0 RCX: 0000000000000000 RDX: 0000000000000246 RSI: 0000000000000000 RDI: 00000000000001b0 RBP: ffffb6b3cf7cfa70 R08: 0000000000000f09 R09: 0000000000000001 R10:
0000000000000000 R11: 0000000000000001 R12: 0000000000000000 R13: ffffb6b3cf7cfa90 R14: ffffffff9b2fbfc0 R15: ffff8a4fdf244690 FS: 0000000000000000(0000) GS:ffff8a527f400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000001b0 CR3: 00000017e2410003 CR4: 00000000007706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6:
00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: __cancel_work_timer+0x42/0x190 ? dev_printk_emit+0x4e/0x70 iowait_cancel_work+0x15/0x30 [hfi1] hfi1_ipoib_txreq_deinit+0x5a/0x220 [hfi1] ? dev_err+0x6c/0x90 hfi1_ipoib_netdev_dtor+0x15/0x30 [hfi1] hfi1_ipoib_setup_rn+0x10e/0x150 [hfi1] rdma_init_netdev+0x5a/0x80 [ib_core] ? hfi1_ipoib_free_rdma_netdev+0x20/0x20 [hfi1] ipoib_intf_init+0x6c/0x350 [ib_ipoib] ipoib_intf_alloc+0x5c/0xc0 [ib_ipoib] ipoib_add_one+0xbe/0x300 [ib_ipoib] add_client_context+0x12c/0x1a0 [ib_core] enable_device_and_get+0xdc/0x1d0 [ib_core] ib_register_device+0x572/0x6b0 [ib_core] rvt_register_device+0x11b/0x220 [rdmavt] hfi1_register_ib_device+0x6b4/0x770 [hfi1] do_init_one.isra.20+0x3e3/0x680 [hfi1] local_pci_probe+0x41/0x90 work_for_cpu_fn+0x16/0x20 process_one_work+0x1a7/0x360 ? create_worker+0x1a0/0x1a0 worker_thread+0x1cf/0x390 ? create_worker+0x1a0/0x1a0 kthread+0x116/0x130 ? kthread_flush_work_fn+0x10/0x10 ret_from_fork+0x1f/0x40 The panic happens in hfi1_ipoib_txreq_deinit() because there is a NULL deref when hfi1_ipoib_netdev_dtor() is called in this error case.
hfi1_ipoib_txreq_init() and hfi1_ipoib_rxq_init() are self unwinding so fix by adjusting the error paths accordingly. Other changes: - hfi1_ipoib_free_rdma_netdev() is deleted including the free_netdev() since the netdev core code deletes calls free_netdev() - The switch to the accelerated entrances is moved to the success path. (CVE-2022-48728)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48728
https://ubuntu.com/security/CVE-2022-48728

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48728

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225647 - Linux Distros Unpatched Vulnerability : CVE-2022-48729
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix panic with larger ipoib send_queue_size When the ipoib send_queue_size is increased from the default the following panic happens:
RIP: 0010:hfi1_ipoib_drain_tx_ring+0x45/0xf0 [hfi1] Code: 31 e4 eb 0f 8b 85 c8 02 00 00 41 83 c4 01 44 39 e0 76 60 8b 8d cc 02 00 00 44 89 e3 be 01 00 00 00 d3 e3 48 03 9d c0 02 00 00 <c7> 83 18 01 00 00 00 00 00 00 48 8b bb 30 01 00 00 e8 25 af a7 e0 RSP: 0018:ffffc9000798f4a0 EFLAGS: 00010286 RAX: 0000000000008000 RBX: ffffc9000aa0f000 RCX: 000000000000000f RDX: 0000000000000000 RSI: 0000000000000001 RDI:
0000000000000000 RBP: ffff88810ff08000 R08: ffff88889476d900 R09: 0000000000000101 R10: 0000000000000000 R11: ffffc90006590ff8 R12: 0000000000000200 R13: ffffc9000798fba8 R14: 0000000000000000 R15:
0000000000000001 FS: 00007fd0f79cc3c0(0000) GS:ffff88885fb00000(0000) knlGS:0000000000000000 CS: 0010 DS:
0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000aa0f118 CR3: 0000000889c84001 CR4: 00000000001706e0 Call Trace: <TASK> hfi1_ipoib_napi_tx_disable+0x45/0x60 [hfi1] hfi1_ipoib_dev_stop+0x18/0x80 [hfi1] ipoib_ib_dev_stop+0x1d/0x40 [ib_ipoib] ipoib_stop+0x48/0xc0 [ib_ipoib] __dev_close_many+0x9e/0x110
__dev_change_flags+0xd9/0x210 dev_change_flags+0x21/0x60 do_setlink+0x31c/0x10f0 ?
__nla_validate_parse+0x12d/0x1a0 ? __nla_parse+0x21/0x30 ? inet6_validate_link_af+0x5e/0xf0 ? cpumask_next+0x1f/0x20 ? __snmp6_fill_stats64.isra.53+0xbb/0x140 ? __nla_validate_parse+0x47/0x1a0
__rtnl_newlink+0x530/0x910 ? pskb_expand_head+0x73/0x300 ? __kmalloc_node_track_caller+0x109/0x280 ?
__nla_put+0xc/0x20 ? cpumask_next_and+0x20/0x30 ? update_sd_lb_stats.constprop.144+0xd3/0x820 ?
_raw_spin_unlock_irqrestore+0x25/0x37 ? __wake_up_common_lock+0x87/0xc0 ? kmem_cache_alloc_trace+0x3d/0x3d0 rtnl_newlink+0x43/0x60 The issue happens when the shift that should have been a function of the txq item size mistakenly used the ring size. Fix by using the item size.
(CVE-2022-48729)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48729
https://ubuntu.com/security/CVE-2022-48729

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48729

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225552 - Linux Distros Unpatched Vulnerability : CVE-2022-48731
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm/kmemleak: avoid scanning potential huge holes When using devm_request_free_mem_region() and devm_memremap_pages() to add ZONE_DEVICE memory, if requested free mem region's end pfn were huge(e.g., 0x400000000), the node_end_pfn() will be also huge (see move_pfn_range_to_zone()). Thus it creates a huge hole between node_start_pfn() and node_end_pfn(). We found on some AMD APUs, amdkfd requested such a free mem region and created a huge hole. In such a case, following code snippet was just doing busy test_bit() looping on the huge hole. for (pfn = start_pfn; pfn < end_pfn; pfn++) { struct page *page = pfn_to_online_page(pfn); if (!page) continue; ... } So we got a soft lockup: watchdog: BUG: soft lockup - CPU#6 stuck for 26s! [bash:1221] CPU: 6 PID: 1221 Comm: bash Not tainted 5.15.0-custom #1 RIP:
0010:pfn_to_online_page+0x5/0xd0 Call Trace: ? kmemleak_scan+0x16a/0x440 kmemleak_write+0x306/0x3a0 ? common_file_perm+0x72/0x170 full_proxy_write+0x5c/0x90 vfs_write+0xb9/0x260 ksys_write+0x67/0xe0
__x64_sys_write+0x1a/0x20 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae I did some tests with the patch. (1) amdgpu module unloaded before the patch: real 0m0.976s user 0m0.000s sys 0m0.968s after the patch: real 0m0.981s user 0m0.000s sys 0m0.973s (2) amdgpu module loaded before the patch: real 0m35.365s user 0m0.000s sys 0m35.354s after the patch: real 0m1.049s user 0m0.000s sys 0m1.042s (CVE-2022-48731)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48731
https://ubuntu.com/security/CVE-2022-48731

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48731

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225163 - Linux Distros Unpatched Vulnerability : CVE-2022-48741
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ovl: fix NULL pointer dereference in copy up warning This patch is fixing a NULL pointer dereference to get a recently introduced warning message working. (CVE-2022-48741)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48741
https://ubuntu.com/security/CVE-2022-48741

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48741

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225718 - Linux Distros Unpatched Vulnerability : CVE-2022-48745
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Use del_timer_sync in fw reset flow of halting poll Substitute del_timer() with del_timer_sync() in fw reset polling deactivation flow, in order to prevent a race condition which occurs when del_timer() is called and timer is deactivated while another process is handling the timer interrupt. A situation that led to the following call trace: RIP: 0010:run_timer_softirq+0x137/0x420 <IRQ> recalibrate_cpu_khz+0x10/0x10 ktime_get+0x3e/0xa0 ? sched_clock_cpu+0xb/0xc0 __do_softirq+0xf5/0x2ea irq_exit_rcu+0xc1/0xf0 sysvec_apic_timer_interrupt+0x9e/0xc0 asm_sysvec_apic_timer_interrupt+0x12/0x20 </IRQ> (CVE-2022-48745)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48745
https://ubuntu.com/security/CVE-2022-48745

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48745

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225242 - Linux Distros Unpatched Vulnerability : CVE-2022-48746
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix handling of wrong devices during bond netevent Current implementation of bond netevent handler only check if the handled netdev is VF representor and it missing a check if the VF representor is on the same phys device of the bond handling the netevent. Fix by adding the missing check and optimizing the check if the netdev is VF representor so it will not access uninitialized private data and crashes. BUG: kernel NULL pointer dereference, address: 000000000000036c PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI Workqueue: eth3bond0 bond_mii_monitor [bonding] RIP: 0010:mlx5e_is_uplink_rep+0xc/0x50 [mlx5_core] RSP: 0018:ffff88812d69fd60 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff8881cf800000 RCX: 0000000000000000 RDX: ffff88812d69fe10 RSI: 000000000000001b RDI: ffff8881cf800880 RBP: ffff8881cf800000 R08: 00000445cabccf2b R09:
0000000000000008 R10: 0000000000000004 R11: 0000000000000008 R12: ffff88812d69fe10 R13: 00000000fffffffe R14: ffff88820c0f9000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88846fb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000036c CR3:
0000000103d80006 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace:
mlx5e_eswitch_uplink_rep+0x31/0x40 [mlx5_core] mlx5e_rep_is_lag_netdev+0x94/0xc0 [mlx5_core] mlx5e_rep_esw_bond_netevent+0xeb/0x3d0 [mlx5_core] raw_notifier_call_chain+0x41/0x60 call_netdevice_notifiers_info+0x34/0x80 netdev_lower_state_changed+0x4e/0xa0 bond_mii_monitor+0x56b/0x640 [bonding] process_one_work+0x1b9/0x390 worker_thread+0x4d/0x3d0 ? rescuer_thread+0x350/0x350 kthread+0x124/0x150 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x1f/0x30 (CVE-2022-48746)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48746
https://ubuntu.com/security/CVE-2022-48746

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48746

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225782 - Linux Distros Unpatched Vulnerability : CVE-2022-48751
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/smc: Transitional solution for clcsock race issue We encountered a crash in smc_setsockopt() and it is caused by accessing smc->clcsock after clcsock was released. BUG: kernel NULL pointer dereference, address: 0000000000000020 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 50309 Comm: nginx Kdump: loaded Tainted: G E 5.16.0-rc4+ #53 RIP: 0010:smc_setsockopt+0x59/0x280 [smc] Call Trace: <TASK> __sys_setsockopt+0xfc/0x190
__x64_sys_setsockopt+0x20/0x30 do_syscall_64+0x34/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP:
0033:0x7f16ba83918e </TASK> This patch tries to fix it by holding clcsock_release_lock and checking whether clcsock has already been released before access. In case that a crash of the same reason happens in smc_getsockopt() or smc_switch_to_fallback(), this patch also checkes smc->clcsock in them too. And the caller of smc_switch_to_fallback() will identify whether fallback succeeds according to the return value.
(CVE-2022-48751)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48751
https://security-tracker.debian.org/tracker/CVE-2022-48751
https://ubuntu.com/security/CVE-2022-48751

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48751

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225382 - Linux Distros Unpatched Vulnerability : CVE-2022-48752
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: powerpc/perf: Fix power_pmu_disable to call clear_pmi_irq_pending only if PMI is pending Running selftest with CONFIG_PPC_IRQ_SOFT_MASK_DEBUG enabled in kernel triggered below warning: [ 172.851380] ------------[ cut here ]------------ [ 172.851391] WARNING: CPU: 8 PID: 2901 at arch/powerpc/include/asm/hw_irq.h:246 power_pmu_disable+0x270/0x280 [ 172.851402] Modules linked in: dm_mod bonding nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables rfkill nfnetlink sunrpc xfs libcrc32c pseries_rng xts vmx_crypto uio_pdrv_genirq uio sch_fq_codel ip_tables ext4 mbcache jbd2 sd_mod t10_pi sg ibmvscsi ibmveth scsi_transport_srp fuse [ 172.851442] CPU: 8 PID: 2901 Comm: lost_exception_ Not tainted 5.16.0-rc5-03218-g798527287598 #2 [ 172.851451] NIP: c00000000013d600 LR: c00000000013d5a4 CTR:
c00000000013b180 [ 172.851458] REGS: c000000017687860 TRAP: 0700 Not tainted (5.16.0-rc5-03218-g798527287598) [ 172.851465] MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 48004884 XER: 20040000 [ 172.851482] CFAR: c00000000013d5b4 IRQMASK: 1 [ 172.851482] GPR00: c00000000013d5a4 c000000017687b00 c000000002a10600 0000000000000004 [ 172.851482] GPR04: 0000000082004000 c0000008ba08f0a8 0000000000000000 00000008b7ed0000 [ 172.851482] GPR08: 00000000446194f6 0000000000008000 c00000000013b118 c000000000d58e68 [ 172.851482] GPR12: c00000000013d390 c00000001ec54a80 0000000000000000 0000000000000000 [ 172.851482] GPR16: 0000000000000000 0000000000000000 c000000015d5c708 c0000000025396d0 [ 172.851482] GPR20: 0000000000000000 0000000000000000 c00000000a3bbf40 0000000000000003 [ 172.851482] GPR24:
0000000000000000 c0000008ba097400 c0000000161e0d00 c00000000a3bb600 [ 172.851482] GPR28: c000000015d5c700 0000000000000001 0000000082384090 c0000008ba0020d8 [ 172.851549] NIP [c00000000013d600] power_pmu_disable+0x270/0x280 [ 172.851557] LR [c00000000013d5a4] power_pmu_disable+0x214/0x280 [ 172.851565] Call Trace: [ 172.851568] [c000000017687b00] [c00000000013d5a4] power_pmu_disable+0x214/0x280 (unreliable) [ 172.851579] [c000000017687b40] [c0000000003403ac] perf_pmu_disable+0x4c/0x60 [ 172.851588] [c000000017687b60] [c0000000003445e4] __perf_event_task_sched_out+0x1d4/0x660 [ 172.851596] [c000000017687c50] [c000000000d1175c] __schedule+0xbcc/0x12a0 [ 172.851602] [c000000017687d60] [c000000000d11ea8] schedule+0x78/0x140 [ 172.851608] [c000000017687d90] [c0000000001a8080] sys_sched_yield+0x20/0x40 [ 172.851615] [c000000017687db0] [c0000000000334dc] system_call_exception+0x18c/0x380 [ 172.851622] [c000000017687e10] [c00000000000c74c] system_call_common+0xec/0x268 The warning indicates that MSR_EE being set(interrupt enabled) when there was an overflown PMC detected. This could happen in power_pmu_disable since it runs under interrupt soft disable condition ( local_irq_save ) and not with interrupts hard disabled. commit 2c9ac51b850d (powerpc/perf: Fix PMU callbacks to clear pending PMI before resetting an overflown PMC) intended to clear PMI pending bit in Paca when disabling the PMU. It could happen that PMC gets overflown while code is in power_pmu_disable callback function. Hence add a check to see if PMI pending bit is set in Paca before clearing it via clear_pmi_pending. (CVE-2022-48752)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48752
https://ubuntu.com/security/CVE-2022-48752

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48752

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225255 - Linux Distros Unpatched Vulnerability : CVE-2022-48761
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: xhci-plat: fix crash when suspend if remote wake enable Crashed at i.mx8qm platform when suspend if enable remote wakeup Internal error: synchronous external abort: 96000210 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 244 Comm: kworker/u12:6 Not tainted 5.15.5-dirty #12 Hardware name: Freescale i.MX8QM MEK (DT) Workqueue: events_unbound async_run_entry_fn pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : xhci_disable_hub_port_wake.isra.62+0x60/0xf8 lr :
xhci_disable_hub_port_wake.isra.62+0x34/0xf8 sp : ffff80001394bbf0 x29: ffff80001394bbf0 x28:
0000000000000000 x27: ffff00081193b578 x26: ffff00081193b570 x25: 0000000000000000 x24: 0000000000000000 x23: ffff00081193a29c x22: 0000000000020001 x21: 0000000000000001 x20: 0000000000000000 x19:
ffff800014e90490 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000002 x12: 0000000000000000 x11: 0000000000000000 x10:
0000000000000960 x9 : ffff80001394baa0 x8 : ffff0008145d1780 x7 : ffff0008f95b8e80 x6 : 000000001853b453 x5 : 0000000000000496 x4 : 0000000000000000 x3 : ffff00081193a29c x2 : 0000000000000001 x1 :
0000000000000000 x0 : ffff000814591620 Call trace: xhci_disable_hub_port_wake.isra.62+0x60/0xf8 xhci_suspend+0x58/0x510 xhci_plat_suspend+0x50/0x78 platform_pm_suspend+0x2c/0x78 dpm_run_callback.isra.25+0x50/0xe8 __device_suspend+0x108/0x3c0 The basic flow: 1. run time suspend call xhci_suspend, xhci parent devices gate the clock. 2. echo mem >/sys/power/state, system _device_suspend call xhci_suspend 3. xhci_suspend call xhci_disable_hub_port_wake, which access register, but clock already gated by run time suspend. This problem was hidden by power domain driver, which call run time resume before it. But the below commit remove it and make this issue happen. commit c1df456d0f06e (PM:
domains: Don't runtime resume devices at genpd_prepare()) This patch call run time resume before suspend to make sure clock is on before access register. Testeb-by: Abel Vesa <abel.vesa@nxp.com> (CVE-2022-48761)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48761
https://ubuntu.com/security/CVE-2022-48761

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.2
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48761

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225491 - Linux Distros Unpatched Vulnerability : CVE-2022-48763
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- KVM: x86: Forcibly leave nested virt when SMM state is toggled Forcibly leave nested virtualization operation if userspace toggles SMM state via KVM_SET_VCPU_EVENTS or KVM_SYNC_X86_EVENTS. If userspace forces the vCPU out of SMM while it's post-VMXON and then injects an SMI, vmx_enter_smm() will overwrite vmx->nested.smm.vmxon and end up with both vmxon=false and smm.vmxon=false, but all other nVMX state allocated. Don't attempt to gracefully handle the transition as (a) most transitions are nonsencial, e.g.
forcing SMM while L2 is running, (b) there isn't sufficient information to handle all transitions, e.g.
SVM wants access to the SMRAM save state, and (c) KVM_SET_VCPU_EVENTS must precede KVM_SET_NESTED_STATE during state restore as the latter disallows putting the vCPU into L2 if SMM is active, and disallows tagging the vCPU as being post-VMXON in SMM if SMM is not active. Abuse of KVM_SET_VCPU_EVENTS manifests as a WARN and memory leak in nVMX due to failure to free vmcs01's shadow VMCS, but the bug goes far beyond just a memory leak, e.g. toggling SMM on while L2 is active puts the vCPU in an architecturally impossible state. WARNING: CPU: 0 PID: 3606 at free_loaded_vmcs arch/x86/kvm/vmx/vmx.c:2665 [inline] WARNING: CPU: 0 PID: 3606 at free_loaded_vmcs+0x158/0x1a0 arch/x86/kvm/vmx/vmx.c:2656 Modules linked in: CPU: 1 PID: 3606 Comm: syz-executor725 Not tainted 5.17.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:free_loaded_vmcs arch/x86/kvm/vmx/vmx.c:2665 [inline] RIP: 0010:free_loaded_vmcs+0x158/0x1a0 arch/x86/kvm/vmx/vmx.c:2656 Code: <0f> 0b eb b3 e8 8f 4d 9f 00 e9 f7 fe ff ff 48 89 df e8 92 4d 9f 00 Call Trace: <TASK>
kvm_arch_vcpu_destroy+0x72/0x2f0 arch/x86/kvm/x86.c:11123 kvm_vcpu_destroy arch/x86/kvm/../../../virt/kvm/kvm_main.c:441 [inline] kvm_destroy_vcpus+0x11f/0x290 arch/x86/kvm/../../../virt/kvm/kvm_main.c:460 kvm_free_vcpus arch/x86/kvm/x86.c:11564 [inline] kvm_arch_destroy_vm+0x2e8/0x470 arch/x86/kvm/x86.c:11676 kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:1217 [inline] kvm_put_kvm+0x4fa/0xb00 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1250 kvm_vm_release+0x3f/0x50 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1273 __fput+0x286/0x9f0 fs/file_table.c:311 task_work_run+0xdd/0x1a0 kernel/task_work.c:164 exit_task_work include/linux/task_work.h:32 [inline] do_exit+0xb29/0x2a30 kernel/exit.c:806 do_group_exit+0xd2/0x2f0 kernel/exit.c:935 get_signal+0x4b0/0x28c0 kernel/signal.c:2862 arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:868 handle_signal_work kernel/entry/common.c:148 [inline] exit_to_user_mode_loop kernel/entry/common.c:172 [inline] exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:207 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline] syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae </TASK>
(CVE-2022-48763)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48763
https://ubuntu.com/security/CVE-2022-48763

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48763

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225621 - Linux Distros Unpatched Vulnerability : CVE-2022-48764
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Free kvm_cpuid_entry2 array on post-KVM_RUN KVM_SET_CPUID{,2} Free the struct kvm_cpuid_entry2 array on successful post-KVM_RUN KVM_SET_CPUID{,2} to fix a memory leak, the callers of kvm_set_cpuid() free the array only on failure.
BUG: memory leak unreferenced object 0xffff88810963a800 (size 2048): comm syz-executor025, pid 3610, jiffies 4294944928 (age 8.080s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 0d 00 00 00 ................ 47 65 6e 75 6e 74 65 6c 69 6e 65 49 00 00 00 00 GenuntelineI.... backtrace:
[<ffffffff814948ee>] kmalloc_node include/linux/slab.h:604 [inline] [<ffffffff814948ee>] kvmalloc_node+0x3e/0x100 mm/util.c:580 [<ffffffff814950f2>] kvmalloc include/linux/slab.h:732 [inline] [<ffffffff814950f2>] vmemdup_user+0x22/0x100 mm/util.c:199 [<ffffffff8109f5ff>] kvm_vcpu_ioctl_set_cpuid2+0x8f/0xf0 arch/x86/kvm/cpuid.c:423 [<ffffffff810711b9>] kvm_arch_vcpu_ioctl+0xb99/0x1e60 arch/x86/kvm/x86.c:5251 [<ffffffff8103e92d>] kvm_vcpu_ioctl+0x4ad/0x950 arch/x86/kvm/../../../virt/kvm/kvm_main.c:4066 [<ffffffff815afacc>] vfs_ioctl fs/ioctl.c:51 [inline] [<ffffffff815afacc>] __do_sys_ioctl fs/ioctl.c:874 [inline] [<ffffffff815afacc>] __se_sys_ioctl fs/ioctl.c:860 [inline] [<ffffffff815afacc>] __x64_sys_ioctl+0xfc/0x140 fs/ioctl.c:860 [<ffffffff844a3335>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<ffffffff844a3335>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [<ffffffff84600068>] entry_SYSCALL_64_after_hwframe+0x44/0xae (CVE-2022-48764)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48764
https://ubuntu.com/security/CVE-2022-48764

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
4.6 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.2
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48764

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225232 - Linux Distros Unpatched Vulnerability : CVE-2022-48767
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ceph: properly put ceph_string reference after async create attempt The reference acquired by try_prep_async_create is currently leaked.
Ensure we put it. (CVE-2022-48767)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48767
https://ubuntu.com/security/CVE-2022-48767

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
4.6 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48767

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249664 - Linux Distros Unpatched Vulnerability : CVE-2022-48768
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tracing/histogram: Fix a potential memory leak for kstrdup() kfree() is missing on an error path to free the memory allocated by kstrdup(): p = param = kstrdup(data->params[i], GFP_KERNEL); So it is better to free it via kfree(p). (CVE-2022-48768)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48768
https://ubuntu.com/security/CVE-2022-48768

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48768

Plugin Information
Published: 2025/08/15, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225604 - Linux Distros Unpatched Vulnerability : CVE-2022-48769
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- efi: runtime: avoid EFIv2 runtime services on Apple x86 machines Aditya reports [0] that his recent MacbookPro crashes in the firmware when using the variable services at runtime. The culprit appears to be a call to QueryVariableInfo(), which we did not use to call on Apple x86 machines in the past as they only upgraded from EFI v1.10 to EFI v2.40 firmware fairly recently, and QueryVariableInfo() (along with UpdateCapsule() et al) was added in EFI v2.00. The only runtime service introduced in EFI v2.00 that we actually use in Linux is QueryVariableInfo(), as the capsule based ones are optional, generally not used at runtime (all the LVFS/fwupd firmware update infrastructure uses helper EFI programs that invoke capsule update at boot time, not runtime), and not implemented by Apple machines in the first place.
QueryVariableInfo() is used to 'safely' set variables, i.e., only when there is enough space. This prevents machines with buggy firmwares from corrupting their NVRAMs when they run out of space. Given that Apple machines have been using EFI v1.10 services only for the longest time (the EFI v2.0 spec was released in 2006, and Linux support for the newly introduced runtime services was added in 2011, but the MacbookPro12,1 released in 2015 still claims to be EFI v1.10 only), let's avoid the EFI v2.0 ones on all Apple x86 machines. [0] https://lore.kernel.org/all/6D757C75-65B1-468B-842D-10410081A8E4@live.com/ (CVE-2022-48769)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48769
https://ubuntu.com/security/CVE-2022-48769

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48769

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225168 - Linux Distros Unpatched Vulnerability : CVE-2022-48770
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf: Guard against accessing NULL pt_regs in bpf_get_task_stack() task_pt_regs() can return NULL on powerpc for kernel threads. This is then used in __bpf_get_stack() to check for user mode, resulting in a kernel oops. Guard against this by checking return value of task_pt_regs() before trying to obtain the call chain. (CVE-2022-48770)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48770
https://ubuntu.com/security/CVE-2022-48770

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48770

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225309 - Linux Distros Unpatched Vulnerability : CVE-2022-48773
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create If there are failures then we must not leave the non-NULL pointers with the error value, otherwise `rpcrdma_ep_destroy` gets confused and tries free them, resulting in an Oops.
(CVE-2022-48773)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48773
https://ubuntu.com/security/CVE-2022-48773

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48773

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225706 - Linux Distros Unpatched Vulnerability : CVE-2022-48781
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - get rid of alg_memory_allocated alg_memory_allocated does not seem to be really used. alg_proto does have a .memory_allocated field, but no corresponding .sysctl_mem. This means sk_has_account() returns true, but all sk_prot_mem_limits() users will trigger a NULL dereference [1]. THis was not a problem until SO_RESERVE_MEM addition. general protection fault, probably for non-canonical address 0xdffffc0000000001:
0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 3591 Comm: syz-executor153 Not tainted 5.17.0-rc3-syzkaller-00316-gb81b1829e7e3 #0 Hardware name:
Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:sk_prot_mem_limits include/net/sock.h:1523 [inline] RIP: 0010:sock_reserve_memory+0x1d7/0x330 net/core/sock.c:1000 Code: 08 00 74 08 48 89 ef e8 27 20 bb f9 4c 03 7c 24 10 48 8b 6d 00 48 83 c5 08 48 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 ef e8 fb 1f bb f9 48 8b 6d 00 4c 89 ff 48 RSP:
0018:ffffc90001f1fb68 EFLAGS: 00010202 RAX: 0000000000000001 RBX: ffff88814aabc000 RCX: dffffc0000000000 RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffff90e18120 RBP: 0000000000000008 R08:
dffffc0000000000 R09: fffffbfff21c3025 R10: fffffbfff21c3025 R11: 0000000000000000 R12: ffffffff8d109840 R13: 0000000000001002 R14: 0000000000000001 R15: 0000000000000001 FS: 0000555556e08300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
00007fc74416f130 CR3: 0000000073d9e000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK>
sock_setsockopt+0x14a9/0x3a30 net/core/sock.c:1446 __sys_setsockopt+0x5af/0x980 net/socket.c:2176
__do_sys_setsockopt net/socket.c:2191 [inline] __se_sys_setsockopt net/socket.c:2188 [inline]
__x64_sys_setsockopt+0xb1/0xc0 net/socket.c:2188 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP:
0033:0x7fc7440fddc9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffe98f07968 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX:
0000000000000003 RCX: 00007fc7440fddc9 RDX: 0000000000000049 RSI: 0000000000000001 RDI: 0000000000000004 RBP: 0000000000000000 R08: 0000000000000004 R09: 00007ffe98f07990 R10: 0000000020000000 R11:
0000000000000246 R12: 00007ffe98f0798c R13: 00007ffe98f079a0 R14: 00007ffe98f079e0 R15: 0000000000000000 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:sk_prot_mem_limits include/net/sock.h:1523 [inline] RIP: 0010:sock_reserve_memory+0x1d7/0x330 net/core/sock.c:1000 Code: 08 00 74 08 48 89 ef e8 27 20 bb f9 4c 03 7c 24 10 48 8b 6d 00 48 83 c5 08 48 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 ef e8 fb 1f bb f9 48 8b 6d 00 4c 89 ff 48 RSP:
0018:ffffc90001f1fb68 EFLAGS: 00010202 RAX: 0000000000000001 RBX: ffff88814aabc000 RCX: dffffc0000000000 RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffff90e18120 RBP: 0000000000000008 R08:
dffffc0000000000 R09: fffffbfff21c3025 R10: fffffbfff21c3025 R11: 0000000000000000 R12: ffffffff8d109840 R13: 0000000000001002 R14: 0000000000000001 R15: 0000000000000001 FS: 0000555556e08300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
00007fc74416f130 CR3: 0000000073d9e000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 (CVE-2022-48781)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48781
https://ubuntu.com/security/CVE-2022-48781

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48781

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225727 - Linux Distros Unpatched Vulnerability : CVE-2022-48784
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cfg80211: fix race in netlink owner interface destruction My previous fix here to fix the deadlock left a race where the exact same deadlock (see the original commit referenced below) can still happen if cfg80211_destroy_ifaces() already runs while nl80211_netlink_notify() is still marking some interfaces as nl_owner_dead. The race happens because we have two loops here - first we dev_close() all the netdevs, and then we destroy them. If we also have two netdevs (first one need only be a wdev though) then we can find one during the first iteration, close it, and go to the second iteration -- but then find two, and try to destroy also the one we didn't close yet. Fix this by only iterating once. (CVE-2022-48784)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48784
https://ubuntu.com/security/CVE-2022-48784

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48784

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225557 - Linux Distros Unpatched Vulnerability : CVE-2022-48793
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: KVM: x86: nSVM: fix potential NULL derefernce on nested migration Turns out that due to review feedback and/or rebases I accidentally moved the call to nested_svm_load_cr3 to be too early, before the NPT is enabled, which is very wrong to do. KVM can't even access guest memory at that point as nested NPT is needed for that, and of course it won't initialize the walk_mmu, which is main issue the patch was addressing. Fix this for real. (CVE-2022-48793)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48793
https://ubuntu.com/security/CVE-2022-48793

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48793

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225356 - Linux Distros Unpatched Vulnerability : CVE-2022-48797
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mm: don't try to NUMA-migrate COW pages that have other uses Oded Gabbay reports that enabling NUMA balancing causes corruption with his Gaudi accelerator test load: All the details are in the bug, but the bottom line is that somehow, this patch causes corruption when the numa balancing feature is enabled AND we don't use process affinity AND we use GUP to pin pages so our accelerator can DMA to/from system memory. Either disabling numa balancing, using process affinity to bind to specific numa-node or reverting this patch causes the bug to disappear and Oded bisected the issue to commit 09854ba94c6a (mm: do_wp_page() simplification). Now, the NUMA balancing shouldn't actually be changing the writability of a page, and as such shouldn't matter for COW.
But it appears it does. Suspicious. However, regardless of that, the condition for enabling NUMA faults in change_pte_range() is nonsensical. It uses page_mapcount(page) to decide if a COW page should be NUMA- protected or not, and that makes absolutely no sense. The number of mappings a page has is irrelevant: not only does GUP get a reference to a page as in Oded's case, but the other mappings migth be paged out and the only reference to them would be in the page count. Since we should never try to NUMA-balance a page that we can't move anyway due to other references, just fix the code to use 'page_count()'. Oded confirms that that fixes his issue. Now, this does imply that something in NUMA balancing ends up changing page protections (other than the obvious one of making the page inaccessible to get the NUMA faulting information). Otherwise the COW simplification wouldn't matter - since doing the GUP on the page would make sure it's writable. The cause of that permission change would be good to figure out too, since it clearly results in spurious COW events - but fixing the nonsensical test that just happened to work before is obviously the CorrectThing(tm) to do regardless. (CVE-2022-48797)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48797
https://ubuntu.com/security/CVE-2022-48797

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48797

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225431 - Linux Distros Unpatched Vulnerability : CVE-2022-48799
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: perf: Fix list corruption in perf_cgroup_switch() There's list corruption on cgrp_cpuctx_list. This happens on the following path:
perf_cgroup_switch: list_for_each_entry(cgrp_cpuctx_list) cpu_ctx_sched_in ctx_sched_in ctx_pinned_sched_in merge_sched_in perf_cgroup_event_disable: remove the event from the list Use list_for_each_entry_safe() to allow removing an entry during iteration. (CVE-2022-48799)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48799
https://ubuntu.com/security/CVE-2022-48799

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0009
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48799

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225204 - Linux Distros Unpatched Vulnerability : CVE-2022-48800
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mm: vmscan: remove deadlock due to throttling failing to make progress A soft lockup bug in kcompactd was reported in a private bugzilla with the following visible in dmesg; watchdog: BUG: soft lockup - CPU#33 stuck for 26s! [kcompactd0:479] watchdog: BUG: soft lockup - CPU#33 stuck for 52s! [kcompactd0:479] watchdog: BUG: soft lockup - CPU#33 stuck for 78s! [kcompactd0:479] watchdog: BUG: soft lockup - CPU#33 stuck for 104s! [kcompactd0:479] The machine had 256G of RAM with no swap and an earlier failed allocation indicated that node 0 where kcompactd was run was potentially unreclaimable; Node 0 active_anon:29355112kB inactive_anon:2913528kB active_file:0kB inactive_file:0kB unevictable:64kB isolated(anon):0kB isolated(file):0kB mapped:8kB dirty:0kB writeback:0kB shmem:26780kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 23480320kB writeback_tmp:0kB kernel_stack:2272kB pagetables:24500kB all_unreclaimable? yes Vlastimil Babka investigated a crash dump and found that a task migrating pages was trying to drain PCP lists; PID: 52922 TASK: ffff969f820e5000 CPU: 19 COMMAND: kworker/u128:3 Call Trace: __schedule schedule schedule_timeout wait_for_completion __flush_work __drain_all_pages __alloc_pages_slowpath.constprop.114 __alloc_pages alloc_migration_target migrate_pages migrate_to_node do_migrate_pages cpuset_migrate_mm_workfn process_one_work worker_thread kthread ret_from_fork This failure is specific to CONFIG_PREEMPT=n builds.
The root of the problem is that kcompact0 is not rescheduling on a CPU while a task that has isolated a large number of the pages from the LRU is waiting on kcompact0 to reschedule so the pages can be released.
While shrink_inactive_list() only loops once around too_many_isolated, reclaim can continue without rescheduling if sc->skipped_deactivate == 1 which could happen if there was no file LRU and the inactive anon list was not low. (CVE-2022-48800)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48800
https://ubuntu.com/security/CVE-2022-48800

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48800

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225732 - Linux Distros Unpatched Vulnerability : CVE-2022-48802
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fs/proc: task_mmu.c: don't read mapcount for migration entry The syzbot reported the below BUG: kernel BUG at include/linux/page-flags.h:785! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 4392 Comm: syz- executor560 Not tainted 5.16.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:PageDoubleMap include/linux/page-flags.h:785 [inline] RIP:
0010:__page_mapcount+0x2d2/0x350 mm/util.c:744 Call Trace: page_mapcount include/linux/mm.h:837 [inline] smaps_account+0x470/0xb10 fs/proc/task_mmu.c:466 smaps_pte_entry fs/proc/task_mmu.c:538 [inline] smaps_pte_range+0x611/0x1250 fs/proc/task_mmu.c:601 walk_pmd_range mm/pagewalk.c:128 [inline] walk_pud_range mm/pagewalk.c:205 [inline] walk_p4d_range mm/pagewalk.c:240 [inline] walk_pgd_range mm/pagewalk.c:277 [inline] __walk_page_range+0xe23/0x1ea0 mm/pagewalk.c:379 walk_page_vma+0x277/0x350 mm/pagewalk.c:530 smap_gather_stats.part.0+0x148/0x260 fs/proc/task_mmu.c:768 smap_gather_stats fs/proc/task_mmu.c:741 [inline] show_smap+0xc6/0x440 fs/proc/task_mmu.c:822 seq_read_iter+0xbb0/0x1240 fs/seq_file.c:272 seq_read+0x3e0/0x5b0 fs/seq_file.c:162 vfs_read+0x1b5/0x600 fs/read_write.c:479 ksys_read+0x12d/0x250 fs/read_write.c:619 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae The reproducer was trying to read /proc/$PID/smaps when calling MADV_FREE at the mean time. MADV_FREE may split THPs if it is called for partial THP. It may trigger the below race: CPU A CPU B ----- ----- smaps walk:
MADV_FREE: page_mapcount() PageCompound() split_huge_page() page = compound_head(page) PageDoubleMap(page) When calling PageDoubleMap() this page is not a tail page of THP anymore so the BUG is triggered. This could be fixed by elevated refcount of the page before calling mapcount, but that would prevent it from counting migration entries, and it seems overkilling because the race just could happen when PMD is split so all PTE entries of tail pages are actually migration entries, and smaps_account() does treat migration entries as mapcount == 1 as Kirill pointed out. Add a new parameter for smaps_account() to tell this entry is migration entry then skip calling page_mapcount(). Don't skip getting mapcount for device private entries since they do track references with mapcount. Pagemap also has the similar issue although it was not reported. Fixed it as well. [shy828301@gmail.com: v4] [nathan@kernel.org: avoid unused variable warning in pagemap_pmd_range()] (CVE-2022-48802)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48802
https://ubuntu.com/security/CVE-2022-48802

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48802

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225756 - Linux Distros Unpatched Vulnerability : CVE-2022-48806
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX Commit effa453168a7 (i2c: i801: Don't silently correct invalid transfer size) revealed that ee1004_eeprom_read() did not properly limit how many bytes to read at once. In particular, i2c_smbus_read_i2c_block_data_or_emulated() takes the length to read as an u8. If count == 256 after taking into account the offset and page boundary, the cast to u8 overflows. And this is common when user space tries to read the entire EEPROM at once. To fix it, limit each read to I2C_SMBUS_BLOCK_MAX (32) bytes, already the maximum length i2c_smbus_read_i2c_block_data_or_emulated() allows. (CVE-2022-48806)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48806
https://ubuntu.com/security/CVE-2022-48806

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0009
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48806

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225517 - Linux Distros Unpatched Vulnerability : CVE-2022-48809
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: fix a memleak when uncloning an skb dst and its metadata When uncloning an skb dst and its associated metadata, a new dst+metadata is allocated and later replaces the old one in the skb. This is helpful to have a non-shared dst+metadata attached to a specific skb. The issue is the uncloned dst+metadata is initialized with a refcount of 1, which is increased to 2 before attaching it to the skb. When tun_dst_unclone returns, the dst+metadata is only referenced from a single place (the skb) while its refcount is 2. Its refcount will never drop to 0 (when the skb is consumed), leading to a memory leak. Fix this by removing the call to dst_hold in tun_dst_unclone, as the dst+metadata refcount is already 1.
(CVE-2022-48809)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48809
https://ubuntu.com/security/CVE-2022-48809

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48809

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225566 - Linux Distros Unpatched Vulnerability : CVE-2022-48810
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path ip[6]mr_free_table() can only be called under RTNL lock. RTNL: assertion failed at net/core/dev.c (10367) WARNING: CPU: 1 PID: 5890 at net/core/dev.c:10367 unregister_netdevice_many+0x1246/0x1850 net/core/dev.c:10367 Modules linked in: CPU:
1 PID: 5890 Comm: syz-executor.2 Not tainted 5.16.0-syzkaller-11627-g422ee58dc0ef #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP:
0010:unregister_netdevice_many+0x1246/0x1850 net/core/dev.c:10367 Code: 0f 85 9b ee ff ff e8 69 07 4b fa ba 7f 28 00 00 48 c7 c6 00 90 ae 8a 48 c7 c7 40 90 ae 8a c6 05 6d b1 51 06 01 e8 8c 90 d8 01 <0f> 0b e9 70 ee ff ff e8 3e 07 4b fa 4c 89 e7 e8 86 2a 59 fa e9 ee RSP: 0018:ffffc900046ff6e0 EFLAGS: 00010286 RAX:
0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff888050f51d00 RSI: ffffffff815fa008 RDI: fffff520008dfece RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10:
ffffffff815f3d6e R11: 0000000000000000 R12: 00000000fffffff4 R13: dffffc0000000000 R14: ffffc900046ff750 R15: ffff88807b7dc000 FS: 00007f4ab736e700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fee0b4f8990 CR3: 000000001e7d2000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6:
00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> mroute_clean_tables+0x244/0xb40 net/ipv6/ip6mr.c:1509 ip6mr_free_table net/ipv6/ip6mr.c:389 [inline] ip6mr_rules_init net/ipv6/ip6mr.c:246 [inline] ip6mr_net_init net/ipv6/ip6mr.c:1306 [inline] ip6mr_net_init+0x3f0/0x4e0 net/ipv6/ip6mr.c:1298 ops_init+0xaf/0x470 net/core/net_namespace.c:140 setup_net+0x54f/0xbb0 net/core/net_namespace.c:331 copy_net_ns+0x318/0x760 net/core/net_namespace.c:475 create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110 copy_namespaces+0x391/0x450 kernel/nsproxy.c:178 copy_process+0x2e0c/0x7300 kernel/fork.c:2167 kernel_clone+0xe7/0xab0 kernel/fork.c:2555 __do_sys_clone+0xc8/0x110 kernel/fork.c:2672 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f4ab89f9059 Code: Unable to access opcode bytes at RIP 0x7f4ab89f902f. RSP: 002b:00007f4ab736e118 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 RAX:
ffffffffffffffda RBX: 00007f4ab8b0bf60 RCX: 00007f4ab89f9059 RDX: 0000000020000280 RSI: 0000000020000270 RDI: 0000000040200000 RBP: 00007f4ab8a5308d R08: 0000000020000300 R09: 0000000020000300 R10:
00000000200002c0 R11: 0000000000000206 R12: 0000000000000000 R13: 00007ffc3977cc1f R14: 00007f4ab736e300 R15: 0000000000022000 </TASK> (CVE-2022-48810)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48810
https://ubuntu.com/security/CVE-2022-48810

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0009
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48810

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225351 - Linux Distros Unpatched Vulnerability : CVE-2022-48811
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ibmvnic: don't release napi in __ibmvnic_open() If __ibmvnic_open() encounters an error such as when setting link state, it calls release_resources() which frees the napi structures needlessly. Instead, have
__ibmvnic_open() only clean up the work it did so far (i.e. disable napi and irqs) and leave the rest to the callers. If caller of __ibmvnic_open() is ibmvnic_open(), it should release the resources immediately.
If the caller is do_reset() or do_hard_reset(), they will release the resources on the next reset. This fixes following crash that occurred when running the drmgr command several times to add/remove a vnic interface: [102056] ibmvnic 30000003 env3: Disabling rx_scrq[6] irq [102056] ibmvnic 30000003 env3:
Disabling rx_scrq[7] irq [102056] ibmvnic 30000003 env3: Replenished 8 pools Kernel attempted to read user page (10) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x00000010 Faulting instruction address: 0xc000000000a3c840 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries ... CPU: 9 PID: 102056 Comm: kworker/9:2 Kdump: loaded Not tainted 5.16.0-rc5-autotest-g6441998e2e37 #1 Workqueue: events_long __ibmvnic_reset [ibmvnic] NIP:
c000000000a3c840 LR: c0080000029b5378 CTR: c000000000a3c820 REGS: c0000000548e37e0 TRAP: 0300 Not tainted (5.16.0-rc5-autotest-g6441998e2e37) MSR: 8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 28248484 XER:
00000004 CFAR: c0080000029bdd24 DAR: 0000000000000010 DSISR: 40000000 IRQMASK: 0 GPR00: c0080000029b55d0 c0000000548e3a80 c0000000028f0200 0000000000000000 ... NIP [c000000000a3c840] napi_enable+0x20/0xc0 LR [c0080000029b5378] __ibmvnic_open+0xf0/0x430 [ibmvnic] Call Trace: [c0000000548e3a80] [0000000000000006] 0x6 (unreliable) [c0000000548e3ab0] [c0080000029b55d0] __ibmvnic_open+0x348/0x430 [ibmvnic] [c0000000548e3b40] [c0080000029bcc28] __ibmvnic_reset+0x500/0xdf0 [ibmvnic] [c0000000548e3c60] [c000000000176228] process_one_work+0x288/0x570 [c0000000548e3d00] [c000000000176588] worker_thread+0x78/0x660 [c0000000548e3da0] [c0000000001822f0] kthread+0x1c0/0x1d0 [c0000000548e3e10] [c00000000000cf64] ret_from_kernel_thread+0x5c/0x64 Instruction dump: 7d2948f8 792307e0 4e800020 60000000 3c4c01eb 384239e0 f821ffd1 39430010 38a0fff6 e92d1100 f9210028 39200000 <e9030010> f9010020 60420000 e9210020 ---[ end trace 5f8033b08fd27706 ]--- (CVE-2022-48811)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48811
https://security-tracker.debian.org/tracker/CVE-2022-48811
https://ubuntu.com/security/CVE-2022-48811

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48811

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225183 - Linux Distros Unpatched Vulnerability : CVE-2022-48812
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: dsa: lantiq_gswip: don't use devres for mdiobus As explained in commits: 74b6d7d13307 (net: dsa: realtek: register the MDIO bus under devres) 5135e96a3dd2 (net: dsa: don't allocate the slave_mii_bus using devres) mdiobus_free() will panic when called from devm_mdiobus_free() <- devres_release_all() <- __device_release_driver(), and that mdiobus was not previously unregistered. The GSWIP switch is a platform device, so the initial set of constraints that I thought would cause this (I2C or SPI buses which call ->remove on ->shutdown) do not apply. But there is one more which applies here. If the DSA master itself is on a bus that calls ->remove from ->shutdown (like dpaa2-eth, which is on the fsl-mc bus), there is a device link between the switch and the DSA master, and device_links_unbind_consumers() will unbind the GSWIP switch driver on shutdown.
So the same treatment must be applied to all DSA switch drivers, which is: either use devres for both the mdiobus allocation and registration, or don't use devres at all. The gswip driver has the code structure in place for orderly mdiobus removal, so just replace devm_mdiobus_alloc() with the non-devres variant, and add manual free where necessary, to ensure that we don't let devres free a still-registered bus.
(CVE-2022-48812)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48812
https://ubuntu.com/security/CVE-2022-48812

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48812

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225285 - Linux Distros Unpatched Vulnerability : CVE-2022-48813
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: dsa: felix: don't use devres for mdiobus As explained in commits: 74b6d7d13307 (net: dsa: realtek: register the MDIO bus under devres) 5135e96a3dd2 (net: dsa: don't allocate the slave_mii_bus using devres) mdiobus_free() will panic when called from devm_mdiobus_free() <- devres_release_all() <- __device_release_driver(), and that mdiobus was not previously unregistered. The Felix VSC9959 switch is a PCI device, so the initial set of constraints that I thought would cause this (I2C or SPI buses which call ->remove on ->shutdown) do not apply. But there is one more which applies here. If the DSA master itself is on a bus that calls ->remove from
->shutdown (like dpaa2-eth, which is on the fsl-mc bus), there is a device link between the switch and the DSA master, and device_links_unbind_consumers() will unbind the felix switch driver on shutdown. So the same treatment must be applied to all DSA switch drivers, which is: either use devres for both the mdiobus allocation and registration, or don't use devres at all. The felix driver has the code structure in place for orderly mdiobus removal, so just replace devm_mdiobus_alloc_size() with the non-devres variant, and add manual free where necessary, to ensure that we don't let devres free a still-registered bus.
(CVE-2022-48813)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48813
https://ubuntu.com/security/CVE-2022-48813

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48813

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225159 - Linux Distros Unpatched Vulnerability : CVE-2022-48814
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: dsa: seville: register the mdiobus under devres As explained in commits: 74b6d7d13307 (net: dsa:
realtek: register the MDIO bus under devres) 5135e96a3dd2 (net: dsa: don't allocate the slave_mii_bus using devres) mdiobus_free() will panic when called from devm_mdiobus_free() <- devres_release_all() <-
__device_release_driver(), and that mdiobus was not previously unregistered. The Seville VSC9959 switch is a platform device, so the initial set of constraints that I thought would cause this (I2C or SPI buses which call ->remove on ->shutdown) do not apply. But there is one more which applies here. If the DSA master itself is on a bus that calls ->remove from ->shutdown (like dpaa2-eth, which is on the fsl-mc bus), there is a device link between the switch and the DSA master, and device_links_unbind_consumers() will unbind the seville switch driver on shutdown. So the same treatment must be applied to all DSA switch drivers, which is: either use devres for both the mdiobus allocation and registration, or don't use devres at all. The seville driver has a code structure that could accommodate both the mdiobus_unregister and mdiobus_free calls, but it has an external dependency upon mscc_miim_setup() from mdio-mscc-miim.c, which calls devm_mdiobus_alloc_size() on its behalf. So rather than restructuring that, and exporting yet one more symbol mscc_miim_teardown(), let's work with devres and replace of_mdiobus_register with the devres variant. When we use all-devres, we can ensure that devres doesn't free a still-registered bus (it either runs both callbacks, or none). (CVE-2022-48814)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48814
https://security-tracker.debian.org/tracker/CVE-2022-48814
https://ubuntu.com/security/CVE-2022-48814

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48814

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225786 - Linux Distros Unpatched Vulnerability : CVE-2022-48815
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcm_sf2: don't use devres for mdiobus As explained in commits: 74b6d7d13307 (net: dsa: realtek: register the MDIO bus under devres) 5135e96a3dd2 (net: dsa: don't allocate the slave_mii_bus using devres) mdiobus_free() will panic when called from devm_mdiobus_free() <- devres_release_all() <- __device_release_driver(), and that mdiobus was not previously unregistered. The Starfighter 2 is a platform device, so the initial set of constraints that I thought would cause this (I2C or SPI buses which call ->remove on ->shutdown) do not apply. But there is one more which applies here. If the DSA master itself is on a bus that calls ->remove from ->shutdown (like dpaa2-eth, which is on the fsl-mc bus), there is a device link between the switch and the DSA master, and device_links_unbind_consumers() will unbind the bcm_sf2 switch driver on shutdown.
So the same treatment must be applied to all DSA switch drivers, which is: either use devres for both the mdiobus allocation and registration, or don't use devres at all. The bcm_sf2 driver has the code structure in place for orderly mdiobus removal, so just replace devm_mdiobus_alloc() with the non-devres variant, and add manual free where necessary, to ensure that we don't let devres free a still-registered bus.
(CVE-2022-48815)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48815
https://ubuntu.com/security/CVE-2022-48815

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48815

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225434 - Linux Distros Unpatched Vulnerability : CVE-2022-48816
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- SUNRPC: lock against ->sock changing during sysfs read ->sock can be set to NULL asynchronously unless
->recv_mutex is held. So it is important to hold that mutex. Otherwise a sysfs read can trigger an oops.
Commit 17f09d3f619a (SUNRPC: Check if the xprt is connected before handling sysfs reads) appears to attempt to fix this problem, but it only narrows the race window. (CVE-2022-48816)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48816
https://security-tracker.debian.org/tracker/CVE-2022-48816
https://ubuntu.com/security/CVE-2022-48816

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48816

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225670 - Linux Distros Unpatched Vulnerability : CVE-2022-48817
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: dsa: ar9331: register the mdiobus under devres As explained in commits: 74b6d7d13307 (net: dsa: realtek: register the MDIO bus under devres) 5135e96a3dd2 (net: dsa: don't allocate the slave_mii_bus using devres) mdiobus_free() will panic when called from devm_mdiobus_free() <- devres_release_all() <- __device_release_driver(), and that mdiobus was not previously unregistered. The ar9331 is an MDIO device, so the initial set of constraints that I thought would cause this (I2C or SPI buses which call ->remove on ->shutdown) do not apply. But there is one more which applies here. If the DSA master itself is on a bus that calls ->remove from
->shutdown (like dpaa2-eth, which is on the fsl-mc bus), there is a device link between the switch and the DSA master, and device_links_unbind_consumers() will unbind the ar9331 switch driver on shutdown. So the same treatment must be applied to all DSA switch drivers, which is: either use devres for both the mdiobus allocation and registration, or don't use devres at all. The ar9331 driver doesn't have a complex code structure for mdiobus removal, so just replace of_mdiobus_register with the devres variant in order to be all-devres and ensure that we don't free a still-registered bus. (CVE-2022-48817)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48817
https://ubuntu.com/security/CVE-2022-48817

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48817

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225802 - Linux Distros Unpatched Vulnerability : CVE-2022-48818
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: dsa: mv88e6xxx: don't use devres for mdiobus As explained in commits: 74b6d7d13307 (net: dsa:
realtek: register the MDIO bus under devres) 5135e96a3dd2 (net: dsa: don't allocate the slave_mii_bus using devres) mdiobus_free() will panic when called from devm_mdiobus_free() <- devres_release_all() <-
__device_release_driver(), and that mdiobus was not previously unregistered. The mv88e6xxx is an MDIO device, so the initial set of constraints that I thought would cause this (I2C or SPI buses which call
->remove on ->shutdown) do not apply. But there is one more which applies here. If the DSA master itself is on a bus that calls ->remove from ->shutdown (like dpaa2-eth, which is on the fsl-mc bus), there is a device link between the switch and the DSA master, and device_links_unbind_consumers() will unbind the Marvell switch driver on shutdown. systemd-shutdown[1]: Powering off. mv88e6085 0x0000000008b96000:00 sw_gl0: Link is Down fsl-mc dpbp.9: Removing from iommu group 7 fsl-mc dpbp.8: Removing from iommu group 7
------------[ cut here ]------------ kernel BUG at drivers/net/phy/mdio_bus.c:677! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 1 Comm: systemd-shutdow Not tainted 5.16.5-00040-gdc05f73788e5 #15 pc : mdiobus_free+0x44/0x50 lr : devm_mdiobus_free+0x10/0x20 Call trace:
mdiobus_free+0x44/0x50 devm_mdiobus_free+0x10/0x20 devres_release_all+0xa0/0x100
__device_release_driver+0x190/0x220 device_release_driver_internal+0xac/0xb0 device_links_unbind_consumers+0xd4/0x100 __device_release_driver+0x4c/0x220 device_release_driver_internal+0xac/0xb0 device_links_unbind_consumers+0xd4/0x100
__device_release_driver+0x94/0x220 device_release_driver+0x28/0x40 bus_remove_device+0x118/0x124 device_del+0x174/0x420 fsl_mc_device_remove+0x24/0x40 __fsl_mc_device_remove+0xc/0x20 device_for_each_child+0x58/0xa0 dprc_remove+0x90/0xb0 fsl_mc_driver_remove+0x20/0x5c
__device_release_driver+0x21c/0x220 device_release_driver+0x28/0x40 bus_remove_device+0x118/0x124 device_del+0x174/0x420 fsl_mc_bus_remove+0x80/0x100 fsl_mc_bus_shutdown+0xc/0x1c platform_shutdown+0x20/0x30 device_shutdown+0x154/0x330 kernel_power_off+0x34/0x6c
__do_sys_reboot+0x15c/0x250 __arm64_sys_reboot+0x20/0x30 invoke_syscall.constprop.0+0x4c/0xe0 do_el0_svc+0x4c/0x150 el0_svc+0x24/0xb0 el0t_64_sync_handler+0xa8/0xb0 el0t_64_sync+0x178/0x17c So the same treatment must be applied to all DSA switch drivers, which is: either use devres for both the mdiobus allocation and registration, or don't use devres at all. The Marvell driver already has a good structure for mdiobus removal, so just plug in mdiobus_free and get rid of devres. (CVE-2022-48818)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48818
https://ubuntu.com/security/CVE-2022-48818

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48818

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225507 - Linux Distros Unpatched Vulnerability : CVE-2022-48819
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tcp: take care of mixed splice()/sendmsg(MSG_ZEROCOPY) case syzbot found that mixing sendpage() and sendmsg(MSG_ZEROCOPY) calls over the same TCP socket would again trigger the infamous warning in inet_sock_destruct() WARN_ON(sk_forward_alloc_get(sk)); While Talal took into account a mix of regular copied data and MSG_ZEROCOPY one in the same skb, the sendpage() path has been forgotten. We want the charging to happen for sendpage(), because pages could be coming from a pipe. What is missing is the downgrading of pure zerocopy status to make sure sk_forward_alloc will stay synced. Add tcp_downgrade_zcopy_pure() helper so that we can use it from the two callers. (CVE-2022-48819)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48819
https://ubuntu.com/security/CVE-2022-48819

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48819

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225661 - Linux Distros Unpatched Vulnerability : CVE-2022-48823
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: qedf: Fix refcount issue when LOGO is received during TMF Hung task call trace was seen during LOGO processing. [ 974.309060] [0000:00:00.0]:[qedf_eh_device_reset:868]: 1:0:2:0: LUN RESET Issued... [ 974.309065] [0000:00:00.0]:[qedf_initiate_tmf:2422]: tm_flags 0x10 sc_cmd 00000000c16b930f op = 0x2a target_id = 0x2 lun=0 [ 974.309178] [0000:00:00.0]:[qedf_initiate_tmf:2431]: portid=016900 tm_flags =LUN RESET [ 974.309222] [0000:00:00.0]:[qedf_initiate_tmf:2438]: orig io_req = 00000000ec78df8f xid = 0x180 ref_cnt = 1. [ 974.309625] host1: rport 016900: Received LOGO request while in state Ready [ 974.309627] host1: rport 016900: Delete port [ 974.309642] host1: rport 016900: work event 3 [ 974.309644] host1:
rport 016900: lld callback ev 3 [ 974.313243] [0000:61:00.2]:[qedf_execute_tmf:2383]:1: fcport is uploading, not executing flush. [ 974.313295] [0000:61:00.2]:[qedf_execute_tmf:2400]:1: task mgmt command success... [ 984.031088] INFO: task jbd2/dm-15-8:7645 blocked for more than 120 seconds. [ 984.031136] Not tainted 4.18.0-305.el8.x86_64 #1 [ 984.031166] echo 0 > /proc/sys/kernel/hung_task_timeout_secs disables this message. [ 984.031209] jbd2/dm-15-8 D 0 7645 2 0x80004080 [ 984.031212] Call Trace: [ 984.031222]
__schedule+0x2c4/0x700 [ 984.031230] ? unfreeze_partials.isra.83+0x16e/0x1a0 [ 984.031233] ? bit_wait_timeout+0x90/0x90 [ 984.031235] schedule+0x38/0xa0 [ 984.031238] io_schedule+0x12/0x40 [ 984.031240] bit_wait_io+0xd/0x50 [ 984.031243] __wait_on_bit+0x6c/0x80 [ 984.031248] ? free_buffer_head+0x21/0x50 [ 984.031251] out_of_line_wait_on_bit+0x91/0xb0 [ 984.031257] ? init_wait_var_entry+0x50/0x50 [ 984.031268] jbd2_journal_commit_transaction+0x112e/0x19f0 [jbd2] [ 984.031280] kjournald2+0xbd/0x270 [jbd2] [ 984.031284] ? finish_wait+0x80/0x80 [ 984.031291] ? commit_timeout+0x10/0x10 [jbd2] [ 984.031294] kthread+0x116/0x130 [ 984.031300] ? kthread_flush_work_fn+0x10/0x10 [ 984.031305] ret_from_fork+0x1f/0x40 There was a ref count issue when LOGO is received during TMF. This leads to one of the I/Os hanging with the driver. Fix the ref count.
(CVE-2022-48823)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48823
https://ubuntu.com/security/CVE-2022-48823

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48823

Plugin Information
Published: 2025/03/05, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225387 - Linux Distros Unpatched Vulnerability : CVE-2022-48825
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: qedf: Add stag_work to all the vports Call trace seen when creating NPIV ports, only 32 out of 64 show online. stag work was not initialized for vport, hence initialize the stag work. WARNING: CPU: 8 PID:
645 at kernel/workqueue.c:1635 __queue_delayed_work+0x68/0x80 CPU: 8 PID: 645 Comm: kworker/8:1 Kdump:
loaded Tainted: G IOE --------- -- 4.18.0-348.el8.x86_64 #1 Hardware name: Dell Inc. PowerEdge MX740c/0177V9, BIOS 2.12.2 07/09/2021 Workqueue: events fc_lport_timeout [libfc] RIP:
0010:__queue_delayed_work+0x68/0x80 Code: 89 b2 88 00 00 00 44 89 82 90 00 00 00 48 01 c8 48 89 42 50 41 81 f8 00 20 00 00 75 1d e9 60 24 07 00 44 89 c7 e9 98 f6 ff ff <0f> 0b eb c5 0f 0b eb a1 0f 0b eb a7 0f 0b eb ac 44 89 c6 e9 40 23 RSP: 0018:ffffae514bc3be40 EFLAGS: 00010006 RAX: ffff8d25d6143750 RBX:
0000000000000202 RCX: 0000000000000002 RDX: ffff8d2e31383748 RSI: ffff8d25c000d600 RDI: ffff8d2e31383788 RBP: ffff8d2e31380de0 R08: 0000000000002000 R09: ffff8d2e31383750 R10: ffffffffc0c957e0 R11:
ffff8d2624800000 R12: ffff8d2e31380a58 R13: ffff8d2d915eb000 R14: ffff8d25c499b5c0 R15: ffff8d2e31380e18 FS: 0000000000000000(0000) GS:ffff8d2d1fb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055fd0484b8b8 CR3: 00000008ffc10006 CR4: 00000000007706e0 DR0:
0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: queue_delayed_work_on+0x36/0x40 qedf_elsct_send+0x57/0x60 [qedf] fc_lport_enter_flogi+0x90/0xc0 [libfc] fc_lport_timeout+0xb7/0x140 [libfc] process_one_work+0x1a7/0x360 ? create_worker+0x1a0/0x1a0 worker_thread+0x30/0x390 ? create_worker+0x1a0/0x1a0 kthread+0x116/0x130 ? kthread_flush_work_fn+0x10/0x10 ret_from_fork+0x35/0x40
---[ end trace 008f00f722f2c2ff ]-- Initialize stag work for all the vports. (CVE-2022-48825)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48825
https://ubuntu.com/security/CVE-2022-48825

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48825

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225125 - Linux Distros Unpatched Vulnerability : CVE-2022-48832
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: audit: don't deref the syscall args when checking the openat2 open_how::flags As reported by Jeff, dereferencing the openat2 syscall argument in audit_match_perm() to obtain the open_how::flags can result in an oops/page-fault. This patch fixes this by using the open_how struct that we store in the audit_context with audit_openat2_how(). Independent of this patch, Richard Guy Briggs posted a similar patch to the audit mailing list roughly 40 minutes after this patch was posted. (CVE-2022-48832)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48832
https://ubuntu.com/security/CVE-2022-48832

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48832

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225240 - Linux Distros Unpatched Vulnerability : CVE-2022-48835
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Page fault in reply q processing A page fault was encountered in mpt3sas on a LUN reset error path: [ 145.763216] mpt3sas_cm1:
Task abort tm failed: handle(0x0002),timeout(30) tr_method(0x0) smid(3) msix_index(0) [ 145.778932] scsi 1:0:0:0: task abort: FAILED scmd(0x0000000024ba29a2) [ 145.817307] scsi 1:0:0:0: attempting device reset! scmd(0x0000000024ba29a2) [ 145.827253] scsi 1:0:0:0: [sg1] tag#2 CDB: Receive Diagnostic 1c 01 01 ff fc 00 [ 145.837617] scsi target1:0:0: handle(0x0002), sas_address(0x500605b0000272b9), phy(0) [ 145.848598] scsi target1:0:0: enclosure logical id(0x500605b0000272b8), slot(0) [ 149.858378] mpt3sas_cm1: Poll ReplyDescriptor queues for completion of smid(0), task_type(0x05), handle(0x0002) [ 149.875202] BUG:
unable to handle page fault for address: 00000007fffc445d [ 149.885617] #PF: supervisor read access in kernel mode [ 149.894346] #PF: error_code(0x0000) - not-present page [ 149.903123] PGD 0 P4D 0 [ 149.909387] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 149.917417] CPU: 24 PID: 3512 Comm: scsi_eh_1 Kdump:
loaded Tainted: G S O 5.10.89-altav-1 #1 [ 149.934327] Hardware name: DDN 200NVX2 /200NVX2-MB , BIOS ATHG2.2.02.01 09/10/2021 [ 149.951871] RIP: 0010:_base_process_reply_queue+0x4b/0x900 [mpt3sas] [ 149.961889] Code: 0f 84 22 02 00 00 8d 48 01 49 89 fd 48 8d 57 38 f0 0f b1 4f 38 0f 85 d8 01 00 00 49 8b 45 10 45 31 e4 41 8b 55 0c 48 8d 1c d0 <0f> b6 03 83 e0 0f 3c 0f 0f 85 a2 00 00 00 e9 e6 01 00 00 0f b7 ee [ 149.991952] RSP: 0018:ffffc9000f1ebcb8 EFLAGS: 00010246 [ 150.000937] RAX: 0000000000000055 RBX:
00000007fffc445d RCX: 000000002548f071 [ 150.011841] RDX: 00000000ffff8881 RSI: 0000000000000001 RDI:
ffff888125ed50d8 [ 150.022670] RBP: 0000000000000000 R08: 0000000000000000 R09: c0000000ffff7fff [ 150.033445] R10: ffffc9000f1ebb68 R11: ffffc9000f1ebb60 R12: 0000000000000000 [ 150.044204] R13:
ffff888125ed50d8 R14: 0000000000000080 R15: 34cdc00034cdea80 [ 150.054963] FS: 0000000000000000(0000) GS:ffff88dfaf200000(0000) knlGS:0000000000000000 [ 150.066715] CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 [ 150.076078] CR2: 00000007fffc445d CR3: 000000012448a006 CR4: 0000000000770ee0 [ 150.086887] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 150.097670] DR3:
0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 150.108323] PKRU: 55555554 [ 150.114690] Call Trace: [ 150.120497] ? printk+0x48/0x4a [ 150.127049] mpt3sas_scsih_issue_tm.cold.114+0x2e/0x2b3 [mpt3sas] [ 150.136453] mpt3sas_scsih_issue_locked_tm+0x86/0xb0 [mpt3sas] [ 150.145759] scsih_dev_reset+0xea/0x300 [mpt3sas] [ 150.153891] scsi_eh_ready_devs+0x541/0x9e0 [scsi_mod] [ 150.162206] ? __scsi_host_match+0x20/0x20 [scsi_mod] [ 150.170406] ? scsi_try_target_reset+0x90/0x90 [scsi_mod] [ 150.178925] ? blk_mq_tagset_busy_iter+0x45/0x60 [ 150.186638] ? scsi_try_target_reset+0x90/0x90 [scsi_mod] [ 150.195087] scsi_error_handler+0x3a5/0x4a0 [scsi_mod] [ 150.203206] ? __schedule+0x1e9/0x610 [ 150.209783] ? scsi_eh_get_sense+0x210/0x210 [scsi_mod] [ 150.217924] kthread+0x12e/0x150 [ 150.224041] ? kthread_worker_fn+0x130/0x130 [ 150.231206] ret_from_fork+0x1f/0x30 This is caused by mpt3sas_base_sync_reply_irqs() using an invalid reply_q pointer outside of the list_for_each_entry() loop.
At the end of the full list traversal the pointer is invalid. Move the _base_process_reply_queue() call inside of the loop. (CVE-2022-48835)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48835
https://ubuntu.com/security/CVE-2022-48835

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48835

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225330 - Linux Distros Unpatched Vulnerability : CVE-2022-48836
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Input: aiptek - properly check endpoint type Syzbot reported warning in usb_submit_urb() which is caused by wrong endpoint type. There was a check for the number of endpoints, but not for the type of endpoint.
Fix it by replacing old desc.bNumEndpoints check with usb_find_common_endpoints() helper for finding endpoints Fail log: usb 5-1: BOGUS urb xfer, pipe 1 != type 3 WARNING: CPU: 2 PID: 48 at drivers/usb/core/urb.c:502 usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502 Modules linked in: CPU:
2 PID: 48 Comm: kworker/2:2 Not tainted 5.17.0-rc6-syzkaller-00226-g07ebd38a0da2 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Workqueue: usb_hub_wq hub_event ... Call Trace:
<TASK> aiptek_open+0xd5/0x130 drivers/input/tablet/aiptek.c:830 input_open_device+0x1bb/0x320 drivers/input/input.c:629 kbd_connect+0xfe/0x160 drivers/tty/vt/keyboard.c:1593 (CVE-2022-48836)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48836
https://ubuntu.com/security/CVE-2022-48836

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48836

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225236 - Linux Distros Unpatched Vulnerability : CVE-2022-48839
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/packet: fix slab-out-of-bounds access in packet_recvmsg() syzbot found that when an AF_PACKET socket is using PACKET_COPY_THRESH and mmap operations, tpacket_rcv() is queueing skbs with garbage in skb->cb[], triggering a too big copy [1] Presumably, users of af_packet using mmap() already gets correct metadata from the mapped buffer, we can simply make sure to clear 12 bytes that might be copied to user space later. BUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:225 [inline] BUG: KASAN:
stack-out-of-bounds in packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489 Write of size 165 at addr ffffc9000385fb78 by task syz-executor233/3631 CPU: 0 PID: 3631 Comm: syz-executor233 Not tainted 5.17.0-rc7-syzkaller-02396-g0b3660695e80 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xf/0x336 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 memcpy+0x39/0x60 mm/kasan/shadow.c:66 memcpy include/linux/fortify-string.h:225 [inline] packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489 sock_recvmsg_nosec net/socket.c:948 [inline] sock_recvmsg net/socket.c:966 [inline] sock_recvmsg net/socket.c:962 [inline]
____sys_recvmsg+0x2c4/0x600 net/socket.c:2632 ___sys_recvmsg+0x127/0x200 net/socket.c:2674
__sys_recvmsg+0xe2/0x1a0 net/socket.c:2704 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP:
0033:0x7fdfd5954c29 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcf8e71e48 EFLAGS: 00000246 ORIG_RAX: 000000000000002f RAX: ffffffffffffffda RBX:
0000000000000003 RCX: 00007fdfd5954c29 RDX: 0000000000000000 RSI: 0000000020000500 RDI: 0000000000000005 RBP: 0000000000000000 R08: 000000000000000d R09: 000000000000000d R10: 0000000000000000 R11:
0000000000000246 R12: 00007ffcf8e71e60 R13: 00000000000f4240 R14: 000000000000c1ff R15: 00007ffcf8e71e54 </TASK> addr ffffc9000385fb78 is located in stack of task syz-executor233/3631 at offset 32 in frame:
____sys_recvmsg+0x0/0x600 include/linux/uio.h:246 this frame has 1 object: [32, 160) 'addr' Memory state around the buggy address: ffffc9000385fa80: 00 04 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 ffffc9000385fb00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 >ffffc9000385fb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f3 ^ ffffc9000385fc00: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 f1 ffffc9000385fc80: f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 00 00 00 00 00 ================================================================== (CVE-2022-48839)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48839
https://ubuntu.com/security/CVE-2022-48839

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48839

Plugin Information
Published: 2025/03/05, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225776 - Linux Distros Unpatched Vulnerability : CVE-2022-48840
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: iavf: Fix hang during reboot/shutdown Recent commit 974578017fc1 (iavf: Add waiting so the port is initialized in remove) adds a wait-loop at the beginning of iavf_remove() to ensure that port initialization is finished prior unregistering net device. This causes a regression in reboot/shutdown scenario because in this case callback iavf_shutdown() is called and this callback detaches the device, makes it down if it is running and sets its state to
__IAVF_REMOVE. Later shutdown callback of associated PF driver (e.g. ice_shutdown) is called. That callback calls among other things sriov_disable() that calls indirectly iavf_remove() (see stack trace below). As the adapter state is already __IAVF_REMOVE then the mentioned loop is end-less and shutdown process hangs. The patch fixes this by checking adapter's state at the beginning of iavf_remove() and skips the rest of the function if the adapter is already in remove state (shutdown is in progress).
Reproducer: 1. Create VF on PF driven by ice or i40e driver 2. Ensure that the VF is bound to iavf driver 3. Reboot [52625.981294] sysrq: SysRq : Show Blocked State [52625.988377] task:reboot state:D stack: 0 pid:17359 ppid: 1 f2 [52625.996732] Call Trace: [52625.999187] __schedule+0x2d1/0x830 [52626.007400] schedule+0x35/0xa0 [52626.010545] schedule_hrtimeout_range_clock+0x83/0x100 [52626.020046] usleep_range+0x5b/0x80 [52626.023540] iavf_remove+0x63/0x5b0 [iavf] [52626.027645] pci_device_remove+0x3b/0xc0 [52626.031572] device_release_driver_internal+0x103/0x1f0 [52626.036805] pci_stop_bus_device+0x72/0xa0 [52626.040904] pci_stop_and_remove_bus_device+0xe/0x20 [52626.045870] pci_iov_remove_virtfn+0xba/0x120 [52626.050232] sriov_disable+0x2f/0xe0 [52626.053813] ice_free_vfs+0x7c/0x340 [ice] [52626.057946] ice_remove+0x220/0x240 [ice] [52626.061967] ice_shutdown+0x16/0x50 [ice] [52626.065987] pci_device_shutdown+0x34/0x60 [52626.070086] device_shutdown+0x165/0x1c5 [52626.074011] kernel_restart+0xe/0x30 [52626.077593]
__do_sys_reboot+0x1d2/0x210 [52626.093815] do_syscall_64+0x5b/0x1a0 [52626.097483] entry_SYSCALL_64_after_hwframe+0x65/0xca (CVE-2022-48840)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48840
https://ubuntu.com/security/CVE-2022-48840

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48840

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225699 - Linux Distros Unpatched Vulnerability : CVE-2022-48843
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/vrr: Set VRR capable prop only if it is attached to connector VRR capable property is not attached by default to the connector It is attached only if VRR is supported. So if the driver tries to call drm core set prop function without it being attached that causes NULL dereference. (CVE-2022-48843)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48843
https://ubuntu.com/security/CVE-2022-48843

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48843

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225395 - Linux Distros Unpatched Vulnerability : CVE-2022-48844
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix leaking sent_cmd skb sent_cmd memory is not freed before freeing hci_dev causing it to leak it contents.
(CVE-2022-48844)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48844
https://ubuntu.com/security/CVE-2022-48844

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48844

Plugin Information
Published: 2025/03/05, Modified: 2025/12/23
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225136 - Linux Distros Unpatched Vulnerability : CVE-2022-48849
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: bypass tiling flag check in virtual display case (v2) vkms leverages common amdgpu framebuffer creation, and also as it does not support FB modifier, there is no need to check tiling flags when initing framebuffer when virtual display is enabled. This can fix below calltrace: amdgpu 0000:00:08.0: GFX9+ requires FB check based on format modifier WARNING: CPU: 0 PID: 1023 at drivers/gpu/drm/amd/amdgpu/amdgpu_display.c:1150 amdgpu_display_framebuffer_init+0x8e7/0xb40 [amdgpu] v2: check adev->enable_virtual_display instead as vkms can be enabled in bare metal as well. (CVE-2022-48849)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48849
https://ubuntu.com/security/CVE-2022-48849

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48849

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225417 - Linux Distros Unpatched Vulnerability : CVE-2022-48850
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net-sysfs: add check for netdevice being present to speed_show When bringing down the netdevice or system shutdown, a panic can be triggered while accessing the sysfs path because the device is already removed. [ 755.549084] mlx5_core 0000:12:00.1: Shutdown was called [ 756.404455] mlx5_core 0000:12:00.0: Shutdown was called ... [ 757.937260] BUG: unable to handle kernel NULL pointer dereference at (null) [ 758.031397] IP:
[<ffffffff8ee11acb>] dma_pool_alloc+0x1ab/0x280 crash> bt ... PID: 12649 TASK: ffff8924108f2100 CPU: 1 COMMAND: amsd ... #9 [ffff89240e1a38b0] page_fault at ffffffff8f38c778 [exception RIP:
dma_pool_alloc+0x1ab] RIP: ffffffff8ee11acb RSP: ffff89240e1a3968 RFLAGS: 00010046 RAX: 0000000000000246 RBX: ffff89243d874100 RCX: 0000000000001000 RDX: 0000000000000000 RSI: 0000000000000246 RDI:
ffff89243d874090 RBP: ffff89240e1a39c0 R8: 000000000001f080 R9: ffff8905ffc03c00 R10: ffffffffc04680d4 R11: ffffffff8edde9fd R12: 00000000000080d0 R13: ffff89243d874090 R14: ffff89243d874080 R15:
0000000000000000 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #10 [ffff89240e1a39c8] mlx5_alloc_cmd_msg at ffffffffc04680f3 [mlx5_core] #11 [ffff89240e1a3a18] cmd_exec at ffffffffc046ad62 [mlx5_core] #12 [ffff89240e1a3ab8] mlx5_cmd_exec at ffffffffc046b4fb [mlx5_core] #13 [ffff89240e1a3ae8] mlx5_core_access_reg at ffffffffc0475434 [mlx5_core] #14 [ffff89240e1a3b40] mlx5e_get_fec_caps at ffffffffc04a7348 [mlx5_core] #15 [ffff89240e1a3bb0] get_fec_supported_advertised at ffffffffc04992bf [mlx5_core] #16 [ffff89240e1a3c08] mlx5e_get_link_ksettings at ffffffffc049ab36 [mlx5_core] #17 [ffff89240e1a3ce8] __ethtool_get_link_ksettings at ffffffff8f25db46 #18 [ffff89240e1a3d48] speed_show at ffffffff8f277208 #19 [ffff89240e1a3dd8] dev_attr_show at ffffffff8f0b70e3 #20 [ffff89240e1a3df8] sysfs_kf_seq_show at ffffffff8eedbedf #21 [ffff89240e1a3e18] kernfs_seq_show at ffffffff8eeda596 #22 [ffff89240e1a3e28] seq_read at ffffffff8ee76d10 #23 [ffff89240e1a3e98] kernfs_fop_read at ffffffff8eedaef5 #24 [ffff89240e1a3ed8] vfs_read at ffffffff8ee4e3ff #25 [ffff89240e1a3f08] sys_read at ffffffff8ee4f27f #26 [ffff89240e1a3f50] system_call_fastpath at ffffffff8f395f92 crash> net_device.state ffff89443b0c0000 state = 0x5 (__LINK_STATE_START| __LINK_STATE_NOCARRIER) To prevent this scenario, we also make sure that the netdevice is present. (CVE-2022-48850)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48850
https://ubuntu.com/security/CVE-2022-48850

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48850

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225166 - Linux Distros Unpatched Vulnerability : CVE-2022-48853
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- swiotlb: fix info leak with DMA_FROM_DEVICE The problem I'm addressing was discovered by the LTP test covering cve-2018-1000204. A short description of what happens follows: 1) The test case issues a command code 00 (TEST UNIT READY) via the SG_IO interface with: dxfer_len == 524288, dxdfer_dir == SG_DXFER_FROM_DEV and a corresponding dxferp. The peculiar thing about this is that TUR is not reading from the device. 2) In sg_start_req() the invocation of blk_rq_map_user() effectively bounces the user- space buffer. As if the device was to transfer into it. Since commit a45b599ad808 (scsi: sg: allocate with __GFP_ZERO in sg_build_indirect()) we make sure this first bounce buffer is allocated with GFP_ZERO.
3) For the rest of the story we keep ignoring that we have a TUR, so the device won't touch the buffer we prepare as if the we had a DMA_FROM_DEVICE type of situation. My setup uses a virtio-scsi device and the buffer allocated by SG is mapped by the function virtqueue_add_split() which uses DMA_FROM_DEVICE for the in sgs (here scatter-gather and not scsi generics). This mapping involves bouncing via the swiotlb (we need swiotlb to do virtio in protected guest like s390 Secure Execution, or AMD SEV). 4) When the SCSI TUR is done, we first copy back the content of the second (that is swiotlb) bounce buffer (which most likely contains some previous IO data), to the first bounce buffer, which contains all zeros. Then we copy back the content of the first bounce buffer to the user-space buffer. 5) The test case detects that the buffer, which it zero-initialized, ain't all zeros and fails. One can argue that this is an swiotlb problem, because without swiotlb we leak all zeros, and the swiotlb should be transparent in a sense that it does not affect the outcome (if all other participants are well behaved). Copying the content of the original buffer into the swiotlb buffer is the only way I can think of to make swiotlb transparent in such scenarios. So let's do just that if in doubt, but allow the driver to tell us that the whole mapped buffer is going to be overwritten, in which case we can preserve the old behavior and avoid the performance impact of the extra bounce. (CVE-2022-48853)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48853
https://ubuntu.com/security/CVE-2022-48853

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48853

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225336 - Linux Distros Unpatched Vulnerability : CVE-2022-48861
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: vdpa: fix use-after-free on vp_vdpa_remove When vp_vdpa driver is unbind, vp_vdpa is freed in vdpa_unregister_device and then vp_vdpa->mdev.pci_dev is dereferenced in vp_modern_remove, triggering use-after-free. Call Trace of unbinding driver free vp_vdpa : do_syscall_64 vfs_write kernfs_fop_write_iter device_release_driver_internal pci_device_remove vp_vdpa_remove vdpa_unregister_device kobject_release device_release kfree Call Trace of dereference vp_vdpa->mdev.pci_dev: vp_modern_remove pci_release_selected_regions pci_release_region pci_resource_len pci_resource_end (dev)->resource[(bar)].end (CVE-2022-48861)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48861
https://ubuntu.com/security/CVE-2022-48861

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48861

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225263 - Linux Distros Unpatched Vulnerability : CVE-2022-48862
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vhost: fix hung thread due to erroneous iotlb entries In vhost_iotlb_add_range_ctx(), range size can overflow to 0 when start is 0 and last is ULONG_MAX. One instance where it can happen is when userspace sends an IOTLB message with iova=size=uaddr=0 (vhost_process_iotlb_msg). So, an entry with size = 0, start = 0, last = ULONG_MAX ends up in the iotlb. Next time a packet is sent, iotlb_access_ok() loops indefinitely due to that erroneous entry. Call Trace: <TASK> iotlb_access_ok+0x21b/0x3e0 drivers/vhost/vhost.c:1340 vq_meta_prefetch+0xbc/0x280 drivers/vhost/vhost.c:1366 vhost_transport_do_send_pkt+0xe0/0xfd0 drivers/vhost/vsock.c:104 vhost_worker+0x23d/0x3d0 drivers/vhost/vhost.c:372 kthread+0x2e9/0x3a0 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 </TASK> Reported by syzbot at:
https://syzkaller.appspot.com/bug?extid=0abd373e2e50d704db87 To fix this, do two things: 1. Return -EINVAL in vhost_chr_write_iter() when userspace asks to map a range with size 0. 2. Fix vhost_iotlb_add_range_ctx() to handle the range [0, ULONG_MAX] by splitting it into two entries.
(CVE-2022-48862)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48862
https://security-tracker.debian.org/tracker/CVE-2022-48862
https://ubuntu.com/security/CVE-2022-48862

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48862

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225747 - Linux Distros Unpatched Vulnerability : CVE-2022-48863
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mISDN: Fix memory leak in dsp_pipeline_build() dsp_pipeline_build() allocates dup pointer by kstrdup(cfg), but then it updates dup variable by strsep(&dup, |). As a result when it calls kfree(dup), the dup variable contains NULL. Found by Linux Driver Verification project (linuxtesting.org) with SVACE.
(CVE-2022-48863)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48863
https://ubuntu.com/security/CVE-2022-48863

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48863

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225244 - Linux Distros Unpatched Vulnerability : CVE-2022-48864
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command When control vq receives a VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command request from the driver, presently there is no validation against the number of queue pairs to configure, or even if multiqueue had been negotiated or not is unverified. This may lead to kernel panic due to uninitialized resource for the queues were there any bogus request sent down by untrusted driver. Tie up the loose ends there. (CVE-2022-48864)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48864
https://ubuntu.com/security/CVE-2022-48864

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48864

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225490 - Linux Distros Unpatched Vulnerability : CVE-2022-48865
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tipc: fix kernel panic when enabling bearer When enabling a bearer on a node, a kernel panic is observed:
[ 4.498085] RIP: 0010:tipc_mon_prep+0x4e/0x130 [tipc] ... [ 4.520030] Call Trace: [ 4.520689] <IRQ> [ 4.521236] tipc_link_build_proto_msg+0x375/0x750 [tipc] [ 4.522654] tipc_link_build_state_msg+0x48/0xc0 [tipc] [ 4.524034] __tipc_node_link_up+0xd7/0x290 [tipc] [ 4.525292] tipc_rcv+0x5da/0x730 [tipc] [ 4.526346] ? __netif_receive_skb_core+0xb7/0xfc0 [ 4.527601] tipc_l2_rcv_msg+0x5e/0x90 [tipc] [ 4.528737]
__netif_receive_skb_list_core+0x20b/0x260 [ 4.530068] netif_receive_skb_list_internal+0x1bf/0x2e0 [ 4.531450] ? dev_gro_receive+0x4c2/0x680 [ 4.532512] napi_complete_done+0x6f/0x180 [ 4.533570] virtnet_poll+0x29c/0x42e [virtio_net] ... The node in question is receiving activate messages in another thread after changing bearer status to allow message sending/ receiving in current thread: thread 1 | thread 2 -------- | -------- | tipc_enable_bearer() | test_and_set_bit_lock() | tipc_bearer_xmit_skb() | | tipc_l2_rcv_msg() | tipc_rcv() | __tipc_node_link_up() | tipc_link_build_state_msg() | tipc_link_build_proto_msg() | tipc_mon_prep() | { | ... | // null-pointer dereference | u16 gen = mon->dom_gen; | ... | } // Not being executed yet | tipc_mon_create() | { | ... | // allocate | mon = kzalloc(); | ... | } | Monitoring pointer in thread 2 is dereferenced before monitoring data is allocated in thread 1. This causes kernel panic. This commit fixes it by allocating the monitoring data before enabling the bearer to receive messages. (CVE-2022-48865)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48865
https://ubuntu.com/security/CVE-2022-48865

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48865

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225334 - Linux Distros Unpatched Vulnerability : CVE-2022-48875
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: mac80211: sdata can be NULL during AMPDU start ieee80211_tx_ba_session_handle_start() may get NULL for sdata when a deauthentication is ongoing. Here a trace triggering the race with the hostapd test multi_ap_fronthaul_on_ap: (gdb) list *drv_ampdu_action+0x46 0x8b16 is in drv_ampdu_action (net/mac80211/driver-ops.c:396). 391 int ret = -EOPNOTSUPP; 392 393 might_sleep(); 394 395 sdata = get_bss_sdata(sdata); 396 if (!check_sdata_in_driver(sdata)) 397 return -EIO; 398 399 trace_drv_ampdu_action(local, sdata, params); 400 wlan0: moving STA 02:00:00:00:03:00 to state 3 wlan0:
associated wlan0: deauthenticating from 02:00:00:00:03:00 by local choice (Reason: 3=DEAUTH_LEAVING) wlan3.sta1: Open BA session requested for 02:00:00:00:00:00 tid 0 wlan3.sta1: dropped frame to 02:00:00:00:00:00 (unauthorized port) wlan0: moving STA 02:00:00:00:03:00 to state 2 wlan0: moving STA 02:00:00:00:03:00 to state 1 wlan0: Removed STA 02:00:00:00:03:00 wlan0: Destroyed STA 02:00:00:00:03:00 BUG: unable to handle page fault for address: fffffffffffffb48 PGD 11814067 P4D 11814067 PUD 11816067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 2 PID: 133397 Comm: kworker/u16:1 Tainted: G W 6.1.0-rc8-wt+ #59 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014 Workqueue: phy3 ieee80211_ba_session_work [mac80211] RIP: 0010:drv_ampdu_action+0x46/0x280 [mac80211] Code: 53 48 89 f3 be 89 01 00 00 e8 d6 43 bf ef e8 21 46 81 f0 83 bb a0 1b 00 00 04 75 0e 48 8b 9b 28 0d 00 00 48 81 eb 10 0e 00 00 <8b> 93 58 09 00 00 f6 c2 20 0f 84 3b 01 00 00 8b 05 dd 1c 0f 00 85 RSP:
0018:ffffc900025ebd20 EFLAGS: 00010287 RAX: 0000000000000000 RBX: fffffffffffff1f0 RCX: ffff888102228240 RDX: 0000000080000000 RSI: ffffffff918c5de0 RDI: ffff888102228b40 RBP: ffffc900025ebd40 R08:
0000000000000001 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888118c18ec0 R13: 0000000000000000 R14: ffffc900025ebd60 R15: ffff888018b7efb8 FS: 0000000000000000(0000) GS:ffff88817a600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
fffffffffffffb48 CR3: 0000000105228006 CR4: 0000000000170ee0 Call Trace: <TASK>
ieee80211_tx_ba_session_handle_start+0xd0/0x190 [mac80211] ieee80211_ba_session_work+0xff/0x2e0 [mac80211] process_one_work+0x29f/0x620 worker_thread+0x4d/0x3d0 ? process_one_work+0x620/0x620 kthread+0xfb/0x120 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 </TASK> (CVE-2022-48875)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48875
https://ubuntu.com/security/CVE-2022-48875

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48875

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225540 - Linux Distros Unpatched Vulnerability : CVE-2022-48876
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix initialization of rx->link and rx->link_sta There are some codepaths that do not initialize rx->link_sta properly. This causes a crash in places which assume that rx->link_sta is valid if rx->sta is valid. One known instance is triggered by __ieee80211_rx_h_amsdu being called from fast-rx. It results in a crash like this one:
BUG: kernel NULL pointer dereference, address: 00000000000000a8 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP PTI CPU: 1 PID:
506 Comm: mt76-usb-rx phy Tainted: G E 6.1.0-debian64x+1.7 #3 Hardware name: ZOTAC ZBOX-ID92/ZBOX- IQ01/ZBOX-ID92/ZBOX-IQ01, BIOS B220P007 05/21/2014 RIP: 0010:ieee80211_deliver_skb+0x62/0x1f0 [mac80211] Code: 00 48 89 04 24 e8 9e a7 c3 df 89 c0 48 03 1c c5 a0 ea 39 a1 4c 01 6b 08 48 ff 03 48 83 7d 28 00 74 11 48 8b 45 30 48 63 55 44 <48> 83 84 d0 a8 00 00 00 01 41 8b 86 c0 11 00 00 8d 50 fd 83 fa 01 RSP:
0018:ffff999040803b10 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffffb9903f496480 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff999040803ce0 R08:
0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8d21828ac900 R13: 000000000000004a R14: ffff8d2198ed89c0 R15: ffff8d2198ed8000 FS: 0000000000000000(0000) GS:ffff8d24afe80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
00000000000000a8 CR3: 0000000429810002 CR4: 00000000001706e0 Call Trace: <TASK>
__ieee80211_rx_h_amsdu+0x1b5/0x240 [mac80211] ? ieee80211_prepare_and_rx_handle+0xcdd/0x1320 [mac80211] ?
__local_bh_enable_ip+0x3b/0xa0 ieee80211_prepare_and_rx_handle+0xcdd/0x1320 [mac80211] ? prepare_transfer+0x109/0x1a0 [xhci_hcd] ieee80211_rx_list+0xa80/0xda0 [mac80211] mt76_rx_complete+0x207/0x2e0 [mt76] mt76_rx_poll_complete+0x357/0x5a0 [mt76] mt76u_rx_worker+0x4f5/0x600 [mt76_usb] ? mt76_get_min_avg_rssi+0x140/0x140 [mt76] __mt76_worker_fn+0x50/0x80 [mt76] kthread+0xed/0x120 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 Since the initialization of rx->link and rx->link_sta is rather convoluted and duplicated in many places, clean it up by using a helper function to set it. [remove unnecessary rx->sta->sta.mlo check] (CVE-2022-48876)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48876
https://ubuntu.com/security/CVE-2022-48876

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48876

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225126 - Linux Distros Unpatched Vulnerability : CVE-2022-48879
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: efi: fix NULL-deref in init error path In cases where runtime services are not supported or have been disabled, the runtime services workqueue will never have been allocated. Do not try to destroy the workqueue unconditionally in the unlikely event that EFI initialisation fails to avoid dereferencing a NULL pointer. (CVE-2022-48879)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48879
https://ubuntu.com/security/CVE-2022-48879

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48879

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225528 - Linux Distros Unpatched Vulnerability : CVE-2022-48886
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ice: Add check for kzalloc Add the check for the return value of kzalloc in order to avoid NULL pointer dereference. Moreover, use the goto- label to share the clean code. (CVE-2022-48886)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48886
https://ubuntu.com/security/CVE-2022-48886

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48886

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225130 - Linux Distros Unpatched Vulnerability : CVE-2022-48887
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/vmwgfx: Remove rcu locks from user resources User resource lookups used rcu to avoid two extra atomics. Unfortunately the rcu paths were buggy and it was easy to make the driver crash by submitting command buffers from two different threads. Because the lookups never show up in performance profiles replace them with a regular spin lock which fixes the races in accesses to those shared resources. Fixes kernel oops'es in IGT's vmwgfx execution_buffer stress test and seen crashes with apps using shared resources. (CVE-2022-48887)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48887
https://security-tracker.debian.org/tracker/CVE-2022-48887
https://ubuntu.com/security/CVE-2022-48887

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48887

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225691 - Linux Distros Unpatched Vulnerability : CVE-2022-48889
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: sof-nau8825: fix module alias overflow The maximum name length for a platform_device_id entry is 20 characters including the trailing NUL byte. The sof_nau8825.c file exceeds that, which causes an obscure error message:
sound/soc/intel/boards/snd-soc-sof_nau8825.mod.c:35:45: error: illegal character encoding in string literal [-Werror,-Winvalid-source-encoding] MODULE_ALIAS(platform:adl_max98373_nau8825<U+0018><AA>);
^~~~ include/linux/module.h:168:49: note: expanded from macro 'MODULE_ALIAS' ^~~~~~ include/linux/module.h:165:56: note: expanded from macro 'MODULE_INFO' ^~~~ include/linux/moduleparam.h:26:47: note: expanded from macro '__MODULE_INFO' = __MODULE_INFO_PREFIX
__stringify(tag) = info I could not figure out how to make the module handling robust enough to handle this better, but as a quick fix, using slightly shorter names that are still unique avoids the build issue. (CVE-2022-48889)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48889
https://ubuntu.com/security/CVE-2022-48889

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48889

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225654 - Linux Distros Unpatched Vulnerability : CVE-2022-48890
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM storvsc_queuecommand() maps the scatter/gather list using scsi_dma_map(), which in a confidential VM allocates swiotlb bounce buffers. If the I/O submission fails in storvsc_do_io(), the I/O is typically retried by higher level code, but the bounce buffer memory is never freed. The mostly like cause of I/O submission failure is a full VMBus channel ring buffer, which is not uncommon under high I/O loads. Eventually enough bounce buffer memory leaks that the confidential VM can't do any I/O. The same problem can arise in a non-confidential VM with kernel boot parameter swiotlb=force.
Fix this by doing scsi_dma_unmap() in the case of an I/O submission error, which frees the bounce buffer memory. (CVE-2022-48890)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48890
https://ubuntu.com/security/CVE-2022-48890

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48890

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249987 - Linux Distros Unpatched Vulnerability : CVE-2022-48896
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ixgbe: fix pci device refcount leak As the comment of pci_get_domain_bus_and_slot() says, it returns a PCI device with refcount incremented, when finish using it, the caller must decrement the reference count by calling pci_dev_put(). In ixgbe_get_first_secondary_devfn() and ixgbe_x550em_a_has_mii(), pci_dev_put() is called to avoid leak.
(CVE-2022-48896)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48896
https://ubuntu.com/security/CVE-2022-48896

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48896

Plugin Information
Published: 2025/08/15, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225187 - Linux Distros Unpatched Vulnerability : CVE-2022-48899
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/virtio: Fix GEM handle creation UAF Userspace can guess the handle value and try to race GEM object creation with handle close, resulting in a use-after-free if we dereference the object after dropping the handle's reference. For that reason, dropping the handle's reference must be done *after* we are done dereferencing the object. (CVE-2022-48899)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48899
https://ubuntu.com/security/CVE-2022-48899

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48899

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225569 - Linux Distros Unpatched Vulnerability : CVE-2022-48914
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: xen/netfront: destroy queues before real_num_tx_queues is zeroed xennet_destroy_queues() relies on info->netdev->real_num_tx_queues to delete queues. Since d7dac083414eb5bb99a6d2ed53dc2c1b405224e5 (net-sysfs: update the queue counts in the unregistration path), unregister_netdev() indirectly sets real_num_tx_queues to 0. Those two facts together means, that xennet_destroy_queues() called from xennet_remove() cannot do its job, because it's called after unregister_netdev(). This results in kfree-ing queues that are still linked in napi, which ultimately crashes: BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 52 Comm: xenwatch Tainted: G W 5.16.10-1.32.fc32.qubes.x86_64+ #226 RIP:
0010:free_netdev+0xa3/0x1a0 Code: ff 48 89 df e8 2e e9 00 00 48 8b 43 50 48 8b 08 48 8d b8 a0 fe ff ff 48 8d a9 a0 fe ff ff 49 39 c4 75 26 eb 47 e8 ed c1 66 ff <48> 8b 85 60 01 00 00 48 8d 95 60 01 00 00 48 89 ef 48 2d 60 01 00 RSP: 0000:ffffc90000bcfd00 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff88800edad000 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffffc90000bcfc30 RDI: 00000000ffffffff RBP:
fffffffffffffea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: ffff88800edad050 R13: ffff8880065f8f88 R14: 0000000000000000 R15: ffff8880066c6680 FS:
0000000000000000(0000) GS:ffff8880f3300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 CR2: 0000000000000000 CR3: 00000000e998c006 CR4: 00000000003706e0 Call Trace: <TASK>
xennet_remove+0x13d/0x300 [xen_netfront] xenbus_dev_remove+0x6d/0xf0 __device_release_driver+0x17a/0x240 device_release_driver+0x24/0x30 bus_remove_device+0xd8/0x140 device_del+0x18b/0x410 ?
_raw_spin_unlock+0x16/0x30 ? klist_iter_exit+0x14/0x20 ? xenbus_dev_request_and_reply+0x80/0x80 device_unregister+0x13/0x60 xenbus_dev_changed+0x18e/0x1f0 xenwatch_thread+0xc0/0x1a0 ? do_wait_intr_irq+0xa0/0xa0 kthread+0x16b/0x190 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x22/0x30 </TASK> Fix this by calling xennet_destroy_queues() from xennet_uninit(), when real_num_tx_queues is still available. This ensures that queues are destroyed when real_num_tx_queues is set to 0, regardless of how unregister_netdev() was called. Originally reported at https://github.com/QubesOS/qubes-issues/issues/7257 (CVE-2022-48914)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48914
https://ubuntu.com/security/CVE-2022-48914

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48914

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225614 - Linux Distros Unpatched Vulnerability : CVE-2022-48931
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- configfs: fix a race in configfs_{,un}register_subsystem() When configfs_register_subsystem() or configfs_unregister_subsystem() is executing link_group() or unlink_group(), it is possible that two processes add or delete list concurrently. Some unfortunate interleavings of them can cause kernel panic.
One of cases is: A --> B --> C --> D A <-- B <-- C <-- D delete list_head *B | delete list_head *C
--------------------------------|----------------------------------- configfs_unregister_subsystem | configfs_unregister_subsystem unlink_group | unlink_group unlink_obj | unlink_obj list_del_init | list_del_init __list_del_entry | __list_del_entry __list_del | __list_del // next == C | next->prev = prev | | next->prev = prev prev->next = next | | // prev == B | prev->next = next Fix this by adding mutex when calling link_group() or unlink_group(), but parent configfs_subsystem is NULL when config_item is root. So I create a mutex configfs_subsystem_mutex. (CVE-2022-48931)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48931
https://ubuntu.com/security/CVE-2022-48931

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48931

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225430 - Linux Distros Unpatched Vulnerability : CVE-2022-48938
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- CDC-NCM: avoid overflow in sanity checking A broken device may give an extreme offset like 0xFFF0 and a reasonable length for a fragment. In the sanity check as formulated now, this will create an integer overflow, defeating the sanity check. Both offset and offset + len need to be checked in such a manner that no overflow can occur. And those quantities should be unsigned. (CVE-2022-48938)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48938
https://ubuntu.com/security/CVE-2022-48938

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48938

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225735 - Linux Distros Unpatched Vulnerability : CVE-2022-48944
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sched: Fix yet more sched_fork() races Where commit 4ef0c5c6b5ba (kernel/sched: Fix sched_fork() access an invalid sched_task_group) fixed a fork race vs cgroup, it opened up a race vs syscalls by not placing the task on the runqueue before it gets exposed through the pidhash. Commit 13765de8148f (sched/fair: Fix fault in reweight_entity) is trying to fix a single instance of this, instead fix the whole class of issues, effectively reverting this commit. (CVE-2022-48944)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48944
https://security-tracker.debian.org/tracker/CVE-2022-48944
https://ubuntu.com/security/CVE-2022-48944

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48944

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225608 - Linux Distros Unpatched Vulnerability : CVE-2022-48946
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- udf: Fix preallocation discarding at indirect extent boundary When preallocation extent is the first one in the extent block, the code would corrupt extent tree header instead. Fix the problem and use udf_delete_aext() for deleting extent to avoid some code duplication. (CVE-2022-48946)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48946
https://ubuntu.com/security/CVE-2022-48946

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48946

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225433 - Linux Distros Unpatched Vulnerability : CVE-2022-48953
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- rtc: cmos: Fix event handler registration ordering issue Because acpi_install_fixed_event_handler() enables the event automatically on success, it is incorrect to call it before the handler routine passed to it is ready to handle events. Unfortunately, the rtc-cmos driver does exactly the incorrect thing by calling cmos_wake_setup(), which passes rtc_handler() to acpi_install_fixed_event_handler(), before cmos_do_probe(), because rtc_handler() uses dev_get_drvdata() to get to the cmos object pointer and the driver data pointer is only populated in cmos_do_probe(). This leads to a NULL pointer dereference in rtc_handler() on boot if the RTC fixed event happens to be active at the init time. To address this issue, change the initialization ordering of the driver so that cmos_wake_setup() is always called after a successful cmos_do_probe() call. While at it, change cmos_pnp_probe() to call cmos_do_probe() after the initial if () statement used for computing the IRQ argument to be passed to cmos_do_probe() which is cleaner than calling it in each branch of that if () (local variable irq can be of type int, because it is passed to that function as an argument of type int). Note that commit 6492fed7d8c9 (rtc: rtc-cmos: Do not check ACPI_FADT_LOW_POWER_S0) caused this issue to affect a larger number of systems, because previously it only affected systems with ACPI_FADT_LOW_POWER_S0 set, but it is present regardless of that commit. (CVE-2022-48953)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48953
https://ubuntu.com/security/CVE-2022-48953

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48953

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225320 - Linux Distros Unpatched Vulnerability : CVE-2022-48961
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: mdio: fix unbalanced fwnode reference count in mdio_device_release() There is warning report about of_node refcount leak while probing mdio device: OF: ERROR: memory leak, expected refcount 1 instead of 2, of_node_get()/of_node_put() unbalanced - destroy cset entry: attach overlay node /spi/soc@0/mdio@710700c0/ethernet@4 In of_mdiobus_register_device(), we increase fwnode refcount by fwnode_handle_get() before associating the of_node with mdio device, but it has never been decreased in normal path. Since that, in mdio_device_release(), it needs to call fwnode_handle_put() in addition instead of calling kfree() directly. After above, just calling mdio_device_free() in the error handle path of of_mdiobus_register_device() is enough to keep the refcount balanced. (CVE-2022-48961)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48961
https://security-tracker.debian.org/tracker/CVE-2022-48961
https://ubuntu.com/security/CVE-2022-48961

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48961

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244412 - Linux Distros Unpatched Vulnerability : CVE-2022-48963
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: fix memory leak in ipc_mux_init() When failed to alloc ipc_mux->ul_adb.pp_qlt in ipc_mux_init(), ipc_mux is not released.
(CVE-2022-48963)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48963
https://ubuntu.com/security/CVE-2022-48963

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48963

Plugin Information
Published: 2025/08/06, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225510 - Linux Distros Unpatched Vulnerability : CVE-2022-48971
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: Fix not cleanup led when bt_init fails bt_init() calls bt_leds_init() to register led, but if it fails later, bt_leds_cleanup() is not called to unregister it. This can cause panic if the argument bluetooth-power in text is freed and then another led_trigger_register() tries to access it: BUG: unable to handle page fault for address: ffffffffc06d3bc0 RIP: 0010:strcmp+0xc/0x30 Call Trace: <TASK>
led_trigger_register+0x10d/0x4f0 led_trigger_register_simple+0x7d/0x100 bt_init+0x39/0xf7 [bluetooth] do_one_initcall+0xd0/0x4e0 (CVE-2022-48971)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48971
https://ubuntu.com/security/CVE-2022-48971

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48971

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225570 - Linux Distros Unpatched Vulnerability : CVE-2022-48972
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() Kernel fault injection test reports null-ptr- deref as follows: BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP:
0010:cfg802154_netdev_notifier_call+0x120/0x310 include/linux/list.h:114 Call Trace: <TASK>
raw_notifier_call_chain+0x6d/0xa0 kernel/notifier.c:87 call_netdevice_notifiers_info+0x6e/0xc0 net/core/dev.c:1944 unregister_netdevice_many_notify+0x60d/0xcb0 net/core/dev.c:1982 unregister_netdevice_queue+0x154/0x1a0 net/core/dev.c:10879 register_netdevice+0x9a8/0xb90 net/core/dev.c:10083 ieee802154_if_add+0x6ed/0x7e0 net/mac802154/iface.c:659 ieee802154_register_hw+0x29c/0x330 net/mac802154/main.c:229 mcr20a_probe+0xaaa/0xcb1 drivers/net/ieee802154/mcr20a.c:1316 ieee802154_if_add() allocates wpan_dev as netdev's private data, but not init the list in struct wpan_dev. cfg802154_netdev_notifier_call() manage the list when device register/unregister, and may lead to null-ptr-deref. Use INIT_LIST_HEAD() on it to initialize it correctly. (CVE-2022-48972)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48972
https://ubuntu.com/security/CVE-2022-48972

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48972

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225713 - Linux Distros Unpatched Vulnerability : CVE-2022-48979
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/amd/display: fix array index out of bound error in DCN32 DML [Why&How] LinkCapacitySupport array is indexed with the number of voltage states and not the number of max DPPs. Fix the error by changing the array declaration to use the correct (larger) array size of total number of voltage states.
(CVE-2022-48979)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48979
https://security-tracker.debian.org/tracker/CVE-2022-48979
https://ubuntu.com/security/CVE-2022-48979

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48979

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225384 - Linux Distros Unpatched Vulnerability : CVE-2022-48982
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: Fix crash when replugging CSR fake controllers It seems fake CSR 5.0 clones can cause the suspend notifier to be registered twice causing the following kernel panic: [ 71.986122] Call Trace: [ 71.986124] <TASK> [ 71.986125] blocking_notifier_chain_register+0x33/0x60 [ 71.986130] hci_register_dev+0x316/0x3d0 [bluetooth 99b5497ea3d09708fa1366c1dc03288bf3cca8da] [ 71.986154] btusb_probe+0x979/0xd85 [btusb e1e0605a4f4c01984a4b9c8ac58c3666ae287477] [ 71.986159] ?
__pm_runtime_set_status+0x1a9/0x300 [ 71.986162] ? ktime_get_mono_fast_ns+0x3e/0x90 [ 71.986167] usb_probe_interface+0xe3/0x2b0 [ 71.986171] really_probe+0xdb/0x380 [ 71.986174] ? pm_runtime_barrier+0x54/0x90 [ 71.986177] __driver_probe_device+0x78/0x170 [ 71.986180] driver_probe_device+0x1f/0x90 [ 71.986183] __device_attach_driver+0x89/0x110 [ 71.986186] ? driver_allows_async_probing+0x70/0x70 [ 71.986189] bus_for_each_drv+0x8c/0xe0 [ 71.986192]
__device_attach+0xb2/0x1e0 [ 71.986195] bus_probe_device+0x92/0xb0 [ 71.986198] device_add+0x422/0x9a0 [ 71.986201] ? sysfs_merge_group+0xd4/0x110 [ 71.986205] usb_set_configuration+0x57a/0x820 [ 71.986208] usb_generic_driver_probe+0x4f/0x70 [ 71.986211] usb_probe_device+0x3a/0x110 [ 71.986213] really_probe+0xdb/0x380 [ 71.986216] ? pm_runtime_barrier+0x54/0x90 [ 71.986219]
__driver_probe_device+0x78/0x170 [ 71.986221] driver_probe_device+0x1f/0x90 [ 71.986224]
__device_attach_driver+0x89/0x110 [ 71.986227] ? driver_allows_async_probing+0x70/0x70 [ 71.986230] bus_for_each_drv+0x8c/0xe0 [ 71.986232] __device_attach+0xb2/0x1e0 [ 71.986235] bus_probe_device+0x92/0xb0 [ 71.986237] device_add+0x422/0x9a0 [ 71.986239] ? _dev_info+0x7d/0x98 [ 71.986242] ? blake2s_update+0x4c/0xc0 [ 71.986246] usb_new_device.cold+0x148/0x36d [ 71.986250] hub_event+0xa8a/0x1910 [ 71.986255] process_one_work+0x1c4/0x380 [ 71.986259] worker_thread+0x51/0x390 [ 71.986262] ? rescuer_thread+0x3b0/0x3b0 [ 71.986264] kthread+0xdb/0x110 [ 71.986266] ? kthread_complete_and_exit+0x20/0x20 [ 71.986268] ret_from_fork+0x1f/0x30 [ 71.986273] </TASK> [ 71.986274]
---[ end trace 0000000000000000 ]--- [ 71.986284] btusb: probe of 2-1.6:1.0 failed with error -17 (CVE-2022-48982)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48982
https://ubuntu.com/security/CVE-2022-48982

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48982

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225429 - Linux Distros Unpatched Vulnerability : CVE-2022-48983
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() Syzkaller reports a NULL deref bug as follows: BUG: KASAN: null-ptr-deref in io_tctx_exit_cb+0x53/0xd3 Read of size 4 at addr 0000000000000138 by task file1/1955 CPU: 1 PID: 1955 Comm: file1 Not tainted 6.1.0-rc7-00103-gef4d3ea40565 #75 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0xcd/0x134 ? io_tctx_exit_cb+0x53/0xd3 kasan_report+0xbb/0x1f0 ? io_tctx_exit_cb+0x53/0xd3 kasan_check_range+0x140/0x190 io_tctx_exit_cb+0x53/0xd3 task_work_run+0x164/0x250 ? task_work_cancel+0x30/0x30 get_signal+0x1c3/0x2440 ? lock_downgrade+0x6e0/0x6e0 ? lock_downgrade+0x6e0/0x6e0 ? exit_signals+0x8b0/0x8b0 ? do_raw_read_unlock+0x3b/0x70 ? do_raw_spin_unlock+0x50/0x230 arch_do_signal_or_restart+0x82/0x2470 ? kmem_cache_free+0x260/0x4b0 ? putname+0xfe/0x140 ? get_sigframe_size+0x10/0x10 ? do_execveat_common.isra.0+0x226/0x710 ? lockdep_hardirqs_on+0x79/0x100 ? putname+0xfe/0x140 ? do_execveat_common.isra.0+0x238/0x710 exit_to_user_mode_prepare+0x15f/0x250 syscall_exit_to_user_mode+0x19/0x50 do_syscall_64+0x42/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0023:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. RSP: 002b:00000000fffb7790 EFLAGS: 00000200 ORIG_RAX: 000000000000000b RAX:
0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10:
0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> Kernel panic - not syncing: panic_on_warn set ... This happens because the adding of task_work from io_ring_exit_work() isn't synchronized with canceling all work items from eg exec. The execution of the two are ordered in that they are both run by the task itself, but if io_tctx_exit_cb() is queued while we're canceling all work items off exec AND gets executed when the task exits to userspace rather than in the main loop in io_uring_cancel_generic(), then we can find current->io_uring == NULL and hit the above crash. It's safe to add this NULL check here, because the execution of the two paths are done by the task itself. [axboe: add code comment and also put an explanation in the commit msg] (CVE-2022-48983)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48983
https://ubuntu.com/security/CVE-2022-48983

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48983

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225453 - Linux Distros Unpatched Vulnerability : CVE-2022-48984
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: can: slcan: fix freed work crash The LTP test pty03 is causing a crash in slcan: BUG: kernel NULL pointer dereference, address:
0000000000000008 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 348 Comm: kworker/0:3 Not tainted 6.0.8-1-default #1 openSUSE Tumbleweed 9d20364b934f5aab0a9bdf84e8f45cfdfae39dab Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014 Workqueue: 0x0 (events) RIP:
0010:process_one_work (/home/rich/kernel/linux/kernel/workqueue.c:706 /home/rich/kernel/linux/kernel/workqueue.c:2185) Code: 49 89 ff 41 56 41 55 41 54 55 53 48 89 f3 48 83 ec 10 48 8b 06 48 8b 6f 48 49 89 c4 45 30 e4 a8 04 b8 00 00 00 00 4c 0f 44 e0 <49> 8b 44 24 08 44 8b a8 00 01 00 00 41 83 e5 20 f6 45 10 04 75 0e RSP: 0018:ffffaf7b40f47e98 EFLAGS: 00010046 RAX: 0000000000000000 RBX:
ffff9d644e1b8b48 RCX: ffff9d649e439968 RDX: 00000000ffff8455 RSI: ffff9d644e1b8b48 RDI: ffff9d64764aa6c0 RBP: ffff9d649e4335c0 R08: 0000000000000c00 R09: ffff9d64764aa734 R10: 0000000000000007 R11:
0000000000000001 R12: 0000000000000000 R13: ffff9d649e4335e8 R14: ffff9d64490da780 R15: ffff9d64764aa6c0 FS: 0000000000000000(0000) GS:ffff9d649e400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 0000000036424000 CR4: 00000000000006f0 Call Trace: <TASK>
worker_thread (/home/rich/kernel/linux/kernel/workqueue.c:2436) kthread (/home/rich/kernel/linux/kernel/kthread.c:376) ret_from_fork (/home/rich/kernel/linux/arch/x86/entry/entry_64.S:312) Apparently, the slcan's tx_work is freed while being scheduled. While slcan_netdev_close() (netdev side) calls flush_work(&sl->tx_work), slcan_close() (tty side) does not. So when the netdev is never set UP, but the tty is stuffed with bytes and forced to wakeup write, the work is scheduled, but never flushed. So add an additional flush_work() to slcan_close() to be sure the work is flushed under all circumstances. The Fixes commit below moved flush_work() from slcan_close() to slcan_netdev_close(). What was the rationale behind it? Maybe we can drop the one in slcan_netdev_close()? I see the same pattern in can327. So it perhaps needs the very same fix.
(CVE-2022-48984)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48984
https://ubuntu.com/security/CVE-2022-48984

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48984

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225349 - Linux Distros Unpatched Vulnerability : CVE-2022-48986
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm/gup: fix gup_pud_range() for dax For dax pud, pud_huge() returns true on x86. So the function works as long as hugetlb is configured. However, dax doesn't depend on hugetlb. Commit 414fd080d125 (mm/gup: fix gup_pmd_range() for dax) fixed devmap-backed huge PMDs, but missed devmap-backed huge PUDs. Fix this as well. This fixes the below kernel panic: general protection fault, probably for non-canonical address 0x69e7c000cc478: 0000 [#1] SMP < snip > Call Trace: <TASK> get_user_pages_fast+0x1f/0x40 iov_iter_get_pages+0xc6/0x3b0 ? mempool_alloc+0x5d/0x170 bio_iov_iter_get_pages+0x82/0x4e0 ? bvec_alloc+0x91/0xc0 ? bio_alloc_bioset+0x19a/0x2a0 blkdev_direct_IO+0x282/0x480 ?
__io_complete_rw_common+0xc0/0xc0 ? filemap_range_has_page+0x82/0xc0 generic_file_direct_write+0x9d/0x1a0 ? inode_update_time+0x24/0x30 __generic_file_write_iter+0xbd/0x1e0 blkdev_write_iter+0xb4/0x150 ? io_import_iovec+0x8d/0x340 io_write+0xf9/0x300 io_issue_sqe+0x3c3/0x1d30 ? sysvec_reschedule_ipi+0x6c/0x80
__io_queue_sqe+0x33/0x240 ? fget+0x76/0xa0 io_submit_sqes+0xe6a/0x18d0 ? __fget_light+0xd1/0x100
__x64_sys_io_uring_enter+0x199/0x880 ? __context_tracking_enter+0x1f/0x70 ? irqentry_exit_to_user_mode+0x24/0x30 ? irqentry_exit+0x1d/0x30 ? __context_tracking_exit+0xe/0x70 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fc97c11a7be < snip > </TASK>
---[ end trace 48b2e0e67debcaeb ]--- RIP: 0010:internal_get_user_pages_fast+0x340/0x990 < snip > Kernel panic - not syncing: Fatal exception Kernel Offset: disabled (CVE-2022-48986)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48986
https://ubuntu.com/security/CVE-2022-48986

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48986

Plugin Information
Published: 2025/03/05, Modified: 2025/11/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225678 - Linux Distros Unpatched Vulnerability : CVE-2022-48987
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: media: v4l2-dv-timings.c: fix too strict blanking sanity checks Sanity checks were added to verify the v4l2_bt_timings blanking fields in order to avoid integer overflows when userspace passes weird values. But that assumed that userspace would correctly fill in the front porch, backporch and sync values, but sometimes all you know is the total blanking, which is then assigned to just one of these fields. And that can fail with these checks. So instead set a maximum for the total horizontal and vertical blanking and check that each field remains below that. That is still sufficient to avoid integer overflows, but it also allows for more flexibility in how userspace fills in these fields. (CVE-2022-48987)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48987
https://ubuntu.com/security/CVE-2022-48987

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-48987

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225760 - Linux Distros Unpatched Vulnerability : CVE-2022-48994
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. seq_copy_in_user() and seq_copy_in_kernel() did not have prototypes matching snd_seq_dump_func_t. Adjust this and remove the casts. There are not resulting binary output differences. This was found as a result of Clang's new
-Wcast-function-type-strict flag, which is more sensitive than the simpler -Wcast-function-type, which only checks for type width mismatches. (CVE-2022-48994)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-48994
https://ubuntu.com/security/CVE-2022-48994

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-48994

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246039 - Linux Distros Unpatched Vulnerability : CVE-2022-49005
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Fix bounds check for _sx controls For _sx controls the semantics of the max field is not the usual one, max is the number of steps rather than the maximum value. This means that our check in snd_soc_put_volsw_sx() needs to just check against the maximum value. (CVE-2022-49005)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49005
https://ubuntu.com/security/CVE-2022-49005

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49005

Plugin Information
Published: 2025/08/08, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225751 - Linux Distros Unpatched Vulnerability : CVE-2022-49012
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: afs: Fix server->active leak in afs_put_server The atomic_read was accidentally replaced with atomic_inc_return, which prevents the server from getting cleaned up and causes rmmod to hang with a warning: Can't purge s=00000001 (CVE-2022-49012)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49012
https://ubuntu.com/security/CVE-2022-49012

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49012

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225456 - Linux Distros Unpatched Vulnerability : CVE-2022-49013
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sctp: fix memory leak in sctp_stream_outq_migrate() When sctp_stream_outq_migrate() is called to release stream out resources, the memory pointed to by prio_head in stream out is not released. The memory leak information is as follows: unreferenced object 0xffff88801fe79f80 (size 64): comm sctp_repo, pid 7957, jiffies 4294951704 (age 36.480s) hex dump (first 32 bytes): 80 9f e7 1f 80 88 ff ff 80 9f e7 1f 80 88 ff ff ................ 90 9f e7 1f 80 88 ff ff 90 9f e7 1f 80 88 ff ff ................ backtrace:
[<ffffffff81b215c6>] kmalloc_trace+0x26/0x60 [<ffffffff88ae517c>] sctp_sched_prio_set+0x4cc/0x770 [<ffffffff88ad64f2>] sctp_stream_init_ext+0xd2/0x1b0 [<ffffffff88aa2604>] sctp_sendmsg_to_asoc+0x1614/0x1a30 [<ffffffff88ab7ff1>] sctp_sendmsg+0xda1/0x1ef0 [<ffffffff87f765ed>] inet_sendmsg+0x9d/0xe0 [<ffffffff8754b5b3>] sock_sendmsg+0xd3/0x120 [<ffffffff8755446a>]
__sys_sendto+0x23a/0x340 [<ffffffff87554651>] __x64_sys_sendto+0xe1/0x1b0 [<ffffffff89978b49>] do_syscall_64+0x39/0xb0 [<ffffffff89a0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd (CVE-2022-49013)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49013
https://ubuntu.com/security/CVE-2022-49013

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49013

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225692 - Linux Distros Unpatched Vulnerability : CVE-2022-49021
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: phy: fix null-ptr-deref while probe() failed I got a null-ptr-deref report as following when doing fault injection test: BUG: kernel NULL pointer dereference, address: 0000000000000058 Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 PID: 253 Comm: 507-spi-dm9051 Tainted: G B N 6.1.0-rc3+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:klist_put+0x2d/0xd0 Call Trace: <TASK> klist_remove+0xf1/0x1c0 device_release_driver_internal+0x23e/0x2d0 bus_remove_device+0x1bd/0x240 device_del+0x357/0x770 phy_device_remove+0x11/0x30 mdiobus_unregister+0xa5/0x140 release_nodes+0x6a/0xa0 devres_release_all+0xf8/0x150 device_unbind_cleanup+0x19/0xd0 //probe path: phy_device_register() device_add() phy_connect phy_attach_direct() //set device driver probe() //it's failed, driver is not bound device_bind_driver() // probe failed, it's not called //remove path: phy_device_remove() device_del() device_release_driver_internal() __device_release_driver() //dev->drv is not NULL klist_remove() <- knode_driver is not added yet, cause null-ptr-deref In phy_attach_direct(), after setting the 'dev->driver', probe() fails, device_bind_driver() is not called, so the knode_driver->n_klist is not set, then it causes null-ptr-deref in __device_release_driver() while deleting device. Fix this by setting dev->driver to NULL in the error path in phy_attach_direct(). (CVE-2022-49021)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49021
https://ubuntu.com/security/CVE-2022-49021

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49021

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225635 - Linux Distros Unpatched Vulnerability : CVE-2022-49027
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- iavf: Fix error handling in iavf_init_module() The iavf_init_module() won't destroy workqueue when pci_register_driver() failed. Call destroy_workqueue() when pci_register_driver() failed to prevent the resource leak. Similar to the handling of u132_hcd_init in commit f276e002793c (usb: u132-hcd: fix resource leak) (CVE-2022-49027)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49027
https://ubuntu.com/security/CVE-2022-49027

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49027

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225703 - Linux Distros Unpatched Vulnerability : CVE-2022-49046
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- i2c: dev: check return value when calling dev_set_name() If dev_set_name() fails, the dev_name() is null, check the return value of dev_set_name() to avoid the null-ptr-deref. (CVE-2022-49046)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49046
https://ubuntu.com/security/CVE-2022-49046

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49046

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225617 - Linux Distros Unpatched Vulnerability : CVE-2022-49048
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ipv6: fix panic when forwarding a pkt with no in6 dev kongweibin reported a kernel panic in ip6_forward() when input interface has no in6 dev associated. The following tc commands were used to reproduce this panic: tc qdisc del dev vxlan100 root tc qdisc add dev vxlan100 root netem corrupt 5% (CVE-2022-49048)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49048
https://ubuntu.com/security/CVE-2022-49048

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49048

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225505 - Linux Distros Unpatched Vulnerability : CVE-2022-49052
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mm: fix unexpected zeroed page mapping with zram swap Two processes under CLONE_VM cloning, user process can be corrupted by seeing zeroed page unexpectedly. CPU A CPU B do_swap_page do_swap_page SWP_SYNCHRONOUS_IO path SWP_SYNCHRONOUS_IO path swap_readpage valid data swap_slot_free_notify delete zram entry swap_readpage zeroed(invalid) data pte_lock map the *zero data* to userspace pte_unlock pte_lock if (!pte_same) goto out_nomap; pte_unlock return and next refault will read zeroed data The swap_slot_free_notify is bogus for CLONE_VM case since it doesn't increase the refcount of swap slot at copy_mm so it couldn't catch up whether it's safe or not to discard data from backing device. In the case, only the lock it could rely on to synchronize swap slot freeing is page table lock. Thus, this patch gets rid of the swap_slot_free_notify function. With this patch, CPU A will see correct data. CPU A CPU B do_swap_page do_swap_page SWP_SYNCHRONOUS_IO path SWP_SYNCHRONOUS_IO path swap_readpage original data pte_lock map the original data swap_free swap_range_free bd_disk->fops->swap_slot_free_notify swap_readpage read zeroed data pte_unlock pte_lock if (!pte_same) goto out_nomap; pte_unlock return on next refault will see mapped data by CPU B The concern of the patch would increase memory consumption since it could keep wasted memory with compressed form in zram as well as uncompressed form in address space. However, most of cases of zram uses no readahead and do_swap_page is followed by swap_free so it will free the compressed form from in zram quickly.
(CVE-2022-49052)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49052
https://ubuntu.com/security/CVE-2022-49052

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49052

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225350 - Linux Distros Unpatched Vulnerability : CVE-2022-49061
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link When using a fixed-link, the altr_tse_pcs driver crashes due to null-pointer dereference as no phy_device is provided to tse_pcs_fix_mac_speed function. Fix this by adding a check for phy_dev before calling the tse_pcs_fix_mac_speed() function. Also clean up the tse_pcs_fix_mac_speed function a bit. There is no need to check for splitter_base and sgmii_adapter_base because the driver will fail if these 2 variables are not derived from the device tree. (CVE-2022-49061)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49061
https://ubuntu.com/security/CVE-2022-49061

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49061

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225624 - Linux Distros Unpatched Vulnerability : CVE-2022-49065
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- SUNRPC: Fix the svc_deferred_event trace class Fix a NULL deref crash that occurs when an svc_rqst is deferred while the sunrpc tracing subsystem is enabled. svc_revisit() sets dr->xprt to NULL, so it can't be relied upon in the tracepoint to provide the remote's address. Unfortunately we can't revert the svc_deferred_class hunk in commit ece200ddd54b (sunrpc: Save remote presentation address in svc_xprt for trace events) because there is now a specific check of event format specifiers for unsafe dereferences. The warning that check emits is: event svc_defer_recv has unsafe dereference of argument 1 A %pISpc format specifier with a struct sockaddr * is indeed flagged by this check. Instead, take the brute-force approach used by the svcrdma_qp_error tracepoint. Convert the dr::addr field into a presentation address in the TP_fast_assign() arm of the trace event, and store that as a string. This fix can be backported to -stable kernels. In the meantime, commit c6ced22997ad (tracing: Update print fmt check to handle new __get_sockaddr() macro) is now in v5.18, so this wonky fix can be replaced with
__sockaddr() and friends properly during the v5.19 merge window. (CVE-2022-49065)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49065
https://ubuntu.com/security/CVE-2022-49065

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49065

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225227 - Linux Distros Unpatched Vulnerability : CVE-2022-49074
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- irqchip/gic-v3: Fix GICR_CTLR.RWP polling It turns out that our polling of RWP is totally wrong when checking for it in the redistributors, as we test the *distributor* bit index, whereas it is a different bit number in the RDs... Oopsie boo. This is embarassing. Not only because it is wrong, but also because it took *8 years* to notice the blunder... Just fix the damn thing. (CVE-2022-49074)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49074
https://ubuntu.com/security/CVE-2022-49074

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49074

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225572 - Linux Distros Unpatched Vulnerability : CVE-2022-49077
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) If an mremap() syscall with old_size=0 ends up in move_page_tables(), it will call invalidate_range_start()/invalidate_range_end() unnecessarily, i.e. with an empty range. This causes a WARN in KVM's mmu_notifier. In the past, empty ranges have been diagnosed to be off-by-one bugs, hence the WARNing. Given the low (so far) number of unique reports, the benefits of detecting more buggy callers seem to outweigh the cost of having to fix cases such as this one, where userspace is doing something silly. In this particular case, an early return from move_page_tables() is enough to fix the issue. (CVE-2022-49077)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49077
https://ubuntu.com/security/CVE-2022-49077

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49077

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225462 - Linux Distros Unpatched Vulnerability : CVE-2022-49089
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition The documentation of the function rvt_error_qp says both r_lock and s_lock need to be held when calling that function. It also asserts using lockdep that both of those locks are held. However, the commit I referenced in Fixes accidentally makes the call to rvt_error_qp in rvt_ruc_loopback no longer covered by r_lock. This results in the lockdep assertion failing and also possibly in a race condition. (CVE-2022-49089)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49089
https://ubuntu.com/security/CVE-2022-49089

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49089

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225423 - Linux Distros Unpatched Vulnerability : CVE-2022-49092
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix route with nexthop object delete warning FRR folks have hit a kernel warning[1] while deleting routes[2] which is caused by trying to delete a route pointing to a nexthop id without specifying nhid but matching on an interface.
That is, a route is found but we hit a warning while matching it. The warning is from fib_info_nh() in include/net/nexthop.h because we run it on a fib_info with nexthop object. The call chain is:
inet_rtm_delroute -> fib_table_delete -> fib_nh_match (called with a nexthop fib_info and also with fc_oif set thus calling fib_info_nh on the fib_info and triggering the warning). The fix is to not do any matching in that branch if the fi has a nexthop object because those are managed separately. I.e. we should match when deleting without nh spec and should fail when deleting a nexthop route with old-style nh spec because nexthop objects are managed separately, e.g.: $ ip r show 1.2.3.4/32 1.2.3.4 nhid 12 via 192.168.11.2 dev dummy0 $ ip r del 1.2.3.4/32 $ ip r del 1.2.3.4/32 nhid 12 <both should work> $ ip r del 1.2.3.4/32 dev dummy0 <should fail with ESRCH> [1] [ 523.462226] ------------[ cut here ]------------ [ 523.462230] WARNING: CPU: 14 PID: 22893 at include/net/nexthop.h:468 fib_nh_match+0x210/0x460 [ 523.462236] Modules linked in: dummy rpcsec_gss_krb5 xt_socket nf_socket_ipv4 nf_socket_ipv6 ip6table_raw iptable_raw bpf_preload xt_statistic ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs xt_mark nf_tables xt_nat veth nf_conntrack_netlink nfnetlink xt_addrtype br_netfilter overlay dm_crypt nfsv3 nfs fscache netfs vhost_net vhost vhost_iotlb tap tun xt_CHECKSUM xt_MASQUERADE xt_conntrack 8021q garp mrp ipt_REJECT nf_reject_ipv4 ip6table_mangle ip6table_nat iptable_mangle iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter bridge stp llc rfcomm snd_seq_dummy snd_hrtimer rpcrdma rdma_cm iw_cm ib_cm ib_core ip6table_filter xt_comment ip6_tables vboxnetadp(OE) vboxnetflt(OE) vboxdrv(OE) qrtr bnep binfmt_misc xfs vfat fat squashfs loop nvidia_drm(POE) nvidia_modeset(POE) nvidia_uvm(POE) nvidia(POE) intel_rapl_msr intel_rapl_common snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi btusb btrtl iwlmvm uvcvideo btbcm snd_hda_intel edac_mce_amd [ 523.462274] videobuf2_vmalloc videobuf2_memops btintel snd_intel_dspcfg videobuf2_v4l2 snd_intel_sdw_acpi bluetooth snd_usb_audio snd_hda_codec mac80211 snd_usbmidi_lib joydev snd_hda_core videobuf2_common kvm_amd snd_rawmidi snd_hwdep snd_seq videodev ccp snd_seq_device libarc4 ecdh_generic mc snd_pcm kvm iwlwifi snd_timer drm_kms_helper snd cfg80211 cec soundcore irqbypass rapl wmi_bmof i2c_piix4 rfkill k10temp pcspkr acpi_cpufreq nfsd auth_rpcgss nfs_acl lockd grace sunrpc drm zram ip_tables crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel nvme sp5100_tco r8169 nvme_core wmi ipmi_devintf ipmi_msghandler fuse [ 523.462300] CPU: 14 PID: 22893 Comm: ip Tainted: P OE 5.16.18-200.fc35.x86_64 #1 [ 523.462302] Hardware name: Micro-Star International Co., Ltd. MS-7C37/MPG X570 GAMING EDGE WIFI (MS-7C37), BIOS 1.C0 10/29/2020 [ 523.462303] RIP: 0010:fib_nh_match+0x210/0x460 [ 523.462304] Code: 7c 24 20 48 8b b5 90 00 00 00 e8 bb ee f4 ff 48 8b 7c 24 20 41 89 c4 e8 ee eb f4 ff 45 85 e4 0f 85 2e fe ff ff e9 4c ff ff ff <0f> 0b e9 17 ff ff ff 3c 0a 0f 85 61 fe ff ff 48 8b b5 98 00 00 00 [ 523.462306] RSP:
0018:ffffaa53d4d87928 EFLAGS: 00010286 [ 523.462307] RAX: 0000000000000000 RBX: ffffaa53d4d87a90 RCX:
ffffaa53d4d87bb0 [ 523.462308] RDX: ffff9e3d2ee6be80 RSI: ffffaa53d4d87a90 RDI: ffffffff920ed380 [ 523.462309] RBP: ffff9e3d2ee6be80 R08: 0000000000000064 R09: 0000000000000000 [ 523.462310] R10:
0000000000000000 R11: 0000000000000000 R12: 0000000000000031 [ 523.462310] R13: 0000000000000020 R14:
0000000000000000 R15: ffff9e3d331054e0 [ 523.462311] FS: 00007f2455 ---truncated--- (CVE-2022-49092)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49092
https://ubuntu.com/security/CVE-2022-49092

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49092

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225613 - Linux Distros Unpatched Vulnerability : CVE-2022-49096
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: sfc: add missing xdp queue reinitialization After rx/tx ring buffer size is changed, kernel panic occurs when it acts XDP_TX or XDP_REDIRECT. When tx/rx ring buffer size is changed(ethtool -G), sfc driver reallocates and reinitializes rx and tx queues and their buffer (tx_queue->buffer). But it misses reinitializing xdp queues(efx->xdp_tx_queues). So, while it is acting XDP_TX or XDP_REDIRECT, it uses the uninitialized tx_queue->buffer. A new function efx_set_xdp_channels() is separated from efx_set_channels() to handle only xdp queues. Splat looks like: BUG: kernel NULL pointer dereference, address:
000000000000002a #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#4] PREEMPT SMP NOPTI RIP: 0010:efx_tx_map_chunk+0x54/0x90 [sfc] CPU: 2 PID: 0 Comm: swapper/2 Tainted: G D 5.17.0+ #55 e8beeee8289528f11357029357cf Code: 48 8b 8d a8 01 00 00 48 8d 14 52 4c 8d 2c d0 44 89 e0 48 85 c9 74 0e 44 89 e2 4c 89 f6 48 80 RSP: 0018:ffff92f121e45c60 EFLAGS: 00010297 RIP: 0010:efx_tx_map_chunk+0x54/0x90 [sfc] RAX: 0000000000000040 RBX: ffff92ea506895c0 RCX:
ffffffffc0330870 RDX: 0000000000000001 RSI: 00000001139b10ce RDI: ffff92ea506895c0 RBP: ffffffffc0358a80 R08: 00000001139b110d R09: 0000000000000000 R10: 0000000000000001 R11: ffff92ea414c0088 R12:
0000000000000040 R13: 0000000000000018 R14: 00000001139b10ce R15: ffff92ea506895c0 FS:
0000000000000000(0000) GS:ffff92f121ec0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 Code: 48 8b 8d a8 01 00 00 48 8d 14 52 4c 8d 2c d0 44 89 e0 48 85 c9 74 0e 44 89 e2 4c 89 f6 48 80 CR2: 000000000000002a CR3: 00000003e6810004 CR4: 00000000007706e0 RSP: 0018:ffff92f121e85c60 EFLAGS: 00010297 PKRU: 55555554 RAX: 0000000000000040 RBX: ffff92ea50689700 RCX: ffffffffc0330870 RDX:
0000000000000001 RSI: 00000001145a90ce RDI: ffff92ea50689700 RBP: ffffffffc0358a80 R08: 00000001145a910d R09: 0000000000000000 R10: 0000000000000001 R11: ffff92ea414c0088 R12: 0000000000000040 R13:
0000000000000018 R14: 00000001145a90ce R15: ffff92ea50689700 FS: 0000000000000000(0000) GS:ffff92f121e80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
000000000000002a CR3: 00000003e6810005 CR4: 00000000007706e0 PKRU: 55555554 Call Trace: <IRQ>
efx_xdp_tx_buffers+0x12b/0x3d0 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] __efx_rx_packet+0x5c3/0x930 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] efx_rx_packet+0x28c/0x2e0 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] efx_ef10_ev_process+0x5f8/0xf40 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] ? enqueue_task_fair+0x95/0x550 efx_poll+0xc4/0x360 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] (CVE-2022-49096)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49096
https://security-tracker.debian.org/tracker/CVE-2022-49096
https://ubuntu.com/security/CVE-2022-49096

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49096

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225646 - Linux Distros Unpatched Vulnerability : CVE-2022-49100
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- virtio_console: eliminate anonymous module_init & module_exit Eliminate anonymous module_init() and module_exit(), which can lead to confusion or ambiguity when reading System.map, crashes/oops/bugs, or an initcall_debug log. Give each of these init and exit functions unique driver-specific names to eliminate the anonymous names. Example 1: (System.map) ffffffff832fc78c t init ffffffff832fc79e t init ffffffff832fc8f8 t init Example 2: (initcall_debug log) calling init+0x0/0x12 @ 1 initcall init+0x0/0x12 returned 0 after 15 usecs calling init+0x0/0x60 @ 1 initcall init+0x0/0x60 returned 0 after 2 usecs calling init+0x0/0x9a @ 1 initcall init+0x0/0x9a returned 0 after 74 usecs (CVE-2022-49100)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49100
https://ubuntu.com/security/CVE-2022-49100

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49100

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225418 - Linux Distros Unpatched Vulnerability : CVE-2022-49103
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NFSv4.2: fix reference count leaks in _nfs42_proc_copy_notify() [You don't often get email from xiongx18@fudan.edu.cn. Learn why this is important at http://aka.ms/LearnAboutSenderIdentification.] The reference counting issue happens in two error paths in the function _nfs42_proc_copy_notify(). In both error paths, the function simply returns the error code and forgets to balance the refcount of object `ctx`, bumped by get_nfs_open_context() earlier, which may cause refcount leaks. Fix it by balancing refcount of the `ctx` object before the function returns in both error paths. (CVE-2022-49103)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49103
https://ubuntu.com/security/CVE-2022-49103

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49103

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225352 - Linux Distros Unpatched Vulnerability : CVE-2022-49110
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfilter: conntrack: revisit gc autotuning as of commit 4608fdfc07e1 (netfilter: conntrack: collect all entries in one cycle) conntrack gc was changed to run every 2 minutes. On systems where conntrack hash table is set to large value, most evictions happen from gc worker rather than the packet path due to hash table distribution. This causes netlink event overflows when events are collected. This change collects average expiry of scanned entries and reschedules to the average remaining value, within 1 to 60 second interval. To avoid event overflows, reschedule after each bucket and add a limit for both run time and number of evictions per run. If more entries have to be evicted, reschedule and restart 1 jiffy into the future. (CVE-2022-49110)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49110
https://security-tracker.debian.org/tracker/CVE-2022-49110
https://ubuntu.com/security/CVE-2022-49110

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49110

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225420 - Linux Distros Unpatched Vulnerability : CVE-2022-49118
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: hisi_sas: Free irq vectors in order for v3 HW If the driver probe fails to request the channel IRQ or fatal IRQ, the driver will free the IRQ vectors before freeing the IRQs in free_irq(), and this will cause a kernel BUG like this: ------------[ cut here ]------------ kernel BUG at drivers/pci/msi.c:369! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Call trace: free_msi_irqs+0x118/0x13c pci_disable_msi+0xfc/0x120 pci_free_irq_vectors+0x24/0x3c hisi_sas_v3_probe+0x360/0x9d0 [hisi_sas_v3_hw] local_pci_probe+0x44/0xb0 work_for_cpu_fn+0x20/0x34 process_one_work+0x1d0/0x340 worker_thread+0x2e0/0x460 kthread+0x180/0x190 ret_from_fork+0x10/0x20 ---[ end trace b88990335b610c11 ]--- So we use devm_add_action() to control the order in which we free the vectors. (CVE-2022-49118)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49118
https://ubuntu.com/security/CVE-2022-49118

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49118

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225587 - Linux Distros Unpatched Vulnerability : CVE-2022-49132
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ath11k: pci: fix crash on suspend if board file is not found Mario reported that the kernel was crashing on suspend if ath11k was not able to find a board file: [ 473.693286] PM: Suspending system (s2idle) [ 473.693291] printk: Suspending console(s) (use no_console_suspend to debug) [ 474.407787] BUG: unable to handle page fault for address: 0000000000002070 [ 474.407791] #PF: supervisor read access in kernel mode [ 474.407794] #PF: error_code(0x0000) - not-present page [ 474.407798] PGD 0 P4D 0 [ 474.407801] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 474.407805] CPU: 2 PID: 2350 Comm: kworker/u32:14 Tainted: G W 5.16.0 #248 [...] [ 474.407868] Call Trace: [ 474.407870] <TASK> [ 474.407874] ? _raw_spin_lock_irqsave+0x2a/0x60 [ 474.407882] ? lock_timer_base+0x72/0xa0 [ 474.407889] ? _raw_spin_unlock_irqrestore+0x29/0x3d [ 474.407892] ? try_to_del_timer_sync+0x54/0x80 [ 474.407896] ath11k_dp_rx_pktlog_stop+0x49/0xc0 [ath11k] [ 474.407912] ath11k_core_suspend+0x34/0x130 [ath11k] [ 474.407923] ath11k_pci_pm_suspend+0x1b/0x50 [ath11k_pci] [ 474.407928] pci_pm_suspend+0x7e/0x170 [ 474.407935] ? pci_pm_freeze+0xc0/0xc0 [ 474.407939] dpm_run_callback+0x4e/0x150 [ 474.407947] __device_suspend+0x148/0x4c0 [ 474.407951] async_suspend+0x20/0x90 dmesg-efi-164255130401001: Oops#1 Part1 [ 474.407955] async_run_entry_fn+0x33/0x120 [ 474.407959] process_one_work+0x220/0x3f0 [ 474.407966] worker_thread+0x4a/0x3d0 [ 474.407971] kthread+0x17a/0x1a0 [ 474.407975] ? process_one_work+0x3f0/0x3f0 [ 474.407979] ? set_kthread_struct+0x40/0x40 [ 474.407983] ret_from_fork+0x22/0x30 [ 474.407991] </TASK> The issue here is that board file loading happens after ath11k_pci_probe() succesfully returns (ath11k initialisation happends asynchronously) and the suspend handler is still enabled, of course failing as ath11k is not properly initialised. Fix this by checking ATH11K_FLAG_QMI_FAIL during both suspend and resume. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03003-QCAHSPSWPL_V1_V2_SILICONZ_LITE-2 (CVE-2022-49132)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49132
https://security-tracker.debian.org/tracker/CVE-2022-49132
https://ubuntu.com/security/CVE-2022-49132

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49132

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225325 - Linux Distros Unpatched Vulnerability : CVE-2022-49134
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mlxsw: spectrum: Guard against invalid local ports When processing events generated by the device's firmware, the driver protects itself from events reported for non-existent local ports, but not for the CPU port (local port 0), which exists, but does not have all the fields as any local port. This can result in a NULL pointer dereference when trying access 'struct mlxsw_sp_port' fields which are not initialized for CPU port. Commit 63b08b1f6834 (mlxsw: spectrum: Protect driver from buggy firmware) already handled such issue by bailing early when processing a PUDE event reported for the CPU port. Generalize the approach by moving the check to a common function and making use of it in all relevant places.
(CVE-2022-49134)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49134
https://security-tracker.debian.org/tracker/CVE-2022-49134
https://ubuntu.com/security/CVE-2022-49134

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49134

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225324 - Linux Distros Unpatched Vulnerability : CVE-2022-49138
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: hci_event: Ignore multiple conn complete events When one of the three connection complete events is received multiple times for the same handle, the device is registered multiple times which leads to memory corruptions. Therefore, consequent events for a single connection are ignored. The conn->state can hold different values, therefore HCI_CONN_HANDLE_UNSET is introduced to identify new connections. To make sure the events do not contain this or another invalid handle HCI_CONN_HANDLE_MAX and checks are introduced. Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=215497 (CVE-2022-49138)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49138
https://security-tracker.debian.org/tracker/CVE-2022-49138
https://ubuntu.com/security/CVE-2022-49138

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.7 (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49138

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225332 - Linux Distros Unpatched Vulnerability : CVE-2022-49139
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt This event is just specified for SCO and eSCO link types. On the reception of a HCI_Synchronous_Connection_Complete for a BDADDR of an existing LE connection, LE link type and a status that triggers the second case of the packet processing a NULL pointer dereference happens, as conn->link is NULL. (CVE-2022-49139)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49139
https://ubuntu.com/security/CVE-2022-49139

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49139

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225348 - Linux Distros Unpatched Vulnerability : CVE-2022-49148
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: watch_queue: Free the page array when watch_queue is dismantled Commit 7ea1a0124b6d (watch_queue: Free the alloc bitmap when the watch_queue is torn down) took care of the bitmap, but not the page array. BUG: memory leak unreferenced object 0xffff88810d9bc140 (size 32): comm syz-executor335, pid 3603, jiffies 4294946994 (age 12.840s) hex dump (first 32 bytes): 40 a7 40 04 00 ea ff ff 00 00 00 00 00 00 00 00 @.@............. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: kmalloc_array include/linux/slab.h:621 [inline] kcalloc include/linux/slab.h:652 [inline] watch_queue_set_size+0x12f/0x2e0 kernel/watch_queue.c:251 pipe_ioctl+0x82/0x140 fs/pipe.c:632 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __x64_sys_ioctl+0xfc/0x140 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] (CVE-2022-49148)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49148
https://ubuntu.com/security/CVE-2022-49148

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49148

Plugin Information
Published: 2025/03/05, Modified: 2025/10/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225788 - Linux Distros Unpatched Vulnerability : CVE-2022-49149
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- rxrpc: Fix call timer start racing with call destruction The rxrpc_call struct has a timer used to handle various timed events relating to a call. This timer can get started from the packet input routines that are run in softirq mode with just the RCU read lock held. Unfortunately, because only the RCU read lock is held - and neither ref or other lock is taken - the call can start getting destroyed at the same time a packet comes in addressed to that call. This causes the timer - which was already stopped - to get restarted. Later, the timer dispatch code may then oops if the timer got deallocated first. Fix this by trying to take a ref on the rxrpc_call struct and, if successful, passing that ref along to the timer. If the timer was already running, the ref is discarded. The timer completion routine can then pass the ref along to the call's work item when it queues it. If the timer or work item where already queued/running, the extra ref is discarded. (CVE-2022-49149)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49149
https://ubuntu.com/security/CVE-2022-49149

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49149

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225511 - Linux Distros Unpatched Vulnerability : CVE-2022-49154
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- KVM: SVM: fix panic on out-of-bounds guest IRQ As guest_irq is coming from KVM_IRQFD API call, it may trigger crash in svm_update_pi_irte() due to out-of-bounds: crash> bt PID: 22218 TASK: ffff951a6ad74980 CPU: 73 COMMAND: vcpu8 #0 [ffffb1ba6707fa40] machine_kexec at ffffffff8565b397 #1 [ffffb1ba6707fa90]
__crash_kexec at ffffffff85788a6d #2 [ffffb1ba6707fb58] crash_kexec at ffffffff8578995d #3 [ffffb1ba6707fb70] oops_end at ffffffff85623c0d #4 [ffffb1ba6707fb90] no_context at ffffffff856692c9 #5 [ffffb1ba6707fbf8] exc_page_fault at ffffffff85f95b51 #6 [ffffb1ba6707fc50] asm_exc_page_fault at ffffffff86000ace [exception RIP: svm_update_pi_irte+227] RIP: ffffffffc0761b53 RSP: ffffb1ba6707fd08 RFLAGS: 00010086 RAX: ffffb1ba6707fd78 RBX: ffffb1ba66d91000 RCX: 0000000000000001 RDX: 00003c803f63f1c0 RSI: 000000000000019a RDI: ffffb1ba66db2ab8 RBP: 000000000000019a R8: 0000000000000040 R9:
ffff94ca41b82200 R10: ffffffffffffffcf R11: 0000000000000001 R12: 0000000000000001 R13: 0000000000000001 R14: ffffffffffffffcf R15: 000000000000005f ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #7 [ffffb1ba6707fdb8] kvm_irq_routing_update at ffffffffc09f19a1 [kvm] #8 [ffffb1ba6707fde0] kvm_set_irq_routing at ffffffffc09f2133 [kvm] #9 [ffffb1ba6707fe18] kvm_vm_ioctl at ffffffffc09ef544 [kvm] RIP: 00007f143c36488b RSP: 00007f143a4e04b8 RFLAGS: 00000246 RAX: ffffffffffffffda RBX: 00007f05780041d0 RCX: 00007f143c36488b RDX: 00007f05780041d0 RSI: 000000004008ae6a RDI: 0000000000000020 RBP:
00000000000004e8 R8: 0000000000000008 R9: 00007f05780041e0 R10: 00007f0578004560 R11: 0000000000000246 R12: 00000000000004e0 R13: 000000000000001a R14: 00007f1424001c60 R15: 00007f0578003bc0 ORIG_RAX:
0000000000000010 CS: 0033 SS: 002b Vmx have been fix this in commit 3a8b0677fc61 (KVM: VMX: Do not BUG() on out-of-bounds guest IRQ), so we can just copy source from that to fix this. (CVE-2022-49154)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49154
https://ubuntu.com/security/CVE-2022-49154

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49154

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225381 - Linux Distros Unpatched Vulnerability : CVE-2022-49155
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() [ 12.323788] BUG: using smp_processor_id() in preemptible [00000000] code: systemd-udevd/1020 [ 12.332297] caller is qla2xxx_create_qpair+0x32a/0x5d0 [qla2xxx] [ 12.338417] CPU: 7 PID: 1020 Comm: systemd-udevd Tainted: G I
--------- --- 5.14.0-29.el9.x86_64 #1 [ 12.348827] Hardware name: Dell Inc. PowerEdge R610/0F0XJ6, BIOS 6.6.0 05/22/2018 [ 12.356356] Call Trace: [ 12.358821] dump_stack_lvl+0x34/0x44 [ 12.362514] check_preemption_disabled+0xd9/0xe0 [ 12.367164] qla2xxx_create_qpair+0x32a/0x5d0 [qla2xxx] [ 12.372481] qla2x00_probe_one+0xa3a/0x1b80 [qla2xxx] [ 12.377617] ? _raw_spin_lock_irqsave+0x19/0x40 [ 12.384284] local_pci_probe+0x42/0x80 [ 12.390162] ? pci_match_device+0xd7/0x110 [ 12.396366] pci_device_probe+0xfd/0x1b0 [ 12.402372] really_probe+0x1e7/0x3e0 [ 12.408114]
__driver_probe_device+0xfe/0x180 [ 12.414544] driver_probe_device+0x1e/0x90 [ 12.420685]
__driver_attach+0xc0/0x1c0 [ 12.426536] ? __device_attach_driver+0xe0/0xe0 [ 12.433061] ?
__device_attach_driver+0xe0/0xe0 [ 12.439538] bus_for_each_dev+0x78/0xc0 [ 12.445294] bus_add_driver+0x12b/0x1e0 [ 12.451021] driver_register+0x8f/0xe0 [ 12.456631] ? 0xffffffffc07bc000 [ 12.461773] qla2x00_module_init+0x1be/0x229 [qla2xxx] [ 12.468776] do_one_initcall+0x44/0x200 [ 12.474401] ? load_module+0xad3/0xba0 [ 12.479908] ? kmem_cache_alloc_trace+0x45/0x410 [ 12.486268] do_init_module+0x5c/0x280 [ 12.491730] __do_sys_init_module+0x12e/0x1b0 [ 12.497785] do_syscall_64+0x3b/0x90 [ 12.503029] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 12.509764] RIP:
0033:0x7f554f73ab2e (CVE-2022-49155)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49155
https://ubuntu.com/security/CVE-2022-49155

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49155

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225287 - Linux Distros Unpatched Vulnerability : CVE-2022-49159
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: qla2xxx: Implement ref count for SRB The timeout handler and the done function are racing. When qla2x00_async_iocb_timeout() starts to run it can be preempted by the normal response path (via the firmware?). qla24xx_async_gpsc_sp_done() releases the SRB unconditionally. When scheduling back to qla2x00_async_iocb_timeout() qla24xx_async_abort_cmd() will access an freed sp->qpair pointer: qla2xxx [0000:83:00.0]-2871:0: Async-gpsc timeout - hdl=63d portid=234500 50:06:0e:80:08:77:b6:21. qla2xxx [0000:83:00.0]-2853:0: Async done-gpsc res 0, WWPN 50:06:0e:80:08:77:b6:21 qla2xxx [0000:83:00.0]-2854:0:
Async-gpsc OUT WWPN 20:45:00:27:f8:75:33:00 speeds=2c00 speed=0400. qla2xxx [0000:83:00.0]-28d8:0:
qla24xx_handle_gpsc_event 50:06:0e:80:08:77:b6:21 DS 7 LS 6 rc 0 login 1|1 rscn 1|0 lid 5 BUG: unable to handle kernel NULL pointer dereference at 0000000000000004 IP: qla24xx_async_abort_cmd+0x1b/0x1c0 [qla2xxx] Obvious solution to this is to introduce a reference counter. One reference is taken for the normal code path (the 'good' case) and one for the timeout path. As we always race between the normal good case and the timeout/abort handler we need to serialize it. Also we cannot assume any order between the handlers. Since this is slow path we can use proper synchronization via locks. When we are able to cancel a timer (del_timer returns 1) we know there can't be any error handling in progress because the timeout handler hasn't expired yet, thus we can safely decrement the refcounter by one. If we are not able to cancel the timer, we know an abort handler is running. We have to make sure we call sp->done() in the abort handlers before calling kref_put(). (CVE-2022-49159)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49159
https://ubuntu.com/security/CVE-2022-49159

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49159

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225492 - Linux Distros Unpatched Vulnerability : CVE-2022-49171
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: don't BUG if someone dirty pages without asking ext4 first [un]pin_user_pages_remote is dirtying pages without properly warning the file system in advance. A related race was noted by Jan Kara in 2018[1]; however, more recently instead of it being a very hard-to-hit race, it could be reliably triggered by process_vm_writev(2) which was discovered by Syzbot[2]. This is technically a bug in mm/gup.c, but arguably ext4 is fragile in that if some other kernel subsystem dirty pages without properly notifying the file system using page_mkwrite(), ext4 will BUG, while other file systems will not BUG (although data will still be lost). So instead of crashing with a BUG, issue a warning (since there may be potential data loss) and just mark the page as clean to avoid unprivileged denial of service attacks until the problem can be properly fixed. More discussion and background can be found in the thread starting at [2]. [1] https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz [2] https://lore.kernel.org/r/Yg0m6IjcNmfaSokM@google.com (CVE-2022-49171)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49171
https://ubuntu.com/security/CVE-2022-49171

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0008
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49171

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225178 - Linux Distros Unpatched Vulnerability : CVE-2022-49174
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit In case of flex_bg feature (which is by default enabled), extents for any given inode might span across blocks from two different block group.
ext4_mb_mark_bb() only reads the buffer_head of block bitmap once for the starting block group, but it fails to read it again when the extent length boundary overflows to another block group. Then in this below loop it accesses memory beyond the block group bitmap buffer_head and results into a data abort. for (i = 0; i < clen; i++) if (!mb_test_bit(blkoff + i, bitmap_bh->b_data) == !state) already++; This patch adds this functionality for checking block group boundary in ext4_mb_mark_bb() and update the buffer_head(bitmap_bh) for every different block group. w/o this patch, I was easily able to hit a data access abort using Power platform. <...> [ 74.327662] EXT4-fs error (device loop3):
ext4_mb_generate_buddy:1141: group 11, block bitmap and bg descriptor inconsistent: 21248 vs 23294 free clusters [ 74.533214] EXT4-fs (loop3): shut down requested (2) [ 74.536705] Aborting journal on device loop3-8. [ 74.702705] BUG: Unable to handle kernel data access on read at 0xc00000005e980000 [ 74.703727] Faulting instruction address: 0xc0000000007bffb8 cpu 0xd: Vector: 300 (Data Access) at [c000000015db7060] pc: c0000000007bffb8: ext4_mb_mark_bb+0x198/0x5a0 lr: c0000000007bfeec: ext4_mb_mark_bb+0xcc/0x5a0 sp:
c000000015db7300 msr: 800000000280b033 dar: c00000005e980000 dsisr: 40000000 current = 0xc000000027af6880 paca = 0xc00000003ffd5200 irqmask: 0x03 irq_happened: 0x01 pid = 5167, comm = mount <...> enter ? for help [c000000015db7380] c000000000782708 ext4_ext_clear_bb+0x378/0x410 [c000000015db7400] c000000000813f14 ext4_fc_replay+0x1794/0x2000 [c000000015db7580] c000000000833f7c do_one_pass+0xe9c/0x12a0 [c000000015db7710] c000000000834504 jbd2_journal_recover+0x184/0x2d0 [c000000015db77c0] c000000000841398 jbd2_journal_load+0x188/0x4a0 [c000000015db7880] c000000000804de8 ext4_fill_super+0x2638/0x3e10 [c000000015db7a40] c0000000005f8404 get_tree_bdev+0x2b4/0x350 [c000000015db7ae0] c0000000007ef058 ext4_get_tree+0x28/0x40 [c000000015db7b00] c0000000005f6344 vfs_get_tree+0x44/0x100 [c000000015db7b70] c00000000063c408 path_mount+0xdd8/0xe70 [c000000015db7c40] c00000000063c8f0 sys_mount+0x450/0x550 [c000000015db7d50] c000000000035770 system_call_exception+0x4a0/0x4e0 [c000000015db7e10] c00000000000c74c system_call_common+0xec/0x250 (CVE-2022-49174)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49174
https://ubuntu.com/security/CVE-2022-49174

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49174

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225294 - Linux Distros Unpatched Vulnerability : CVE-2022-49177
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- hwrng: cavium - fix NULL but dereferenced coccicheck error Fix following coccicheck warning:
./drivers/char/hw_random/cavium-rng-vf.c:182:17-20: ERROR: pdev is NULL but dereferenced. (CVE-2022-49177)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49177
https://ubuntu.com/security/CVE-2022-49177

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49177

Plugin Information
Published: 2025/03/05, Modified: 2025/12/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225649 - Linux Distros Unpatched Vulnerability : CVE-2022-49178
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- memstick/mspro_block: fix handling of read-only devices Use set_disk_ro to propagate the read-only state to the block layer instead of checking for it in ->open and leaking a reference in case of a read-only device. (CVE-2022-49178)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49178
https://security-tracker.debian.org/tracker/CVE-2022-49178
https://ubuntu.com/security/CVE-2022-49178

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49178

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225220 - Linux Distros Unpatched Vulnerability : CVE-2022-49187
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: clk: Fix clk_hw_get_clk() when dev is NULL Any registered clk_core structure can have a NULL pointer in its dev field. While never actually documented, this is evidenced by the wide usage of clk_register and clk_hw_register with a NULL device pointer, and the fact that the core of_clk_hw_register() function also passes a NULL device pointer. A call to clk_hw_get_clk() on a clk_hw struct whose clk_core is in that case will result in a NULL pointer derefence when it calls dev_name() on that NULL device pointer. Add a test for this case and use NULL as the dev_id if the device pointer is NULL. (CVE-2022-49187)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49187
https://ubuntu.com/security/CVE-2022-49187

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49187

Plugin Information
Published: 2025/03/05, Modified: 2025/10/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225270 - Linux Distros Unpatched Vulnerability : CVE-2022-49190
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- kernel/resource: fix kfree() of bootmem memory again Since commit ebff7d8f270d (mem hotunplug: fix kfree() of bootmem memory), we could get a resource allocated during boot via alloc_resource(). And it's required to release the resource using free_resource(). Howerver, many people use kfree directly which will result in kernel BUG. In order to fix this without fixing every call site, just leak a couple of bytes in such corner case. (CVE-2022-49190)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49190
https://ubuntu.com/security/CVE-2022-49190

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49190

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225533 - Linux Distros Unpatched Vulnerability : CVE-2022-49198
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mptcp: Fix crash due to tcp_tsorted_anchor was initialized before release skb Got crash when doing pressure test of mptcp:
=========================================================================== dst_release:
dst:ffffa06ce6e5c058 refcnt:-1 kernel tried to execute NX-protected page - exploit attempt? (uid: 0) BUG:
unable to handle kernel paging request at ffffa06ce6e5c058 PGD 190a01067 P4D 190a01067 PUD 43fffb067 PMD 22e403063 PTE 8000000226e5c063 Oops: 0011 [#1] SMP PTI CPU: 7 PID: 7823 Comm: kworker/7:0 Kdump: loaded Tainted: G E Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.2.1 04/01/2014 Call Trace: ? skb_release_head_state+0x68/0x100 ? skb_release_all+0xe/0x30 ? kfree_skb+0x32/0xa0 ? mptcp_sendmsg_frag+0x57e/0x750 ? __mptcp_retrans+0x21b/0x3c0 ? __switch_to_asm+0x35/0x70 ? mptcp_worker+0x25e/0x320 ? process_one_work+0x1a7/0x360 ? worker_thread+0x30/0x390 ? create_worker+0x1a0/0x1a0 ? kthread+0x112/0x130 ? kthread_flush_work_fn+0x10/0x10 ? ret_from_fork+0x35/0x40 =========================================================================== In
__mptcp_alloc_tx_skb skb was allocated and skb->tcp_tsorted_anchor will be initialized, in under memory pressure situation sk_wmem_schedule will return false and then kfree_skb. In this case skb->_skb_refdst is not null because_skb_refdst and tcp_tsorted_anchor are stored in the same mem, and kfree_skb will try to release dst and cause crash. (CVE-2022-49198)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49198
https://ubuntu.com/security/CVE-2022-49198

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49198

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225307 - Linux Distros Unpatched Vulnerability : CVE-2022-49206
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix memory leak in error flow for subscribe event routine In case the second xa_insert() fails, the obj_event is not released. Fix the error unwind flow to free that memory to avoid a memory leak. (CVE-2022-49206)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49206
https://ubuntu.com/security/CVE-2022-49206

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49206

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225221 - Linux Distros Unpatched Vulnerability : CVE-2022-49208
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent some integer underflows My static checker complains that: drivers/infiniband/hw/irdma/ctrl.c:3605 irdma_sc_ceq_init() warn: can subtract underflow 'info->dev->hmc_fpm_misc.max_ceqs'? It appears that info->dev->hmc_fpm_misc.max_ceqs comes from the firmware in irdma_sc_parse_fpm_query_buf() so, yes, there is a chance that it could be zero. Even if we trust the firmware, it's easy enough to change the condition just as a hardenning measure. (CVE-2022-49208)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49208
https://ubuntu.com/security/CVE-2022-49208

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49208

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225368 - Linux Distros Unpatched Vulnerability : CVE-2022-49209
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full If tcp_bpf_sendmsg() is running while sk msg is full. When sk_msg_alloc() returns -ENOMEM error, tcp_bpf_sendmsg() goes to wait_for_memory. If partial memory has been alloced by sk_msg_alloc(), that is, msg_tx->sg.size is greater than osize after sk_msg_alloc(), memleak occurs. To fix we use sk_msg_trim() to release the allocated memory, then goto wait for memory.
Other call paths of sk_msg_alloc() have the similar issue, such as tls_sw_sendmsg(), so handle sk_msg_trim logic inside sk_msg_alloc(), as Cong Wang suggested. This issue can cause the following info: WARNING:
CPU: 3 PID: 7950 at net/core/stream.c:208 sk_stream_kill_queues+0xd4/0x1a0 Call Trace: <TASK>
inet_csk_destroy_sock+0x55/0x110 __tcp_close+0x279/0x470 tcp_close+0x1f/0x60 inet_release+0x3f/0x80
__sock_release+0x3d/0xb0 sock_close+0x11/0x20 __fput+0x92/0x250 task_work_run+0x6a/0xa0 do_exit+0x33b/0xb60 do_group_exit+0x2f/0xa0 get_signal+0xb6/0x950 arch_do_signal_or_restart+0xac/0x2a0 exit_to_user_mode_prepare+0xa9/0x200 syscall_exit_to_user_mode+0x12/0x30 do_syscall_64+0x46/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae </TASK> WARNING: CPU: 3 PID: 2094 at net/ipv4/af_inet.c:155 inet_sock_destruct+0x13c/0x260 Call Trace: <TASK> __sk_destruct+0x24/0x1f0 sk_psock_destroy+0x19b/0x1c0 process_one_work+0x1b3/0x3c0 kthread+0xe6/0x110 ret_from_fork+0x22/0x30 </TASK> (CVE-2022-49209)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49209
https://ubuntu.com/security/CVE-2022-49209

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49209

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225497 - Linux Distros Unpatched Vulnerability : CVE-2022-49216
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/tegra: Fix reference leak in tegra_dsi_ganged_probe The reference taken by 'of_find_device_by_node()'
must be released when not needed anymore. Add put_device() call to fix this. (CVE-2022-49216)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49216
https://ubuntu.com/security/CVE-2022-49216

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49216

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225553 - Linux Distros Unpatched Vulnerability : CVE-2022-49219
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vfio/pci: fix memory leak during D3hot to D0 transition If 'vfio_pci_core_device::needs_pm_restore' is set (PCI device does not have No_Soft_Reset bit set in its PMCSR config register), then the current PCI state will be saved locally in 'vfio_pci_core_device::pm_save' during D0->D3hot transition and same will be restored back during D3hot->D0 transition. For saving the PCI state locally, pci_store_saved_state() is being used and the pci_load_and_free_saved_state() will free the allocated memory. But for reset related IOCTLs, vfio driver calls PCI reset-related API's which will internally change the PCI power state back to D0. So, when the guest resumes, then it will get the current state as D0 and it will skip the call to vfio_pci_set_power_state() for changing the power state to D0 explicitly. In this case, the memory pointed by 'pm_save' will never be freed. In a malicious sequence, the state changing to D3hot followed by VFIO_DEVICE_RESET/VFIO_DEVICE_PCI_HOT_RESET can be run in a loop and it can cause an OOM situation. This patch frees the earlier allocated memory first before overwriting 'pm_save' to prevent the mentioned memory leak. (CVE-2022-49219)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49219
https://ubuntu.com/security/CVE-2022-49219

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49219

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225152 - Linux Distros Unpatched Vulnerability : CVE-2022-49225
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921s: fix a possible memory leak in mt7921_load_patch Always release fw data at the end of mt7921_load_patch routine. (CVE-2022-49225)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49225
https://ubuntu.com/security/CVE-2022-49225

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49225

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225594 - Linux Distros Unpatched Vulnerability : CVE-2022-49231
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: rtw88: fix memory overrun and memory leak during hw_scan Previously we allocated less memory than actual required, overwrite to the buffer causes the mm module to complaint and raise access violation faults. Along with potential memory leaks when returned early. Fix these by passing the correct size and proper deinit flow. (CVE-2022-49231)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49231
https://ubuntu.com/security/CVE-2022-49231

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49231

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225466 - Linux Distros Unpatched Vulnerability : CVE-2022-49237
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ath11k: add missing of_node_put() to avoid leak The node pointer is returned by of_find_node_by_type() or of_parse_phandle() with refcount incremented. Calling of_node_put() to aovid the refcount leak. (CVE-2022-49237)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49237
https://ubuntu.com/security/CVE-2022-49237

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49237

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225298 - Linux Distros Unpatched Vulnerability : CVE-2022-49262
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: crypto: octeontx2 - remove CONFIG_DM_CRYPT check No issues were found while using the driver with dm-crypt enabled. So CONFIG_DM_CRYPT check in the driver can be removed. This also fixes the NULL pointer dereference in driver release if CONFIG_DM_CRYPT is enabled. ... Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 ... Call trace: crypto_unregister_alg+0x68/0xfc crypto_unregister_skciphers+0x44/0x60 otx2_cpt_crypto_exit+0x100/0x1a0 otx2_cptvf_remove+0xf8/0x200 pci_device_remove+0x3c/0xd4 __device_release_driver+0x188/0x234 device_release_driver+0x2c/0x4c ...
(CVE-2022-49262)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49262
https://ubuntu.com/security/CVE-2022-49262

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49262

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225716 - Linux Distros Unpatched Vulnerability : CVE-2022-49266
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- block: fix rq-qos breakage from skipping rq_qos_done_bio() a647a524a467 (block: don't call rq_qos_ops->done_bio if the bio isn't tracked) made bio_endio() skip rq_qos_done_bio() if BIO_TRACKED is not set. While this fixed a potential oops, it also broke blk-iocost by skipping the done_bio callback for merged bios. Before, whether a bio goes through rq_qos_throttle() or rq_qos_merge(), rq_qos_done_bio() would be called on the bio on completion with BIO_TRACKED distinguishing the former from the latter.
rq_qos_done_bio() is not called for bios which wenth through rq_qos_merge(). This royally confuses blk- iocost as the merged bios never finish and are considered perpetually in-flight. One reliably reproducible failure mode is an intermediate cgroup geting stuck active preventing its children from being activated due to the leaf-only rule, leading to loss of control. The following is from resctl-bench protection scenario which emulates isolating a web server like workload from a memory bomb run on an iocost configuration which should yield a reasonable level of protection. # cat /sys/block/nvme2n1/device/model Samsung SSD 970 PRO 512GB # cat /sys/fs/cgroup/io.cost.model 259:0 ctrl=user model=linear rbps=834913556 rseqiops=93622 rrandiops=102913 wbps=618985353 wseqiops=72325 wrandiops=71025 # cat /sys/fs/cgroup/io.cost.qos 259:0 enable=1 ctrl=user rpct=95.00 rlat=18776 wpct=95.00 wlat=8897 min=60.00 max=100.00 # resctl-bench -m 29.6G -r out.json run protection::scenario=mem-hog,loops=1 ... Memory Hog Summary ================== IO Latency: R p50=242u:336u/2.5m p90=794u:1.4m/7.5m p99=2.7m:8.0m/62.5m max=8.0m:36.4m/350m W p50=221u:323u/1.5m p90=709u:1.2m/5.5m p99=1.5m:2.5m/9.5m max=6.9m:35.9m/350m Isolation and Request Latency Impact Distributions: min p01 p05 p10 p25 p50 p75 p90 p95 p99 max mean stdev isol% 15.90 15.90 15.90 40.05 57.24 59.07 60.01 74.63 74.63 90.35 90.35 58.12 15.82 lat-imp% 0 0 0 0 0 4.55 14.68 15.54 233.5 548.1 548.1 53.88 143.6 Result: isol=58.12:15.82% lat_imp=53.88%:143.6 work_csv=100.0% missing=3.96% The isolation result of 58.12% is close to what this device would show without any IO control. Fix it by introducing a new flag BIO_QOS_MERGED to mark merged bios and calling rq_qos_done_bio() on them too. For consistency and clarity, rename BIO_TRACKED to BIO_QOS_THROTTLED. The flag checks are moved into rq_qos_done_bio() so that it's next to the code paths that set the flags. With the patch applied, the above same benchmark shows: # resctl-bench -m 29.6G -r out.json run protection::scenario=mem-hog,loops=1 ... Memory Hog Summary ================== IO Latency: R p50=123u:84.4u/985u p90=322u:256u/2.5m p99=1.6m:1.4m/9.5m max=11.1m:36.0m/350m W p50=429u:274u/995u p90=1.7m:1.3m/4.5m p99=3.4m:2.7m/11.5m max=7.9m:5.9m/26.5m Isolation and Request Latency Impact Distributions: min p01 p05 p10 p25 p50 p75 p90 p95 p99 max mean stdev isol% 84.91 84.91 89.51 90.73 92.31 94.49 96.36 98.04 98.71 100.0 100.0 94.42 2.81 lat-imp% 0 0 0 0 0 2.81 5.73 11.11 13.92 17.53 22.61 4.10 4.68 Result: isol=94.42:2.81% lat_imp=4.10%:4.68 work_csv=58.34% missing=0% (CVE-2022-49266)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49266
https://security-tracker.debian.org/tracker/CVE-2022-49266
https://ubuntu.com/security/CVE-2022-49266

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49266

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225432 - Linux Distros Unpatched Vulnerability : CVE-2022-49279
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NFSD: prevent integer overflow on 32 bit systems On a 32 bit system, the len * sizeof(*p) operation can have an integer overflow. (CVE-2022-49279)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49279
https://ubuntu.com/security/CVE-2022-49279

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49279

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225458 - Linux Distros Unpatched Vulnerability : CVE-2022-49286
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tpm: use try_get_ops() in tpm-space.c As part of the series conversion to remove nested TPM operations:
https://lore.kernel.org/all/20190205224723.19671-1-jarkko.sakkinen@linux.intel.com/ exposure of the chip->tpm_mutex was removed from much of the upper level code. In this conversion, tpm2_del_space() was missed. This didn't matter much because it's usually called closely after a converted operation, so there's only a very tiny race window where the chip can be removed before the space flushing is done which causes a NULL deref on the mutex. However, there are reports of this window being hit in practice, so fix this by converting tpm2_del_space() to use tpm_try_get_ops(), which performs all the teardown checks before acquring the mutex. (CVE-2022-49286)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49286
https://ubuntu.com/security/CVE-2022-49286

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49286

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225585 - Linux Distros Unpatched Vulnerability : CVE-2022-49296
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ceph: fix possible deadlock when holding Fwb to get inline_data 1, mount with wsync. 2, create a file with O_RDWR, and the request was sent to mds.0: ceph_atomic_open()--> ceph_mdsc_do_request(openc) finish_open(file, dentry, ceph_open)--> ceph_open()--> ceph_init_file()--> ceph_init_file_info()-->
ceph_uninline_data()--> { ... if (inline_version == 1 || /* initial version, no data */ inline_version == CEPH_INLINE_NONE) goto out_unlock; ... } The inline_version will be 1, which is the initial version for the new create file. And here the ci->i_inline_version will keep with 1, it's buggy. 3, buffer write to the file immediately: ceph_write_iter()--> ceph_get_caps(file, need=Fw, want=Fb, ...);
generic_perform_write()--> a_ops->write_begin()--> ceph_write_begin()--> netfs_write_begin()-->
netfs_begin_read()--> netfs_rreq_submit_slice()--> netfs_read_from_server()-->
rreq->netfs_ops->issue_read()--> ceph_netfs_issue_read()--> { ... if (ci->i_inline_version != CEPH_INLINE_NONE && ceph_netfs_issue_op_inline(subreq)) return; ... } ceph_put_cap_refs(ci, Fwb); The ceph_netfs_issue_op_inline() will send a getattr(Fsr) request to mds.1. 4, then the mds.1 will request the rd lock for CInode::filelock from the auth mds.0, the mds.0 will do the CInode::filelock state transation from excl --> sync, but it need to revoke the Fxwb caps back from the clients. While the kernel client has aleady held the Fwb caps and waiting for the getattr(Fsr). It's deadlock! URL:
https://tracker.ceph.com/issues/55377 (CVE-2022-49296)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49296
https://security-tracker.debian.org/tracker/CVE-2022-49296
https://ubuntu.com/security/CVE-2022-49296

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49296

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225308 - Linux Distros Unpatched Vulnerability : CVE-2022-49307
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() When the driver fails at alloc_hdlcdev(), and then we remove the driver module, we will get the following splat: [ 25.065966] general protection fault, probably for non-canonical address 0xdffffc0000000182: 0000 [#1] PREEMPT SMP KASAN PTI [ 25.066914] KASAN: null-ptr-deref in range [0x0000000000000c10-0x0000000000000c17] [ 25.069262] RIP:
0010:detach_hdlc_protocol+0x2a/0x3e0 [ 25.077709] Call Trace: [ 25.077924] <TASK> [ 25.078108] unregister_hdlc_device+0x16/0x30 [ 25.078481] slgt_cleanup+0x157/0x9f0 [synclink_gt] Fix this by checking whether the 'info->netdev' is a null pointer first. (CVE-2022-49307)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49307
https://ubuntu.com/security/CVE-2022-49307

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49307

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225771 - Linux Distros Unpatched Vulnerability : CVE-2022-49314
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tty: Fix a possible resource leak in icom_probe When pci_read_config_dword failed, call pci_release_regions() and pci_disable_device() to recycle the resource previously allocated.
(CVE-2022-49314)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49314
https://ubuntu.com/security/CVE-2022-49314

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49314

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225182 - Linux Distros Unpatched Vulnerability : CVE-2022-49341
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Clear prog->jited_len along prog->jited syzbot reported an illegal copy_to_user() attempt from bpf_prog_get_info_by_fd() [1] There was no repro yet on this bug, but I think that commit 0aef499f3172 (mm/usercopy: Detect vmalloc overruns) is exposing a prior bug in bpf arm64. bpf_prog_get_info_by_fd() looks at prog->jited_len to determine if the JIT image can be copied out to user space. My theory is that syzbot managed to get a prog where prog->jited_len has been set to 43, while prog->bpf_func has ben cleared. It is not clear why copy_to_user(uinsns, NULL, ulen) is triggering this particular warning. I thought find_vma_area(NULL) would not find a vm_struct. As we do not hold vmap_area_lock spinlock, it might be possible that the found vm_struct was garbage. [1] usercopy: Kernel memory exposure attempt detected from vmalloc (offset 792633534417210172, size 43)! kernel BUG at mm/usercopy.c:101! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 25002 Comm: syz-executor.1 Not tainted 5.18.0-syzkaller-10139-g8291eaafed36 #0 Hardware name: linux,dummy-virt (DT) pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usercopy_abort+0x90/0x94 mm/usercopy.c:101 lr :
usercopy_abort+0x90/0x94 mm/usercopy.c:89 sp : ffff80000b773a20 x29: ffff80000b773a30 x28:
faff80000b745000 x27: ffff80000b773b48 x26: 0000000000000000 x25: 000000000000002b x24: 0000000000000000 x23: 00000000000000e0 x22: ffff80000b75db67 x21: 0000000000000001 x20: 000000000000002b x19:
ffff80000b75db3c x18: 00000000fffffffd x17: 2820636f6c6c616d x16: 76206d6f72662064 x15: 6574636574656420 x14: 74706d6574746120 x13: 2129333420657a69 x12: 73202c3237313031 x11: 3237313434333533 x10:
3336323937207465 x9 : 657275736f707865 x8 : ffff80000a30c550 x7 : ffff80000b773830 x6 : ffff80000b773830 x5 : 0000000000000000 x4 : ffff00007fbbaa10 x3 : 0000000000000000 x2 : 0000000000000000 x1 :
f7ff000028fc0000 x0 : 0000000000000064 Call trace: usercopy_abort+0x90/0x94 mm/usercopy.c:89 check_heap_object mm/usercopy.c:186 [inline] __check_object_size mm/usercopy.c:252 [inline]
__check_object_size+0x198/0x36c mm/usercopy.c:214 check_object_size include/linux/thread_info.h:199 [inline] check_copy_size include/linux/thread_info.h:235 [inline] copy_to_user include/linux/uaccess.h:159 [inline] bpf_prog_get_info_by_fd.isra.0+0xf14/0xfdc kernel/bpf/syscall.c:3993 bpf_obj_get_info_by_fd+0x12c/0x510 kernel/bpf/syscall.c:4253 __sys_bpf+0x900/0x2150 kernel/bpf/syscall.c:4956 __do_sys_bpf kernel/bpf/syscall.c:5021 [inline] __se_sys_bpf kernel/bpf/syscall.c:5019 [inline] __arm64_sys_bpf+0x28/0x40 kernel/bpf/syscall.c:5019 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x48/0x114 arch/arm64/kernel/syscall.c:52 el0_svc_common.constprop.0+0x44/0xec arch/arm64/kernel/syscall.c:142 do_el0_svc+0xa0/0xc0 arch/arm64/kernel/syscall.c:206 el0_svc+0x44/0xb0 arch/arm64/kernel/entry-common.c:624 el0t_64_sync_handler+0x1ac/0x1b0 arch/arm64/kernel/entry-common.c:642 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:581 Code: aa0003e3 d00038c0 91248000 97fff65f (d4210000) (CVE-2022-49341)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49341
https://ubuntu.com/security/CVE-2022-49341

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49341

Plugin Information
Published: 2025/03/05, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225764 - Linux Distros Unpatched Vulnerability : CVE-2022-49352
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: fix warning in ext4_handle_inode_extension We got issue as follows: EXT4-fs error (device loop0) in ext4_reserve_inode_write:5741: Out of memory EXT4-fs error (device loop0): ext4_setattr:5462: inode #13:
comm syz-executor.0: mark_inode_dirty error EXT4-fs error (device loop0) in ext4_setattr:5519: Out of memory EXT4-fs error (device loop0): ext4_ind_map_blocks:595: inode #13: comm syz-executor.0: Can't allocate blocks for non-extent mapped inodes with bigalloc ------------[ cut here ]------------ WARNING:
CPU: 1 PID: 4361 at fs/ext4/file.c:301 ext4_file_write_iter+0x11c9/0x1220 Modules linked in: CPU: 1 PID:
4361 Comm: syz-executor.0 Not tainted 5.10.0+ #1 RIP: 0010:ext4_file_write_iter+0x11c9/0x1220 RSP:
0018:ffff924d80b27c00 EFLAGS: 00010282 RAX: ffffffff815a3379 RBX: 0000000000000000 RCX: 000000003b000000 RDX: ffff924d81601000 RSI: 00000000000009cc RDI: 00000000000009cd RBP: 000000000000000d R08:
ffffffffbc5a2c6b R09: 0000902e0e52a96f R10: ffff902e2b7c1b40 R11: ffff902e2b7c1b40 R12: 000000000000000a R13: 0000000000000001 R14: ffff902e0e52aa10 R15: ffffffffffffff8b FS: 00007f81a7f65700(0000) GS:ffff902e3bc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
ffffffffff600400 CR3: 000000012db88001 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace:
do_iter_readv_writev+0x2e5/0x360 do_iter_write+0x112/0x4c0 do_pwritev+0x1e5/0x390
__x64_sys_pwritev2+0x7e/0xa0 do_syscall_64+0x37/0x50 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Above issue may happen as follows: Assume inode.i_size=4096 EXT4_I(inode)->i_disksize=4096 step 1: set inode->i_isize = 8192 ext4_setattr if (attr->ia_size != inode->i_size) EXT4_I(inode)->i_disksize = attr->ia_size; rc = ext4_mark_inode_dirty ext4_reserve_inode_write ext4_get_inode_loc __ext4_get_inode_loc sb_getblk -->
return -ENOMEM ... if (!error) ->will not update i_size i_size_write(inode, attr->ia_size); Now:
inode.i_size=4096 EXT4_I(inode)->i_disksize=8192 step 2: Direct write 4096 bytes ext4_file_write_iter ext4_dio_write_iter iomap_dio_rw ->return error if (extend) ext4_handle_inode_extension WARN_ON_ONCE(i_size_read(inode) < EXT4_I(inode)->i_disksize); ->Then trigger warning. To solve above issue, if mark inode dirty failed in ext4_setattr just set 'EXT4_I(inode)->i_disksize' with old value.
(CVE-2022-49352)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49352
https://ubuntu.com/security/CVE-2022-49352

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49352

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225620 - Linux Distros Unpatched Vulnerability : CVE-2022-49370
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle kobject_init_and_add() takes reference even when it fails. According to the doc of kobject_init_and_add() If this function returns an error, kobject_put() must be called to properly clean up the memory associated with the object. Fix this issue by calling kobject_put(). (CVE-2022-49370)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49370
https://ubuntu.com/security/CVE-2022-49370

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49370

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225679 - Linux Distros Unpatched Vulnerability : CVE-2022-49400
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: md: Don't set mddev private to NULL in raid0 pers->free In normal stop process, it does like this: do_md_stop | __md_stop (pers->free();
mddev->private=NULL) | md_free (free mddev) __md_stop sets mddev->private to NULL after pers->free. The raid device will be stopped and mddev memory is free. But in reshape, it doesn't free the mddev and mddev will still be used in new raid. In reshape, it first sets mddev->private to new_pers and then runs old_pers->free(). Now raid0 sets mddev->private to NULL in raid0_free. The new raid can't work anymore. It will panic when dereference mddev->private because of NULL pointer dereference. It can panic like this:
[63010.814972] kernel BUG at drivers/md/raid10.c:928! [63010.819778] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [63010.825011] CPU: 3 PID: 44437 Comm: md0_resync Kdump: loaded Not tainted 5.14.0-86.el9.x86_64 #1 [63010.833789] Hardware name: Dell Inc. PowerEdge R6415/07YXFK, BIOS 1.15.0 09/11/2020 [63010.841440] RIP:
0010:raise_barrier+0x161/0x170 [raid10] [63010.865508] RSP: 0018:ffffc312408bbc10 EFLAGS: 00010246 [63010.870734] RAX: 0000000000000000 RBX: ffffa00bf7d39800 RCX: 0000000000000000 [63010.877866] RDX:
0000000000000000 RSI: 0000000000000001 RDI: ffffa00bf7d39800 [63010.884999] RBP: 0000000000000000 R08:
fffffa4945e74400 R09: 0000000000000000 [63010.892132] R10: ffffa00eed02f798 R11: 0000000000000000 R12:
ffffa00bbc435200 [63010.899266] R13: ffffa00bf7d39800 R14: 0000000000000400 R15: 0000000000000003 [63010.906399] FS: 0000000000000000(0000) GS:ffffa00eed000000(0000) knlGS:0000000000000000 [63010.914485] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [63010.920229] CR2: 00007f5cfbe99828 CR3:
0000000105efe000 CR4: 00000000003506e0 [63010.927363] Call Trace: [63010.929822] ? bio_reset+0xe/0x40 [63010.933144] ? raid10_alloc_init_r10buf+0x60/0xa0 [raid10] [63010.938629] raid10_sync_request+0x756/0x1610 [raid10] [63010.943770] md_do_sync.cold+0x3e4/0x94c [63010.947698] md_thread+0xab/0x160 [63010.951024] ? md_write_inc+0x50/0x50 [63010.954688] kthread+0x149/0x170 [63010.957923] ? set_kthread_struct+0x40/0x40 [63010.962107] ret_from_fork+0x22/0x30 Removing the code that sets mddev->private to NULL in raid0 can fix problem. (CVE-2022-49400)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49400
https://ubuntu.com/security/CVE-2022-49400

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0008
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49400

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225639 - Linux Distros Unpatched Vulnerability : CVE-2022-49403
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: lib/string_helpers: fix not adding strarray to device's resource list Add allocated strarray to device's resource list. This is a must to automatically release strarray when the device disappears. Without this fix we have a memory leak in the few drivers which use devm_kasprintf_strarray(). (CVE-2022-49403)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49403
https://ubuntu.com/security/CVE-2022-49403

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49403

Plugin Information
Published: 2025/03/05, Modified: 2025/10/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225567 - Linux Distros Unpatched Vulnerability : CVE-2022-49406
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: block: Fix potential deadlock in blk_ia_range_sysfs_show() When being read, a sysfs attribute is already protected against removal with the kobject node active reference counter. As a result, in blk_ia_range_sysfs_show(), there is no need to take the queue sysfs lock when reading the value of a range attribute. Using the queue sysfs lock in this function creates a potential deadlock situation with the disk removal, something that a lockdep signals with a splat when the device is removed: [ 760.703551] Possible unsafe locking scenario: [ 760.703551] [ 760.703554] CPU0 CPU1 [ 760.703556] ---- ---- [ 760.703558] lock(&q->sysfs_lock); [ 760.703565] lock(kn->active#385); [ 760.703573] lock(&q->sysfs_lock); [ 760.703579] lock(kn->active#385); [ 760.703587] [ 760.703587] *** DEADLOCK *** Solve this by removing the mutex_lock()/mutex_unlock() calls from blk_ia_range_sysfs_show(). (CVE-2022-49406)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49406
https://ubuntu.com/security/CVE-2022-49406

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49406

Plugin Information
Published: 2025/03/05, Modified: 2025/10/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225768 - Linux Distros Unpatched Vulnerability : CVE-2022-49414
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: fix race condition between ext4_write and ext4_convert_inline_data Hulk Robot reported a BUG_ON:
================================================================== EXT4-fs error (device loop3):
ext4_mb_generate_buddy:805: group 0, block bitmap and bg descriptor inconsistent: 25 vs 31513 free clusters kernel BUG at fs/ext4/ext4_jbd2.c:53! invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 PID: 25371 Comm: syz-executor.3 Not tainted 5.10.0+ #1 RIP: 0010:ext4_put_nojournal fs/ext4/ext4_jbd2.c:53 [inline] RIP: 0010:__ext4_journal_stop+0x10e/0x110 fs/ext4/ext4_jbd2.c:116 [...] Call Trace:
ext4_write_inline_data_end+0x59a/0x730 fs/ext4/inline.c:795 generic_perform_write+0x279/0x3c0 mm/filemap.c:3344 ext4_buffered_write_iter+0x2e3/0x3d0 fs/ext4/file.c:270 ext4_file_write_iter+0x30a/0x11c0 fs/ext4/file.c:520 do_iter_readv_writev+0x339/0x3c0 fs/read_write.c:732 do_iter_write+0x107/0x430 fs/read_write.c:861 vfs_writev fs/read_write.c:934 [inline] do_pwritev+0x1e5/0x380 fs/read_write.c:1031 [...] ================================================================== Above issue may happen as follows: cpu1 cpu2 __________________________|__________________________ do_pwritev vfs_writev do_iter_write ext4_file_write_iter ext4_buffered_write_iter generic_perform_write ext4_da_write_begin vfs_fallocate ext4_fallocate ext4_convert_inline_data ext4_convert_inline_data_nolock ext4_destroy_inline_data_nolock clear EXT4_STATE_MAY_INLINE_DATA ext4_map_blocks ext4_ext_map_blocks ext4_mb_new_blocks ext4_mb_regular_allocator ext4_mb_good_group_nolock ext4_mb_init_group ext4_mb_init_cache ext4_mb_generate_buddy --> error ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA) ext4_restore_inline_data set EXT4_STATE_MAY_INLINE_DATA ext4_block_write_begin ext4_da_write_end ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA) ext4_write_inline_data_end handle=NULL ext4_journal_stop(handle) __ext4_journal_stop ext4_put_nojournal(handle) ref_cnt = (unsigned long)handle BUG_ON(ref_cnt == 0) ---> BUG_ON The lock held by ext4_convert_inline_data is xattr_sem, but the lock held by generic_perform_write is i_rwsem. Therefore, the two locks can be concurrent. To solve above issue, we add inode_lock() for ext4_convert_inline_data(). At the same time, move ext4_convert_inline_data() in front of ext4_punch_hole(), remove similar handling from ext4_punch_hole(). (CVE-2022-49414)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49414
https://ubuntu.com/security/CVE-2022-49414

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0008
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49414

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225625 - Linux Distros Unpatched Vulnerability : CVE-2022-49420
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: annotate races around sk->sk_bound_dev_if UDP sendmsg() is lockless, and reads sk->sk_bound_dev_if while this field can be changed by another thread. Adds minimal annotations to avoid KCSAN splats for UDP.
Following patches will add more annotations to potential lockless readers. BUG: KCSAN: data-race in
__ip6_datagram_connect / udpv6_sendmsg write to 0xffff888136d47a94 of 4 bytes by task 7681 on cpu 0:
__ip6_datagram_connect+0x6e2/0x930 net/ipv6/datagram.c:221 ip6_datagram_connect+0x2a/0x40 net/ipv6/datagram.c:272 inet_dgram_connect+0x107/0x190 net/ipv4/af_inet.c:576 __sys_connect_file net/socket.c:1900 [inline] __sys_connect+0x197/0x1b0 net/socket.c:1917 __do_sys_connect net/socket.c:1927 [inline] __se_sys_connect net/socket.c:1924 [inline] __x64_sys_connect+0x3d/0x50 net/socket.c:1924 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x50 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffff888136d47a94 of 4 bytes by task 7670 on cpu 1:
udpv6_sendmsg+0xc60/0x16e0 net/ipv6/udp.c:1436 inet6_sendmsg+0x5f/0x80 net/ipv6/af_inet6.c:652 sock_sendmsg_nosec net/socket.c:705 [inline] sock_sendmsg net/socket.c:725 [inline]
____sys_sendmsg+0x39a/0x510 net/socket.c:2413 ___sys_sendmsg net/socket.c:2467 [inline]
__sys_sendmmsg+0x267/0x4c0 net/socket.c:2553 __do_sys_sendmmsg net/socket.c:2582 [inline]
__se_sys_sendmmsg net/socket.c:2579 [inline] __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2579 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x50 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0x00000000 -> 0xffffff9b Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 7670 Comm: syz-executor.3 Tainted: G W 5.18.0-rc1-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 I chose to not add Fixes: tag because race has minor consequences and stable teams busy enough. (CVE-2022-49420)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49420
https://security-tracker.debian.org/tracker/CVE-2022-49420
https://ubuntu.com/security/CVE-2022-49420

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49420

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225256 - Linux Distros Unpatched Vulnerability : CVE-2022-49422
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix the error handling path in idxd_cdev_register() If a call to alloc_chrdev_region() fails, the already allocated resources are leaking. Add the needed error handling path to fix the leak. (CVE-2022-49422)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49422
https://ubuntu.com/security/CVE-2022-49422

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49422

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225673 - Linux Distros Unpatched Vulnerability : CVE-2022-49441
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tty: fix deadlock caused by calling printk() under tty_port->lock pty_write() invokes kmalloc() which may invoke a normal printk() to print failure message. This can cause a deadlock in the scenario reported by syz-bot below: CPU0 CPU1 CPU2 ---- ---- ---- lock(console_owner); lock(&port_lock_key); lock(&port->lock);
lock(&port_lock_key); lock(&port->lock); lock(console_owner); As commit dbdda842fe96 (printk: Add console owner and waiter logic to load balance console writes) said, such deadlock can be prevented by using printk_deferred() in kmalloc() (which is invoked in the section guarded by the port->lock). But there are too many printk() on the kmalloc() path, and kmalloc() can be called from anywhere, so changing printk() to printk_deferred() is too complicated and inelegant. Therefore, this patch chooses to specify
__GFP_NOWARN to kmalloc(), so that printk() will not be called, and this deadlock problem can be avoided.
Syzbot reported the following lockdep error: ====================================================== WARNING: possible circular locking dependency detected 5.4.143-00237-g08ccc19a-dirty #10 Not tainted
------------------------------------------------------ syz-executor.4/29420 is trying to acquire lock:
ffffffff8aedb2a0 (console_owner){....}-{0:0}, at: console_trylock_spinning kernel/printk/printk.c:1752 [inline] ffffffff8aedb2a0 (console_owner){....}-{0:0}, at: vprintk_emit+0x2ca/0x470 kernel/printk/printk.c:2023 but task is already holding lock: ffff8880119c9158 (&port->lock){-.-.}-{2:2}, at: pty_write+0xf4/0x1f0 drivers/tty/pty.c:120 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&port->lock){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159 tty_port_tty_get drivers/tty/tty_port.c:288 [inline] <-- lock(&port->lock);
tty_port_default_wakeup+0x1d/0xb0 drivers/tty/tty_port.c:47 serial8250_tx_chars+0x530/0xa80 drivers/tty/serial/8250/8250_port.c:1767 serial8250_handle_irq.part.0+0x31f/0x3d0 drivers/tty/serial/8250/8250_port.c:1854 serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1827 [inline] <-- lock(&port_lock_key); serial8250_default_handle_irq+0xb2/0x220 drivers/tty/serial/8250/8250_port.c:1870 serial8250_interrupt+0xfd/0x200 drivers/tty/serial/8250/8250_core.c:126 __handle_irq_event_percpu+0x109/0xa50 kernel/irq/handle.c:156 [...] -> #1 (&port_lock_key){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159 serial8250_console_write+0x184/0xa40 drivers/tty/serial/8250/8250_port.c:3198 <-- lock(&port_lock_key);
call_console_drivers kernel/printk/printk.c:1819 [inline] console_unlock+0x8cb/0xd00 kernel/printk/printk.c:2504 vprintk_emit+0x1b5/0x470 kernel/printk/printk.c:2024 <-- lock(console_owner);
vprintk_func+0x8d/0x250 kernel/printk/printk_safe.c:394 printk+0xba/0xed kernel/printk/printk.c:2084 register_console+0x8b3/0xc10 kernel/printk/printk.c:2829 univ8250_console_init+0x3a/0x46 drivers/tty/serial/8250/8250_core.c:681 console_init+0x49d/0x6d3 kernel/printk/printk.c:2915 start_kernel+0x5e9/0x879 init/main.c:713 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241 ->
#0 (console_owner){....}-{0:0}: [...] lock_acquire+0x127/0x340 kernel/locking/lockdep.c:4734 console_trylock_spinning kernel/printk/printk.c:1773 ---truncated--- (CVE-2022-49441)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49441
https://ubuntu.com/security/CVE-2022-49441

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49441

Plugin Information
Published: 2025/03/05, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225496 - Linux Distros Unpatched Vulnerability : CVE-2022-49446
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: nvdimm: Fix firmware activation deadlock scenarios Lockdep reports the following deadlock scenarios for CXL root device power-management, device_prepare(), operations, and device_shutdown() operations for 'nd_region' devices: Chain exists of:
&nvdimm_region_key --> &nvdimm_bus->reconfig_mutex --> system_transition_mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(system_transition_mutex); lock(&nvdimm_bus->reconfig_mutex);
lock(system_transition_mutex); lock(&nvdimm_region_key); Chain exists of: &cxl_nvdimm_bridge_key -->
acpi_scan_lock --> &cxl_root_key Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&cxl_root_key); lock(acpi_scan_lock); lock(&cxl_root_key); lock(&cxl_nvdimm_bridge_key); These stem from holding nvdimm_bus_lock() over hibernate_quiet_exec() which walks the entire system device topology taking device_lock() along the way. The nvdimm_bus_lock() is protecting against unregistration, multiple simultaneous ops callers, and preventing activate_show() from racing activate_store(). For the first 2, the lock is redundant. Unregistration already flushes all ops users, and sysfs already prevents multiple threads to be active in an ops handler at the same time. For the last userspace should already be waiting for its last activate_store() to complete, and does not need activate_show() to flush the write side, so this lock usage can be deleted in these attributes. (CVE-2022-49446)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49446
https://ubuntu.com/security/CVE-2022-49446

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49446

Plugin Information
Published: 2025/03/05, Modified: 2025/10/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225645 - Linux Distros Unpatched Vulnerability : CVE-2022-49447
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ARM: hisi: Add missing of_node_put after of_find_compatible_node of_find_compatible_node will increment the refcount of the returned device_node. Calling of_node_put() to avoid the refcount leak (CVE-2022-49447)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49447
https://ubuntu.com/security/CVE-2022-49447

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49447

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226361 - Linux Distros Unpatched Vulnerability : CVE-2022-49450
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix listen() setting the bar too high for the prealloc rings AF_RXRPC's listen() handler lets you set the backlog up to 32 (if you bump up the sysctl), but whilst the preallocation circular buffers have 32 slots in them, one of them has to be a dead slot because we're using CIRC_CNT(). This means that listen(rxrpc_sock, 32) will cause an oops when the socket is closed because rxrpc_service_prealloc_one() allocated one too many calls and rxrpc_discard_prealloc() won't then be able to get rid of them because it'll think the ring is empty.
rxrpc_release_calls_on_socket() then tries to abort them, but oopses because call->peer isn't yet set. Fix this by setting the maximum backlog to RXRPC_BACKLOG_MAX - 1 to match the ring capacity. BUG: kernel NULL pointer dereference, address: 0000000000000086 ... RIP: 0010:rxrpc_send_abort_packet+0x73/0x240 [rxrpc] Call Trace: <TASK> ? __wake_up_common_lock+0x7a/0x90 ? rxrpc_notify_socket+0x8e/0x140 [rxrpc] ? rxrpc_abort_call+0x4c/0x60 [rxrpc] rxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc] rxrpc_release+0xc9/0x1c0 [rxrpc] __sock_release+0x37/0xa0 sock_close+0x11/0x20 __fput+0x89/0x240 task_work_run+0x59/0x90 do_exit+0x319/0xaa0 (CVE-2022-49450)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49450
https://ubuntu.com/security/CVE-2022-49450

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49450

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225509 - Linux Distros Unpatched Vulnerability : CVE-2022-49456
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bonding: fix missed rcu protection When removing the rcu_read_lock in bond_ethtool_get_ts_info() as discussed [1], I didn't notice it could be called via setsockopt, which doesn't hold rcu lock, as syzbot pointed: stack backtrace: CPU: 0 PID:
3599 Comm: syz-executor317 Not tainted 5.18.0-rc5-syzkaller-01392-g01f4685797a5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 bond_option_active_slave_get_rcu include/net/bonding.h:353 [inline] bond_ethtool_get_ts_info+0x32c/0x3a0 drivers/net/bonding/bond_main.c:5595 __ethtool_get_ts_info+0x173/0x240 net/ethtool/common.c:554 ethtool_get_phc_vclocks+0x99/0x110 net/ethtool/common.c:568 sock_timestamping_bind_phc net/core/sock.c:869 [inline] sock_set_timestamping+0x3a3/0x7e0 net/core/sock.c:916 sock_setsockopt+0x543/0x2ec0 net/core/sock.c:1221 __sys_setsockopt+0x55e/0x6a0 net/socket.c:2223 __do_sys_setsockopt net/socket.c:2238 [inline] __se_sys_setsockopt net/socket.c:2235 [inline] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2235 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f8902c8eb39 Fix it by adding rcu_read_lock and take a ref on the real_dev. Since dev_hold() and dev_put() can take NULL these days, we can skip checking if real_dev exist. [1] https://lore.kernel.org/netdev/27565.1642742439@famine/ (CVE-2022-49456)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49456
https://ubuntu.com/security/CVE-2022-49456

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49456

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227247 - Linux Distros Unpatched Vulnerability : CVE-2022-49468
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- thermal/core: Fix memory leak in __thermal_cooling_device_register() I got memory leak as follows when doing fault injection test: unreferenced object 0xffff888010080000 (size 264312): comm 182, pid 102533, jiffies 4296434960 (age 10.100s) hex dump (first 32 bytes): 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... ff ff ff ff ff ff ff ff 40 7f 1f b9 ff ff ff ff ........@....... backtrace:
[<0000000038b2f4fc>] kmalloc_order_trace+0x1d/0x110 mm/slab_common.c:969 [<00000000ebcb8da5>]
__kmalloc+0x373/0x420 include/linux/slab.h:510 [<0000000084137f13>] thermal_cooling_device_setup_sysfs+0x15d/0x2d0 include/linux/slab.h:586 [<00000000352b8755>]
__thermal_cooling_device_register+0x332/0xa60 drivers/thermal/thermal_core.c:927 [<00000000fb9f331b>] devm_thermal_of_cooling_device_register+0x6b/0xf0 drivers/thermal/thermal_core.c:1041 [<000000009b8012d2>] max6650_probe.cold+0x557/0x6aa drivers/hwmon/max6650.c:211 [<00000000da0b7e04>] i2c_device_probe+0x472/0xac0 drivers/i2c/i2c-core-base.c:561 If device_register() fails, thermal_cooling_device_destroy_sysfs() need be called to free the memory allocated in thermal_cooling_device_setup_sysfs(). (CVE-2022-49468)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49468
https://ubuntu.com/security/CVE-2022-49468

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49468

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226328 - Linux Distros Unpatched Vulnerability : CVE-2022-49472
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: phy: micrel: Allow probing without .driver_data Currently, if the .probe element is present in the phy_driver structure and the .driver_data is not, a NULL pointer dereference happens. Allow passing .probe without .driver_data by inserting NULL checks for priv->type. (CVE-2022-49472)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49472
https://ubuntu.com/security/CVE-2022-49472

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49472

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226598 - Linux Distros Unpatched Vulnerability : CVE-2022-49475
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: spi: spi-fsl-qspi: check return value after calling platform_get_resource_byname() It will cause null-ptr-deref if platform_get_resource_byname() returns NULL, we need check the return value. (CVE-2022-49475)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49475
https://ubuntu.com/security/CVE-2022-49475

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49475

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226943 - Linux Distros Unpatched Vulnerability : CVE-2022-49476
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mt76: mt7921: fix kernel crash at mt7921_pci_remove The crash log shown it is possible that mt7921_irq_handler is called while devm_free_irq is being handled so mt76_free_device need to be postponed until devm_free_irq is completed to solve the crash we free the mt76 device too early. [ 9299.339655] BUG:
kernel NULL pointer dereference, address: 0000000000000008 [ 9299.339705] #PF: supervisor read access in kernel mode [ 9299.339735] #PF: error_code(0x0000) - not-present page [ 9299.339768] PGD 0 P4D 0 [ 9299.339786] Oops: 0000 [#1] SMP PTI [ 9299.339812] CPU: 1 PID: 1624 Comm: prepare-suspend Not tainted 5.15.14-1.fc32.qubes.x86_64 #1 [ 9299.339863] Hardware name: Xen HVM domU, BIOS 4.14.3 01/20/2022 [ 9299.339901] RIP: 0010:mt7921_irq_handler+0x1e/0x70 [mt7921e] [ 9299.340048] RSP: 0018:ffffa81b80c27cb0 EFLAGS: 00010082 [ 9299.340081] RAX: 0000000000000000 RBX: ffff98a4cb752020 RCX: ffffffffa96211c5 [ 9299.340123] RDX: 0000000000000000 RSI: 00000000000d4204 RDI: ffff98a4cb752020 [ 9299.340165] RBP:
ffff98a4c28a62a4 R08: ffff98a4c37a96c0 R09: 0000000080150011 [ 9299.340207] R10: 0000000040000000 R11:
0000000000000000 R12: ffff98a4c4eaa080 [ 9299.340249] R13: ffff98a4c28a6360 R14: ffff98a4cb752020 R15:
ffff98a4c28a6228 [ 9299.340297] FS: 00007260840d3740(0000) GS:ffff98a4ef700000(0000) knlGS:0000000000000000 [ 9299.340345] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 9299.340383] CR2:
0000000000000008 CR3: 0000000004c56001 CR4: 0000000000770ee0 [ 9299.340432] PKRU: 55555554 [ 9299.340449] Call Trace: [ 9299.340467] <TASK> [ 9299.340485] __free_irq+0x221/0x350 [ 9299.340527] free_irq+0x30/0x70 [ 9299.340553] devm_free_irq+0x55/0x80 [ 9299.340579] mt7921_pci_remove+0x2f/0x40 [mt7921e] [ 9299.340616] pci_device_remove+0x3b/0xa0 [ 9299.340651] __device_release_driver+0x17a/0x240 [ 9299.340686] device_driver_detach+0x3c/0xa0 [ 9299.340714] unbind_store+0x113/0x130 [ 9299.340740] kernfs_fop_write_iter+0x124/0x1b0 [ 9299.340775] new_sync_write+0x15c/0x1f0 [ 9299.340806] vfs_write+0x1d2/0x270 [ 9299.340831] ksys_write+0x67/0xe0 [ 9299.340857] do_syscall_64+0x3b/0x90 [ 9299.340887] entry_SYSCALL_64_after_hwframe+0x44/0xae (CVE-2022-49476)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49476
https://ubuntu.com/security/CVE-2022-49476

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49476

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226677 - Linux Distros Unpatched Vulnerability : CVE-2022-49481
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt of_node_get() returns a node with refcount incremented. Calling of_node_put() to drop the reference when not needed anymore.
(CVE-2022-49481)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49481
https://ubuntu.com/security/CVE-2022-49481

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49481

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225835 - Linux Distros Unpatched Vulnerability : CVE-2022-49486
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe of_find_i2c_device_by_node() takes a reference, In error paths, we should call put_device() to drop the reference to aviod refount leak. (CVE-2022-49486)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49486
https://ubuntu.com/security/CVE-2022-49486

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49486

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226011 - Linux Distros Unpatched Vulnerability : CVE-2022-49497
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: remove two BUG() from skb_checksum_help() I have a syzbot report that managed to get a crash in skb_checksum_help() If syzbot can trigger these BUG(), it makes sense to replace them with more friendly WARN_ON_ONCE() since skb_checksum_help() can instead return an error code. Note that syzbot will still crash there, until real bug is fixed. (CVE-2022-49497)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49497
https://ubuntu.com/security/CVE-2022-49497

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49497

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226547 - Linux Distros Unpatched Vulnerability : CVE-2022-49498
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Check for null pointer of pointer substream before dereferencing it Pointer substream is being dereferenced on the assignment of pointer card before substream is being null checked with the macro PCM_RUNTIME_CHECK. Although PCM_RUNTIME_CHECK calls BUG_ON, it still is useful to perform the the pointer check before card is assigned. (CVE-2022-49498)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49498
https://ubuntu.com/security/CVE-2022-49498

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49498

Plugin Information
Published: 2025/03/05, Modified: 2025/10/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226278 - Linux Distros Unpatched Vulnerability : CVE-2022-49516
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ice: always check VF VSI pointer values The ice_get_vf_vsi function can return NULL in some cases, such as if handling messages during a reset where the VSI is being removed and recreated. Several places throughout the driver do not bother to check whether this VSI pointer is valid. Static analysis tools maybe report issues because they detect paths where a potentially NULL pointer could be dereferenced. Fix this by checking the return value of ice_get_vf_vsi everywhere. (CVE-2022-49516)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49516
https://ubuntu.com/security/CVE-2022-49516

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49516

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227306 - Linux Distros Unpatched Vulnerability : CVE-2022-49521
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp() If no handler is found in lpfc_complete_unsol_iocb() to match the rctl of a received frame, the frame is dropped and resources are leaked. Fix by returning resources when discarding an unhandled frame type. Update lpfc_fc_frame_check() handling of NOP basic link service. (CVE-2022-49521)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49521
https://ubuntu.com/security/CVE-2022-49521

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49521

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226112 - Linux Distros Unpatched Vulnerability : CVE-2022-49523
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ath11k: disable spectral scan during spectral deinit When ath11k modules are removed using rmmod with spectral scan enabled, crash is observed. Different crash trace is observed for each crash. Send spectral scan disable WMI command to firmware before cleaning the spectral dbring in the spectral_deinit API to avoid this crash. call trace from one of the crash observed: [ 1252.880802] Unable to handle kernel NULL pointer dereference at virtual address 00000008 [ 1252.882722] pgd = 0f42e886 [ 1252.890955] [00000008]
*pgd=00000000 [ 1252.893478] Internal error: Oops: 5 [#1] PREEMPT SMP ARM [ 1253.093035] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.89 #0 [ 1253.115261] Hardware name: Generic DT based system [ 1253.121149] PC is at ath11k_spectral_process_data+0x434/0x574 [ath11k] [ 1253.125940] LR is at 0x88e31017 [ 1253.132448] pc : [<7f9387b8>] lr : [<88e31017>] psr: a0000193 [ 1253.135488] sp : 80d01bc8 ip : 00000001 fp : 970e0000 [ 1253.141737] r10: 88e31000 r9 : 970ec000 r8 : 00000080 [ 1253.146946] r7 : 94734040 r6 :
a0000113 r5 : 00000057 r4 : 00000000 [ 1253.152159] r3 : e18cb694 r2 : 00000217 r1 : 1df1f000 r0 :
00000001 [ 1253.158755] Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user [ 1253.165266] Control: 10c0383d Table: 5e71006a DAC: 00000055 [ 1253.172472] Process swapper/0 (pid: 0, stack limit = 0x60870141) [ 1253.458055] [<7f9387b8>] (ath11k_spectral_process_data [ath11k]) from [<7f917fdc>] (ath11k_dbring_buffer_release_event+0x214/0x2e4 [ath11k]) [ 1253.466139] [<7f917fdc>] (ath11k_dbring_buffer_release_event [ath11k]) from [<7f8ea3c4>] (ath11k_wmi_tlv_op_rx+0x1840/0x29cc [ath11k]) [ 1253.478807] [<7f8ea3c4>] (ath11k_wmi_tlv_op_rx [ath11k]) from [<7f8fe868>] (ath11k_htc_rx_completion_handler+0x180/0x4e0 [ath11k]) [ 1253.490699] [<7f8fe868>] (ath11k_htc_rx_completion_handler [ath11k]) from [<7f91308c>] (ath11k_ce_per_engine_service+0x2c4/0x3b4 [ath11k]) [ 1253.502386] [<7f91308c>] (ath11k_ce_per_engine_service [ath11k]) from [<7f9a4198>] (ath11k_pci_ce_tasklet+0x28/0x80 [ath11k_pci]) [ 1253.514811] [<7f9a4198>] (ath11k_pci_ce_tasklet [ath11k_pci]) from [<8032227c>] (tasklet_action_common.constprop.2+0x64/0xe8) [ 1253.526476] [<8032227c>] (tasklet_action_common.constprop.2) from [<803021e8>] (__do_softirq+0x130/0x2d0) [ 1253.537756] [<803021e8>] (__do_softirq) from [<80322610>] (irq_exit+0xcc/0xe8) [ 1253.547304] [<80322610>] (irq_exit) from [<8036a4a4>] (__handle_domain_irq+0x60/0xb4) [ 1253.554428] [<8036a4a4>] (__handle_domain_irq) from [<805eb348>] (gic_handle_irq+0x4c/0x90) [ 1253.562321] [<805eb348>] (gic_handle_irq) from [<80301a78>] (__irq_svc+0x58/0x8c) Tested-on: QCN6122 hw1.0 AHB WLAN.HK.2.6.0.1-00851-QCAHKSWPL_SILICONZ-1 (CVE-2022-49523)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49523
https://ubuntu.com/security/CVE-2022-49523

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49523

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227191 - Linux Distros Unpatched Vulnerability : CVE-2022-49526
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- md/bitmap: don't set sb values if can't pass sanity check If bitmap area contains invalid data, kernel will crash then mdadm triggers Segmentation fault. This is cluster-md speical bug. In non-clustered env, mdadm will handle broken metadata case. In clustered array, only kernel space handles bitmap slot info.
But even this bug only happened in clustered env, current sanity check is wrong, the code should be changed. How to trigger: (faulty injection) dd if=/dev/zero bs=1M count=1 oflag=direct of=/dev/sda dd if=/dev/zero bs=1M count=1 oflag=direct of=/dev/sdb mdadm -C /dev/md0 -b clustered -e 1.2 -n 2 -l mirror /dev/sda /dev/sdb mdadm -Ss echo aaa > magic.txt == below modifying slot 2 bitmap data == dd if=magic.txt of=/dev/sda seek=16384 bs=1 count=3 <== destroy magic dd if=/dev/zero of=/dev/sda seek=16436 bs=1 count=4 <== ZERO chunksize mdadm -A /dev/md0 /dev/sda /dev/sdb == kernel crashes. mdadm outputs Segmentation fault == Reason of kernel crash: In md_bitmap_read_sb (called by md_bitmap_create), bad bitmap magic didn't block chunksize assignment, and zero value made DIV_ROUND_UP_SECTOR_T() trigger divide error.
Crash log: kernel: md: md0 stopped. kernel: md/raid1:md0: not clean -- starting background reconstruction kernel: md/raid1:md0: active with 2 out of 2 mirrors kernel: dlm: ... ... kernel: md-cluster: Joined cluster 44810aba-38bb-e6b8-daca-bc97a0b254aa slot 1 kernel: md0: invalid bitmap file superblock: bad magic kernel: md_bitmap_copy_from_slot can't get bitmap from slot 2 kernel: md-cluster: Could not gather bitmaps from slot 2 kernel: divide error: 0000 [#1] SMP NOPTI kernel: CPU: 0 PID: 1603 Comm: mdadm Not tainted 5.14.6-1-default kernel: Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) kernel: RIP:
0010:md_bitmap_create+0x1d1/0x850 [md_mod] kernel: RSP: 0018:ffffc22ac0843ba0 EFLAGS: 00010246 kernel: ...
... kernel: Call Trace: kernel: ? dlm_lock_sync+0xd0/0xd0 [md_cluster 77fe..7a0] kernel:
md_bitmap_copy_from_slot+0x2c/0x290 [md_mod 24ea..d3a] kernel: load_bitmaps+0xec/0x210 [md_cluster 77fe..7a0] kernel: md_bitmap_load+0x81/0x1e0 [md_mod 24ea..d3a] kernel: do_md_run+0x30/0x100 [md_mod 24ea..d3a] kernel: md_ioctl+0x1290/0x15a0 [md_mod 24ea....d3a] kernel: ? mddev_unlock+0xaa/0x130 [md_mod 24ea..d3a] kernel: ? blkdev_ioctl+0xb1/0x2b0 kernel: block_ioctl+0x3b/0x40 kernel:
__x64_sys_ioctl+0x7f/0xb0 kernel: do_syscall_64+0x59/0x80 kernel: ? exit_to_user_mode_prepare+0x1ab/0x230 kernel: ? syscall_exit_to_user_mode+0x18/0x40 kernel: ? do_syscall_64+0x69/0x80 kernel:
entry_SYSCALL_64_after_hwframe+0x44/0xae kernel: RIP: 0033:0x7f4a15fa722b kernel: ... ... kernel: ---[ end trace 8afa7612f559c868 ]--- kernel: RIP: 0010:md_bitmap_create+0x1d1/0x850 [md_mod] (CVE-2022-49526)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49526
https://ubuntu.com/security/CVE-2022-49526

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49526

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226531 - Linux Distros Unpatched Vulnerability : CVE-2022-49532
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes drm_cvt_mode may return NULL and we should check it. This bug is found by syzkaller: FAULT_INJECTION stacktrace: [ 168.567394] FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 1 [ 168.567403] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1 [ 168.567406] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [ 168.567408] Call trace: [ 168.567414] dump_backtrace+0x0/0x310 [ 168.567418] show_stack+0x28/0x38 [ 168.567423] dump_stack+0xec/0x15c [ 168.567427] should_fail+0x3ac/0x3d0 [ 168.567437] __should_failslab+0xb8/0x120 [ 168.567441] should_failslab+0x28/0xc0 [ 168.567445] kmem_cache_alloc_trace+0x50/0x640 [ 168.567454] drm_mode_create+0x40/0x90 [ 168.567458] drm_cvt_mode+0x48/0xc78 [ 168.567477] virtio_gpu_conn_get_modes+0xa8/0x140 [virtio_gpu] [ 168.567485] drm_helper_probe_single_connector_modes+0x3a4/0xd80 [ 168.567492] drm_mode_getconnector+0x2e0/0xa70 [ 168.567496] drm_ioctl_kernel+0x11c/0x1d8 [ 168.567514] drm_ioctl+0x558/0x6d0 [ 168.567522] do_vfs_ioctl+0x160/0xf30 [ 168.567525] ksys_ioctl+0x98/0xd8 [ 168.567530] __arm64_sys_ioctl+0x50/0xc8 [ 168.567536] el0_svc_common+0xc8/0x320 [ 168.567540] el0_svc_handler+0xf8/0x160 [ 168.567544] el0_svc+0x10/0x218 KASAN stacktrace: [ 168.567561] BUG: KASAN: null-ptr-deref in virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu] [ 168.567565] Read of size 4 at addr 0000000000000054 by task syz/6425 [ 168.567566] [ 168.567571] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1 [ 168.567573] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [ 168.567575] Call trace: [ 168.567578] dump_backtrace+0x0/0x310 [ 168.567582] show_stack+0x28/0x38 [ 168.567586] dump_stack+0xec/0x15c [ 168.567591] kasan_report+0x244/0x2f0 [ 168.567594] __asan_load4+0x58/0xb0 [ 168.567607] virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu] [ 168.567612] drm_helper_probe_single_connector_modes+0x3a4/0xd80 [ 168.567617] drm_mode_getconnector+0x2e0/0xa70 [ 168.567621] drm_ioctl_kernel+0x11c/0x1d8 [ 168.567624] drm_ioctl+0x558/0x6d0 [ 168.567628] do_vfs_ioctl+0x160/0xf30 [ 168.567632] ksys_ioctl+0x98/0xd8 [ 168.567636] __arm64_sys_ioctl+0x50/0xc8 [ 168.567641] el0_svc_common+0xc8/0x320 [ 168.567645] el0_svc_handler+0xf8/0x160 [ 168.567649] el0_svc+0x10/0x218 (CVE-2022-49532)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49532
https://ubuntu.com/security/CVE-2022-49532

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.0 (CVSS2#AV:L/AC:H/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49532

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227028 - Linux Distros Unpatched Vulnerability : CVE-2022-49542
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: lpfc: Move cfg_log_verbose check before calling lpfc_dmp_dbg() In an attempt to log message 0126 with LOG_TRACE_EVENT, the following hard lockup call trace hangs the system. Call Trace:
_raw_spin_lock_irqsave+0x32/0x40 lpfc_dmp_dbg.part.32+0x28/0x220 [lpfc] lpfc_cmpl_els_fdisc+0x145/0x460 [lpfc] lpfc_sli_cancel_jobs+0x92/0xd0 [lpfc] lpfc_els_flush_cmd+0x43c/0x670 [lpfc] lpfc_els_flush_all_cmd+0x37/0x60 [lpfc] lpfc_sli4_async_event_proc+0x956/0x1720 [lpfc] lpfc_do_work+0x1485/0x1d70 [lpfc] kthread+0x112/0x130 ret_from_fork+0x1f/0x40 Kernel panic - not syncing:
Hard LOCKUP The same CPU tries to claim the phba->port_list_lock twice. Move the cfg_log_verbose checks as part of the lpfc_printf_vlog() and lpfc_printf_log() macros before calling lpfc_dmp_dbg(). There is no need to take the phba->port_list_lock within lpfc_dmp_dbg(). (CVE-2022-49542)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49542
https://ubuntu.com/security/CVE-2022-49542

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49542

Plugin Information
Published: 2025/03/05, Modified: 2025/12/23
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226487 - Linux Distros Unpatched Vulnerability : CVE-2022-49554
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: zsmalloc: fix races between asynchronous zspage free and page migration The asynchronous zspage free worker tries to lock a zspage's entire page list without defending against page migration. Since pages which haven't yet been locked can concurrently migrate off the zspage page list while lock_zspage() churns away, lock_zspage() can suffer from a few different lethal races. It can lock a page which no longer belongs to the zspage and unsafely dereference page_private(), it can unsafely dereference a torn pointer to the next page (since there's a data race), and it can observe a spurious NULL pointer to the next page and thus not lock all of the zspage's pages (since a single page migration will reconstruct the entire page list, and create_page_chain() unconditionally zeroes out each list pointer in the process). Fix the races by using migrate_read_lock() in lock_zspage() to synchronize with page migration. (CVE-2022-49554)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49554
https://ubuntu.com/security/CVE-2022-49554

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49554

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227374 - Linux Distros Unpatched Vulnerability : CVE-2022-49571
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tcp: Fix data-races around sysctl_tcp_max_reordering. While reading sysctl_tcp_max_reordering, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. (CVE-2022-49571)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49571
https://ubuntu.com/security/CVE-2022-49571

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49571

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227321 - Linux Distros Unpatched Vulnerability : CVE-2022-49597
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tcp: Fix data-races around sysctl_tcp_base_mss. While reading sysctl_tcp_base_mss, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. (CVE-2022-49597)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49597
https://ubuntu.com/security/CVE-2022-49597

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49597

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226343 - Linux Distros Unpatched Vulnerability : CVE-2022-49607
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- perf/core: Fix data race between perf_event_set_output() and perf_mmap_close() Yang Jihing reported a race between perf_event_set_output() and perf_mmap_close(): CPU1 CPU2 perf_mmap_close(e2) if (atomic_dec_and_test(&e2->rb->mmap_count)) // 1 - > 0 detach_rest = true ioctl(e1, IOC_SET_OUTPUT, e2) perf_event_set_output(e1, e2) ... list_for_each_entry_rcu(e, &e2->rb->event_list, rb_entry) ring_buffer_attach(e, NULL); // e1 isn't yet added and // therefore not detached ring_buffer_attach(e1, e2->rb) list_add_rcu(&e1->rb_entry, &e2->rb->event_list) After this; e1 is attached to an unmapped rb and a subsequent perf_mmap() will loop forever more: again: mutex_lock(&e->mmap_mutex); if (event->rb) { ...
if (!atomic_inc_not_zero(&e->rb->mmap_count)) { ... mutex_unlock(&e->mmap_mutex); goto again; } } The loop in perf_mmap_close() holds e2->mmap_mutex, while the attach in perf_event_set_output() holds e1->mmap_mutex. As such there is no serialization to avoid this race. Change perf_event_set_output() to take both e1->mmap_mutex and e2->mmap_mutex to alleviate that problem. Additionally, have the loop in perf_mmap() detach the rb directly, this avoids having to wait for the concurrent perf_mmap_close() to get around to doing it to make progress. (CVE-2022-49607)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49607
https://ubuntu.com/security/CVE-2022-49607

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49607

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226373 - Linux Distros Unpatched Vulnerability : CVE-2022-49611
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- x86/speculation: Fill RSB on vmexit for IBRS Prevent RSB underflow/poisoning attacks with RSB. While at it, add a bunch of comments to attempt to document the current state of tribal knowledge about RSB attacks and what exactly is being mitigated. (CVE-2022-49611)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49611
https://ubuntu.com/security/CVE-2022-49611

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0009
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49611

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227345 - Linux Distros Unpatched Vulnerability : CVE-2022-49613
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: serial: 8250: Fix PM usage_count for console handover When console is enabled, univ8250_console_setup() calls serial8250_console_setup() before .dev is set to uart_port. Therefore, it will not call pm_runtime_get_sync(). Later, when the actual driver is going to take over univ8250_console_exit() is called. As .dev is already set, serial8250_console_exit() makes pm_runtime_put_sync() call with usage count being zero triggering PM usage count warning (extra debug for univ8250_console_setup(), univ8250_console_exit(), and serial8250_register_ports()): [ 0.068987] univ8250_console_setup ttyS0 nodev [ 0.499670] printk: console [ttyS0] enabled [ 0.717955] printk: console [ttyS0] printing thread started [ 1.960163] serial8250_register_ports assigned dev for ttyS0 [ 1.976830] printk: console [ttyS0] disabled [ 1.976888] printk: console [ttyS0] printing thread stopped [ 1.977073] univ8250_console_exit ttyS0 usage:0 [ 1.977075] serial8250 serial8250: Runtime PM usage count underflow! [ 1.977429] dw-apb-uart.6: ttyS0 at MMIO 0x4010006000 (irq = 33, base_baud = 115200) is a 16550A [ 1.977812] univ8250_console_setup ttyS0 usage:2 [ 1.978167] printk: console [ttyS0] printing thread started [ 1.978203] printk: console [ttyS0] enabled To fix the issue, call pm_runtime_get_sync() in serial8250_register_ports() as soon as .dev is set for an uart_port if it has console enabled. This problem became apparent only recently because 82586a721595 (PM: runtime: Avoid device usage count underflows) added the warning printout. I confirmed this problem also occurs with v5.18 (w/o the warning printout, obviously). (CVE-2022-49613)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49613
https://ubuntu.com/security/CVE-2022-49613

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49613

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227192 - Linux Distros Unpatched Vulnerability : CVE-2022-49616
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ASoC: rt7*-sdw: harden jack_detect_handler Realtek headset codec drivers typically check if the card is instantiated before proceeding with the jack detection. The rt700, rt711 and rt711-sdca are however missing a check on the card pointer, which can lead to NULL dereferences encountered in driver bind/unbind tests. (CVE-2022-49616)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49616
https://security-tracker.debian.org/tracker/CVE-2022-49616
https://ubuntu.com/security/CVE-2022-49616

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49616

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226886 - Linux Distros Unpatched Vulnerability : CVE-2022-49617
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ASoC: Intel: sof_sdw: handle errors on card registration If the card registration fails, typically because of deferred probes, the device properties added for headset codecs are not removed, which leads to kernel oopses in driver bind/unbind tests. We already clean-up the device properties when the card is removed, this code can be moved as a helper and called upon card registration errors. (CVE-2022-49617)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49617
https://security-tracker.debian.org/tracker/CVE-2022-49617
https://ubuntu.com/security/CVE-2022-49617

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49617

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227058 - Linux Distros Unpatched Vulnerability : CVE-2022-49620
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: tipc: fix possible refcount leak in tipc_sk_create() Free sk in case tipc_sk_insert() fails.
(CVE-2022-49620)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49620
https://ubuntu.com/security/CVE-2022-49620

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49620

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226875 - Linux Distros Unpatched Vulnerability : CVE-2022-49624
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: atlantic: remove aq_nic_deinit() when resume aq_nic_deinit() has been called while suspending, so we don't have to call it again on resume.
Actually, call it again leads to another hang issue when resuming from S3. Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992345] Call Trace: Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992346] <TASK> Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992348] aq_nic_deinit+0xb4/0xd0 [atlantic] Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992356] aq_pm_thaw+0x7f/0x100 [atlantic] Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992362] pci_pm_resume+0x5c/0x90 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992366] ? pci_pm_thaw+0x80/0x80 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992368] dpm_run_callback+0x4e/0x120 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992371] device_resume+0xad/0x200 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992373] async_resume+0x1e/0x40 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992374] async_run_entry_fn+0x33/0x120 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992377] process_one_work+0x220/0x3c0 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992380] worker_thread+0x4d/0x3f0 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992382] ? process_one_work+0x3c0/0x3c0 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992384] kthread+0x12a/0x150 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992386] ? set_kthread_struct+0x40/0x40 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992387] ret_from_fork+0x22/0x30 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992391] </TASK> Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992392] ---[ end trace 1ec8c79604ed5e0d ]--- Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992394] PM: dpm_run_callback(): pci_pm_resume+0x0/0x90 returns -110 Jul 8 03:09:44 u-Precision-7865-Tower kernel: [ 5910.992397] atlantic 0000:02:00.0: PM: failed to resume async: error -110 (CVE-2022-49624)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49624
https://ubuntu.com/security/CVE-2022-49624

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49624

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226357 - Linux Distros Unpatched Vulnerability : CVE-2022-49633
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: icmp: Fix data-races around sysctl_icmp_echo_enable_probe. While reading sysctl_icmp_echo_enable_probe, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. (CVE-2022-49633)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49633
https://ubuntu.com/security/CVE-2022-49633

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49633

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226639 - Linux Distros Unpatched Vulnerability : CVE-2022-49656
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ARM: meson: Fix refcount leak in meson_smp_prepare_cpus of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak.
(CVE-2022-49656)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49656
https://ubuntu.com/security/CVE-2022-49656

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49656

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226266 - Linux Distros Unpatched Vulnerability : CVE-2022-49658
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals Kuee reported a corner case where the tnum becomes constant after the call to __reg_bound_offset(), but the register's bounds are not, that is, its min bounds are still not equal to the register's max bounds. This in turn allows to leak pointers through turning a pointer register as is into an unknown scalar via adjust_ptr_min_max_vals(). Before:
func#0 @0 0: R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) 0: (b7) r0 = 1 ; R0_w=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) 1: (b7) r3 = 0 ;
R3_w=scalar(imm=0,umax=0,var_off=(0x0; 0x0)) 2: (87) r3 = -r3 ; R3_w=scalar() 3: (87) r3 = -r3 ;
R3_w=scalar() 4: (47) r3 |= 32767 ; R3_w=scalar(smin=-9223372036854743041,umin=32767,var_off=(0x7fff;
0xffffffffffff8000),s32_min=-2147450881) 5: (75) if r3 s>= 0x0 goto pc+1 ;
R3_w=scalar(umin=9223372036854808575,var_off=(0x8000000000007fff;
0x7fffffffffff8000),s32_min=-2147450881,u32_min=32767) 6: (95) exit from 5 to 7:
R0=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R3=scalar(umin=32767,umax=9223372036854775807,var_off=(0x7fff; 0x7fffffffffff8000),s32_min=-2147450881) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) 7: (d5) if r3 s<= 0x8000 goto pc+1 ;
R3=scalar(umin=32769,umax=9223372036854775807,var_off=(0x7fff;
0x7fffffffffff8000),s32_min=-2147450881,u32_min=32767) 8: (95) exit from 7 to 9:
R0=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R3=scalar(umin=32767,umax=32768,var_off=(0x7fff; 0x8000)) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) 9:
(07) r3 += -32767 ; R3_w=scalar(imm=0,umax=1,var_off=(0x0; 0x0)) <--- [*] 10: (95) exit What can be seen here is that R3=scalar(umin=32767,umax=32768,var_off=(0x7fff; 0x8000)) after the operation R3 += -32767 results in a 'malformed' constant, that is, R3_w=scalar(imm=0,umax=1,var_off=(0x0; 0x0)). Intersecting with var_off has not been done at that point via __update_reg_bounds(), which would have improved the umax to be equal to umin. Refactor the tnum <> min/max bounds information flow into a reg_bounds_sync() helper and use it consistently everywhere. After the fix, bounds have been corrected to R3_w=scalar(imm=0,umax=0,var_off=(0x0; 0x0)) and thus the register is regarded as a 'proper' constant scalar of 0. After: func#0 @0 0: R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) 0: (b7) r0 = 1 ;
R0_w=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) 1: (b7) r3 = 0 ;
R3_w=scalar(imm=0,umax=0,var_off=(0x0; 0x0)) 2: (87) r3 = -r3 ; R3_w=scalar() 3: (87) r3 = -r3 ;
R3_w=scalar() 4: (47) r3 |= 32767 ; R3_w=scalar(smin=-9223372036854743041,umin=32767,var_off=(0x7fff;
0xffffffffffff8000),s32_min=-2147450881) 5: (75) if r3 s>= 0x0 goto pc+1 ;
R3_w=scalar(umin=9223372036854808575,var_off=(0x8000000000007fff;
0x7fffffffffff8000),s32_min=-2147450881,u32_min=32767) 6: (95) exit from 5 to 7:
R0=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R3=scalar(umin=32767,umax=9223372036854775807,var_off=(0x7fff; 0x7fffffffffff8000),s32_min=-2147450881) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) 7: (d5) if r3 s<= 0x8000 goto pc+1 ;
R3=scalar(umin=32769,umax=9223372036854775807,var_off=(0x7fff;
0x7fffffffffff8000),s32_min=-2147450881,u32_min=32767) 8: (95) exit from 7 to 9:
R0=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R3=scalar(umin=32767,umax=32768,var_off=(0x7fff; 0x8000)) R10=fp(off=0 ---truncated--- (CVE-2022-49658)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49658
https://ubuntu.com/security/CVE-2022-49658

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
3.3 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
2.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49658

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226593 - Linux Distros Unpatched Vulnerability : CVE-2022-49662
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ipv6: fix lockdep splat in in6_dump_addrs() As reported by syzbot, we should not use rcu_dereference() when rcu_read_lock() is not held. WARNING: suspicious RCU usage 5.19.0-rc2-syzkaller #0 Not tainted net/ipv6/addrconf.c:5175 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by syz-executor326/3617: #0: ffffffff8d5848e8 (rtnl_mutex){+.+.}-{3:3}, at:
netlink_dump+0xae/0xc20 net/netlink/af_netlink.c:2223 stack backtrace: CPU: 0 PID: 3617 Comm: syz- executor326 Not tainted 5.19.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 in6_dump_addrs+0x12d1/0x1790 net/ipv6/addrconf.c:5175 inet6_dump_addr+0x9c1/0xb50 net/ipv6/addrconf.c:5300 netlink_dump+0x541/0xc20 net/netlink/af_netlink.c:2275 __netlink_dump_start+0x647/0x900 net/netlink/af_netlink.c:2380 netlink_dump_start include/linux/netlink.h:245 [inline] rtnetlink_rcv_msg+0x73e/0xc90 net/core/rtnetlink.c:6046 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:734 ____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
___sys_sendmsg+0xf3/0x170 net/socket.c:2546 __sys_sendmsg net/socket.c:2575 [inline] __do_sys_sendmsg net/socket.c:2584 [inline] __se_sys_sendmsg net/socket.c:2582 [inline] __x64_sys_sendmsg+0x132/0x220 net/socket.c:2582 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 (CVE-2022-49662)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49662
https://ubuntu.com/security/CVE-2022-49662

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0008
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49662

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226709 - Linux Distros Unpatched Vulnerability : CVE-2022-49679
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ARM: Fix refcount leak in axxia_boot_secondary of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak. (CVE-2022-49679)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49679
https://ubuntu.com/security/CVE-2022-49679

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49679

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227073 - Linux Distros Unpatched Vulnerability : CVE-2022-49728
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipv6: Fix signed integer overflow in __ip6_append_data Resurrect ubsan overflow checks and ubsan report this warning, fix it by change the variable [length] type to size_t. UBSAN: signed-integer-overflow in net/ipv6/ip6_output.c:1489:19 2147479552 + 8567 cannot be represented in type 'int' CPU: 0 PID: 253 Comm:
err Not tainted 5.16.0+ #1 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x214/0x230 show_stack+0x30/0x78 dump_stack_lvl+0xf8/0x118 dump_stack+0x18/0x30 ubsan_epilogue+0x18/0x60 handle_overflow+0xd0/0xf0 __ubsan_handle_add_overflow+0x34/0x44 __ip6_append_data.isra.48+0x1598/0x1688 ip6_append_data+0x128/0x260 udpv6_sendmsg+0x680/0xdd0 inet6_sendmsg+0x54/0x90 sock_sendmsg+0x70/0x88
____sys_sendmsg+0xe8/0x368 ___sys_sendmsg+0x98/0xe0 __sys_sendmmsg+0xf4/0x3b8
__arm64_sys_sendmmsg+0x34/0x48 invoke_syscall+0x64/0x160 el0_svc_common.constprop.4+0x124/0x300 do_el0_svc+0x44/0xc8 el0_svc+0x3c/0x1e8 el0t_64_sync_handler+0x88/0xb0 el0t_64_sync+0x16c/0x170 Changes since v1: -Change the variable [length] type to unsigned, as Eric Dumazet suggested. Changes since v2:
-Don't change exthdrlen type in ip6_make_skb, as Paolo Abeni suggested. Changes since v3: -Don't change ulen type in udpv6_sendmsg and l2tp_ip6_sendmsg, as Jakub Kicinski suggested. (CVE-2022-49728)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49728
https://ubuntu.com/security/CVE-2022-49728

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49728

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246530 - Linux Distros Unpatched Vulnerability : CVE-2022-49749
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- i2c: designware: use casting of u64 in clock multiplication to avoid overflow In functions i2c_dw_scl_lcnt() and i2c_dw_scl_hcnt() may have overflow by depending on the values of the given parameters including the ic_clk. For example in our use case where ic_clk is larger than one million, multiplication of ic_clk * 4700 will result in 32 bit overflow. Add cast of u64 to the calculation to avoid multiplication overflow, and use the corresponding define for divide. (CVE-2022-49749)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49749
https://ubuntu.com/security/CVE-2022-49749

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49749

Plugin Information
Published: 2025/08/09, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246852 - Linux Distros Unpatched Vulnerability : CVE-2022-49752
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: device property: fix of node refcount leak in fwnode_graph_get_next_endpoint() The 'parent' returned by fwnode_graph_get_port_parent() with refcount incremented when 'prev' is not NULL, it needs be put when finish using it. Because the parent is const, introduce a new variable to store the returned fwnode, then put it before returning from fwnode_graph_get_next_endpoint(). (CVE-2022-49752)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49752
https://ubuntu.com/security/CVE-2022-49752

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49752

Plugin Information
Published: 2025/08/09, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243361 - Linux Distros Unpatched Vulnerability : CVE-2022-49764
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Prevent bpf program recursion for raw tracepoint probes We got report from sysbot [1] about warnings that were caused by bpf program attached to contention_begin raw tracepoint triggering the same tracepoint by using bpf_trace_printk helper that takes trace_printk_lock lock. Call Trace: <TASK> ? trace_event_raw_event_bpf_trace_printk+0x5f/0x90 bpf_trace_printk+0x2b/0xe0 bpf_prog_a9aec6167c091eef_prog+0x1f/0x24 bpf_trace_run2+0x26/0x90 native_queued_spin_lock_slowpath+0x1c6/0x2b0 _raw_spin_lock_irqsave+0x44/0x50 bpf_trace_printk+0x3f/0xe0 bpf_prog_a9aec6167c091eef_prog+0x1f/0x24 bpf_trace_run2+0x26/0x90 native_queued_spin_lock_slowpath+0x1c6/0x2b0 _raw_spin_lock_irqsave+0x44/0x50 bpf_trace_printk+0x3f/0xe0 bpf_prog_a9aec6167c091eef_prog+0x1f/0x24 bpf_trace_run2+0x26/0x90 native_queued_spin_lock_slowpath+0x1c6/0x2b0 _raw_spin_lock_irqsave+0x44/0x50 bpf_trace_printk+0x3f/0xe0 bpf_prog_a9aec6167c091eef_prog+0x1f/0x24 bpf_trace_run2+0x26/0x90 native_queued_spin_lock_slowpath+0x1c6/0x2b0 _raw_spin_lock_irqsave+0x44/0x50
__unfreeze_partials+0x5b/0x160 ... The can be reproduced by attaching bpf program as raw tracepoint on contention_begin tracepoint. The bpf prog calls bpf_trace_printk helper. Then by running perf bench the spin lock code is forced to take slow path and call contention_begin tracepoint. Fixing this by skipping execution of the bpf program if it's already running, Using bpf prog 'active' field, which is being currently used by trampoline programs for the same reason. Moving bpf_prog_inc_misses_counter to syscall.c because trampoline.c is compiled in just for CONFIG_BPF_JIT option. [1] https://lore.kernel.org/bpf/YxhFe3EwqchC%2FfYf@krava/T/#t (CVE-2022-49764)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49764
https://security-tracker.debian.org/tracker/CVE-2022-49764
https://ubuntu.com/security/CVE-2022-49764

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49764

Plugin Information
Published: 2025/08/04, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247501 - Linux Distros Unpatched Vulnerability : CVE-2022-49769
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- gfs2: Check sb_bsize_shift after reading superblock Fuzzers like to scribble over sb_bsize_shift but in reality it's very unlikely that this field would be corrupted on its own. Nevertheless it should be checked to avoid the possibility of messy mount errors due to bad calculations. It's always a fixed value based on the block size so we can just check that it's the expected value. Tested with: mkfs.gfs2 -O -p lock_nolock /dev/vdb for i in 0 -1 64 65 32 33; do gfs2_edit -p sb field sb_bsize_shift $i /dev/vdb mount /dev/vdb /mnt/test && umount /mnt/test done Before this patch we get a withdraw after [ 76.413681] gfs2:
fsid=loop0.0: fatal: invalid metadata block [ 76.413681] bh = 19 (type: exp=5, found=4) [ 76.413681] function = gfs2_meta_buffer, file = fs/gfs2/meta_io.c, line = 492 and with UBSAN configured we also get complaints like [ 76.373395] UBSAN: shift-out-of-bounds in fs/gfs2/ops_fstype.c:295:19 [ 76.373815] shift exponent 4294967287 is too large for 64-bit type 'long unsigned int' After the patch, these complaints don't appear, mount fails immediately and we get an explanation in dmesg. (CVE-2022-49769)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49769
https://ubuntu.com/security/CVE-2022-49769

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49769

Plugin Information
Published: 2025/08/10, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244228 - Linux Distros Unpatched Vulnerability : CVE-2022-49772
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() snd_usbmidi_output_open() has a check of the NULL port with snd_BUG_ON(). snd_BUG_ON() was used as this shouldn't have happened, but in reality, the NULL port may be seen when the device gives an invalid endpoint setup at the descriptor, hence the driver skips the allocation. That is, the check itself is valid and snd_BUG_ON() should be dropped from there. Otherwise it's confusing as if it were a real bug, as recently syzbot stumbled on it.
(CVE-2022-49772)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49772
https://ubuntu.com/security/CVE-2022-49772

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49772

Plugin Information
Published: 2025/08/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247177 - Linux Distros Unpatched Vulnerability : CVE-2022-49779
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case In __unregister_kprobe_top(), if the currently unregistered probe has post_handler but other child probes of the aggrprobe do not have post_handler, the post_handler of the aggrprobe is cleared. If this is a ftrace-based probe, there is a problem. In later calls to disarm_kprobe(), we will use kprobe_ftrace_ops because post_handler is NULL. But we're armed with kprobe_ipmodify_ops. This triggers a WARN in __disarm_kprobe_ftrace() and may even cause use-after-free:
Failed to disarm kprobe-ftrace at kernel_clone+0x0/0x3c0 (error -2) WARNING: CPU: 5 PID: 137 at kernel/kprobes.c:1135 __disarm_kprobe_ftrace.isra.21+0xcf/0xe0 Modules linked in: testKprobe_007(-) CPU: 5 PID: 137 Comm: rmmod Not tainted 6.1.0-rc4-dirty #18 [...] Call Trace: <TASK> __disable_kprobe+0xcd/0xe0
__unregister_kprobe_top+0x12/0x150 ? mutex_lock+0xe/0x30 unregister_kprobes.part.23+0x31/0xa0 unregister_kprobe+0x32/0x40 __x64_sys_delete_module+0x15e/0x260 ? do_user_addr_fault+0x2cd/0x6b0 do_syscall_64+0x3a/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] For the kprobe-on-ftrace case, we keep the post_handler setting to identify this aggrprobe armed with kprobe_ipmodify_ops. This way we can disarm it correctly. (CVE-2022-49779)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49779
https://ubuntu.com/security/CVE-2022-49779

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49779

Plugin Information
Published: 2025/08/10, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245500 - Linux Distros Unpatched Vulnerability : CVE-2022-49781
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd: Fix crash due to race between amd_pmu_enable_all, perf NMI and throttling amd_pmu_enable_all() does: if (!test_bit(idx, cpuc->active_mask)) continue; amd_pmu_enable_event(cpuc->events[idx]); A perf NMI of another event can come between these two steps. Perf NMI handler internally disables and enables _all_ events, including the one which nmi-intercepted amd_pmu_enable_all() was in process of enabling. If that unintentionally enabled event has very low sampling period and causes immediate successive NMI, causing the event to be throttled, cpuc->events[idx] and cpuc->active_mask gets cleared by x86_pmu_stop(). This will result in amd_pmu_enable_event() getting called with event=NULL when amd_pmu_enable_all() resumes after handling the NMIs. This causes a kernel crash: BUG: kernel NULL pointer dereference, address: 0000000000000198 #PF:
supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page [...] Call Trace: <TASK>
amd_pmu_enable_all+0x68/0xb0 ctx_resched+0xd9/0x150 event_function+0xb8/0x130 ? hrtimer_start_range_ns+0x141/0x4a0 ? perf_duration_warn+0x30/0x30 remote_function+0x4d/0x60
__flush_smp_call_function_queue+0xc4/0x500 flush_smp_call_function_queue+0x11d/0x1b0 do_idle+0x18f/0x2d0 cpu_startup_entry+0x19/0x20 start_secondary+0x121/0x160 secondary_startup_64_no_verify+0xe5/0xeb </TASK>
amd_pmu_disable_all()/amd_pmu_enable_all() calls inside perf NMI handler were recently added as part of BRS enablement but I'm not sure whether we really need them. We can just disable BRS in the beginning and enable it back while returning from NMI. This will solve the issue by not enabling those events whose active_masks are set but are not yet enabled in hw pmu. (CVE-2022-49781)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49781
https://ubuntu.com/security/CVE-2022-49781

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49781

Plugin Information
Published: 2025/08/07, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246814 - Linux Distros Unpatched Vulnerability : CVE-2022-49782
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: perf: Improve missing SIGTRAP checking To catch missing SIGTRAP we employ a WARN in __perf_event_overflow(), which fires if pending_sigtrap was already set: returning to user space without consuming pending_sigtrap, and then having the event fire again would re-enter the kernel and trigger the WARN. This, however, seemed to miss the case where some events not associated with progress in the user space task can fire and the interrupt handler runs before the IRQ work meant to consume pending_sigtrap (and generate the SIGTRAP). syzbot gifted us this stack trace: | WARNING: CPU: 0 PID: 3607 at kernel/events/core.c:9313 __perf_event_overflow | Modules linked in:
| CPU: 0 PID: 3607 Comm: syz-executor100 Not tainted 6.1.0-rc2-syzkaller-00073-g88619e77b33d #0 | Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 | RIP:
0010:__perf_event_overflow+0x498/0x540 kernel/events/core.c:9313 | <...> | Call Trace: | <TASK> | perf_swevent_hrtimer+0x34f/0x3c0 kernel/events/core.c:10729 | __run_hrtimer kernel/time/hrtimer.c:1685 [inline] | __hrtimer_run_queues+0x1c6/0xfb0 kernel/time/hrtimer.c:1749 | hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811 | local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1096 [inline] |
__sysvec_apic_timer_interrupt+0x17c/0x640 arch/x86/kernel/apic/apic.c:1113 | sysvec_apic_timer_interrupt+0x40/0xc0 arch/x86/kernel/apic/apic.c:1107 | asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649 | <...> | </TASK> In this case, syzbot produced a program with event type PERF_TYPE_SOFTWARE and config PERF_COUNT_SW_CPU_CLOCK. The hrtimer manages to fire again before the IRQ work got a chance to run, all while never having returned to user space. Improve the WARN to check for real progress in user space: approximate this by storing a 32-bit hash of the current IP into pending_sigtrap, and if an event fires while pending_sigtrap still matches the previous IP, we assume no progress (false negatives are possible given we could return to user space and trigger again on the same IP). (CVE-2022-49782)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49782
https://ubuntu.com/security/CVE-2022-49782

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49782

Plugin Information
Published: 2025/08/09, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248783 - Linux Distros Unpatched Vulnerability : CVE-2022-49783
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- x86/fpu: Drop fpregs lock before inheriting FPU permissions Mike Galbraith reported the following against an old fork of preempt-rt but the same issue also applies to the current preempt-rt tree. BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46 in_atomic(): 1, irqs_disabled():
0, non_block: 0, pid: 1, name: systemd preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 Preemption disabled at: fpu_clone CPU: 6 PID: 1 Comm: systemd Tainted: G E (unreleased) Call Trace: <TASK>
dump_stack_lvl ? fpu_clone __might_resched rt_spin_lock fpu_clone ? copy_thread ? copy_process ? shmem_alloc_inode ? kmem_cache_alloc ? kernel_clone ? __do_sys_clone ? do_syscall_64 ?
__x64_sys_rt_sigprocmask ? syscall_exit_to_user_mode ? do_syscall_64 ? syscall_exit_to_user_mode ? do_syscall_64 ? syscall_exit_to_user_mode ? do_syscall_64 ? exc_page_fault ? entry_SYSCALL_64_after_hwframe </TASK> Mike says: The splat comes from fpu_inherit_perms() being called under fpregs_lock(), and us reaching the spin_lock_irq() therein due to fpu_state_size_dynamic() returning true despite static key __fpu_state_size_dynamic having never been enabled. Mike's assessment looks correct. fpregs_lock on a PREEMPT_RT kernel disables preemption so calling spin_lock_irq() in fpu_inherit_perms() is unsafe. This problem exists since commit 9e798e9aa14c (x86/fpu: Prepare fpu_clone() for dynamically enabled features). Even though the original bug report should not have enabled the paths at all, the bug still exists. fpregs_lock is necessary when editing the FPU registers or a task's FP state but it is not necessary for fpu_inherit_perms(). The only write of any FP state in fpu_inherit_perms() is for the new child which is not running yet and cannot context switch or be borrowed by a kernel thread yet. Hence, fpregs_lock is not protecting anything in the new child until clone() completes and can be dropped earlier. The siglock still needs to be acquired by fpu_inherit_perms() as the read of the parent's permissions has to be serialised. [ bp: Cleanup splat. ] (CVE-2022-49783)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49783
https://ubuntu.com/security/CVE-2022-49783

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
4.0 (CVSS2#AV:L/AC:H/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49783

Plugin Information
Published: 2025/08/12, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245275 - Linux Distros Unpatched Vulnerability : CVE-2022-49784
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/uncore: Fix memory leak for events array When a CPU comes online, the per-CPU NB and LLC uncore contexts are freed but not the events array within the context structure. This causes a memory leak as identified by the kmemleak detector. [...] unreferenced object 0xffff8c5944b8e320 (size 32): comm swapper/0, pid 1, jiffies 4294670387 (age 151.072s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace:
[<000000000759fb79>] amd_uncore_cpu_up_prepare+0xaf/0x230 [<00000000ddc9e126>] cpuhp_invoke_callback+0x2cf/0x470 [<0000000093e727d4>] cpuhp_issue_call+0x14d/0x170 [<0000000045464d54>]
__cpuhp_setup_state_cpuslocked+0x11e/0x330 [<0000000069f67cbd>] __cpuhp_setup_state+0x6b/0x110 [<0000000015365e0f>] amd_uncore_init+0x260/0x321 [<00000000089152d2>] do_one_initcall+0x3f/0x1f0 [<000000002d0bd18d>] kernel_init_freeable+0x1ca/0x212 [<0000000030be8dde>] kernel_init+0x11/0x120 [<0000000059709e59>] ret_from_fork+0x22/0x30 unreferenced object 0xffff8c5944b8dd40 (size 64): comm swapper/0, pid 1, jiffies 4294670387 (age 151.072s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace: [<00000000306efe8b>] amd_uncore_cpu_up_prepare+0x183/0x230 [<00000000ddc9e126>] cpuhp_invoke_callback+0x2cf/0x470 [<0000000093e727d4>] cpuhp_issue_call+0x14d/0x170 [<0000000045464d54>]
__cpuhp_setup_state_cpuslocked+0x11e/0x330 [<0000000069f67cbd>] __cpuhp_setup_state+0x6b/0x110 [<0000000015365e0f>] amd_uncore_init+0x260/0x321 [<00000000089152d2>] do_one_initcall+0x3f/0x1f0 [<000000002d0bd18d>] kernel_init_freeable+0x1ca/0x212 [<0000000030be8dde>] kernel_init+0x11/0x120 [<0000000059709e59>] ret_from_fork+0x22/0x30 [...] Fix the problem by freeing the events array before freeing the uncore context. (CVE-2022-49784)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49784
https://ubuntu.com/security/CVE-2022-49784

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49784

Plugin Information
Published: 2025/08/07, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244092 - Linux Distros Unpatched Vulnerability : CVE-2022-49797
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tracing: kprobe: Fix potential null- ptr-deref on trace_event_file in kprobe_event_gen_test_exit() When trace_get_event_file() failed, gen_kretprobe_test will be assigned as the error code. If module kprobe_event_gen_test is removed now, the null pointer dereference will happen in kprobe_event_gen_test_exit(). Check if gen_kprobe_test or gen_kretprobe_test is error code or NULL before dereference them. BUG: kernel NULL pointer dereference, address: 0000000000000012 PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 3 PID: 2210 Comm: modprobe Not tainted 6.1.0-rc1-00171-g2159299a3b74-dirty #217 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:kprobe_event_gen_test_exit+0x1c/0xb5 [kprobe_event_gen_test] Code: Unable to access opcode bytes at 0xffffffff9ffffff2. RSP:
0018:ffffc900015bfeb8 EFLAGS: 00010246 RAX: ffffffffffffffea RBX: ffffffffa0002080 RCX: 0000000000000000 RDX: ffffffffa0001054 RSI: ffffffffa0001064 RDI: ffffffffdfc6349c RBP: ffffffffa0000000 R08:
0000000000000004 R09: 00000000001e95c0 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000800 R13: ffffffffa0002420 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f56b75be540(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
ffffffff9ffffff2 CR3: 000000010874a006 CR4: 0000000000330ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK>
__x64_sys_delete_module+0x206/0x380 ? lockdep_hardirqs_on_prepare+0xd8/0x190 ? syscall_enter_from_user_mode+0x1c/0x50 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd (CVE-2022-49797)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49797
https://ubuntu.com/security/CVE-2022-49797

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49797

Plugin Information
Published: 2025/08/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247296 - Linux Distros Unpatched Vulnerability : CVE-2022-49799
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tracing: Fix wild-memory-access in register_synth_event() In register_synth_event(), if set_synth_event_print_fmt() failed, then both trace_remove_event_call() and unregister_trace_event() will be called, which means the trace_event_call will call __unregister_trace_event() twice. As the result, the second unregister will causes the wild-memory-access. register_synth_event set_synth_event_print_fmt failed trace_remove_event_call event_remove if call->event.funcs then __unregister_trace_event (first call) unregister_trace_event __unregister_trace_event (second call) Fix the bug by avoiding to call the second __unregister_trace_event() by checking if the first one is called. general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN PTI KASAN: maybe wild-memory- access in range [0xdead000000000120-0xdead000000000127] CPU: 0 PID: 3807 Comm: modprobe Not tainted 6.1.0-rc1-00186-g76f33a7eedb4 #299 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:unregister_trace_event+0x6e/0x280 Code:
00 fc ff df 4c 89 ea 48 c1 ea 03 80 3c 02 00 0f 85 0e 02 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 63 08 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 0f 85 e2 01 00 00 49 89 2c 24 48 85 ed 74 28 e8 7a 9b RSP:
0018:ffff88810413f370 EFLAGS: 00010a06 RAX: dffffc0000000000 RBX: ffff888105d050b0 RCX: 0000000000000000 RDX: 1bd5a00000000024 RSI: ffff888119e276e0 RDI: ffffffff835a8b20 RBP: dead000000000100 R08:
0000000000000000 R09: fffffbfff0913481 R10: ffffffff8489a407 R11: fffffbfff0913480 R12: dead000000000122 R13: ffff888105d050b8 R14: 0000000000000000 R15: ffff888105d05028 FS: 00007f7823e8d540(0000) GS:ffff888119e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
00007f7823e7ebec CR3: 000000010a058002 CR4: 0000000000330ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK>
__create_synth_event+0x1e37/0x1eb0 create_or_delete_synth_event+0x110/0x250 synth_event_run_command+0x2f/0x110 test_gen_synth_cmd+0x170/0x2eb [synth_event_gen_test] synth_event_gen_test_init+0x76/0x9bc [synth_event_gen_test] do_one_initcall+0xdb/0x480 do_init_module+0x1cf/0x680 load_module+0x6a50/0x70a0 __do_sys_finit_module+0x12f/0x1c0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd (CVE-2022-49799)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49799
https://ubuntu.com/security/CVE-2022-49799

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49799

Plugin Information
Published: 2025/08/10, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248236 - Linux Distros Unpatched Vulnerability : CVE-2022-49800
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tracing: Fix memory leak in test_gen_synth_cmd() and test_empty_synth_event() test_gen_synth_cmd() only free buf in fail path, hence buf will leak when there is no failure. Add kfree(buf) to prevent the memleak. The same reason and solution in test_empty_synth_event(). unreferenced object 0xffff8881127de000 (size 2048): comm modprobe, pid 247, jiffies 4294972316 (age 78.756s) hex dump (first 32 bytes): 20 67 65 6e 5f 73 79 6e 74 68 5f 74 65 73 74 20 gen_synth_test 20 70 69 64 5f 74 20 6e 65 78 74 5f 70 69 64 5f pid_t next_pid_ backtrace:
[<000000004254801a>] kmalloc_trace+0x26/0x100 [<0000000039eb1cf5>] 0xffffffffa00083cd [<000000000e8c3bc8>] 0xffffffffa00086ba [<00000000c293d1ea>] do_one_initcall+0xdb/0x480 [<00000000aa189e6d>] do_init_module+0x1cf/0x680 [<00000000d513222b>] load_module+0x6a50/0x70a0 [<000000001fd4d529>]
__do_sys_finit_module+0x12f/0x1c0 [<00000000b36c4c0f>] do_syscall_64+0x3f/0x90 [<00000000bbf20cf3>] entry_SYSCALL_64_after_hwframe+0x63/0xcd unreferenced object 0xffff8881127df000 (size 2048): comm modprobe, pid 247, jiffies 4294972324 (age 78.728s) hex dump (first 32 bytes): 20 65 6d 70 74 79 5f 73 79 6e 74 68 5f 74 65 73 empty_synth_tes 74 20 20 70 69 64 5f 74 20 6e 65 78 74 5f 70 69 t pid_t next_pi backtrace: [<000000004254801a>] kmalloc_trace+0x26/0x100 [<00000000d4db9a3d>] 0xffffffffa0008071 [<00000000c31354a5>] 0xffffffffa00086ce [<00000000c293d1ea>] do_one_initcall+0xdb/0x480 [<00000000aa189e6d>] do_init_module+0x1cf/0x680 [<00000000d513222b>] load_module+0x6a50/0x70a0 [<000000001fd4d529>] __do_sys_finit_module+0x12f/0x1c0 [<00000000b36c4c0f>] do_syscall_64+0x3f/0x90 [<00000000bbf20cf3>] entry_SYSCALL_64_after_hwframe+0x63/0xcd (CVE-2022-49800)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49800
https://ubuntu.com/security/CVE-2022-49800

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49800

Plugin Information
Published: 2025/08/11, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243767 - Linux Distros Unpatched Vulnerability : CVE-2022-49801
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tracing: Fix memory leak in tracing_read_pipe() kmemleak reports this issue: unreferenced object 0xffff888105a18900 (size 128): comm test_progs, pid 18933, jiffies 4336275356 (age 22801.766s) hex dump (first 32 bytes): 25 73 00 90 81 88 ff ff 26 05 00 00 42 01 58 04 %s......&...B.X. 03 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000560143a1>]
__kmalloc_node_track_caller+0x4a/0x140 [<000000006af00822>] krealloc+0x8d/0xf0 [<00000000c309be6a>] trace_iter_expand_format+0x99/0x150 [<000000005a53bdb6>] trace_check_vprintf+0x1e0/0x11d0 [<0000000065629d9d>] trace_event_printf+0xb6/0xf0 [<000000009a690dc7>] trace_raw_output_bpf_trace_printk+0x89/0xc0 [<00000000d22db172>] print_trace_line+0x73c/0x1480 [<00000000cdba76ba>] tracing_read_pipe+0x45c/0x9f0 [<0000000015b58459>] vfs_read+0x17b/0x7c0 [<000000004aeee8ed>] ksys_read+0xed/0x1c0 [<0000000063d3d898>] do_syscall_64+0x3b/0x90 [<00000000a06dda7f>] entry_SYSCALL_64_after_hwframe+0x63/0xcd iter->fmt alloced in tracing_read_pipe() ->
.. ->trace_iter_expand_format(), but not freed, to fix, add free in tracing_release_pipe() (CVE-2022-49801)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49801
https://security-tracker.debian.org/tracker/CVE-2022-49801
https://ubuntu.com/security/CVE-2022-49801

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49801

Plugin Information
Published: 2025/08/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245567 - Linux Distros Unpatched Vulnerability : CVE-2022-49802
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix null pointer dereference in ftrace_add_mod() The @ftrace_mod is allocated by kzalloc(), so both the members {prev,next} of @ftrace_mode->list are NULL, it's not a valid state to call list_del(). If kstrdup() for @ftrace_mod->{func|module} fails, it goes to @out_free tag and calls free_ftrace_mod() to destroy @ftrace_mod, then list_del() will write prev->next and next->prev, where null pointer dereference happens.
BUG: kernel NULL pointer dereference, address: 0000000000000008 Oops: 0002 [#1] PREEMPT SMP NOPTI Call Trace: <TASK> ftrace_mod_callback+0x20d/0x220 ? do_filp_open+0xd9/0x140 ftrace_process_regex.isra.51+0xbf/0x130 ftrace_regex_write.isra.52.part.53+0x6e/0x90 vfs_write+0xee/0x3a0 ? __audit_filter_op+0xb1/0x100 ? auditd_test_task+0x38/0x50 ksys_write+0xa5/0xe0 do_syscall_64+0x3a/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Kernel panic - not syncing: Fatal exception So call INIT_LIST_HEAD() to initialize the list member to fix this issue. (CVE-2022-49802)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49802
https://ubuntu.com/security/CVE-2022-49802

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49802

Plugin Information
Published: 2025/08/07, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249831 - Linux Distros Unpatched Vulnerability : CVE-2022-49803
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netdevsim: Fix memory leak of nsim_dev->fa_cookie kmemleak reports this issue: unreferenced object 0xffff8881bac872d0 (size 8): comm sh, pid 58603, jiffies 4481524462 (age 68.065s) hex dump (first 8 bytes): 04 00 00 00 de ad be ef ........ backtrace: [<00000000c80b8577>] __kmalloc+0x49/0x150 [<000000005292b8c6>] nsim_dev_trap_fa_cookie_write+0xc1/0x210 [netdevsim] [<0000000093d78e77>] full_proxy_write+0xf3/0x180 [<000000005a662c16>] vfs_write+0x1c5/0xaf0 [<000000007aabf84a>] ksys_write+0xed/0x1c0 [<000000005f1d2e47>] do_syscall_64+0x3b/0x90 [<000000006001c6ec>] entry_SYSCALL_64_after_hwframe+0x63/0xcd The issue occurs in the following scenarios:
nsim_dev_trap_fa_cookie_write() kmalloc() fa_cookie nsim_dev->fa_cookie = fa_cookie .. nsim_drv_remove() The fa_cookie allocked in nsim_dev_trap_fa_cookie_write() is not freed. To fix, add kfree(nsim_dev->fa_cookie) to nsim_drv_remove(). (CVE-2022-49803)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49803
https://security-tracker.debian.org/tracker/CVE-2022-49803
https://ubuntu.com/security/CVE-2022-49803

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49803

Plugin Information
Published: 2025/08/15, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245085 - Linux Distros Unpatched Vulnerability : CVE-2022-49807
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: nvmet: fix a memory leak in nvmet_auth_set_key When changing dhchap secrets we need to release the old secrets as well. kmemleak complaint: -- unreferenced object 0xffff8c7f44ed8180 (size 64): comm check, pid 7304, jiffies 4295686133 (age 72034.246s) hex dump (first 32 bytes): 44 48 48 43 2d 31 3a 30 30 3a 4c 64 4c 4f 64 71 DHHC-1:00:LdLOdq 79 56 69 67 77 48 55 32 6d 5a 59 4c 7a 35 59 38 yVigwHU2mZYLz5Y8 backtrace:
[<00000000b6fc5071>] kstrdup+0x2e/0x60 [<00000000f0f4633f>] 0xffffffffc0e07ee6 [<0000000053006c05>] 0xffffffffc0dff783 [<00000000419ae922>] configfs_write_iter+0xb1/0x120 [<000000008183c424>] vfs_write+0x2be/0x3c0 [<000000009005a2a5>] ksys_write+0x5f/0xe0 [<00000000cd495c89>] do_syscall_64+0x38/0x90 [<00000000f2a84ac5>] entry_SYSCALL_64_after_hwframe+0x63/0xcd (CVE-2022-49807)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49807
https://ubuntu.com/security/CVE-2022-49807

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49807

Plugin Information
Published: 2025/08/07, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244210 - Linux Distros Unpatched Vulnerability : CVE-2022-49810
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfs: Fix missing xas_retry() calls in xarray iteration netfslib has a number of places in which it performs iteration of an xarray whilst being under the RCU read lock. It *should* call xas_retry() as the first thing inside of the loop and do continue if it returns true in case the xarray walker passed out a special value indicating that the walk needs to be redone from the root[*]. Fix this by adding the missing retry checks. [*] I wonder if this should be done inside xas_find(), xas_next_node() and suchlike, but I'm told that's not an simple change to effect. This can cause an oops like that below. Note the faulting address - this is an internal value (|0x2) returned from xarray. BUG: kernel NULL pointer dereference, address: 0000000000000402 ... RIP: 0010:netfs_rreq_unlock+0xef/0x380 [netfs] ... Call Trace:
netfs_rreq_assess+0xa6/0x240 [netfs] netfs_readpage+0x173/0x3b0 [netfs] ? init_wait_var_entry+0x50/0x50 filemap_read_page+0x33/0xf0 filemap_get_pages+0x2f2/0x3f0 filemap_read+0xaa/0x320 ? do_filp_open+0xb2/0x150 ? rmqueue+0x3be/0xe10 ceph_read_iter+0x1fe/0x680 [ceph] ? new_sync_read+0x115/0x1a0 new_sync_read+0x115/0x1a0 vfs_read+0xf3/0x180 ksys_read+0x5f/0xe0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae Changes: ======== ver #2) - Changed an unsigned int to a size_t to reduce the likelihood of an overflow as per Willy's suggestion. - Added an additional patch to fix the maths. (CVE-2022-49810)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49810
https://ubuntu.com/security/CVE-2022-49810

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49810

Plugin Information
Published: 2025/08/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247559 - Linux Distros Unpatched Vulnerability : CVE-2022-49812
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bridge: switchdev: Fix memory leaks when changing VLAN protocol The bridge driver can offload VLANs to the underlying hardware either via switchdev or the 8021q driver. When the former is used, the VLAN is marked in the bridge driver with the 'BR_VLFLAG_ADDED_BY_SWITCHDEV' private flag. To avoid the memory leaks mentioned in the cited commit, the bridge driver will try to delete a VLAN via the 8021q driver if the VLAN is not marked with the previously mentioned flag. When the VLAN protocol of the bridge changes, switchdev drivers are notified via the 'SWITCHDEV_ATTR_ID_BRIDGE_VLAN_PROTOCOL' attribute, but the 8021q driver is also called to add the existing VLANs with the new protocol and delete them with the old protocol. In case the VLANs were offloaded via switchdev, the above behavior is both redundant and buggy.
Redundant because the VLANs are already programmed in hardware and drivers that support VLAN protocol change (currently only mlx5) change the protocol upon the switchdev attribute notification. Buggy because the 8021q driver is called despite these VLANs being marked with 'BR_VLFLAG_ADDED_BY_SWITCHDEV'. This leads to memory leaks [1] when the VLANs are deleted. Fix by not calling the 8021q driver for VLANs that were already programmed via switchdev. [1] unreferenced object 0xffff8881f6771200 (size 256): comm ip, pid 446855, jiffies 4298238841 (age 55.240s) hex dump (first 32 bytes): 00 00 7f 0e 83 88 ff ff 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace: [<00000000012819ac>] vlan_vid_add+0x437/0x750 [<00000000f2281fad>]
__br_vlan_set_proto+0x289/0x920 [<000000000632b56f>] br_changelink+0x3d6/0x13f0 [<0000000089d25f04>]
__rtnl_newlink+0x8ae/0x14c0 [<00000000f6276baf>] rtnl_newlink+0x5f/0x90 [<00000000746dc902>] rtnetlink_rcv_msg+0x336/0xa00 [<000000001c2241c0>] netlink_rcv_skb+0x11d/0x340 [<0000000010588814>] netlink_unicast+0x438/0x710 [<00000000e1a4cd5c>] netlink_sendmsg+0x788/0xc40 [<00000000e8992d4e>] sock_sendmsg+0xb0/0xe0 [<00000000621b8f91>] ____sys_sendmsg+0x4ff/0x6d0 [<000000000ea26996>]
___sys_sendmsg+0x12e/0x1b0 [<00000000684f7e25>] __sys_sendmsg+0xab/0x130 [<000000004538b104>] do_syscall_64+0x3d/0x90 [<0000000091ed9678>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 (CVE-2022-49812)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49812
https://ubuntu.com/security/CVE-2022-49812

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49812

Plugin Information
Published: 2025/08/10, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246519 - Linux Distros Unpatched Vulnerability : CVE-2022-49813
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: ena: Fix error handling in ena_init() The ena_init() won't destroy workqueue created by create_singlethread_workqueue() when pci_register_driver() failed. Call destroy_workqueue() when pci_register_driver() failed to prevent the resource leak. (CVE-2022-49813)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49813
https://ubuntu.com/security/CVE-2022-49813

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49813

Plugin Information
Published: 2025/08/09, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247308 - Linux Distros Unpatched Vulnerability : CVE-2022-49817
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: mhi: Fix memory leak in mhi_net_dellink() MHI driver registers network device without setting the needs_free_netdev flag, and does NOT call free_netdev() when unregisters network device, which causes a memory leak. This patch calls free_netdev() to fix it since netdev_priv is used after unregister. (CVE-2022-49817)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49817
https://ubuntu.com/security/CVE-2022-49817

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49817

Plugin Information
Published: 2025/08/10, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248892 - Linux Distros Unpatched Vulnerability : CVE-2022-49819
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: octeon_ep: fix potential memory leak in octep_device_setup() When occur unsupported_dev and mbox init errors, it did not free oct->conf and iounmap() oct->mmio[i].hw_addr. That would trigger memory leak problem. Add kfree() for oct->conf and iounmap() for oct->mmio[i].hw_addr under unsupported_dev and mbox init errors to fix the problem.
(CVE-2022-49819)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49819
https://ubuntu.com/security/CVE-2022-49819

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49819

Plugin Information
Published: 2025/08/12, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249404 - Linux Distros Unpatched Vulnerability : CVE-2022-49821
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mISDN: fix possible memory leak in mISDN_dsp_element_register() Afer commit 1fa5ae857bb1 (driver core:
get rid of struct device's bus_id string array), the name of device is allocated dynamically, use put_device() to give up the reference, so that the name can be freed in kobject_cleanup() when the refcount is 0. The 'entry' is going to be freed in mISDN_dsp_dev_release(), so the kfree() is removed.
list_del() is called in mISDN_dsp_dev_release(), so it need be initialized. (CVE-2022-49821)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49821
https://ubuntu.com/security/CVE-2022-49821

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49821

Plugin Information
Published: 2025/08/15, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249743 - Linux Distros Unpatched Vulnerability : CVE-2022-49822
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cifs: Fix connections leak when tlink setup failed If the tlink setup failed, lost to put the connections, then the module refcnt leak since the cifsd kthread not exit. Also leak the fscache info, and for next mount with fsc, it will print the follow errors: CIFS: Cache volume key already in use (cifs,127.0.0.1:445,TEST) Let's check the result of tlink setup, and do some cleanup. (CVE-2022-49822)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49822
https://security-tracker.debian.org/tracker/CVE-2022-49822
https://ubuntu.com/security/CVE-2022-49822

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49822

Plugin Information
Published: 2025/08/15, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244987 - Linux Distros Unpatched Vulnerability : CVE-2022-49823
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ata: libata-transport: fix error handling in ata_tdev_add() In ata_tdev_add(), the return value of transport_add_device() is not checked. As a result, it causes null-ptr-deref while removing the module, because transport_remove_device() is called to remove the device that was not added. Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0 CPU: 13 PID: 13603 Comm: rmmod Kdump:
loaded Tainted: G W 6.1.0-rc3+ #36 pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc :
device_del+0x48/0x3a0 lr : device_del+0x44/0x3a0 Call trace: device_del+0x48/0x3a0 attribute_container_class_device_del+0x28/0x40 transport_remove_classdev+0x60/0x7c attribute_container_device_trigger+0x118/0x120 transport_remove_device+0x20/0x30 ata_tdev_delete+0x24/0x50 [libata] ata_tlink_delete+0x40/0xa0 [libata] ata_tport_delete+0x2c/0x60 [libata] ata_port_detach+0x148/0x1b0 [libata] ata_pci_remove_one+0x50/0x80 [libata] ahci_remove_one+0x4c/0x8c [ahci] Fix this by checking and handling return value of transport_add_device() in ata_tdev_add(). In the error path, device_del() is called to delete the device which was added earlier in this function, and ata_tdev_free() is called to free ata_dev. (CVE-2022-49823)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49823
https://ubuntu.com/security/CVE-2022-49823

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49823

Plugin Information
Published: 2025/08/07, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245742 - Linux Distros Unpatched Vulnerability : CVE-2022-49824
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ata: libata-transport: fix error handling in ata_tlink_add() In ata_tlink_add(), the return value of transport_add_device() is not checked. As a result, it causes null-ptr-deref while removing the module, because transport_remove_device() is called to remove the device that was not added. Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0 CPU: 33 PID: 13850 Comm: rmmod Kdump:
loaded Tainted: G W 6.1.0-rc3+ #12 pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc :
device_del+0x48/0x39c lr : device_del+0x44/0x39c Call trace: device_del+0x48/0x39c attribute_container_class_device_del+0x28/0x40 transport_remove_classdev+0x60/0x7c attribute_container_device_trigger+0x118/0x120 transport_remove_device+0x20/0x30 ata_tlink_delete+0x88/0xb0 [libata] ata_tport_delete+0x2c/0x60 [libata] ata_port_detach+0x148/0x1b0 [libata] ata_pci_remove_one+0x50/0x80 [libata] ahci_remove_one+0x4c/0x8c [ahci] Fix this by checking and handling return value of transport_add_device() in ata_tlink_add(). (CVE-2022-49824)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49824
https://ubuntu.com/security/CVE-2022-49824

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49824

Plugin Information
Published: 2025/08/08, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
252996 - Linux Distros Unpatched Vulnerability : CVE-2022-49825
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ata: libata-transport: fix error handling in ata_tport_add() In ata_tport_add(), the return value of transport_add_device() is not checked. As a result, it causes null-ptr-deref while removing the module, because transport_remove_device() is called to remove the device that was not added. Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0 CPU: 12 PID: 13605 Comm: rmmod Kdump:
loaded Tainted: G W 6.1.0-rc3+ #8 pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc :
device_del+0x48/0x39c lr : device_del+0x44/0x39c Call trace: device_del+0x48/0x39c attribute_container_class_device_del+0x28/0x40 transport_remove_classdev+0x60/0x7c attribute_container_device_trigger+0x118/0x120 transport_remove_device+0x20/0x30 ata_tport_delete+0x34/0x60 [libata] ata_port_detach+0x148/0x1b0 [libata] ata_pci_remove_one+0x50/0x80 [libata] ahci_remove_one+0x4c/0x8c [ahci] Fix this by checking and handling return value of transport_add_device() in ata_tport_add(). (CVE-2022-49825)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49825
https://ubuntu.com/security/CVE-2022-49825

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49825

Plugin Information
Published: 2025/08/20, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245879 - Linux Distros Unpatched Vulnerability : CVE-2022-49830
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/drv: Fix potential memory leak in drm_dev_init() drm_dev_init() will add drm_dev_init_release() as a callback. When drmm_add_action() failed, the release function won't be added. As the result, the ref cnt added by device_get() in drm_dev_init() won't be put by drm_dev_init_release(), which leads to the memleak. Use drmm_add_action_or_reset() instead of drmm_add_action() to prevent memleak. unreferenced object 0xffff88810bc0c800 (size 2048): comm modprobe, pid 8322, jiffies 4305809845 (age 15.292s) hex dump (first 32 bytes): e8 cc c0 0b 81 88 ff ff ff ff ff ff 00 00 00 00 ................ 20 24 3c 0c 81 88 ff ff 18 c8 c0 0b 81 88 ff ff $<............. backtrace: [<000000007251f72d>] __kmalloc+0x4b/0x1c0 [<0000000045f21f26>] platform_device_alloc+0x2d/0xe0 [<000000004452a479>] platform_device_register_full+0x24/0x1c0 [<0000000089f4ea61>] 0xffffffffa0736051 [<00000000235b2441>] do_one_initcall+0x7a/0x380 [<0000000001a4a177>] do_init_module+0x5c/0x230 [<000000002bf8a8e2>] load_module+0x227d/0x2420 [<00000000637d6d0a>] __do_sys_finit_module+0xd5/0x140 [<00000000c99fc324>] do_syscall_64+0x3f/0x90 [<000000004d85aa77>] entry_SYSCALL_64_after_hwframe+0x63/0xcd (CVE-2022-49830)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49830
https://ubuntu.com/security/CVE-2022-49830

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49830

Plugin Information
Published: 2025/08/08, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247641 - Linux Distros Unpatched Vulnerability : CVE-2022-49832
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map Here is the BUG report by KASAN about null pointer dereference: BUG: KASAN: null-ptr-deref in strcmp+0x2e/0x50 Read of size 1 at addr 0000000000000000 by task python3/2640 Call Trace: strcmp __of_find_property of_find_property pinctrl_dt_to_map kasprintf() would return NULL pointer when kmalloc() fail to allocate. So directly return ENOMEM, if kasprintf() return NULL pointer. (CVE-2022-49832)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49832
https://ubuntu.com/security/CVE-2022-49832

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49832

Plugin Information
Published: 2025/08/10, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250228 - Linux Distros Unpatched Vulnerability : CVE-2022-49835
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: hda: fix potential memleak in 'add_widget_node' As 'kobject_add' may allocated memory for 'kobject->name' when return error. And in this function, if call 'kobject_add' failed didn't free kobject.
So call 'kobject_put' to recycling resources. (CVE-2022-49835)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49835
https://ubuntu.com/security/CVE-2022-49835

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49835

Plugin Information
Published: 2025/08/15, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243887 - Linux Distros Unpatched Vulnerability : CVE-2022-49836
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: siox: fix possible memory leak in siox_device_add() If device_register() returns error in siox_device_add(), the name allocated by dev_set_name() need be freed. As comment of device_register() says, it should use put_device() to give up the reference in the error path. So fix this by calling put_device(), then the name can be freed in kobject_cleanup(), and sdevice is freed in siox_device_release(), set it to null in error path.
(CVE-2022-49836)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49836
https://ubuntu.com/security/CVE-2022-49836

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49836

Plugin Information
Published: 2025/08/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245092 - Linux Distros Unpatched Vulnerability : CVE-2022-49838
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sctp: clear out_curr if all frag chunks of current msg are pruned A crash was reported by Zhen Chen:
list_del corruption, ffffa035ddf01c18->next is NULL WARNING: CPU: 1 PID: 250682 at lib/list_debug.c:49
__list_del_entry_valid+0x59/0xe0 RIP: 0010:__list_del_entry_valid+0x59/0xe0 Call Trace:
sctp_sched_dequeue_common+0x17/0x70 [sctp] sctp_sched_fcfs_dequeue+0x37/0x50 [sctp] sctp_outq_flush_data+0x85/0x360 [sctp] sctp_outq_uncork+0x77/0xa0 [sctp] sctp_cmd_interpreter.constprop.0+0x164/0x1450 [sctp] sctp_side_effects+0x37/0xe0 [sctp] sctp_do_sm+0xd0/0x230 [sctp] sctp_primitive_SEND+0x2f/0x40 [sctp] sctp_sendmsg_to_asoc+0x3fa/0x5c0 [sctp] sctp_sendmsg+0x3d5/0x440 [sctp] sock_sendmsg+0x5b/0x70 and in sctp_sched_fcfs_dequeue() it dequeued a chunk from stream out_curr outq while this outq was empty. Normally stream->out_curr must be set to NULL once all frag chunks of current msg are dequeued, as we can see in sctp_sched_dequeue_done(). However, in sctp_prsctp_prune_unsent() as it is not a proper dequeue, sctp_sched_dequeue_done() is not called to do this. This patch is to fix it by simply setting out_curr to NULL when the last frag chunk of current msg is dequeued from out_curr stream in sctp_prsctp_prune_unsent(). (CVE-2022-49838)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49838
https://ubuntu.com/security/CVE-2022-49838

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49838

Plugin Information
Published: 2025/08/07, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248430 - Linux Distros Unpatched Vulnerability : CVE-2022-49847
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw: Fix segmentation fault at module unload Move am65_cpsw_nuss_phylink_cleanup() call to after am65_cpsw_nuss_cleanup_ndev() so phylink is still valid to prevent the below Segmentation fault on module remove when first slave link is up. [ 31.652944] Unable to handle kernel paging request at virtual address 00040008000005f4 [ 31.684627] Mem abort info: [ 31.687446] ESR = 0x0000000096000004 [ 31.704614] EC = 0x25: DABT (current EL), IL = 32 bits [ 31.720663] SET = 0, FnV = 0 [ 31.723729] EA = 0, S1PTW = 0 [ 31.740617] FSC = 0x04: level 0 translation fault [ 31.756624] Data abort info: [ 31.759508] ISV = 0, ISS = 0x00000004 [ 31.776705] CM = 0, WnR = 0 [ 31.779695] [00040008000005f4] address between user and kernel address ranges [ 31.808644] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 31.814928] Modules linked in: wlcore_sdio wl18xx wlcore mac80211 libarc4 cfg80211 rfkill crct10dif_ce phy_gmii_sel ti_am65_cpsw_nuss(-) sch_fq_codel ipv6 [ 31.828776] CPU: 0 PID: 1026 Comm: modprobe Not tainted 6.1.0-rc2-00012-gfabfcf7dafdb-dirty #160 [ 31.837547] Hardware name: Texas Instruments AM625 (DT) [ 31.842760] pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 31.849709] pc :
phy_stop+0x18/0xf8 [ 31.853202] lr : phylink_stop+0x38/0xf8 [ 31.857031] sp : ffff80000a0839f0 [ 31.860335] x29: ffff80000a0839f0 x28: ffff000000de1c80 x27: 0000000000000000 [ 31.867462] x26:
0000000000000000 x25: 0000000000000000 x24: ffff80000a083b98 [ 31.874589] x23: 0000000000000800 x22:
0000000000000001 x21: ffff000001bfba90 [ 31.881715] x20: ffff0000015ee000 x19: 0004000800000200 x18:
0000000000000000 [ 31.888842] x17: ffff800076c45000 x16: ffff800008004000 x15: 000058e39660b106 [ 31.895969] x14: 0000000000000144 x13: 0000000000000144 x12: 0000000000000000 [ 31.903095] x11:
000000000000275f x10: 00000000000009e0 x9 : ffff80000a0837d0 [ 31.910222] x8 : ffff000000de26c0 x7 :
ffff00007fbd6540 x6 : ffff00007fbd64c0 [ 31.917349] x5 : ffff00007fbd0b10 x4 : ffff00007fbd0b10 x3 :
ffff00007fbd3920 [ 31.924476] x2 : d0a07fcff8b8d500 x1 : 0000000000000000 x0 : 0004000800000200 [ 31.931603] Call trace: [ 31.934042] phy_stop+0x18/0xf8 [ 31.937177] phylink_stop+0x38/0xf8 [ 31.940657] am65_cpsw_nuss_ndo_slave_stop+0x28/0x1e0 [ti_am65_cpsw_nuss] [ 31.947452] __dev_close_many+0xa4/0x140 [ 31.951371] dev_close_many+0x84/0x128 [ 31.955115] unregister_netdevice_many+0x130/0x6d0 [ 31.959897] unregister_netdevice_queue+0x94/0xd8 [ 31.964591] unregister_netdev+0x24/0x38 [ 31.968504] am65_cpsw_nuss_cleanup_ndev.isra.0+0x48/0x70 [ti_am65_cpsw_nuss] [ 31.975637] am65_cpsw_nuss_remove+0x58/0xf8 [ti_am65_cpsw_nuss] (CVE-2022-49847)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49847
https://ubuntu.com/security/CVE-2022-49847

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49847

Plugin Information
Published: 2025/08/11, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249396 - Linux Distros Unpatched Vulnerability : CVE-2022-49858
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- octeontx2-pf: Fix SQE threshold checking Current way of checking available SQE count which is based on HW updated SQB count could result in driver submitting an SQE even before CQE for the previously transmitted SQE at the same index is processed in NAPI resulting losing SKB pointers, hence a leak. Fix this by checking a consumer index which is updated once CQE is processed. (CVE-2022-49858)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49858
https://security-tracker.debian.org/tracker/CVE-2022-49858
https://ubuntu.com/security/CVE-2022-49858

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49858

Plugin Information
Published: 2025/08/15, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245076 - Linux Distros Unpatched Vulnerability : CVE-2022-49863
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: can: af_can: fix NULL pointer dereference in can_rx_register() It causes NULL pointer dereference when testing as following: (a) use syscall(__NR_socket, 0x10ul, 3ul, 0) to create netlink socket. (b) use syscall(__NR_sendmsg, ...) to create bond link device and vxcan link device, and bind vxcan device to bond device (can also use ifenslave command to bind vxcan device to bond device). (c) use syscall(__NR_socket, 0x1dul, 3ul, 1) to create CAN socket. (d) use syscall(__NR_bind, ...) to bind the bond device to CAN socket. The bond device invokes the can-raw protocol registration interface to receive CAN packets. However, ml_priv is not allocated to the dev, dev_rcv_lists is assigned to NULL in can_rx_register(). In this case, it will occur the NULL pointer dereference issue. The following is the stack information: BUG: kernel NULL pointer dereference, address: 0000000000000008 PGD 122a4067 P4D 122a4067 PUD 1223c067 PMD 0 Oops: 0000 [#1] PREEMPT SMP RIP: 0010:can_rx_register+0x12d/0x1e0 Call Trace: <TASK> raw_enable_filters+0x8d/0x120 raw_enable_allfilters+0x3b/0x130 raw_bind+0x118/0x4f0 __sys_bind+0x163/0x1a0 __x64_sys_bind+0x1e/0x30 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> (CVE-2022-49863)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49863
https://ubuntu.com/security/CVE-2022-49863

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49863

Plugin Information
Published: 2025/08/07, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247681 - Linux Distros Unpatched Vulnerability : CVE-2022-49865
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network When copying a `struct ifaddrlblmsg` to the network, __ifal_reserved remained uninitialized, resulting in a 1-byte infoleak: BUG:
KMSAN: kernel-network-infoleak in __netdev_start_xmit ./include/linux/netdevice.h:4841 __netdev_start_xmit ./include/linux/netdevice.h:4841 netdev_start_xmit ./include/linux/netdevice.h:4857 xmit_one net/core/dev.c:3590 dev_hard_start_xmit+0x1dc/0x800 net/core/dev.c:3606 __dev_queue_xmit+0x17e8/0x4350 net/core/dev.c:4256 dev_queue_xmit ./include/linux/netdevice.h:3009 __netlink_deliver_tap_skb net/netlink/af_netlink.c:307 __netlink_deliver_tap+0x728/0xad0 net/netlink/af_netlink.c:325 netlink_deliver_tap net/netlink/af_netlink.c:338 __netlink_sendskb net/netlink/af_netlink.c:1263 netlink_sendskb+0x1d9/0x200 net/netlink/af_netlink.c:1272 netlink_unicast+0x56d/0xf50 net/netlink/af_netlink.c:1360 nlmsg_unicast ./include/net/netlink.h:1061 rtnl_unicast+0x5a/0x80 net/core/rtnetlink.c:758 ip6addrlbl_get+0xfad/0x10f0 net/ipv6/addrlabel.c:628 rtnetlink_rcv_msg+0xb33/0x1570 net/core/rtnetlink.c:6082 ... Uninit was created at:
slab_post_alloc_hook+0x118/0xb00 mm/slab.h:742 slab_alloc_node mm/slub.c:3398
__kmem_cache_alloc_node+0x4f2/0x930 mm/slub.c:3437 __do_kmalloc_node mm/slab_common.c:954
__kmalloc_node_track_caller+0x117/0x3d0 mm/slab_common.c:975 kmalloc_reserve net/core/skbuff.c:437
__alloc_skb+0x27a/0xab0 net/core/skbuff.c:509 alloc_skb ./include/linux/skbuff.h:1267 nlmsg_new ./include/net/netlink.h:964 ip6addrlbl_get+0x490/0x10f0 net/ipv6/addrlabel.c:608 rtnetlink_rcv_msg+0xb33/0x1570 net/core/rtnetlink.c:6082 netlink_rcv_skb+0x299/0x550 net/netlink/af_netlink.c:2540 rtnetlink_rcv+0x26/0x30 net/core/rtnetlink.c:6109 netlink_unicast_kernel net/netlink/af_netlink.c:1319 netlink_unicast+0x9ab/0xf50 net/netlink/af_netlink.c:1345 netlink_sendmsg+0xebc/0x10f0 net/netlink/af_netlink.c:1921 ... This patch ensures that the reserved field is always initialized. (CVE-2022-49865)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49865
https://ubuntu.com/security/CVE-2022-49865

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49865

Plugin Information
Published: 2025/08/10, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245283 - Linux Distros Unpatched Vulnerability : CVE-2022-49866
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhi: fix memory leak in mhi_mbim_dellink MHI driver registers network device without setting the needs_free_netdev flag, and does NOT call free_netdev() when unregisters network device, which causes a memory leak. This patch sets needs_free_netdev to true when registers network device, which makes netdev subsystem call free_netdev() automatically after unregister_netdevice(). (CVE-2022-49866)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49866
https://ubuntu.com/security/CVE-2022-49866

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49866

Plugin Information
Published: 2025/08/07, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249489 - Linux Distros Unpatched Vulnerability : CVE-2022-49867
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: fix memory leak in ipc_wwan_dellink IOSM driver registers network device without setting the needs_free_netdev flag, and does NOT call free_netdev() when unregisters network device, which causes a memory leak. This patch sets needs_free_netdev to true when registers network device, which makes netdev subsystem call free_netdev() automatically after unregister_netdevice(). (CVE-2022-49867)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49867
https://ubuntu.com/security/CVE-2022-49867

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49867

Plugin Information
Published: 2025/08/15, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244180 - Linux Distros Unpatched Vulnerability : CVE-2022-49871
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: tun: Fix memory leaks of napi_get_frags kmemleak reports after running test_progs: unreferenced object 0xffff8881b1672dc0 (size 232): comm test_progs, pid 394388, jiffies 4354712116 (age 841.975s) hex dump (first 32 bytes): e0 84 d7 a8 81 88 ff ff 80 2c 67 b1 81 88 ff ff .........,g..... 00 40 c5 9b 81 88 ff ff 00 00 00 00 00 00 00 00 .@.............. backtrace: [<00000000c8f01748>] napi_skb_cache_get+0xd4/0x150 [<0000000041c7fc09>]
__napi_build_skb+0x15/0x50 [<00000000431c7079>] __napi_alloc_skb+0x26e/0x540 [<000000003ecfa30e>] napi_get_frags+0x59/0x140 [<0000000099b2199e>] tun_get_user+0x183d/0x3bb0 [tun] [<000000008a5adef0>] tun_chr_write_iter+0xc0/0x1b1 [tun] [<0000000049993ff4>] do_iter_readv_writev+0x19f/0x320 [<000000008f338ea2>] do_iter_write+0x135/0x630 [<000000008a3377a4>] vfs_writev+0x12e/0x440 [<00000000a6b5639a>] do_writev+0x104/0x280 [<00000000ccf065d8>] do_syscall_64+0x3b/0x90 [<00000000d776e329>] entry_SYSCALL_64_after_hwframe+0x63/0xcd The issue occurs in the following scenarios:
tun_get_user() napi_gro_frags() napi_frags_finish() case GRO_NORMAL: gro_normal_one() list_add_tail(&skb->list, &napi->rx_list); <-- While napi->rx_count < READ_ONCE(gro_normal_batch), <-- gro_normal_list() is not called, napi->rx_list is not empty <-- not ask to complete the gro work, will cause memory leaks in <-- following tun_napi_del() ... tun_napi_del() netif_napi_del() __netif_napi_del() <-- &napi->rx_list is not empty, which caused memory leaks To fix, add napi_complete() after napi_gro_frags(). (CVE-2022-49871)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49871
https://ubuntu.com/security/CVE-2022-49871

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49871

Plugin Information
Published: 2025/08/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250034 - Linux Distros Unpatched Vulnerability : CVE-2022-49874
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- HID: hyperv: fix possible memory leak in mousevsc_probe() If hid_add_device() returns error, it should call hid_destroy_device() to free hid_dev which is allocated in hid_allocate_device(). (CVE-2022-49874)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49874
https://ubuntu.com/security/CVE-2022-49874

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49874

Plugin Information
Published: 2025/08/15, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250145 - Linux Distros Unpatched Vulnerability : CVE-2022-49876
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix general- protection-fault in ieee80211_subif_start_xmit() When device is running and the interface status is changed, the gpf issue is triggered. The problem triggering process is as follows: Thread A: Thread B ieee80211_runtime_change_iftype() process_one_work() ... ... ieee80211_do_stop() ... ... ... sdata->bss = NULL ... ... ieee80211_subif_start_xmit() ieee80211_multicast_to_unicast //!sdata->bss->multicast_to_unicast cause gpf issue When the interface status is changed, the sending queue continues to send packets. After the bss is set to NULL, the bss is accessed. As a result, this causes a general-protection-fault issue. The following is the stack information: general protection fault, probably for non-canonical address 0xdffffc000000002f: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000178-0x000000000000017f] Workqueue: mld mld_ifc_work RIP:
0010:ieee80211_subif_start_xmit+0x25b/0x1310 Call Trace: <TASK> dev_hard_start_xmit+0x1be/0x990
__dev_queue_xmit+0x2c9a/0x3b60 ip6_finish_output2+0xf92/0x1520 ip6_finish_output+0x6af/0x11e0 ip6_output+0x1ed/0x540 mld_sendpack+0xa09/0xe70 mld_ifc_work+0x71c/0xdb0 process_one_work+0x9bf/0x1710 worker_thread+0x665/0x1080 kthread+0x2e4/0x3a0 ret_from_fork+0x1f/0x30 </TASK> (CVE-2022-49876)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49876
https://ubuntu.com/security/CVE-2022-49876

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49876

Plugin Information
Published: 2025/08/15, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248624 - Linux Distros Unpatched Vulnerability : CVE-2022-49879
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: fix BUG_ON() when directory entry has invalid rec_len The rec_len field in the directory entry has to be a multiple of 4. A corrupted filesystem image can be used to hit a BUG() in ext4_rec_len_to_disk(), called from make_indexed_dir(). ------------[ cut here ]------------ kernel BUG at fs/ext4/ext4.h:2413! ... RIP: 0010:make_indexed_dir+0x53f/0x5f0 ... Call Trace: <TASK> ? add_dirent_to_buf+0x1b2/0x200 ext4_add_entry+0x36e/0x480 ext4_add_nondir+0x2b/0xc0 ext4_create+0x163/0x200 path_openat+0x635/0xe90 do_filp_open+0xb4/0x160 ? __create_object.isra.0+0x1de/0x3b0 ? _raw_spin_unlock+0x12/0x30 do_sys_openat2+0x91/0x150 __x64_sys_open+0x6c/0xa0 do_syscall_64+0x3c/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The fix simply adds a call to ext4_check_dir_entry() to validate the directory entry, returning -EFSCORRUPTED if the entry is invalid. (CVE-2022-49879)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49879
https://ubuntu.com/security/CVE-2022-49879

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49879

Plugin Information
Published: 2025/08/12, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247212 - Linux Distros Unpatched Vulnerability : CVE-2022-49880
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: fix warning in 'ext4_da_release_space' Syzkaller report issue as follows: EXT4-fs (loop0):
Free/Dirty block details EXT4-fs (loop0): free_blocks=0 EXT4-fs (loop0): dirty_blocks=0 EXT4-fs (loop0):
Block reservation details EXT4-fs (loop0): i_reserved_data_blocks=0 EXT4-fs warning (device loop0):
ext4_da_release_space:1527: ext4_da_release_space: ino 18, to_free 1 with only 0 reserved data blocks
------------[ cut here ]------------ WARNING: CPU: 0 PID: 92 at fs/ext4/inode.c:1528 ext4_da_release_space+0x25e/0x370 fs/ext4/inode.c:1524 Modules linked in: CPU: 0 PID: 92 Comm:
kworker/u4:4 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Workqueue: writeback wb_workfn (flush-7:0) RIP:
0010:ext4_da_release_space+0x25e/0x370 fs/ext4/inode.c:1528 RSP: 0018:ffffc900015f6c90 EFLAGS: 00010296 RAX: 42215896cd52ea00 RBX: 0000000000000000 RCX: 42215896cd52ea00 RDX: 0000000000000000 RSI:
0000000080000001 RDI: 0000000000000000 RBP: 1ffff1100e907d96 R08: ffffffff816aa79d R09: fffff520002bece5 R10: fffff520002bece5 R11: 1ffff920002bece4 R12: ffff888021fd2000 R13: ffff88807483ecb0 R14:
0000000000000001 R15: ffff88807483e740 FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005555569ba628 CR3:
000000000c88e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK>
ext4_es_remove_extent+0x1ab/0x260 fs/ext4/extents_status.c:1461 mpage_release_unused_pages+0x24d/0xef0 fs/ext4/inode.c:1589 ext4_writepages+0x12eb/0x3be0 fs/ext4/inode.c:2852 do_writepages+0x3c3/0x680 mm/page- writeback.c:2469 __writeback_single_inode+0xd1/0x670 fs/fs-writeback.c:1587 writeback_sb_inodes+0xb3b/0x18f0 fs/fs-writeback.c:1870 wb_writeback+0x41f/0x7b0 fs/fs-writeback.c:2044 wb_do_writeback fs/fs-writeback.c:2187 [inline] wb_workfn+0x3cb/0xef0 fs/fs-writeback.c:2227 process_one_work+0x877/0xdb0 kernel/workqueue.c:2289 worker_thread+0xb14/0x1330 kernel/workqueue.c:2436 kthread+0x266/0x300 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 </TASK>
Above issue may happens as follows: ext4_da_write_begin ext4_create_inline_data ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS); ext4_set_inode_flag(inode, EXT4_INODE_INLINE_DATA);
__ext4_ioctl ext4_ext_migrate -> will lead to eh->eh_entries not zero, and set extent flag ext4_da_write_begin ext4_da_convert_inline_data_to_extent ext4_da_write_inline_data_begin ext4_da_map_blocks ext4_insert_delayed_block if (!ext4_es_scan_clu(inode, &ext4_es_is_delonly, lblk)) if (!ext4_es_scan_clu(inode, &ext4_es_is_mapped, lblk)) ext4_clu_mapped(inode, EXT4_B2C(sbi, lblk)); -> will return 1 allocated = true; ext4_es_insert_delayed_block(inode, lblk, allocated); ext4_writepages mpage_map_and_submit_extent(handle, &mpd, &give_up_on_write); -> return -ENOSPC mpage_release_unused_pages(&mpd, give_up_on_write); -> give_up_on_write == 1 ext4_es_remove_extent ext4_da_release_space(inode, reserved); if (unlikely(to_free > ei->i_reserved_data_blocks)) -> to_free == 1 but ei->i_reserved_data_blocks == 0 -> then trigger warning as above To solve above issue, forbid inode do migrate which has inline data. (CVE-2022-49880)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49880
https://ubuntu.com/security/CVE-2022-49880

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49880

Plugin Information
Published: 2025/08/10, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248838 - Linux Distros Unpatched Vulnerability : CVE-2022-49881
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix memory leak in query_regdb_file() In the function query_regdb_file() the alpha2 parameter is duplicated using kmemdup() and subsequently freed in regdb_fw_cb(). However, request_firmware_nowait() can fail without calling regdb_fw_cb() and thus leak memory. (CVE-2022-49881)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49881
https://ubuntu.com/security/CVE-2022-49881

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49881

Plugin Information
Published: 2025/08/12, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250061 - Linux Distros Unpatched Vulnerability : CVE-2022-49889
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Check for NULL cpu_buffer in ring_buffer_wake_waiters() On some machines the number of listed CPUs may be bigger than the actual CPUs that exist. The tracing subsystem allocates a per_cpu directory with access to the per CPU ring buffer via a cpuX file. But to save space, the ring buffer will only allocate buffers for online CPUs, even though the CPU array will be as big as the nr_cpu_ids. With the addition of waking waiters on the ring buffer when closing the file, the ring_buffer_wake_waiters() now needs to make sure that the buffer is allocated (with the irq_work allocated with it) before trying to wake waiters, as it will cause a NULL pointer dereference. While debugging this, I added a NULL check for the buffer itself (which is OK to do), and also NULL pointer checks against buffer->buffers (which is not fine, and will WARN) as well as making sure the CPU number passed in is within the nr_cpu_ids (which is also not fine if it isn't). Bugzilla:
https://bugzilla.opensuse.org/show_bug.cgi?id=1204705 (CVE-2022-49889)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49889
https://ubuntu.com/security/CVE-2022-49889

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49889

Plugin Information
Published: 2025/08/15, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247949 - Linux Distros Unpatched Vulnerability : CVE-2022-49891
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tracing: kprobe: Fix memory leak in test_gen_kprobe/kretprobe_cmd() test_gen_kprobe_cmd() only free buf in fail path, hence buf will leak when there is no failure. Move kfree(buf) from fail path to common path to prevent the memleak. The same reason and solution in test_gen_kretprobe_cmd(). unreferenced object 0xffff888143b14000 (size 2048): comm insmod, pid 52490, jiffies 4301890980 (age 40.553s) hex dump (first 32 bytes): 70 3a 6b 70 72 6f 62 65 73 2f 67 65 6e 5f 6b 70 p:kprobes/gen_kp 72 6f 62 65 5f 74 65 73 74 20 64 6f 5f 73 79 73 robe_test do_sys backtrace: [<000000006d7b836b>] kmalloc_trace+0x27/0xa0 [<0000000009528b5b>] 0xffffffffa059006f [<000000008408b580>] do_one_initcall+0x87/0x2a0 [<00000000c4980a7e>] do_init_module+0xdf/0x320 [<00000000d775aad0>] load_module+0x3006/0x3390 [<00000000e9a74b80>] __do_sys_finit_module+0x113/0x1b0 [<000000003726480d>] do_syscall_64+0x35/0x80 [<000000003441e93b>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 (CVE-2022-49891)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49891
https://ubuntu.com/security/CVE-2022-49891

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49891

Plugin Information
Published: 2025/08/11, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246292 - Linux Distros Unpatched Vulnerability : CVE-2022-49893
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix cxl_region leak, cleanup targets at region delete When a region is deleted any targets that have been previously assigned to that region hold references to it. Trigger those references to drop by detaching all targets at unregister_region() time. Otherwise that region object will leak as userspace has lost the ability to detach targets once region sysfs is torn down. (CVE-2022-49893)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49893
https://ubuntu.com/security/CVE-2022-49893

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49893

Plugin Information
Published: 2025/08/08, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244532 - Linux Distros Unpatched Vulnerability : CVE-2022-49894
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix region HPA ordering validation Some regions may not have any address space allocated. Skip them when validating HPA order otherwise a crash like the following may result: devm_cxl_add_region: cxl_acpi cxl_acpi.0: decoder3.4:
created region9 BUG: kernel NULL pointer dereference, address: 0000000000000000 [..] RIP:
0010:store_targetN+0x655/0x1740 [cxl_core] [..] Call Trace: <TASK> kernfs_fop_write_iter+0x144/0x200 vfs_write+0x24a/0x4d0 ksys_write+0x69/0xf0 do_syscall_64+0x3a/0x90 store_targetN+0x655/0x1740:
alloc_region_ref at drivers/cxl/core/region.c:676 (inlined by) cxl_port_attach_region at drivers/cxl/core/region.c:850 (inlined by) cxl_region_attach at drivers/cxl/core/region.c:1290 (inlined by) attach_target at drivers/cxl/core/region.c:1410 (inlined by) store_targetN at drivers/cxl/core/region.c:1453 (CVE-2022-49894)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49894
https://ubuntu.com/security/CVE-2022-49894

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49894

Plugin Information
Published: 2025/08/07, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249544 - Linux Distros Unpatched Vulnerability : CVE-2022-49895
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix decoder allocation crash When an intermediate port's decoders have been exhausted by existing regions, and creating a new region with the port in question in it's hierarchical path is attempted, cxl_port_attach_region() fails to find a port decoder (as would be expected), and drops into the failure / cleanup path. However, during cleanup of the region reference, a sanity check attempts to dereference the decoder, which in the above case didn't exist. This causes a NULL pointer dereference BUG. To fix this, refactor the decoder allocation and de-allocation into helper routines, and in this 'free' routine, check that the decoder, @cxld, is valid before attempting any operations on it. (CVE-2022-49895)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49895
https://ubuntu.com/security/CVE-2022-49895

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49895

Plugin Information
Published: 2025/08/15, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246860 - Linux Distros Unpatched Vulnerability : CVE-2022-49896
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cxl/pmem: Fix cxl_pmem_region and cxl_memdev leak When a cxl_nvdimm object goes through a ->remove() event (device physically removed, nvdimm-bridge disabled, or nvdimm device disabled), then any associated regions must also be disabled. As highlighted by the cxl-create-region.sh test [1], a single device may host multiple regions, but the driver was only tracking one region at a time. This leads to a situation where only the last enabled region per nvdimm device is cleaned up properly. Other regions are leaked, and this also causes cxl_memdev reference leaks. Fix the tracking by allowing cxl_nvdimm objects to track multiple region associations.
(CVE-2022-49896)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49896
https://ubuntu.com/security/CVE-2022-49896

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49896

Plugin Information
Published: 2025/08/09, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245621 - Linux Distros Unpatched Vulnerability : CVE-2022-49900
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- i2c: piix4: Fix adapter not be removed in piix4_remove() In piix4_probe(), the piix4 adapter will be registered in: piix4_probe() piix4_add_adapters_sb800() / piix4_add_adapter() i2c_add_adapter() Based on the probed device type, piix4_add_adapters_sb800() or single piix4_add_adapter() will be called. For the former case, piix4_adapter_count is set as the number of adapters, while for antoher case it is not set and kept default *zero*. When piix4 is removed, piix4_remove() removes the adapters added in piix4_probe(), basing on the piix4_adapter_count value. Because the count is zero for the single adapter case, the adapter won't be removed and makes the sources allocated for adapter leaked, such as the i2c client and device. These sources can still be accessed by i2c or bus and cause problems. An easily reproduced case is that if a new adapter is registered, i2c will get the leaked adapter and try to call smbus_algorithm, which was already freed: Triggered by: rmmod i2c_piix4 && modprobe max31730 BUG: unable to handle page fault for address: ffffffffc053d860 #PF: supervisor read access in kernel mode #PF:
error_code(0x0000) - not-present page Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 3752 Comm: modprobe Tainted: G Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:i2c_default_probe (drivers/i2c/i2c-core-base.c:2259) i2c_core RSP: 0018:ffff888107477710 EFLAGS: 00000246 ... <TASK>
i2c_detect (drivers/i2c/i2c-core-base.c:2302) i2c_core __process_new_driver (drivers/i2c/i2c-core- base.c:1336) i2c_core bus_for_each_dev (drivers/base/bus.c:301) i2c_for_each_dev (drivers/i2c/i2c-core- base.c:1823) i2c_core i2c_register_driver (drivers/i2c/i2c-core-base.c:1861) i2c_core do_one_initcall (init/main.c:1296) do_init_module (kernel/module/main.c:2455) ... </TASK> ---[ end trace 0000000000000000 ]--- Fix this problem by correctly set piix4_adapter_count as 1 for the single adapter so it can be normally removed. (CVE-2022-49900)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49900
https://ubuntu.com/security/CVE-2022-49900

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49900

Plugin Information
Published: 2025/08/08, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248777 - Linux Distros Unpatched Vulnerability : CVE-2022-49901
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- blk-mq: Fix kmemleak in blk_mq_init_allocated_queue There is a kmemleak caused by modprobe null_blk.ko unreferenced object 0xffff8881acb1f000 (size 1024): comm modprobe, pid 836, jiffies 4294971190 (age 27.068s) hex dump (first 32 bytes): 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... ff ff ff ff ff ff ff ff 00 53 99 9e ff ff ff ff .........S...... backtrace: [<000000004a10c249>] kmalloc_node_trace+0x22/0x60 [<00000000648f7950>] blk_mq_alloc_and_init_hctx+0x289/0x350 [<00000000af06de0e>] blk_mq_realloc_hw_ctxs+0x2fe/0x3d0 [<00000000e00c1872>] blk_mq_init_allocated_queue+0x48c/0x1440 [<00000000d16b4e68>] __blk_mq_alloc_disk+0xc8/0x1c0 [<00000000d10c98c3>] 0xffffffffc450d69d [<00000000b9299f48>] 0xffffffffc4538392 [<0000000061c39ed6>] do_one_initcall+0xd0/0x4f0 [<00000000b389383b>] do_init_module+0x1a4/0x680 [<0000000087cf3542>] load_module+0x6249/0x7110 [<00000000beba61b8>] __do_sys_finit_module+0x140/0x200 [<00000000fdcfff51>] do_syscall_64+0x35/0x80 [<000000003c0f1f71>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 That is because q->ma_ops is set to NULL before blk_release_queue is called. blk_mq_init_queue_data blk_mq_init_allocated_queue blk_mq_realloc_hw_ctxs for (i = 0; i < set->nr_hw_queues; i++) { old_hctx = xa_load(&q->hctx_table, i); if (!blk_mq_alloc_and_init_hctx(.., i, ..)) [1] if (!old_hctx) break;
xa_for_each_start(&q->hctx_table, j, hctx, j) blk_mq_exit_hctx(q, set, hctx, j); [2] if (!q->nr_hw_queues) [3] goto err_hctxs; err_exit: q->mq_ops = NULL; [4] blk_put_queue blk_release_queue if (queue_is_mq(q)) [5] blk_mq_release(q); [1]: blk_mq_alloc_and_init_hctx failed at i != 0. [2]: The hctxs allocated by [1] are moved to q->unused_hctx_list and will be cleaned up in blk_mq_release. [3]: q->nr_hw_queues is 0. [4]:
Set q->mq_ops to NULL. [5]: queue_is_mq returns false due to [4]. And blk_mq_release will not be called.
The hctxs in q->unused_hctx_list are leaked. To fix it, call blk_release_queue in exception path.
(CVE-2022-49901)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49901
https://security-tracker.debian.org/tracker/CVE-2022-49901
https://ubuntu.com/security/CVE-2022-49901

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49901

Plugin Information
Published: 2025/08/12, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243900 - Linux Distros Unpatched Vulnerability : CVE-2022-49905
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/smc: Fix possible leaked pernet namespace in smc_init() In smc_init(), register_pernet_subsys(&smc_net_stat_ops) is called without any error handling. If it fails, registering of &smc_net_ops won't be reverted. And if smc_nl_init() fails, &smc_net_stat_ops itself won't be reverted. This leaves wild ops in subsystem linkedlist and when another module tries to call register_pernet_operations() it triggers page fault: BUG: unable to handle page fault for address: fffffbfff81b964c RIP: 0010:register_pernet_operations+0x1b9/0x5f0 Call Trace: <TASK>
register_pernet_subsys+0x29/0x40 ebtables_init+0x58/0x1000 [ebtables] ... (CVE-2022-49905)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49905
https://ubuntu.com/security/CVE-2022-49905

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49905

Plugin Information
Published: 2025/08/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249648 - Linux Distros Unpatched Vulnerability : CVE-2022-49906
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Free rwi on reset success Free the rwi structure in the event that the last rwi in the list processed successfully. The logic in commit 4f408e1fa6e1 (ibmvnic: retry reset if there are no other resets) introduces an issue that results in a 32 byte memory leak whenever the last rwi in the list gets processed. (CVE-2022-49906)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49906
https://ubuntu.com/security/CVE-2022-49906

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49906

Plugin Information
Published: 2025/08/15, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244014 - Linux Distros Unpatched Vulnerability : CVE-2022-49915
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mISDN: fix possible memory leak in mISDN_register_device() Afer commit 1fa5ae857bb1 (driver core: get rid of struct device's bus_id string array), the name of device is allocated dynamically, add put_device() to give up the reference, so that the name can be freed in kobject_cleanup() when the refcount is 0. Set device class before put_device() to avoid null release() function WARN message in device_release().
(CVE-2022-49915)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49915
https://ubuntu.com/security/CVE-2022-49915

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49915

Plugin Information
Published: 2025/08/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245294 - Linux Distros Unpatched Vulnerability : CVE-2022-49917
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipvs: fix WARNING in ip_vs_app_net_cleanup() During the initialization of ip_vs_app_net_init(), if file ip_vs_app fails to be created, the initialization is successful by default. Therefore, the ip_vs_app file doesn't be found during the remove in ip_vs_app_net_cleanup(). It will cause WRNING. The following is the stack information: name 'ip_vs_app' WARNING: CPU: 1 PID: 9 at fs/proc/generic.c:712 remove_proc_entry+0x389/0x460 Modules linked in: Workqueue: netns cleanup_net RIP:
0010:remove_proc_entry+0x389/0x460 Call Trace: <TASK> ops_exit_list+0x125/0x170 cleanup_net+0x4ea/0xb00 process_one_work+0x9bf/0x1710 worker_thread+0x665/0x1080 kthread+0x2e4/0x3a0 ret_from_fork+0x1f/0x30 </TASK> (CVE-2022-49917)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49917
https://ubuntu.com/security/CVE-2022-49917

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49917

Plugin Information
Published: 2025/08/07, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247000 - Linux Distros Unpatched Vulnerability : CVE-2022-49928
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix null-ptr-deref when xps sysfs alloc failed There is a null-ptr-deref when xps sysfs alloc failed: BUG: KASAN: null-ptr-deref in sysfs_do_create_link_sd+0x40/0xd0 Read of size 8 at addr 0000000000000030 by task gssproxy/457 CPU: 5 PID:
457 Comm: gssproxy Not tainted 6.0.0-09040-g02357b27ee03 #9 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 kasan_report+0xa3/0x120 sysfs_do_create_link_sd+0x40/0xd0 rpc_sysfs_client_setup+0x161/0x1b0 rpc_new_client+0x3fc/0x6e0 rpc_create_xprt+0x71/0x220 rpc_create+0x1d4/0x350 gssp_rpc_create+0xc3/0x160 set_gssp_clnt+0xbc/0x140 write_gssp+0x116/0x1a0 proc_reg_write+0xd6/0x130 vfs_write+0x177/0x690 ksys_write+0xb9/0x150 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 When the xprt_switch sysfs alloc failed, should not add xprt and switch sysfs to it, otherwise, maybe null-ptr- deref; also initialize the 'xps_sysfs' to NULL to avoid oops when destroy it. (CVE-2022-49928)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49928
https://ubuntu.com/security/CVE-2022-49928

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49928

Plugin Information
Published: 2025/08/09, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246975 - Linux Distros Unpatched Vulnerability : CVE-2022-49931
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Correctly move list in sc_disable() Commit 13bac861952a (IB/hfi1: Fix abba locking issue with sc_disable()) incorrectly tries to move a list from one list head to another. The result is a kernel crash. The crash is triggered when a link goes down and there are waiters for a send to complete. The following signature is seen: BUG: kernel NULL pointer dereference, address: 0000000000000030 [...] Call Trace: sc_disable+0x1ba/0x240 [hfi1] pio_freeze+0x3d/0x60 [hfi1] handle_freeze+0x27/0x1b0 [hfi1] process_one_work+0x1b0/0x380 ? process_one_work+0x380/0x380 worker_thread+0x30/0x360 ? process_one_work+0x380/0x380 kthread+0xd7/0x100 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 The fix is to use the correct call to move the list. (CVE-2022-49931)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49931
https://ubuntu.com/security/CVE-2022-49931

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49931

Plugin Information
Published: 2025/08/09, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246249 - Linux Distros Unpatched Vulnerability : CVE-2022-49932
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- KVM: VMX: Do _all_ initialization before exposing /dev/kvm to userspace Call kvm_init() only after _all_ setup is complete, as kvm_init() exposes /dev/kvm to userspace and thus allows userspace to create VMs (and call other ioctls). E.g. KVM will encounter a NULL pointer when attempting to add a vCPU to the per- CPU loaded_vmcss_on_cpu list if userspace is able to create a VM before vmx_init() configures said list.
BUG: kernel NULL pointer dereference, address: 0000000000000008 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP CPU: 6 PID: 1143 Comm:
stable Not tainted 6.0.0-rc7+ #988 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:vmx_vcpu_load_vmcs+0x68/0x230 [kvm_intel] <TASK> vmx_vcpu_load+0x16/0x60 [kvm_intel] kvm_arch_vcpu_load+0x32/0x1f0 [kvm] vcpu_load+0x2f/0x40 [kvm] kvm_arch_vcpu_create+0x231/0x310 [kvm] kvm_vm_ioctl+0x79f/0xe10 [kvm] ? handle_mm_fault+0xb1/0x220 __x64_sys_ioctl+0x80/0xb0 do_syscall_64+0x2b/0x50 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f5a6b05743b </TASK> Modules linked in: vhost_net vhost vhost_iotlb tap kvm_intel(+) kvm irqbypass (CVE-2022-49932)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49932
https://security-tracker.debian.org/tracker/CVE-2022-49932
https://ubuntu.com/security/CVE-2022-49932

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49932

Plugin Information
Published: 2025/08/08, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246076 - Linux Distros Unpatched Vulnerability : CVE-2022-49949
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Fix memory leak in firmware upload In the case of firmware-upload, an instance of struct fw_upload is allocated in firmware_upload_register(). This data needs to be freed in fw_dev_release(). Create a new fw_upload_free() function in sysfs_upload.c to handle the firmware-upload specific memory frees and incorporate the missing kfree call for the fw_upload structure. (CVE-2022-49949)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49949
https://ubuntu.com/security/CVE-2022-49949

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49949

Plugin Information
Published: 2025/08/08, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245152 - Linux Distros Unpatched Vulnerability : CVE-2022-49967
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Fix a data-race around bpf_jit_limit. While reading bpf_jit_limit, it can be changed concurrently via sysctl, WRITE_ONCE() in __do_proc_doulongvec_minmax(). The size of bpf_jit_limit is long, so we need to add a paired READ_ONCE() to avoid load-tearing. (CVE-2022-49967)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49967
https://security-tracker.debian.org/tracker/CVE-2022-49967
https://ubuntu.com/security/CVE-2022-49967

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49967

Plugin Information
Published: 2025/08/07, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248872 - Linux Distros Unpatched Vulnerability : CVE-2022-49972
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: xsk: Fix corrupted packets for XDP_SHARED_UMEM Fix an issue in XDP_SHARED_UMEM mode together with aligned mode where packets are corrupted for the second and any further sockets bound to the same umem. In other words, this does not affect the first socket bound to the umem. The culprit for this bug is that the initialization of the DMA addresses for the pre-populated xsk buffer pool entries was not performed for any socket but the first one bound to the umem. Only the linear array of DMA addresses was populated. Fix this by populating the DMA addresses in the xsk buffer pool for every socket bound to the same umem. (CVE-2022-49972)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49972
https://ubuntu.com/security/CVE-2022-49972

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-49972

Plugin Information
Published: 2025/08/12, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249062 - Linux Distros Unpatched Vulnerability : CVE-2022-49982
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- media: pvrusb2: fix memory leak in pvr_probe The error handling code in pvr2_hdw_create forgets to unregister the v4l2 device. When pvr2_hdw_create returns back to pvr2_context_create, it calls pvr2_context_destroy to destroy context, but mp->hdw is NULL, which leads to that pvr2_hdw_destroy directly returns. Fix this by adding v4l2_device_unregister to decrease the refcount of usb interface.
(CVE-2022-49982)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49982
https://ubuntu.com/security/CVE-2022-49982

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49982

Plugin Information
Published: 2025/08/12, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246361 - Linux Distros Unpatched Vulnerability : CVE-2022-49989
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xen/privcmd: fix error exit of privcmd_ioctl_dm_op() The error exit of privcmd_ioctl_dm_op() is calling unlock_pages() potentially with pages being NULL, leading to a NULL dereference. Additionally lock_pages() doesn't check for pin_user_pages_fast() having been completely successful, resulting in potentially not locking all pages into memory. This could result in sporadic failures when using the related memory in user mode. Fix all of that by calling unlock_pages() always with the real number of pinned pages, which will be zero in case pages being NULL, and by checking the number of pages pinned by pin_user_pages_fast() matching the expected number of pages. (CVE-2022-49989)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49989
https://ubuntu.com/security/CVE-2022-49989

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49989

Plugin Information
Published: 2025/08/08, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
253769 - Linux Distros Unpatched Vulnerability : CVE-2022-50008
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- kprobes: don't call disarm_kprobe() for disabled kprobes The assumption in __disable_kprobe() is wrong, and it could try to disarm an already disarmed kprobe and fire the WARN_ONCE() below. [0] We can easily reproduce this issue. 1. Write 0 to /sys/kernel/debug/kprobes/enabled. # echo 0 >
/sys/kernel/debug/kprobes/enabled 2. Run execsnoop. At this time, one kprobe is disabled. # /usr/share/bcc/tools/execsnoop & [1] 2460 PCOMM PID PPID RET ARGS # cat /sys/kernel/debug/kprobes/list ffffffff91345650 r __x64_sys_execve+0x0 [FTRACE] ffffffff91345650 k __x64_sys_execve+0x0 [DISABLED][FTRACE] 3. Write 1 to /sys/kernel/debug/kprobes/enabled, which changes kprobes_all_disarmed to false but does not arm the disabled kprobe. # echo 1 > /sys/kernel/debug/kprobes/enabled # cat /sys/kernel/debug/kprobes/list ffffffff91345650 r __x64_sys_execve+0x0 [FTRACE] ffffffff91345650 k
__x64_sys_execve+0x0 [DISABLED][FTRACE] 4. Kill execsnoop, when __disable_kprobe() calls disarm_kprobe() for the disabled kprobe and hits the WARN_ONCE() in __disarm_kprobe_ftrace(). # fg /usr/share/bcc/tools/execsnoop ^C Actually, WARN_ONCE() is fired twice, and __unregister_kprobe_top() misses some cleanups and leaves the aggregated kprobe in the hash table. Then, __unregister_trace_kprobe() initialises tk->rp.kp.list and creates an infinite loop like this. aggregated kprobe.list -> kprobe.list
-. ^ | '.__.' In this situation, these commands fall into the infinite loop and result in RCU stall or soft lockup. cat /sys/kernel/debug/kprobes/list : show_kprobe_addr() enters into the infinite loop with RCU. /usr/share/bcc/tools/execsnoop : warn_kprobe_rereg() holds kprobe_mutex, and __get_valid_kprobe() is stuck in the loop. To avoid the issue, make sure we don't call disarm_kprobe() for disabled kprobes. [0] Failed to disarm kprobe-ftrace at __x64_sys_execve+0x0/0x40 (error -2) WARNING: CPU: 6 PID: 2460 at kernel/kprobes.c:1130 __disarm_kprobe_ftrace.isra.19 (kernel/kprobes.c:1129) Modules linked in: ena CPU: 6 PID: 2460 Comm: execsnoop Not tainted 5.19.0+ #28 Hardware name: Amazon EC2 c5.2xlarge/, BIOS 1.0 10/16/2017 RIP: 0010:__disarm_kprobe_ftrace.isra.19 (kernel/kprobes.c:1129) Code: 24 8b 02 eb c1 80 3d c4 83 f2 01 00 75 d4 48 8b 75 00 89 c2 48 c7 c7 90 fa 0f 92 89 04 24 c6 05 ab 83 01 e8 e4 94 f0 ff <0f> 0b 8b 04 24 eb b1 89 c6 48 c7 c7 60 fa 0f 92 89 04 24 e8 cc 94 RSP: 0018:ffff9e6ec154bd98 EFLAGS: 00010282 RAX:
0000000000000000 RBX: ffffffff930f7b00 RCX: 0000000000000001 RDX: 0000000080000001 RSI: ffffffff921461c5 RDI: 00000000ffffffff RBP: ffff89c504286da8 R08: 0000000000000000 R09: c0000000fffeffff R10:
0000000000000000 R11: ffff9e6ec154bc28 R12: ffff89c502394e40 R13: ffff89c502394c00 R14: ffff9e6ec154bc00 R15: 0000000000000000 FS: 00007fe800398740(0000) GS:ffff89c812d80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000c00057f010 CR3: 0000000103b54006 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6:
00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> __disable_kprobe (kernel/kprobes.c:1716) disable_kprobe (kernel/kprobes.c:2392) __disable_trace_kprobe (kernel/trace/trace_kprobe.c:340) disable_trace_kprobe (kernel/trace/trace_kprobe.c:429) perf_trace_event_unreg.isra.2 (./include/linux/tracepoint.h:93 kernel/trace/trace_event_perf.c:168) perf_kprobe_destroy (kernel/trace/trace_event_perf.c:295) _free_event (kernel/events/core.c:4971) perf_event_release_kernel (kernel/events/core.c:5176) perf_release (kernel/events/core.c:5186) __fput (fs/file_table.c:321) task_work_run (./include/linux/ ---truncated--- (CVE-2022-50008)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50008
https://ubuntu.com/security/CVE-2022-50008

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50008

Plugin Information
Published: 2025/08/24, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
252972 - Linux Distros Unpatched Vulnerability : CVE-2022-50012
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- powerpc/64: Init jump labels before parse_early_param() On 64-bit, calling jump_label_init() in setup_feature_keys() is too late because static keys may be used in subroutines of parse_early_param() which is again subroutine of early_init_devtree(). For example booting with threadirqs:
static_key_enable_cpuslocked(): static key '0xc000000002953260' used before call to jump_label_init() WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:166 static_key_enable_cpuslocked+0xfc/0x120 ... NIP static_key_enable_cpuslocked+0xfc/0x120 LR static_key_enable_cpuslocked+0xf8/0x120 Call Trace:
static_key_enable_cpuslocked+0xf8/0x120 (unreliable) static_key_enable+0x30/0x50 setup_forced_irqthreads+0x28/0x40 do_early_param+0xa0/0x108 parse_args+0x290/0x4e0 parse_early_options+0x48/0x5c parse_early_param+0x58/0x84 early_init_devtree+0xd4/0x518 early_setup+0xb4/0x214 So call jump_label_init() just before parse_early_param() in early_init_devtree().
[mpe: Add call trace to change log and minor wording edits.] (CVE-2022-50012)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50012
https://ubuntu.com/security/CVE-2022-50012

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50012

Plugin Information
Published: 2025/08/20, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244108 - Linux Distros Unpatched Vulnerability : CVE-2022-50025
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cxl: Fix a memory leak in an error handling path A bitmap_zalloc() must be balanced by a corresponding bitmap_free() in the error handling path of afu_allocate_irqs(). (CVE-2022-50025)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50025
https://ubuntu.com/security/CVE-2022-50025

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50025

Plugin Information
Published: 2025/08/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250171 - Linux Distros Unpatched Vulnerability : CVE-2022-50043
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: fix potential refcount leak in ndisc_router_discovery() The issue happens on specific paths in the function. After both the object `rt` and `neigh` are grabbed successfully, when `lifetime` is nonzero but the metric needs change, the function just deletes the route and set `rt` to NULL. Then, it may try grabbing `rt` and `neigh` again if above conditions hold. The function simply overwrite `neigh` if succeeds or returns if fails, without decreasing the reference count of previous `neigh`. This may result in memory leaks. Fix it by decrementing the reference count of `neigh` in place. (CVE-2022-50043)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50043
https://ubuntu.com/security/CVE-2022-50043

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50043

Plugin Information
Published: 2025/08/15, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248106 - Linux Distros Unpatched Vulnerability : CVE-2022-50045
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: powerpc/pci: Fix get_phb_number() locking The recent change to get_phb_number() causes a DEBUG_ATOMIC_SLEEP warning on some systems: BUG:
sleeping function called from invalid context at kernel/locking/mutex.c:580 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 1 lock held by swapper/1: #0: c157efb0 (hose_spinlock){+.+.}-{2:2}, at:
pcibios_alloc_controller+0x64/0x220 Preemption disabled at: [<00000000>] 0x0 CPU: 0 PID: 1 Comm: swapper Not tainted 5.19.0-yocto-standard+ #1 Call Trace: [d101dc90] [c073b264] dump_stack_lvl+0x50/0x8c (unreliable) [d101dcb0] [c0093b70] __might_resched+0x258/0x2a8 [d101dcd0] [c0d3e634]
__mutex_lock+0x6c/0x6ec [d101dd50] [c0a84174] of_alias_get_id+0x50/0xf4 [d101dd80] [c002ec78] pcibios_alloc_controller+0x1b8/0x220 [d101ddd0] [c140c9dc] pmac_pci_init+0x198/0x784 [d101de50] [c140852c] discover_phbs+0x30/0x4c [d101de60] [c0007fd4] do_one_initcall+0x94/0x344 [d101ded0] [c1403b40] kernel_init_freeable+0x1a8/0x22c [d101df10] [c00086e0] kernel_init+0x34/0x160 [d101df30] [c001b334] ret_from_kernel_thread+0x5c/0x64 This is because pcibios_alloc_controller() holds hose_spinlock but of_alias_get_id() takes of_mutex which can sleep. The hose_spinlock protects the phb_bitmap, and also the hose_list, but it doesn't need to be held while get_phb_number() calls the OF routines, because those are only looking up information in the device tree. So fix it by having get_phb_number() take the hose_spinlock itself, only where required, and then dropping the lock before returning.
pcibios_alloc_controller() then needs to take the lock again before the list_add() but that's safe, the order of the list is not important. (CVE-2022-50045)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50045
https://ubuntu.com/security/CVE-2022-50045

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50045

Plugin Information
Published: 2025/08/11, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248932 - Linux Distros Unpatched Vulnerability : CVE-2022-50059
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ceph: don't leak snap_rwsem in handle_cap_grant When handle_cap_grant is called on an IMPORT op, then the snap_rwsem is held and the function is expected to release it before returning. It currently fails to do that in all cases which could lead to a deadlock. (CVE-2022-50059)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50059
https://ubuntu.com/security/CVE-2022-50059

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50059

Plugin Information
Published: 2025/08/12, Modified: 2025/11/13
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
253793 - Linux Distros Unpatched Vulnerability : CVE-2022-50060
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- octeontx2-af: Fix mcam entry resource leak The teardown sequence in FLR handler returns if no NIX LF is attached to PF/VF because it indicates that graceful shutdown of resources already happened. But there is a chance of all allocated MCAM entries not being freed by PF/VF. Hence free mcam entries even in case of detached LF. (CVE-2022-50060)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50060
https://security-tracker.debian.org/tracker/CVE-2022-50060
https://ubuntu.com/security/CVE-2022-50060

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50060

Plugin Information
Published: 2025/08/24, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244131 - Linux Distros Unpatched Vulnerability : CVE-2022-50065
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- virtio_net: fix memory leak inside XPD_TX with mergeable When we call xdp_convert_buff_to_frame() to get xdpf, if it returns NULL, we should check if xdp_page was allocated by xdp_linearize_page(). If it is newly allocated, it should be freed here alone. Just like any other goto err_xdp. (CVE-2022-50065)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50065
https://ubuntu.com/security/CVE-2022-50065

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50065

Plugin Information
Published: 2025/08/06, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243830 - Linux Distros Unpatched Vulnerability : CVE-2022-50098
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts Ensure SRB is returned during I/O timeout error escalation. If that is not possible fail the escalation path. Following crash stack was seen: BUG: unable to handle kernel paging request at 0000002f56aa90f8 IP:
qla_chk_edif_rx_sa_delete_pending+0x14/0x30 [qla2xxx] Call Trace: ? qla2x00_status_entry+0x19f/0x1c50 [qla2xxx] ? qla2x00_start_sp+0x116/0x1170 [qla2xxx] ? dma_pool_alloc+0x1d6/0x210 ? mempool_alloc+0x54/0x130 ? qla24xx_process_response_queue+0x548/0x12b0 [qla2xxx] ? qla_do_work+0x2d/0x40 [qla2xxx] ? process_one_work+0x14c/0x390 (CVE-2022-50098)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50098
https://security-tracker.debian.org/tracker/CVE-2022-50098
https://ubuntu.com/security/CVE-2022-50098

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50098

Plugin Information
Published: 2025/08/05, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246633 - Linux Distros Unpatched Vulnerability : CVE-2022-50118
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: powerpc/perf: Optimize clearing the pending PMI and remove WARN_ON for PMI check in power_pmu_disable commit 2c9ac51b850d (powerpc/perf: Fix PMU callbacks to clear pending PMI before resetting an overflown PMC) added a new function pmi_irq_pending in hw_irq.h. This function is to check if there is a PMI marked as pending in Paca (PACA_IRQ_PMI).This is used in power_pmu_disable in a WARN_ON. The intention here is to provide a warning if there is PMI pending, but no counter is found overflown. During some of the perf runs, below warning is hit: WARNING: CPU: 36 PID: 0 at arch/powerpc/perf/core-book3s.c:1332 power_pmu_disable+0x25c/0x2c0 Modules linked in: ----- NIP [c000000000141c3c] power_pmu_disable+0x25c/0x2c0 LR [c000000000141c8c] power_pmu_disable+0x2ac/0x2c0 Call Trace: [c000000baffcfb90] [c000000000141c8c] power_pmu_disable+0x2ac/0x2c0 (unreliable) [c000000baffcfc10] [c0000000003e2f8c] perf_pmu_disable+0x4c/0x60 [c000000baffcfc30] [c0000000003e3344] group_sched_out.part.124+0x44/0x100 [c000000baffcfc80] [c0000000003e353c] __perf_event_disable+0x13c/0x240 [c000000baffcfcd0] [c0000000003dd334] event_function+0xc4/0x140 [c000000baffcfd20] [c0000000003d855c] remote_function+0x7c/0xa0 [c000000baffcfd50] [c00000000026c394] flush_smp_call_function_queue+0xd4/0x300 [c000000baffcfde0] [c000000000065b24] smp_ipi_demux_relaxed+0xa4/0x100 [c000000baffcfe20] [c0000000000cb2b0] xive_muxed_ipi_action+0x20/0x40 [c000000baffcfe40] [c000000000207c3c]
__handle_irq_event_percpu+0x8c/0x250 [c000000baffcfee0] [c000000000207e2c] handle_irq_event_percpu+0x2c/0xa0 [c000000baffcff10] [c000000000210a04] handle_percpu_irq+0x84/0xc0 [c000000baffcff40] [c000000000205f14] generic_handle_irq+0x54/0x80 [c000000baffcff60] [c000000000015740]
__do_irq+0x90/0x1d0 [c000000baffcff90] [c000000000016990] __do_IRQ+0xc0/0x140 [c0000009732f3940] [c000000bafceaca8] 0xc000000bafceaca8 [c0000009732f39d0] [c000000000016b78] do_IRQ+0x168/0x1c0 [c0000009732f3a00] [c0000000000090c8] hardware_interrupt_common_virt+0x218/0x220 This means that there is no PMC overflown among the active events in the PMU, but there is a PMU pending in Paca. The function any_pmc_overflown checks the PMCs on active events in cpuhw->n_events. Code snippet: <<>> if (any_pmc_overflown(cpuhw)) clear_pmi_irq_pending(); else WARN_ON(pmi_irq_pending()); <<>> Here the PMC overflown is not from active event. Example: When we do perf record, default cycles and instructions will be running on PMC6 and PMC5 respectively. It could happen that overflowed event is currently not active and pending PMI is for the inactive event. Debug logs from trace_printk: <<>> any_pmc_overflown: idx is 5:
pmc value is 0xd9a power_pmu_disable: PMC1: 0x0, PMC2: 0x0, PMC3: 0x0, PMC4: 0x0, PMC5: 0xd9a, PMC6:
0x80002011 <<>> Here active PMC (from idx) is PMC5 , but overflown PMC is PMC6(0x80002011). When we handle PMI interrupt for such cases, if the PMC overflown is from inactive event, it will be ignored. Reference commit: commit bc09c219b2e6 (powerpc/perf: Fix finding overflowed PMC in interrupt) Patch addresses two changes: 1) Fix 1 : Removal of warning ( WARN_ON(pmi_irq_pending()); ) We were printing warning if no PMC is found overflown among active PMU events, but PMI pending in PACA. But this could happen in cases where PMC overflown is not in active PMC. An inactive event could have caused the overflow. Hence the warning is not needed. To know pending PMI is from an inactive event, we need to loop through all PMC's which will cause more SPR reads via mfspr and increase in context switch. Also in existing function:
perf_event_interrupt, already we ignore PMI's overflown when it is from an inactive PMC. 2) Fix 2:
optimization in clearing pending PMI. Currently we check for any active PMC overflown before clearing PMI pending in Paca. This is causing additional SP ---truncated--- (CVE-2022-50118)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50118
https://ubuntu.com/security/CVE-2022-50118

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50118

Plugin Information
Published: 2025/08/09, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249759 - Linux Distros Unpatched Vulnerability : CVE-2022-50130
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: staging: fbtft: core: set smem_len before fb_deferred_io_init call The fbtft_framebuffer_alloc() calls fb_deferred_io_init() before initializing info->fix.smem_len. It is set to zero by the framebuffer_alloc() function. It will trigger a WARN_ON() at the start of fb_deferred_io_init() and the function will not do anything. (CVE-2022-50130)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50130
https://ubuntu.com/security/CVE-2022-50130

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-50130

Plugin Information
Published: 2025/08/15, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
253012 - Linux Distros Unpatched Vulnerability : CVE-2022-50134
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: fix potential memory leak in setup_base_ctxt() setup_base_ctxt() allocates a memory chunk for uctxt->groups with hfi1_alloc_ctxt_rcv_groups(). When init_user_ctxt() fails, uctxt->groups is not released, which will lead to a memory leak. We should release the uctxt->groups with hfi1_free_ctxt_rcv_groups() when init_user_ctxt() fails. (CVE-2022-50134)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50134
https://ubuntu.com/security/CVE-2022-50134

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50134

Plugin Information
Published: 2025/08/20, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247883 - Linux Distros Unpatched Vulnerability : CVE-2022-50141
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.
of_node_put() checks null pointer. (CVE-2022-50141)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50141
https://ubuntu.com/security/CVE-2022-50141

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50141

Plugin Information
Published: 2025/08/11, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245184 - Linux Distros Unpatched Vulnerability : CVE-2022-50144
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- soundwire: revisit driver bind/unbind and callbacks In the SoundWire probe, we store a pointer from the driver ops into the 'slave' structure. This can lead to kernel oopses when unbinding codec drivers, e.g.
with the following sequence to remove machine driver and codec driver. /sbin/modprobe -r snd_soc_sof_sdw /sbin/modprobe -r snd_soc_rt711 The full details can be found in the BugLink below, for reference the two following examples show different cases of driver ops/callbacks being invoked after the driver .remove().
kernel: BUG: kernel NULL pointer dereference, address: 0000000000000150 kernel: Workqueue: events cdns_update_slave_status_work [soundwire_cadence] kernel: RIP: 0010:mutex_lock+0x19/0x30 kernel: Call Trace: kernel: ? sdw_handle_slave_status+0x426/0xe00 [soundwire_bus 94ff184bf398570c3f8ff7efe9e32529f532e4ae] kernel: ? newidle_balance+0x26a/0x400 kernel: ? cdns_update_slave_status_work+0x1e9/0x200 [soundwire_cadence 1bcf98eebe5ba9833cd433323769ac923c9c6f82] kernel: BUG: unable to handle page fault for address: ffffffffc07654c8 kernel: Workqueue: pm pm_runtime_work kernel: RIP: 0010:sdw_bus_prep_clk_stop+0x6f/0x160 [soundwire_bus] kernel: Call Trace:
kernel: <TASK> kernel: sdw_cdns_clock_stop+0xb5/0x1b0 [soundwire_cadence 1bcf98eebe5ba9833cd433323769ac923c9c6f82] kernel: intel_suspend_runtime+0x5f/0x120 [soundwire_intel aca858f7c87048d3152a4a41bb68abb9b663a1dd] kernel: ? dpm_sysfs_remove+0x60/0x60 This was not detected earlier in Intel tests since the tests first remove the parent PCI device and shut down the bus. The sequence above is a corner case which keeps the bus operational but without a driver bound. While trying to solve this kernel oopses, it became clear that the existing SoundWire bus does not deal well with the unbind case. Commit 528be501b7d4a (soundwire: sdw_slave: add probe_complete structure and new fields) added a 'probed' status variable and a 'probe_complete' struct completion. This status is however not reset on remove and likewise the 'probe complete' is not re-initialized, so the bind/unbind/bind test cases would fail. The timeout used before the 'update_status' callback was also a bad idea in hindsight, there should really be no timing assumption as to if and when a driver is bound to a device. An initial draft was based on device_lock() and device_unlock() was tested. This proved too complicated, with deadlocks created during the suspend-resume sequences, which also use the same device_lock/unlock() as the bind/unbind sequences. On a CometLake device, a bad DSDT/BIOS caused spurious resumes and the use of device_lock() caused hangs during suspend. After multiple weeks or testing and painful reverse-engineering of deadlocks on different devices, we looked for alternatives that did not interfere with the device core.
A bus notifier was used successfully to keep track of DRIVER_BOUND and DRIVER_UNBIND events. This solved the bind-unbind-bind case in tests, but it can still be defeated with a theoretical corner case where the memory is freed by a .remove while the callback is in use. The notifier only helps make sure the driver callbacks are valid, but not that the memory allocated in probe remains valid while the callbacks are invoked. This patch suggests the introduction of a new 'sdw_dev_lock' mutex protecting probe/remove and all driver callbacks. Since this mutex is 'local' to SoundWire only, it does not interfere with existing locks and does not create deadlocks. In addition, this patch removes the 'probe_complete' completion, instead we directly invoke the 'update_status' from the probe routine. That removes any sort of timing dependency and a much better support for the device/driver model, the driver could be bound before the bus started, or eons after the bus started and the hardware would be properly initialized in all cases.
BugLink: https://github.com/thesofproject/linux/is ---truncated--- (CVE-2022-50144)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50144
https://security-tracker.debian.org/tracker/CVE-2022-50144
https://ubuntu.com/security/CVE-2022-50144

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50144

Plugin Information
Published: 2025/08/07, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246389 - Linux Distros Unpatched Vulnerability : CVE-2022-50170
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: kunit: executor: Fix a memory leak on failure in kunit_filter_tests It's possible that memory allocation for 'filtered' will fail, but for the copy of the suite to succeed. In this case, the copy could be leaked. Properly free 'copy' in the error case for the allocation of 'filtered' failing. Note that there may also have been a similar issue in kunit_filter_subsuites, before it was removed in kunit: flatten kunit_suite*** to kunit_suite** in .kunit_test_suites. This was reported by clang-analyzer via the kernel test robot, here:
https://lore.kernel.org/all/c8073b8e-7b9e-0830-4177-87c12f16349c@intel.com/ And by smatch via Dan Carpenter and the kernel test robot: https://lore.kernel.org/all/202207101328.ASjx88yj-lkp@intel.com/ (CVE-2022-50170)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50170
https://ubuntu.com/security/CVE-2022-50170

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-50170

Plugin Information
Published: 2025/08/08, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246900 - Linux Distros Unpatched Vulnerability : CVE-2022-50174
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: hinic: avoid kernel hung in hinic_get_stats64() When using hinic device as a bond slave device, and reading device stats of master bond device, the kernel may hung. The kernel panic calltrace as follows:
Kernel panic - not syncing: softlockup: hung tasks Call trace:
native_queued_spin_lock_slowpath+0x1ec/0x31c dev_get_stats+0x60/0xcc dev_seq_printf_stats+0x40/0x120 dev_seq_show+0x1c/0x40 seq_read_iter+0x3c8/0x4dc seq_read+0xe0/0x130 proc_reg_read+0xa8/0xe0 vfs_read+0xb0/0x1d4 ksys_read+0x70/0xfc __arm64_sys_read+0x20/0x30 el0_svc_common+0x88/0x234 do_el0_svc+0x2c/0x90 el0_svc+0x1c/0x30 el0_sync_handler+0xa8/0xb0 el0_sync+0x148/0x180 And the calltrace of task that actually caused kernel hungs as follows: __switch_to+124 __schedule+548 schedule+72 schedule_timeout+348 __down_common+188 __down+24 down+104 hinic_get_stats64+44 [hinic] dev_get_stats+92 bond_get_stats+172 [bonding] dev_get_stats+92 dev_seq_printf_stats+60 dev_seq_show+24 seq_read_iter+964 seq_read+220 proc_reg_read+164 vfs_read+172 ksys_read+108 __arm64_sys_read+28 el0_svc_common+132 do_el0_svc+40 el0_svc+24 el0_sync_handler+164 el0_sync+324 When getting device stats from bond, kernel will call bond_get_stats(). It first holds the spinlock bond->stats_lock, and then call hinic_get_stats64() to collect hinic device's stats. However, hinic_get_stats64() calls `down(&nic_dev->mgmt_lock)` to protect its critical section, which may schedule current task out. And if system is under high pressure, the task cannot be woken up immediately, which eventually triggers kernel hung panic. Since previous patch has replaced hinic_dev.tx_stats/rx_stats with local variable in hinic_get_stats64(), there is nothing need to be protected by lock, so just removing down()/up() is ok.
(CVE-2022-50174)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50174
https://ubuntu.com/security/CVE-2022-50174

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50174

Plugin Information
Published: 2025/08/09, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246646 - Linux Distros Unpatched Vulnerability : CVE-2022-50176
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/mcde: Fix refcount leak in mcde_dsi_bind Every iteration of for_each_available_child_of_node() decrements the reference counter of the previous node. There is no decrement when break out from the loop and results in refcount leak. Add missing of_node_put() to fix this. (CVE-2022-50176)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50176
https://ubuntu.com/security/CVE-2022-50176

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50176

Plugin Information
Published: 2025/08/09, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248816 - Linux Distros Unpatched Vulnerability : CVE-2022-50186
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ath11k: fix missing skb drop on htc_tx_completion error On htc_tx_completion error the skb is not dropped. This is wrong since the completion_handler logic expect the skb to be consumed anyway even when an error is triggered. Not freeing the skb on error is a memory leak since the skb won't be freed anywere else. Correctly free the packet on eid >= ATH11K_HTC_EP_COUNT before returning. Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1 (CVE-2022-50186)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50186
https://ubuntu.com/security/CVE-2022-50186

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-50186

Plugin Information
Published: 2025/08/12, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244347 - Linux Distros Unpatched Vulnerability : CVE-2022-50218
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: iio: light: isl29028: Fix the warning in isl29028_remove() The driver use the non-managed form of the register function in isl29028_remove(). To keep the release order as mirroring the ordering in probe, the driver should use non-managed form in probe, too. The following log reveals it: [ 32.374955] isl29028 0-0010: remove [ 32.376861] general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN PTI [ 32.377676] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [ 32.379432] RIP:
0010:kernfs_find_and_get_ns+0x28/0xe0 [ 32.385461] Call Trace: [ 32.385807] sysfs_unmerge_group+0x59/0x110 [ 32.386110] dpm_sysfs_remove+0x58/0xc0 [ 32.386391] device_del+0x296/0xe50 [ 32.386959] cdev_device_del+0x1d/0xd0 [ 32.387231] devm_iio_device_unreg+0x27/0xb0 [ 32.387542] devres_release_group+0x319/0x3d0 [ 32.388162] i2c_device_remove+0x93/0x1f0 (CVE-2022-50218)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50218
https://ubuntu.com/security/CVE-2022-50218

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50218

Plugin Information
Published: 2025/08/06, Modified: 2025/11/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246757 - Linux Distros Unpatched Vulnerability : CVE-2022-50226
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- crypto: ccp - Use kzalloc for sev ioctl interfaces to prevent kernel memory leak For some sev ioctl interfaces, input may be passed that is less than or equal to SEV_FW_BLOB_MAX_SIZE, but larger than the data that PSP firmware returns. In this case, kmalloc will allocate memory that is the size of the input rather than the size of the data. Since PSP firmware doesn't fully overwrite the buffer, the sev ioctl interfaces with the issue may return uninitialized slab memory. Currently, all of the ioctl interfaces in the ccp driver are safe, but to prevent future problems, change all ioctl interfaces that allocate memory with kmalloc to use kzalloc and memset the data buffer to zero in sev_ioctl_do_platform_status.
(CVE-2022-50226)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50226
https://ubuntu.com/security/CVE-2022-50226

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50226

Plugin Information
Published: 2025/08/09, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247362 - Linux Distros Unpatched Vulnerability : CVE-2022-50230
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- arm64: set UXN on swapper page tables [ This issue was fixed upstream by accident in c3cee924bd85 (arm64:
head: cover entire kernel image in initial ID map) as part of a large refactoring of the arm64 boot flow.
This simple fix is therefore preferred for -stable backporting ] On a system that implements FEAT_EPAN, read/write access to the idmap is denied because UXN is not set on the swapper PTEs. As a result, idmap_kpti_install_ng_mappings panics the kernel when accessing __idmap_kpti_flag. Fix it by setting UXN on these PTEs. (CVE-2022-50230)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50230
https://ubuntu.com/security/CVE-2022-50230

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50230

Plugin Information
Published: 2025/08/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244099 - Linux Distros Unpatched Vulnerability : CVE-2022-50232
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- arm64: set UXN on swapper page tables [ This issue was fixed upstream by accident in c3cee924bd85 (arm64:
head: cover entire kernel image in initial ID map) as part of a large refactoring of the arm64 boot flow.
This simple fix is therefore preferred for -stable backporting ] On a system that implements FEAT_EPAN, read/write access to the idmap is denied because UXN is not set on the swapper PTEs. As a result, idmap_kpti_install_ng_mappings panics the kernel when accessing __idmap_kpti_flag. Fix it by setting UXN on these PTEs. (CVE-2022-50232)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50232
https://ubuntu.com/security/CVE-2022-50232

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50232

Plugin Information
Published: 2025/08/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
251183 - Linux Distros Unpatched Vulnerability : CVE-2022-50233
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} Both dev_name and short_name are not guaranteed to be NULL terminated so this instead use strnlen and then attempt to determine if the resulting string needs to be truncated or not. (CVE-2022-50233)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50233
https://security-tracker.debian.org/tracker/CVE-2022-50233
https://ubuntu.com/security/CVE-2022-50233

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-50233

Plugin Information
Published: 2025/08/18, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264985 - Linux Distros Unpatched Vulnerability : CVE-2022-50244
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() If device_register() fails in cxl_pci_afu|adapter(), the device is not added, device_unregister() can not be called in the error path, otherwise it will cause a null-ptr-deref because of removing not added device. As comment of device_register() says, it should use put_device() to give up the reference in the error path. So split device_unregister() into device_del() and put_device(), then goes to put dev when register fails.
(CVE-2022-50244)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50244
https://ubuntu.com/security/CVE-2022-50244

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50244

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265030 - Linux Distros Unpatched Vulnerability : CVE-2022-50255
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tracing: Fix reading strings from synthetic events The follow commands caused a crash: # cd /sys/kernel/tracing # echo 's:open char file[]' > dynamic_events # echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' >
events/syscalls/sys_enter_openat/trigger' # echo 1 > events/synthetic/open/enable BOOM! The problem is that the synthetic event field char file[] will read the value given to it as a string without any memory checks to make sure the address is valid. The above example will pass in the user space address and the sythetic event code will happily call strlen() on it and then strscpy() where either one will cause an oops when accessing user space addresses. Use the helper functions from trace_kprobe and trace_eprobe that can read strings safely (and actually succeed when the address is from user space and the memory is mapped in). Now the above can show: packagekitd-1721 [000] ...2. 104.597170: open:
file=/usr/lib/rpm/fileattrs/cmake.attr in:imjournal-978 [006] ...2. 104.599642: open:
file=/var/lib/rsyslog/imjournal.state.tmp packagekitd-1721 [000] ...2. 104.626308: open:
file=/usr/lib/rpm/fileattrs/debuginfo.attr (CVE-2022-50255)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50255
https://security-tracker.debian.org/tracker/CVE-2022-50255
https://ubuntu.com/security/CVE-2022-50255

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
6.6 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50255

Plugin Information
Published: 2025/09/16, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264986 - Linux Distros Unpatched Vulnerability : CVE-2022-50266
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- kprobes: Fix check for probe enabled in kill_kprobe() In kill_kprobe(), the check whether disarm_kprobe_ftrace() needs to be called always fails. This is because before that we set the KPROBE_FLAG_GONE flag for kprobe so that !kprobe_disabled(p) is always false. The disarm_kprobe_ftrace() call introduced by commit: 0cb2f1372baa (kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler) to fix the NULL pointer reference problem. When the probe is enabled, if we do not disarm it, this problem still exists. Fix it by putting the probe enabled check before setting the KPROBE_FLAG_GONE flag.
(CVE-2022-50266)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50266
https://security-tracker.debian.org/tracker/CVE-2022-50266
https://ubuntu.com/security/CVE-2022-50266

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50266

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265009 - Linux Distros Unpatched Vulnerability : CVE-2022-50267
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mmc: rtsx_pci: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and calling mmc_free_host() in the error path, beside, runtime PM also needs be disabled. (CVE-2022-50267)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50267
https://security-tracker.debian.org/tracker/CVE-2022-50267
https://ubuntu.com/security/CVE-2022-50267

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50267

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265254 - Linux Distros Unpatched Vulnerability : CVE-2022-50278
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- PNP: fix name memory leak in pnp_alloc_dev() After commit 1fa5ae857bb1 (driver core: get rid of struct device's bus_id string array), the name of device is allocated dynamically, move dev_set_name() after pnp_add_id() to avoid memory leak. (CVE-2022-50278)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50278
https://ubuntu.com/security/CVE-2022-50278

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50278

Plugin Information
Published: 2025/09/17, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265034 - Linux Distros Unpatched Vulnerability : CVE-2022-50282
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- chardev: fix error handling in cdev_device_add() While doing fault injection test, I got the following report: ------------[ cut here ]------------ kobject: '(null)' (0000000039956980): is not initialized, yet kobject_put() is being called. WARNING: CPU: 3 PID: 6306 at kobject_put+0x23d/0x4e0 CPU: 3 PID: 6306 Comm:
283 Tainted: G W 6.1.0-rc2-00005-g307c1086d7c9 #1253 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:kobject_put+0x23d/0x4e0 Call Trace: <TASK>
cdev_device_add+0x15e/0x1b0 __iio_device_register+0x13b4/0x1af0 [industrialio]
__devm_iio_device_register+0x22/0x90 [industrialio] max517_probe+0x3d8/0x6b4 [max517] i2c_device_probe+0xa81/0xc00 When device_add() is injected fault and returns error, if dev->devt is not set, cdev_add() is not called, cdev_del() is not needed. Fix this by checking dev->devt in error path.
(CVE-2022-50282)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50282
https://ubuntu.com/security/CVE-2022-50282

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50282

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264968 - Linux Distros Unpatched Vulnerability : CVE-2022-50285
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages The h->*_huge_pages counters are protected by the hugetlb_lock, but alloc_huge_page has a corner case where it can decrement the counter outside of the lock. This could lead to a corrupted value of h->resv_huge_pages, which we have observed on our systems. Take the hugetlb_lock before decrementing h->resv_huge_pages to avoid a potential race.
(CVE-2022-50285)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50285
https://ubuntu.com/security/CVE-2022-50285

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50285

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264995 - Linux Distros Unpatched Vulnerability : CVE-2022-50286
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline When converting files with inline data to extents, delayed allocations made on a file system created with both the bigalloc and inline options can result in invalid extent status cache content, incorrect reserved cluster counts, kernel memory leaks, and potential kernel panics. With bigalloc, the code that determines whether a block must be delayed allocated searches the extent tree to see if that block maps to a previously allocated cluster. If not, the block is delayed allocated, and otherwise, it isn't. However, if the inline option is also used, and if the file containing the block is marked as able to store data inline, there isn't a valid extent tree associated with the file. The current code in ext4_clu_mapped() calls ext4_find_extent() to search the non-existent tree for a previously allocated cluster anyway, which typically finds nothing, as desired. However, a side effect of the search can be to cache invalid content from the non-existent tree (garbage) in the extent status tree, including bogus entries in the pending reservation tree. To fix this, avoid searching the extent tree when allocating blocks for bigalloc + inline files that are being converted from inline to extent mapped. (CVE-2022-50286)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50286
https://ubuntu.com/security/CVE-2022-50286

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.4
EPSS Score
0.0002
References

CVE | CVE-2022-50286

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265204 - Linux Distros Unpatched Vulnerability : CVE-2022-50304
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mtd: core: fix possible resource leak in init_mtd() I got the error report while inject fault in init_mtd(): sysfs: cannot create duplicate filename '/devices/virtual/bdi/mtd-0' Call Trace: <TASK>
dump_stack_lvl+0x67/0x83 sysfs_warn_dup+0x60/0x70 sysfs_create_dir_ns+0x109/0x120 kobject_add_internal+0xce/0x2f0 kobject_add+0x98/0x110 device_add+0x179/0xc00 device_create_groups_vargs+0xf4/0x100 device_create+0x7b/0xb0 bdi_register_va.part.13+0x58/0x2d0 bdi_register+0x9b/0xb0 init_mtd+0x62/0x171 [mtd] do_one_initcall+0x6c/0x3c0 do_init_module+0x58/0x222 load_module+0x268e/0x27d0 __do_sys_finit_module+0xd5/0x140 do_syscall_64+0x37/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> kobject_add_internal failed for mtd-0 with -EEXIST, don't try to register things with the same name in the same directory. Error registering mtd class or bdi: -17 If init_mtdchar() fails in init_mtd(), mtd_bdi will not be unregistered, as a result, we can't load the mtd module again, to fix this by calling bdi_unregister(mtd_bdi) after out_procfs label. (CVE-2022-50304)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50304
https://security-tracker.debian.org/tracker/CVE-2022-50304
https://ubuntu.com/security/CVE-2022-50304

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50304

Plugin Information
Published: 2025/09/17, Modified: 2025/12/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264923 - Linux Distros Unpatched Vulnerability : CVE-2022-50308
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: Add checks for devm_kcalloc As the devm_kcalloc may return NULL, the return value needs to be checked to avoid NULL poineter dereference. (CVE-2022-50308)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50308
https://ubuntu.com/security/CVE-2022-50308

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50308

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264953 - Linux Distros Unpatched Vulnerability : CVE-2022-50319
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: coresight: trbe: remove cpuhp instance node before remove cpuhp state cpuhp_state_add_instance() and cpuhp_state_remove_instance() should be used in pairs. Or there will lead to the warn on cpuhp_remove_multi_state() since the cpuhp_step list is not empty. The following is the error log with 'rmmod coresight-trbe': Error: Removing state 215 which has instances left. Call trace: __cpuhp_remove_state_cpuslocked+0x144/0x160 __cpuhp_remove_state+0xac/0x100 arm_trbe_device_remove+0x2c/0x60 [coresight_trbe] platform_remove+0x34/0x70 device_remove+0x54/0x90 device_release_driver_internal+0x1e4/0x250 driver_detach+0x5c/0xb0 bus_remove_driver+0x64/0xc0 driver_unregister+0x3c/0x70 platform_driver_unregister+0x20/0x30 arm_trbe_exit+0x1c/0x658 [coresight_trbe]
__arm64_sys_delete_module+0x1ac/0x24c invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0x58/0x1a0 do_el0_svc+0x38/0xd0 el0_svc+0x2c/0xc0 el0t_64_sync_handler+0x1ac/0x1b0 el0t_64_sync+0x19c/0x1a0 ---[ end trace 0000000000000000 ]--- (CVE-2022-50319)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50319
https://ubuntu.com/security/CVE-2022-50319

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50319

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264959 - Linux Distros Unpatched Vulnerability : CVE-2022-50321
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() The brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb in case of pskb_expand_head() fails, add dev_kfree_skb() to fix it. Compile tested only. (CVE-2022-50321)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50321
https://ubuntu.com/security/CVE-2022-50321

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50321

Plugin Information
Published: 2025/09/16, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265054 - Linux Distros Unpatched Vulnerability : CVE-2022-50322
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- rtc: msc313: Fix function prototype mismatch in msc313_rtc_probe() With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. msc313_rtc_probe() was passing clk_disable_unprepare() directly, which did not have matching prototypes for devm_add_action_or_reset()'s callback argument. Refactor to use devm_clk_get_enabled() instead. This was found as a result of Clang's new -Wcast-function-type-strict flag, which is more sensitive than the simpler -Wcast-function-type, which only checks for type width mismatches.
(CVE-2022-50322)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50322
https://ubuntu.com/security/CVE-2022-50322

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50322

Plugin Information
Published: 2025/09/16, Modified: 2025/12/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264933 - Linux Distros Unpatched Vulnerability : CVE-2022-50331
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wwan_hwsim: fix possible memory leak in wwan_hwsim_dev_new() Inject fault while probing module, if device_register() fails, but the refcount of kobject is not decreased to 0, the name allocated in dev_set_name() is leaked. Fix this by calling put_device(), so that name can be freed in callback function kobject_cleanup(). unreferenced object 0xffff88810152ad20 (size 8): comm modprobe, pid 252, jiffies 4294849206 (age 22.713s) hex dump (first 8 bytes): 68 77 73 69 6d 30 00 ff hwsim0.. backtrace: [<000000009c3504ed>]
__kmalloc_node_track_caller+0x44/0x1b0 [<00000000c0228a5e>] kvasprintf+0xb5/0x140 [<00000000cff8c21f>] kvasprintf_const+0x55/0x180 [<0000000055a1e073>] kobject_set_name_vargs+0x56/0x150 [<000000000a80b139>] dev_set_name+0xab/0xe0 (CVE-2022-50331)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50331
https://ubuntu.com/security/CVE-2022-50331

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50331

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264965 - Linux Distros Unpatched Vulnerability : CVE-2022-50332
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- video/aperture: Call sysfb_disable() before removing PCI devices Call sysfb_disable() from aperture_remove_conflicting_pci_devices() before removing PCI devices. Without, simpledrm can still bind to simple-framebuffer devices after the hardware driver has taken over the hardware. Both drivers interfere with each other and results are undefined. Reported modesetting errors [1] are shown below. ---- snap ---- rcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 13-.... } 7 jiffies s: 165 root:
0x2000/. rcu: blocking rcu_node structures (internal RCU debug): Task dump for CPU 13: task:X state:R running task stack: 0 pid: 4242 ppid: 4228 flags:0x00000008 Call Trace: <TASK> ? commit_tail+0xd7/0x130 ? drm_atomic_helper_commit+0x126/0x150 ? drm_atomic_commit+0xa4/0xe0 ? drm_plane_get_damage_clips.cold+0x1c/0x1c ? drm_atomic_helper_dirtyfb+0x19e/0x280 ? drm_mode_dirtyfb_ioctl+0x10f/0x1e0 ? drm_mode_getfb2_ioctl+0x2d0/0x2d0 ? drm_ioctl_kernel+0xc4/0x150 ? drm_ioctl+0x246/0x3f0 ? drm_mode_getfb2_ioctl+0x2d0/0x2d0 ? __x64_sys_ioctl+0x91/0xd0 ? do_syscall_64+0x60/0xd0 ? entry_SYSCALL_64_after_hwframe+0x4b/0xb5 </TASK> ... rcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 13-.... } 30 jiffies s: 169 root: 0x2000/. rcu: blocking rcu_node structures (internal RCU debug): Task dump for CPU 13: task:X state:R running task stack: 0 pid:
4242 ppid: 4228 flags:0x0000400e Call Trace: <TASK> ? memcpy_toio+0x76/0xc0 ? memcpy_toio+0x1b/0xc0 ? drm_fb_memcpy_toio+0x76/0xb0 ? drm_fb_blit_toio+0x75/0x2b0 ? simpledrm_simple_display_pipe_update+0x132/0x150 ? drm_atomic_helper_commit_planes+0xb6/0x230 ? drm_atomic_helper_commit_tail+0x44/0x80 ? commit_tail+0xd7/0x130 ? drm_atomic_helper_commit+0x126/0x150 ? drm_atomic_commit+0xa4/0xe0 ? drm_plane_get_damage_clips.cold+0x1c/0x1c ? drm_atomic_helper_dirtyfb+0x19e/0x280 ? drm_mode_dirtyfb_ioctl+0x10f/0x1e0 ? drm_mode_getfb2_ioctl+0x2d0/0x2d0 ? drm_ioctl_kernel+0xc4/0x150 ? drm_ioctl+0x246/0x3f0 ? drm_mode_getfb2_ioctl+0x2d0/0x2d0 ? __x64_sys_ioctl+0x91/0xd0 ? do_syscall_64+0x60/0xd0 ? entry_SYSCALL_64_after_hwframe+0x4b/0xb5 </TASK> The problem was added by commit 5e0137612430 (video/aperture: Disable and unregister sysfb devices via aperture helpers) to v6.0.3 and does not exist in the mainline branch. The mainline commit 5e0137612430 (video/aperture: Disable and unregister sysfb devices via aperture helpers) has been backported from v6.0-rc1 to stable v6.0.3 from a larger patch series [2] that reworks fbdev framebuffer ownership. The backport misses a change to aperture_remove_conflicting_pci_devices(). Mainline itself is fine, because the function does not exist there as a result of the patch series. Instead of backporting the whole series, fix the additional function. (CVE-2022-50332)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50332
https://ubuntu.com/security/CVE-2022-50332

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50332

Plugin Information
Published: 2025/09/16, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264919 - Linux Distros Unpatched Vulnerability : CVE-2022-50334
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() Syzkaller reports a null-ptr-deref bug as follows: ====================================================== KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:hugetlbfs_parse_param+0x1dd/0x8e0 fs/hugetlbfs/inode.c:1380 [...] Call Trace: <TASK> vfs_parse_fs_param fs/fs_context.c:148 [inline] vfs_parse_fs_param+0x1f9/0x3c0 fs/fs_context.c:129 vfs_parse_fs_string+0xdb/0x170 fs/fs_context.c:191 generic_parse_monolithic+0x16f/0x1f0 fs/fs_context.c:231 do_new_mount fs/namespace.c:3036 [inline] path_mount+0x12de/0x1e20 fs/namespace.c:3370 do_mount fs/namespace.c:3383 [inline] __do_sys_mount fs/namespace.c:3591 [inline] __se_sys_mount fs/namespace.c:3568 [inline] __x64_sys_mount+0x27f/0x300 fs/namespace.c:3568 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] </TASK>
====================================================== According to commit vfs: parse: deal with zero length string value, kernel will set the param->string to null pointer in vfs_parse_fs_string() if fs string has zero length. Yet the problem is that, hugetlbfs_parse_param() will dereference the param->string, without checking whether it is a null pointer. To be more specific, if hugetlbfs_parse_param() parses an illegal mount parameter, such as size=,, kernel will constructs struct fs_parameter with null pointer in vfs_parse_fs_string(), then passes this struct fs_parameter to hugetlbfs_parse_param(), which triggers the above null-ptr-deref bug. This patch solves it by adding sanity check on param->string in hugetlbfs_parse_param(). (CVE-2022-50334)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50334
https://ubuntu.com/security/CVE-2022-50334

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50334

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265286 - Linux Distros Unpatched Vulnerability : CVE-2022-50347
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and calling mmc_free_host() in the error path, besides, led_classdev_unregister() and pm_runtime_disable() also need be called. (CVE-2022-50347)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50347
https://ubuntu.com/security/CVE-2022-50347

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50347

Plugin Information
Published: 2025/09/17, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265227 - Linux Distros Unpatched Vulnerability : CVE-2022-50349
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() If device_register() returns error in tifm_7xx1_switch_media(), name of kobject which is allocated in dev_set_name() called in device_add() is leaked. Never directly free @dev after calling device_register(), even if it returned an error! Always use put_device() to give up the reference initialized. (CVE-2022-50349)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50349
https://ubuntu.com/security/CVE-2022-50349

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50349

Plugin Information
Published: 2025/09/17, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265285 - Linux Distros Unpatched Vulnerability : CVE-2022-50352
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: hns: fix possible memory leak in hnae_ae_register() Inject fault while probing module, if device_register() fails, but the refcount of kobject is not decreased to 0, the name allocated in dev_set_name() is leaked. Fix this by calling put_device(), so that name can be freed in callback function kobject_cleanup(). unreferenced object 0xffff00c01aba2100 (size 128): comm systemd-udevd, pid 1259, jiffies 4294903284 (age 294.152s) hex dump (first 32 bytes): 68 6e 61 65 30 00 00 00 18 21 ba 1a c0 00 ff ff hnae0....!...... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace:
[<0000000034783f26>] slab_post_alloc_hook+0xa0/0x3e0 [<00000000748188f2>]
__kmem_cache_alloc_node+0x164/0x2b0 [<00000000ab0743e8>] __kmalloc_node_track_caller+0x6c/0x390 [<000000006c0ffb13>] kvasprintf+0x8c/0x118 [<00000000fa27bfe1>] kvasprintf_const+0x60/0xc8 [<0000000083e10ed7>] kobject_set_name_vargs+0x3c/0xc0 [<000000000b87affc>] dev_set_name+0x7c/0xa0 [<000000003fd8fe26>] hnae_ae_register+0xcc/0x190 [hnae] [<00000000fe97edc9>] hns_dsaf_ae_init+0x9c/0x108 [hns_dsaf] [<00000000c36ff1eb>] hns_dsaf_probe+0x548/0x748 [hns_dsaf] (CVE-2022-50352)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50352
https://ubuntu.com/security/CVE-2022-50352

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50352

Plugin Information
Published: 2025/09/17, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265666 - Linux Distros Unpatched Vulnerability : CVE-2022-50353
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mmc: wmt-sdmmc: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and goto error path which will call mmc_free_host(), besides, clk_disable_unprepare() also needs be called.
(CVE-2022-50353)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50353
https://ubuntu.com/security/CVE-2022-50353

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50353

Plugin Information
Published: 2025/09/20, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265586 - Linux Distros Unpatched Vulnerability : CVE-2022-50354
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/amdkfd: Fix kfd_process_device_init_vm error handling Should only destroy the ib_mem and let process cleanup worker to free the outstanding BOs. Reset the pointer in pdd->qpd structure, to avoid NULL pointer access in process destroy worker. BUG: kernel NULL pointer dereference, address: 0000000000000010 Call Trace: amdgpu_amdkfd_gpuvm_unmap_gtt_bo_from_kernel+0x46/0xb0 [amdgpu] kfd_process_device_destroy_cwsr_dgpu+0x40/0x70 [amdgpu] kfd_process_destroy_pdds+0x71/0x190 [amdgpu] kfd_process_wq_release+0x2a2/0x3b0 [amdgpu] process_one_work+0x2a1/0x600 worker_thread+0x39/0x3d0 (CVE-2022-50354)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50354
https://ubuntu.com/security/CVE-2022-50354

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50354

Plugin Information
Published: 2025/09/20, Modified: 2025/10/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265591 - Linux Distros Unpatched Vulnerability : CVE-2022-50358
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- brcmfmac: return error when getting invalid max_flowrings from dongle When firmware hit trap at initialization, host will read abnormal max_flowrings number from dongle, and it will cause kernel panic when doing iowrite to initialize dongle ring. To detect this error at early stage, we directly return error when getting invalid max_flowrings(>256). (CVE-2022-50358)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50358
https://ubuntu.com/security/CVE-2022-50358

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50358

Plugin Information
Published: 2025/09/20, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265657 - Linux Distros Unpatched Vulnerability : CVE-2022-50366
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue When value < time_unit, the parameter of ilog2() will be zero and the return value is -1. u64(-1) is too large for shift exponent and then will trigger shift-out-of-bounds: shift exponent 18446744073709551615 is too large for 32-bit type 'int' Call Trace:
rapl_compute_time_window_core rapl_write_data_raw set_time_window store_constraint_time_window_us (CVE-2022-50366)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50366
https://ubuntu.com/security/CVE-2022-50366

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50366

Plugin Information
Published: 2025/09/20, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265617 - Linux Distros Unpatched Vulnerability : CVE-2022-50370
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: i2c: designware: Fix handling of real but unexpected device interrupts Commit c7b79a752871 (mfd: intel-lpss: Add Intel Alder Lake PCH-S PCI IDs) caused a regression on certain Gigabyte motherboards for Intel Alder Lake-S where system crashes to NULL pointer dereference in i2c_dw_xfer_msg() when system resumes from S3 sleep state (deep). I was able to debug the issue on Gigabyte Z690 AORUS ELITE and made following notes: - Issue happens when resuming from S3 but not when resuming from s2idle - PCI device 00:15.0 == i2c_designware.0 is already in D0 state when system enters into pci_pm_resume_noirq() while all other i2c_designware PCI devices are in D3.
Devices were runtime suspended and in D3 prior entering into suspend - Interrupt comes after pci_pm_resume_noirq() when device interrupts are re-enabled - According to register dump the interrupt really comes from the i2c_designware.0. Controller is enabled, I2C target address register points to a one detectable I2C device address 0x60 and the DW_IC_RAW_INTR_STAT register START_DET, STOP_DET, ACTIVITY and TX_EMPTY bits are set indicating completed I2C transaction. My guess is that the firmware uses this controller to communicate with an on-board I2C device during resume but does not disable the controller before giving control to an operating system. I was told the UEFI update fixes this but never the less it revealed the driver is not ready to handle TX_EMPTY (or RX_FULL) interrupt when device is supposed to be idle and state variables are not set (especially the dev->msgs pointer which may point to NULL or stale old data). Introduce a new software status flag STATUS_ACTIVE indicating when the controller is active in driver point of view. Now treat all interrupts that occur when is not set as unexpected and mask all interrupts from the controller. (CVE-2022-50370)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50370
https://ubuntu.com/security/CVE-2022-50370

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50370

Plugin Information
Published: 2025/09/20, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265626 - Linux Distros Unpatched Vulnerability : CVE-2022-50373
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fs: dlm: fix race in lowcomms This patch fixes a race between queue_work() in _dlm_lowcomms_commit_msg() and srcu_read_unlock(). The queue_work() can take the final reference of a dlm_msg and so msg->idx can contain garbage which is signaled by the following warning: [ 676.237050] ------------[ cut here ]------------ [ 676.237052] WARNING: CPU: 0 PID: 1060 at include/linux/srcu.h:189 dlm_lowcomms_commit_msg+0x41/0x50 [ 676.238945] Modules linked in: dlm_locktorture torture rpcsec_gss_krb5 intel_rapl_msr intel_rapl_common iTCO_wdt iTCO_vendor_support qxl kvm_intel drm_ttm_helper vmw_vsock_virtio_transport kvm vmw_vsock_virtio_transport_common ttm irqbypass crc32_pclmul joydev crc32c_intel serio_raw drm_kms_helper vsock virtio_scsi virtio_console virtio_balloon snd_pcm drm syscopyarea sysfillrect sysimgblt snd_timer fb_sys_fops i2c_i801 lpc_ich snd i2c_smbus soundcore pcspkr [ 676.244227] CPU: 0 PID: 1060 Comm: lock_torture_wr Not tainted 5.19.0-rc3+ #1546 [ 676.245216] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-2.module+el8.7.0+15506+033991b0 04/01/2014 [ 676.246460] RIP:
0010:dlm_lowcomms_commit_msg+0x41/0x50 [ 676.247132] Code: fe ff ff ff 75 24 48 c7 c6 bd 0f 49 bb 48 c7 c7 38 7c 01 bd e8 00 e7 ca ff 89 de 48 c7 c7 60 78 01 bd e8 42 3d cd ff 5b 5d c3 <0f> 0b eb d8 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 [ 676.249253] RSP: 0018:ffffa401c18ffc68 EFLAGS: 00010282 [ 676.249855] RAX: 0000000000000001 RBX: 00000000ffff8b76 RCX: 0000000000000006 [ 676.250713] RDX:
0000000000000000 RSI: ffffffffbccf3a10 RDI: ffffffffbcc7b62e [ 676.251610] RBP: ffffa401c18ffc70 R08:
0000000000000001 R09: 0000000000000001 [ 676.252481] R10: 0000000000000001 R11: 0000000000000001 R12:
0000000000000005 [ 676.253421] R13: ffff8b76786ec370 R14: ffff8b76786ec370 R15: ffff8b76786ec480 [ 676.254257] FS: 0000000000000000(0000) GS:ffff8b7777800000(0000) knlGS:0000000000000000 [ 676.255239] CS:
0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 676.255897] CR2: 00005590205d88b8 CR3: 000000017656c003 CR4: 0000000000770ee0 [ 676.256734] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 676.257567] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 676.258397] PKRU: 55555554 [ 676.258729] Call Trace: [ 676.259063] <TASK> [ 676.259354] dlm_midcomms_commit_mhandle+0xcc/0x110 [ 676.259964] queue_bast+0x8b/0xb0 [ 676.260423] grant_pending_locks+0x166/0x1b0 [ 676.261007]
_unlock_lock+0x75/0x90 [ 676.261469] unlock_lock.isra.57+0x62/0xa0 [ 676.262009] dlm_unlock+0x21e/0x330 [ 676.262457] ? lock_torture_stats+0x80/0x80 [dlm_locktorture] [ 676.263183] torture_unlock+0x5a/0x90 [dlm_locktorture] [ 676.263815] ? preempt_count_sub+0xba/0x100 [ 676.264361] ? complete+0x1d/0x60 [ 676.264777] lock_torture_writer+0xb8/0x150 [dlm_locktorture] [ 676.265555] kthread+0x10a/0x130 [ 676.266007] ? kthread_complete_and_exit+0x20/0x20 [ 676.266616] ret_from_fork+0x22/0x30 [ 676.267097] </TASK> [ 676.267381] irq event stamp: 9579855 [ 676.267824] hardirqs last enabled at (9579863):
[<ffffffffbb14e6f8>] __up_console_sem+0x58/0x60 [ 676.268896] hardirqs last disabled at (9579872):
[<ffffffffbb14e6dd>] __up_console_sem+0x3d/0x60 [ 676.270008] softirqs last enabled at (9579798):
[<ffffffffbc200349>] __do_softirq+0x349/0x4c7 [ 676.271438] softirqs last disabled at (9579897):
[<ffffffffbb0d54c0>] irq_exit_rcu+0xb0/0xf0 [ 676.272796] ---[ end trace 0000000000000000 ]--- I reproduced this warning with dlm_locktorture test which is currently not upstream. However this patch fix the issue by make a additional refcount between dlm_lowcomms_new_msg() and dlm_lowcomms_commit_msg(). In case of the race the kref_put() in dlm_lowcomms_commit_msg() will be the final put. (CVE-2022-50373)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50373
https://ubuntu.com/security/CVE-2022-50373

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.1
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50373

Plugin Information
Published: 2025/09/20, Modified: 2025/12/23
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265606 - Linux Distros Unpatched Vulnerability : CVE-2022-50375
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown lpuart_dma_shutdown tears down lpuart dma, but lpuart_flush_buffer can still occur which in turn tries to access dma apis if lpuart_dma_tx_use flag is true. At this point since dma is torn down, these dma apis can abort. Set lpuart_dma_tx_use and the corresponding rx flag lpuart_dma_rx_use to false in lpuart_dma_shutdown so that dmas are not accessed after they are relinquished. Otherwise, when try to kill btattach, kernel may panic.
This patch may fix this issue. root@imx8ulpevk:~# btattach -B /dev/ttyLP2 -S 115200 ^C[ 90.182296] Internal error: synchronous external abort: 96000210 [#1] PREEMPT SMP [ 90.189806] Modules linked in:
moal(O) mlan(O) [ 90.194258] CPU: 0 PID: 503 Comm: btattach Tainted: G O 5.15.32-06136-g34eecdf2f9e4 #37 [ 90.203554] Hardware name: NXP i.MX8ULP 9X9 EVK (DT) [ 90.208513] pstate: 600000c5 (nZCv daIF -PAN -UAO
-TCO -DIT -SSBS BTYPE=--) [ 90.215470] pc : fsl_edma3_disable_request+0x8/0x60 [ 90.220358] lr :
fsl_edma3_terminate_all+0x34/0x20c [ 90.225237] sp : ffff800013f0bac0 [ 90.228548] x29: ffff800013f0bac0 x28: 0000000000000001 x27: ffff000008404800 [ 90.235681] x26: ffff000008404960 x25: ffff000008404a08 x24:
ffff000008404a00 [ 90.242813] x23: ffff000008404a60 x22: 0000000000000002 x21: 0000000000000000 [ 90.249946] x20: ffff800013f0baf8 x19: ffff00000559c800 x18: 0000000000000000 [ 90.257078] x17:
0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 90.264211] x14: 0000000000000003 x13:
0000000000000000 x12: 0000000000000040 [ 90.271344] x11: ffff00000600c248 x10: ffff800013f0bb10 x9 :
ffff000057bcb090 [ 90.278477] x8 : fffffc0000241a08 x7 : ffff00000534ee00 x6 : ffff000008404804 [ 90.285609] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff0000055b3480 [ 90.292742] x2 :
ffff8000135c0000 x1 : ffff00000534ee00 x0 : ffff00000559c800 [ 90.299876] Call trace: [ 90.302321] fsl_edma3_disable_request+0x8/0x60 [ 90.306851] lpuart_flush_buffer+0x40/0x160 [ 90.311037] uart_flush_buffer+0x88/0x120 [ 90.315050] tty_driver_flush_buffer+0x20/0x30 [ 90.319496] hci_uart_flush+0x44/0x90 [ 90.323162] +0x34/0x12c [ 90.327253] tty_ldisc_close+0x38/0x70 [ 90.331005] tty_ldisc_release+0xa8/0x190 [ 90.335018] tty_release_struct+0x24/0x8c [ 90.339022] tty_release+0x3ec/0x4c0 [ 90.342593] __fput+0x70/0x234 [ 90.345652] ____fput+0x14/0x20 [ 90.348790] task_work_run+0x84/0x17c [ 90.352455] do_exit+0x310/0x96c [ 90.355688] do_group_exit+0x3c/0xa0 [ 90.359259] __arm64_sys_exit_group+0x1c/0x20 [ 90.363609] invoke_syscall+0x48/0x114 [ 90.367362] el0_svc_common.constprop.0+0xd4/0xfc [ 90.372068] do_el0_svc+0x2c/0x94 [ 90.375379] el0_svc+0x28/0x80 [ 90.378438] el0t_64_sync_handler+0xa8/0x130 [ 90.382711] el0t_64_sync+0x1a0/0x1a4 [ 90.386376] Code:
17ffffda d503201f d503233f f9409802 (b9400041) [ 90.392467] ---[ end trace 2f60524b4a43f1f6 ]--- [ 90.397073] note: btattach[503] exited with preempt_count 1 [ 90.402636] Fixing recursive fault but reboot is needed! (CVE-2022-50375)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50375
https://ubuntu.com/security/CVE-2022-50375

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.0 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50375

Plugin Information
Published: 2025/09/20, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265601 - Linux Distros Unpatched Vulnerability : CVE-2022-50380
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm: /proc/pid/smaps_rollup: fix no vma's null-deref Commit 258f669e7e88 (mm: /proc/pid/smaps_rollup:
convert to single value seq_file) introduced a null-deref if there are no vma's in the task in show_smaps_rollup. (CVE-2022-50380)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50380
https://security-tracker.debian.org/tracker/CVE-2022-50380
https://ubuntu.com/security/CVE-2022-50380

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50380

Plugin Information
Published: 2025/09/20, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265567 - Linux Distros Unpatched Vulnerability : CVE-2022-50382
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: padata: Always leave BHs disabled when running ->parallel() A deadlock can happen when an overloaded system runs ->parallel() in the context of the current task: padata_do_parallel ->parallel() pcrypt_aead_enc/dec padata_do_serial spin_lock(&reorder->lock) // BHs still enabled <interrupt> ... __do_softirq ... padata_do_serial spin_lock(&reorder->lock) It's a bug for BHs to be on in _do_serial as Steffen points out, so ensure they're off in the current task case like they are in padata_parallel_worker to avoid this situation.
(CVE-2022-50382)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50382
https://ubuntu.com/security/CVE-2022-50382

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50382

Plugin Information
Published: 2025/09/19, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265545 - Linux Distros Unpatched Vulnerability : CVE-2022-50387
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: hinic: fix the issue of CMDQ memory leaks When hinic_set_cmdq_depth() fails in hinic_init_cmdqs(), the cmdq memory is not released correctly. Fix it. (CVE-2022-50387)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50387
https://ubuntu.com/security/CVE-2022-50387

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50387

Plugin Information
Published: 2025/09/19, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265584 - Linux Distros Unpatched Vulnerability : CVE-2022-50392
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ASoC: mediatek: mt8183: fix refcount leak in mt8183_mt6358_ts3a227_max98357_dev_probe() The node returned by of_parse_phandle() with refcount incremented, of_node_put() needs be called when finish using it. So add it in the error path in mt8183_mt6358_ts3a227_max98357_dev_probe(). (CVE-2022-50392)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50392
https://security-tracker.debian.org/tracker/CVE-2022-50392
https://ubuntu.com/security/CVE-2022-50392

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50392

Plugin Information
Published: 2025/09/20, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265548 - Linux Distros Unpatched Vulnerability : CVE-2022-50395
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- integrity: Fix memory leakage in keyring allocation error path Key restriction is allocated in integrity_init_keyring(). However, if keyring allocation failed, it is not freed, causing memory leaks.
(CVE-2022-50395)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50395
https://ubuntu.com/security/CVE-2022-50395

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50395

Plugin Information
Published: 2025/09/19, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265517 - Linux Distros Unpatched Vulnerability : CVE-2022-50409
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory Fixes the below NULL pointer dereference: [...] [ 14.471200] Call Trace: [ 14.471562] <TASK> [ 14.471882] lock_acquire+0x245/0x2e0 [ 14.472416] ? remove_wait_queue+0x12/0x50 [ 14.473014] ? _raw_spin_lock_irqsave+0x17/0x50 [ 14.473681]
_raw_spin_lock_irqsave+0x3d/0x50 [ 14.474318] ? remove_wait_queue+0x12/0x50 [ 14.474907] remove_wait_queue+0x12/0x50 [ 14.475480] sk_stream_wait_memory+0x20d/0x340 [ 14.476127] ? do_wait_intr_irq+0x80/0x80 [ 14.476704] do_tcp_sendpages+0x287/0x600 [ 14.477283] tcp_bpf_push+0xab/0x260 [ 14.477817] tcp_bpf_sendmsg_redir+0x297/0x500 [ 14.478461] ? __local_bh_enable_ip+0x77/0xe0 [ 14.479096] tcp_bpf_send_verdict+0x105/0x470 [ 14.479729] tcp_bpf_sendmsg+0x318/0x4f0 [ 14.480311] sock_sendmsg+0x2d/0x40 [ 14.480822] ____sys_sendmsg+0x1b4/0x1c0 [ 14.481390] ? copy_msghdr_from_user+0x62/0x80 [ 14.482048] ___sys_sendmsg+0x78/0xb0 [ 14.482580] ? vmf_insert_pfn_prot+0x91/0x150 [ 14.483215] ? __do_fault+0x2a/0x1a0 [ 14.483738] ? do_fault+0x15e/0x5d0 [ 14.484246] ? __handle_mm_fault+0x56b/0x1040 [ 14.484874] ? lock_is_held_type+0xdf/0x130 [ 14.485474] ? find_held_lock+0x2d/0x90 [ 14.486046] ? __sys_sendmsg+0x41/0x70 [ 14.486587] __sys_sendmsg+0x41/0x70 [ 14.487105] ? intel_pmu_drain_pebs_core+0x350/0x350 [ 14.487822] do_syscall_64+0x34/0x80 [ 14.488345] entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] The test scenario has the following flow: thread1 thread2
----------- --------------- tcp_bpf_sendmsg tcp_bpf_send_verdict tcp_bpf_sendmsg_redir sock_close tcp_bpf_push_locked __sock_release tcp_bpf_push //inet_release do_tcp_sendpages sock->ops->release sk_stream_wait_memory // tcp_close sk_wait_event sk->sk_prot->close release_sock(__sk); *** lock_sock(sk);
__tcp_close sock_orphan(sk) sk->sk_wq = NULL release_sock **** lock_sock(__sk);
remove_wait_queue(sk_sleep(sk), &wait); sk_sleep(sk) //NULL pointer dereference &rcu_dereference_raw(sk->sk_wq)->wait While waiting for memory in thread1, the socket is released with its wait queue because thread2 has closed it. This caused by tcp_bpf_send_verdict didn't increase the f_count of psock->sk_redir->sk_socket->file in thread1. We should check if SOCK_DEAD flag is set on wakeup in sk_stream_wait_memory before accessing the wait queue. (CVE-2022-50409)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50409
https://ubuntu.com/security/CVE-2022-50409

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50409

Plugin Information
Published: 2025/09/19, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265523 - Linux Distros Unpatched Vulnerability : CVE-2022-50414
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails fcoe_init() calls fcoe_transport_attach(&fcoe_sw_transport), but when fcoe_if_init() fails, &fcoe_sw_transport is not detached and leaves freed &fcoe_sw_transport on fcoe_transports list. This causes panic when reinserting module. BUG: unable to handle page fault for address: fffffbfff82e2213 RIP:
0010:fcoe_transport_attach+0xe1/0x230 [libfcoe] Call Trace: <TASK> do_one_initcall+0xd0/0x4e0 load_module+0x5eee/0x7210 ... (CVE-2022-50414)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50414
https://ubuntu.com/security/CVE-2022-50414

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50414

Plugin Information
Published: 2025/09/19, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269578 - Linux Distros Unpatched Vulnerability : CVE-2022-50424
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: resource leaks at mt7921_check_offload_capability() Fixed coverity issue with resource leaks at variable fw going out of scope leaks the storage it points to mt7921_check_offload_capability(). Addresses-Coverity-ID: 1527806 (Resource leaks) (CVE-2022-50424)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50424
https://ubuntu.com/security/CVE-2022-50424

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50424

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269548 - Linux Distros Unpatched Vulnerability : CVE-2022-50425
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly When an extended state component is not present in fpstate, but in init state, the function copies from init_fpstate via copy_feature(). But, dynamic states are not present in init_fpstate because of all-zeros init states. Then retrieving them from init_fpstate will explode like this: BUG: kernel NULL pointer dereference, address: 0000000000000000 ...
RIP: 0010:memcpy_erms+0x6/0x10 ? __copy_xstate_to_uabi_buf+0x381/0x870 fpu_copy_guest_fpstate_to_uabi+0x28/0x80 kvm_arch_vcpu_ioctl+0x14c/0x1460 [kvm] ?
__this_cpu_preempt_check+0x13/0x20 ? vmx_vcpu_put+0x2e/0x260 [kvm_intel] kvm_vcpu_ioctl+0xea/0x6b0 [kvm] ? kvm_vcpu_ioctl+0xea/0x6b0 [kvm] ? __fget_light+0xd4/0x130 __x64_sys_ioctl+0xe3/0x910 ? debug_smp_processor_id+0x17/0x20 ? fpregs_assert_state_consistent+0x27/0x50 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Adjust the 'mask' to zero out the userspace buffer for the features that are not available both from fpstate and from init_fpstate. The dynamic features depend on the compacted XSAVE format. Ensure it is enabled before reading XCOMP_BV in init_fpstate. (CVE-2022-50425)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50425
https://ubuntu.com/security/CVE-2022-50425

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50425

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269635 - Linux Distros Unpatched Vulnerability : CVE-2022-50427
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() If device_register() fails in snd_ac97_dev_register(), it should call put_device() to give up reference, or the name allocated in dev_set_name() is leaked. (CVE-2022-50427)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50427
https://ubuntu.com/security/CVE-2022-50427

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50427

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269584 - Linux Distros Unpatched Vulnerability : CVE-2022-50428
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: fix off-by-one errors in fast-commit block filling Due to several different off-by-one errors, or perhaps due to a late change in design that wasn't fully reflected in the code that was actually merged, there are several very strange constraints on how fast-commit blocks are filled with tlv entries: - tlvs must start at least 10 bytes before the end of the block, even though the minimum tlv length is 8.
Otherwise, the replay code will ignore them. (BUG: ext4_fc_reserve_space() could violate this requirement if called with a len of blocksize - 9 or blocksize - 8. Fortunately, this doesn't seem to happen currently.) - tlvs must end at least 1 byte before the end of the block. Otherwise the replay code will consider them to be invalid. This quirk contributed to a bug (fixed by an earlier commit) where uninitialized memory was being leaked to disk in the last byte of blocks. Also, strangely these constraints don't apply to the replay code in e2fsprogs, which will accept any tlvs in the blocks (with no bounds checks at all, but that is a separate issue...). Given that this all seems to be a bug, let's fix it by just filling blocks with tlv entries in the natural way. Note that old kernels will be unable to replay fast-commit journals created by kernels that have this commit. (CVE-2022-50428)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50428
https://security-tracker.debian.org/tracker/CVE-2022-50428
https://ubuntu.com/security/CVE-2022-50428

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50428

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269579 - Linux Distros Unpatched Vulnerability : CVE-2022-50430
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING vub300_enable_sdio_irq() works with mutex and need TASK_RUNNING here. Ensure that we mark current as TASK_RUNNING for sleepable context. [ 77.554641] do not call blocking ops when !TASK_RUNNING; state=1 set at [<ffffffff92a72c1d>] sdio_irq_thread+0x17d/0x5b0 [ 77.554652] WARNING: CPU: 2 PID: 1983 at kernel/sched/core.c:9813
__might_sleep+0x116/0x160 [ 77.554905] CPU: 2 PID: 1983 Comm: ksdioirqd/mmc1 Tainted: G OE 6.1.0-rc5 #1 [ 77.554910] Hardware name: Intel(R) Client Systems NUC8i7BEH/NUC8BEB, BIOS BECFL357.86A.0081.2020.0504.1834 05/04/2020 [ 77.554912] RIP: 0010:__might_sleep+0x116/0x160 [ 77.554920] RSP: 0018:ffff888107b7fdb8 EFLAGS: 00010282 [ 77.554923] RAX: 0000000000000000 RBX: ffff888118c1b740 RCX: 0000000000000000 [ 77.554926] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffed1020f6ffa9 [ 77.554928] RBP:
ffff888107b7fde0 R08: 0000000000000001 R09: ffffed1043ea60ba [ 77.554930] R10: ffff88821f5305cb R11:
ffffed1043ea60b9 R12: ffffffff93aa3a60 [ 77.554932] R13: 000000000000011b R14: 7fffffffffffffff R15:
ffffffffc0558660 [ 77.554934] FS: 0000000000000000(0000) GS:ffff88821f500000(0000) knlGS:0000000000000000 [ 77.554937] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 77.554939] CR2: 00007f8a44010d68 CR3:
000000024421a003 CR4: 00000000003706e0 [ 77.554942] Call Trace: [ 77.554944] <TASK> [ 77.554952] mutex_lock+0x78/0xf0 [ 77.554973] vub300_enable_sdio_irq+0x103/0x3c0 [vub300] [ 77.554981] sdio_irq_thread+0x25c/0x5b0 [ 77.555006] kthread+0x2b8/0x370 [ 77.555017] ret_from_fork+0x1f/0x30 [ 77.555023] </TASK> [ 77.555025] ---[ end trace 0000000000000000 ]--- (CVE-2022-50430)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50430
https://ubuntu.com/security/CVE-2022-50430

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H)
CVSS v3.0 Temporal Score
5.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.0
EPSS Score
0.0003
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50430

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269532 - Linux Distros Unpatched Vulnerability : CVE-2022-50431
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev() dev_set_name() in soundbus_add_one() allocates memory for name, it need be freed when of_device_register() fails, call soundbus_dev_put() to give up the reference that hold in device_initialize(), so that it can be freed in kobject_cleanup() when the refcount hit to 0. And other resources are also freed in i2sbus_release_dev(), so it can return 0 directly. (CVE-2022-50431)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50431
https://ubuntu.com/security/CVE-2022-50431

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50431

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269630 - Linux Distros Unpatched Vulnerability : CVE-2022-50434
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- blk-mq: fix possible memleak when register 'hctx' failed There's issue as follows when do fault injection test: unreferenced object 0xffff888132a9f400 (size 512): comm insmod, pid 308021, jiffies 4324277909 (age 509.733s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 08 f4 a9 32 81 88 ff ff ...........2....
08 f4 a9 32 81 88 ff ff 00 00 00 00 00 00 00 00 ...2............ backtrace: [<00000000e8952bb4>] kmalloc_node_trace+0x22/0xa0 [<00000000f9980e0f>] blk_mq_alloc_and_init_hctx+0x3f1/0x7e0 [<000000002e719efa>] blk_mq_realloc_hw_ctxs+0x1e6/0x230 [<000000004f1fda40>] blk_mq_init_allocated_queue+0x27e/0x910 [<00000000287123ec>] __blk_mq_alloc_disk+0x67/0xf0 [<00000000a2a34657>] 0xffffffffa2ad310f [<00000000b173f718>] 0xffffffffa2af824a [<0000000095a1dabb>] do_one_initcall+0x87/0x2a0 [<00000000f32fdf93>] do_init_module+0xdf/0x320 [<00000000cbe8541e>] load_module+0x3006/0x3390 [<0000000069ed1bdb>] __do_sys_finit_module+0x113/0x1b0 [<00000000a1a29ae8>] do_syscall_64+0x35/0x80 [<000000009cd878b0>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 Fault injection context as follows: kobject_add blk_mq_register_hctx blk_mq_sysfs_register blk_register_queue device_add_disk null_add_dev.part.0 [null_blk] As 'blk_mq_register_hctx' may already add some objects when failed halfway, but there isn't do fallback, caller don't know which objects add failed. To solve above issue just do fallback when add objects failed halfway in 'blk_mq_register_hctx'. (CVE-2022-50434)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50434
https://ubuntu.com/security/CVE-2022-50434

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50434

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269550 - Linux Distros Unpatched Vulnerability : CVE-2022-50436
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ext4: don't set up encryption key during jbd2 transaction Commit a80f7fcf1867 (ext4: fixup ext4_fc_track_* functions' signature) extended the scope of the transaction in ext4_unlink() too far, making it include the call to ext4_find_entry().
However, ext4_find_entry() can deadlock when called from within a transaction because it may need to set up the directory's encryption key. Fix this by restoring the transaction to its original scope.
(CVE-2022-50436)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50436
https://ubuntu.com/security/CVE-2022-50436

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50436

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269641 - Linux Distros Unpatched Vulnerability : CVE-2022-50438
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: hinic: fix memory leak when reading function table When the input parameter idx meets the expected case option in hinic_dbg_get_func_table(), read_data is not released. Fix it. (CVE-2022-50438)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50438
https://ubuntu.com/security/CVE-2022-50438

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50438

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269603 - Linux Distros Unpatched Vulnerability : CVE-2022-50445
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xfrm: Reinject transport-mode packets through workqueue The following warning is displayed when the tcp6-multi-diffip11 stress test case of the LTP test suite is tested: watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [ns-tcpserver:48198] CPU: 0 PID: 48198 Comm: ns-tcpserver Kdump: loaded Not tainted 6.0.0-rc6+ #39 Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : des3_ede_encrypt+0x27c/0x460 [libdes] lr : 0x3f sp :
ffff80000ceaa1b0 x29: ffff80000ceaa1b0 x28: ffff0000df056100 x27: ffff0000e51e5280 x26: ffff80004df75030 x25: ffff0000e51e4600 x24: 000000000000003b x23: 0000000000802080 x22: 000000000000003d x21:
0000000000000038 x20: 0000000080000020 x19: 000000000000000a x18: 0000000000000033 x17: ffff0000e51e4780 x16: ffff80004e2d1448 x15: ffff80004e2d1248 x14: ffff0000e51e4680 x13: ffff80004e2d1348 x12:
ffff80004e2d1548 x11: ffff80004e2d1848 x10: ffff80004e2d1648 x9 : ffff80004e2d1748 x8 : ffff80004e2d1948 x7 : 000000000bcaf83d x6 : 000000000000001b x5 : ffff80004e2d1048 x4 : 00000000761bf3bf x3 :
000000007f1dd0a3 x2 : ffff0000e51e4780 x1 : ffff0000e3b9a2f8 x0 : 00000000db44e872 Call trace:
des3_ede_encrypt+0x27c/0x460 [libdes] crypto_des3_ede_encrypt+0x1c/0x30 [des_generic] crypto_cbc_encrypt+0x148/0x190 crypto_skcipher_encrypt+0x2c/0x40 crypto_authenc_encrypt+0xc8/0xfc [authenc] crypto_aead_encrypt+0x2c/0x40 echainiv_encrypt+0x144/0x1a0 [echainiv] crypto_aead_encrypt+0x2c/0x40 esp6_output_tail+0x1c8/0x5d0 [esp6] esp6_output+0x120/0x278 [esp6] xfrm_output_one+0x458/0x4ec xfrm_output_resume+0x6c/0x1f0 xfrm_output+0xac/0x4ac
__xfrm6_output+0x130/0x270 xfrm6_output+0x60/0xec ip6_xmit+0x2ec/0x5bc inet6_csk_xmit+0xbc/0x10c
__tcp_transmit_skb+0x460/0x8c0 tcp_write_xmit+0x348/0x890 __tcp_push_pending_frames+0x44/0x110 tcp_rcv_established+0x3c8/0x720 tcp_v6_do_rcv+0xdc/0x4a0 tcp_v6_rcv+0xc24/0xcb0 ip6_protocol_deliver_rcu+0xf0/0x574 ip6_input_finish+0x48/0x7c ip6_input+0x48/0xc0 ip6_rcv_finish+0x80/0x9c xfrm_trans_reinject+0xb0/0xf4 tasklet_action_common.constprop.0+0xf8/0x134 tasklet_action+0x30/0x3c __do_softirq+0x128/0x368 do_softirq+0xb4/0xc0 __local_bh_enable_ip+0xb0/0xb4 put_cpu_fpsimd_context+0x40/0x70 kernel_neon_end+0x20/0x40 sha1_base_do_update.constprop.0.isra.0+0x11c/0x140 [sha1_ce] sha1_ce_finup+0x94/0x110 [sha1_ce] crypto_shash_finup+0x34/0xc0 hmac_finup+0x48/0xe0 crypto_shash_finup+0x34/0xc0 shash_digest_unaligned+0x74/0x90 crypto_shash_digest+0x4c/0x9c shash_ahash_digest+0xc8/0xf0 shash_async_digest+0x28/0x34 crypto_ahash_digest+0x48/0xcc crypto_authenc_genicv+0x88/0xcc [authenc] crypto_authenc_encrypt+0xd8/0xfc [authenc] crypto_aead_encrypt+0x2c/0x40 echainiv_encrypt+0x144/0x1a0 [echainiv] crypto_aead_encrypt+0x2c/0x40 esp6_output_tail+0x1c8/0x5d0 [esp6] esp6_output+0x120/0x278 [esp6] xfrm_output_one+0x458/0x4ec xfrm_output_resume+0x6c/0x1f0 xfrm_output+0xac/0x4ac
__xfrm6_output+0x130/0x270 xfrm6_output+0x60/0xec ip6_xmit+0x2ec/0x5bc inet6_csk_xmit+0xbc/0x10c
__tcp_transmit_skb+0x460/0x8c0 tcp_write_xmit+0x348/0x890 __tcp_push_pending_frames+0x44/0x110 tcp_push+0xb4/0x14c tcp_sendmsg_locked+0x71c/0xb64 tcp_sendmsg+0x40/0x6c inet6_sendmsg+0x4c/0x80 sock_sendmsg+0x5c/0x6c __sys_sendto+0x128/0x15c __arm64_sys_sendto+0x30/0x40 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0x170/0x194 do_el0_svc+0x38/0x4c el0_svc+0x28/0xe0 el0t_64_sync_handler+0xbc/0x13c el0t_64_sync+0x180/0x184 Get softirq info by bcc tool: ./softirqs -NT 10 Tracing soft irq event time... Hit Ctrl-C to end. 15:34:34 SOFTIRQ TOTAL_nsecs block 158990 timer 20030920 sched 46577080 net_rx 676746820 tasklet 9906067650 15:34:45 SOFTIRQ TOTAL_nsecs block 86100 sched 38849790 net_rx ---truncated--- (CVE-2022-50445)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50445
https://security-tracker.debian.org/tracker/CVE-2022-50445
https://ubuntu.com/security/CVE-2022-50445

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50445

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269533 - Linux Distros Unpatched Vulnerability : CVE-2022-50466
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: fs/binfmt_elf: Fix memory leak in load_elf_binary() There is a memory leak reported by kmemleak: unreferenced object 0xffff88817104ef80 (size 224): comm xfs_admin, pid 47165, jiffies 4298708825 (age 1333.476s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 60 a8 b3 00 81 88 ff ff a8 10 5a 00 81 88 ff ff `.........Z..... backtrace: [<ffffffff819171e1>] __alloc_file+0x21/0x250 [<ffffffff81918061>] alloc_empty_file+0x41/0xf0 [<ffffffff81948cda>] path_openat+0xea/0x3d30 [<ffffffff8194ec89>] do_filp_open+0x1b9/0x290 [<ffffffff8192660e>] do_open_execat+0xce/0x5b0 [<ffffffff81926b17>] open_exec+0x27/0x50 [<ffffffff81a69250>] load_elf_binary+0x510/0x3ed0 [<ffffffff81927759>] bprm_execve+0x599/0x1240 [<ffffffff8192a997>] do_execveat_common.isra.0+0x4c7/0x680 [<ffffffff8192b078>]
__x64_sys_execve+0x88/0xb0 [<ffffffff83bbf0a5>] do_syscall_64+0x35/0x80 If interp_elf_ex fails to allocate memory in load_elf_binary(), the program will take the out_free_ph error handing path, resulting in interpreter file resource is not released. Fix it by adding an error handing path out_free_file, which will release the file resource when interp_elf_ex failed to allocate memory.
(CVE-2022-50466)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50466
https://ubuntu.com/security/CVE-2022-50466

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50466

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269400 - Linux Distros Unpatched Vulnerability : CVE-2022-50481
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter() If device_register() fails in cxl_register_afu|adapter(), the device is not added, device_unregister() can not be called in the error path, otherwise it will cause a null-ptr-deref because of removing not added device. As comment of device_register() says, it should use put_device() to give up the reference in the error path. So split device_unregister() into device_del() and put_device(), then goes to put dev when register fails.
(CVE-2022-50481)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50481
https://ubuntu.com/security/CVE-2022-50481

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50481

Plugin Information
Published: 2025/10/08, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269436 - Linux Distros Unpatched Vulnerability : CVE-2022-50493
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: qla2xxx: Fix crash when I/O abort times out While performing CPU hotplug, a crash with the following stack was seen: Call Trace: qla24xx_process_response_queue+0x42a/0x970 [qla2xxx] qla2x00_start_nvme_mq+0x3a2/0x4b0 [qla2xxx] qla_nvme_post_cmd+0x166/0x240 [qla2xxx] nvme_fc_start_fcp_op.part.0+0x119/0x2e0 [nvme_fc] blk_mq_dispatch_rq_list+0x17b/0x610
__blk_mq_sched_dispatch_requests+0xb0/0x140 blk_mq_sched_dispatch_requests+0x30/0x60
__blk_mq_run_hw_queue+0x35/0x90 __blk_mq_delay_run_hw_queue+0x161/0x180 blk_execute_rq+0xbe/0x160
__nvme_submit_sync_cmd+0x16f/0x220 [nvme_core] nvmf_connect_admin_queue+0x11a/0x170 [nvme_fabrics] nvme_fc_create_association.cold+0x50/0x3dc [nvme_fc] nvme_fc_connect_ctrl_work+0x19/0x30 [nvme_fc] process_one_work+0x1e8/0x3c0 On abort timeout, completion was called without checking if the I/O was already completed. Verify that I/O and abort request are indeed outstanding before attempting completion.
(CVE-2022-50493)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50493
https://security-tracker.debian.org/tracker/CVE-2022-50493
https://ubuntu.com/security/CVE-2022-50493

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50493

Plugin Information
Published: 2025/10/08, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269338 - Linux Distros Unpatched Vulnerability : CVE-2022-50498
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: eth: alx: take rtnl_lock on resume Zbynek reports that alx trips an rtnl assertion on resume: RTNL: assertion failed at net/core/dev.c (2891) RIP: 0010:netif_set_real_num_tx_queues+0x1ac/0x1c0 Call Trace: <TASK> __alx_open+0x230/0x570 [alx] alx_resume+0x54/0x80 [alx] ? pci_legacy_resume+0x80/0x80 dpm_run_callback+0x4a/0x150 device_resume+0x8b/0x190 async_resume+0x19/0x30 async_run_entry_fn+0x30/0x130 process_one_work+0x1e5/0x3b0 indeed the driver does not hold rtnl_lock during its internal close and re-open functions during suspend/resume. Note that this is not a huge bug as the driver implements its own locking, and does not implement changing the number of queues, but we need to silence the splat. (CVE-2022-50498)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50498
https://ubuntu.com/security/CVE-2022-50498

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50498

Plugin Information
Published: 2025/10/08, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269424 - Linux Distros Unpatched Vulnerability : CVE-2022-50500
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netdevsim: fix memory leak in nsim_drv_probe() when nsim_dev_resources_register() failed If some items in nsim_dev_resources_register() fail, memory leak will occur. The following is the memory leak information.
unreferenced object 0xffff888074c02600 (size 128): comm echo, pid 8159, jiffies 4294945184 (age 493.530s) hex dump (first 32 bytes): 40 47 ea 89 ff ff ff ff 01 00 00 00 00 00 00 00 @G.............. ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ backtrace: [<0000000011a31c98>] kmalloc_trace+0x22/0x60 [<0000000027384c69>] devl_resource_register+0x144/0x4e0 [<00000000a16db248>] nsim_drv_probe+0x37a/0x1260 [<000000007d1f448c>] really_probe+0x20b/0xb10 [<00000000c416848a>]
__driver_probe_device+0x1b3/0x4a0 [<00000000077e0351>] driver_probe_device+0x49/0x140 [<0000000054f2465a>]
__device_attach_driver+0x18c/0x2a0 [<000000008538f359>] bus_for_each_drv+0x151/0x1d0 [<0000000038e09747>]
__device_attach+0x1c9/0x4e0 [<00000000dd86e533>] bus_probe_device+0x1d5/0x280 [<00000000839bea35>] device_add+0xae0/0x1cb0 [<000000009c2abf46>] new_device_store+0x3b6/0x5f0 [<00000000fb823d7f>] bus_attr_store+0x72/0xa0 [<000000007acc4295>] sysfs_kf_write+0x106/0x160 [<000000005f50cb4d>] kernfs_fop_write_iter+0x3a8/0x5a0 [<0000000075eb41bf>] vfs_write+0x8f0/0xc80 (CVE-2022-50500)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50500
https://security-tracker.debian.org/tracker/CVE-2022-50500
https://ubuntu.com/security/CVE-2022-50500

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50500

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269381 - Linux Distros Unpatched Vulnerability : CVE-2022-50504
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- powerpc/rtas: avoid scheduling in rtas_os_term() It's unsafe to use rtas_busy_delay() to handle a busy status from the ibm,os-term RTAS function in rtas_os_term(): Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b BUG: sleeping function called from invalid context at arch/powerpc/kernel/rtas.c:618 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1, name: swapper/0 preempt_count: 2, expected: 0 CPU: 7 PID: 1 Comm: swapper/0 Tainted: G D 6.0.0-rc5-02182-gf8553a572277-dirty #9 Call Trace: [c000000007b8f000] [c000000001337110] dump_stack_lvl+0xb4/0x110 (unreliable) [c000000007b8f040] [c0000000002440e4] __might_resched+0x394/0x3c0 [c000000007b8f0e0] [c00000000004f680] rtas_busy_delay+0x120/0x1b0 [c000000007b8f100] [c000000000052d04] rtas_os_term+0xb8/0xf4 [c000000007b8f180] [c0000000001150fc] pseries_panic+0x50/0x68 [c000000007b8f1f0] [c000000000036354] ppc_panic_platform_handler+0x34/0x50 [c000000007b8f210] [c0000000002303c4] notifier_call_chain+0xd4/0x1c0 [c000000007b8f2b0] [c0000000002306cc] atomic_notifier_call_chain+0xac/0x1c0 [c000000007b8f2f0] [c0000000001d62b8] panic+0x228/0x4d0 [c000000007b8f390] [c0000000001e573c] do_exit+0x140c/0x1420 [c000000007b8f480] [c0000000001e586c] make_task_dead+0xdc/0x200 Use rtas_busy_delay_time() instead, which signals without side effects whether to attempt the ibm,os-term RTAS call again. (CVE-2022-50504)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50504
https://ubuntu.com/security/CVE-2022-50504

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50504

Plugin Information
Published: 2025/10/08, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
270184 - Linux Distros Unpatched Vulnerability : CVE-2022-50521
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() The ACPI buffer memory (out.pointer) returned by wmi_evaluate_method() is not freed after the call, so it leads to memory leak. The method results in ACPI buffer is not used, so just pass NULL to wmi_evaluate_method() which fixes the memory leak. (CVE-2022-50521)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50521
https://ubuntu.com/security/CVE-2022-50521

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50521

Plugin Information
Published: 2025/10/13, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269275 - Linux Distros Unpatched Vulnerability : CVE-2022-50537
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: firmware: raspberrypi: fix possible memory leak in rpi_firmware_probe() In rpi_firmware_probe(), if mbox_request_channel() fails, the 'fw'
will not be freed through rpi_firmware_delete(), fix this leak by calling kfree() in the error path.
(CVE-2022-50537)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50537
https://ubuntu.com/security/CVE-2022-50537

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50537

Plugin Information
Published: 2025/10/08, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
270169 - Linux Distros Unpatched Vulnerability : CVE-2022-50551
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() This patch fixes a shift- out-of-bounds in brcmfmac that occurs in BIT(chiprev) when a 'chiprev' provided by the device is too large. It should also not be equal to or greater than BITS_PER_TYPE(u32) as we do bitwise AND with a u32 variable and BIT(chiprev). The patch adds a check that makes the function return NULL if that is the case.
Note that the NULL case is later handled by the bus-specific caller, brcmf_usb_probe_cb() or brcmf_usb_reset_resume(), for example. Found by a modified version of syzkaller. UBSAN: shift-out-of- bounds in drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c shift exponent 151055786 is too large for 64-bit type 'long unsigned int' CPU: 0 PID: 1885 Comm: kworker/0:2 Tainted: G O 5.14.0+ #132 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 Workqueue: usb_hub_wq hub_event Call Trace: dump_stack_lvl+0x57/0x7d ubsan_epilogue+0x5/0x40
__ubsan_handle_shift_out_of_bounds.cold+0x53/0xdb ? lock_chain_count+0x20/0x20 brcmf_fw_alloc_request.cold+0x19/0x3ea ? brcmf_fw_get_firmwares+0x250/0x250 ? brcmf_usb_ioctl_resp_wait+0x1a7/0x1f0 brcmf_usb_get_fwname+0x114/0x1a0 ? brcmf_usb_reset_resume+0x120/0x120 ? number+0x6c4/0x9a0 brcmf_c_process_clm_blob+0x168/0x590 ? put_dec+0x90/0x90 ? enable_ptr_key_workfn+0x20/0x20 ? brcmf_common_pd_remove+0x50/0x50 ? rcu_read_lock_sched_held+0xa1/0xd0 brcmf_c_preinit_dcmds+0x673/0xc40 ? brcmf_c_set_joinpref_default+0x100/0x100 ? rcu_read_lock_sched_held+0xa1/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ? lock_acquire+0x19d/0x4e0 ? find_held_lock+0x2d/0x110 ? brcmf_usb_deq+0x1cc/0x260 ? mark_held_locks+0x9f/0xe0 ? lockdep_hardirqs_on_prepare+0x273/0x3e0 ?
_raw_spin_unlock_irqrestore+0x47/0x50 ? trace_hardirqs_on+0x1c/0x120 ? brcmf_usb_deq+0x1a7/0x260 ? brcmf_usb_rx_fill_all+0x5a/0xf0 brcmf_attach+0x246/0xd40 ? wiphy_new_nm+0x1476/0x1d50 ? kmemdup+0x30/0x40 brcmf_usb_probe+0x12de/0x1690 ? brcmf_usbdev_qinit.constprop.0+0x470/0x470 usb_probe_interface+0x25f/0x710 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 ? usb_match_id.part.0+0x88/0xc0 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 ? driver_allows_async_probing+0x120/0x120 bus_for_each_drv+0x123/0x1a0 ? bus_rescan_devices+0x20/0x20 ? lockdep_hardirqs_on_prepare+0x273/0x3e0 ? trace_hardirqs_on+0x1c/0x120 __device_attach+0x207/0x330 ? device_bind_driver+0xb0/0xb0 ? kobject_uevent_env+0x230/0x12c0 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 ? __mutex_unlock_slowpath+0xe7/0x660 ? __fw_devlink_link_to_suppliers+0x550/0x550 usb_set_configuration+0x984/0x1770 ? kernfs_create_link+0x175/0x230 usb_generic_driver_probe+0x69/0x90 usb_probe_device+0x9c/0x220 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 ? driver_allows_async_probing+0x120/0x120 bus_for_each_drv+0x123/0x1a0 ? bus_rescan_devices+0x20/0x20 ? lockdep_hardirqs_on_prepare+0x273/0x3e0 ? trace_hardirqs_on+0x1c/0x120 __device_attach+0x207/0x330 ? device_bind_driver+0xb0/0xb0 ? kobject_uevent_env+0x230/0x12c0 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 ? __fw_devlink_link_to_suppliers+0x550/0x550 usb_new_device.cold+0x463/0xf66 ? hub_disconnect+0x400/0x400 ? _raw_spin_unlock_irq+0x24/0x30 hub_event+0x10d5/0x3330 ? hub_port_debounce+0x280/0x280 ? __lock_acquire+0x1671/0x5790 ? wq_calc_node_cpumask+0x170/0x2a0 ? lock_release+0x640/0x640 ? rcu_read_lock_sched_held+0xa1/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ? lockdep_hardirqs_on_prepare+0x273/0x3e0 process_one_work+0x873/0x13e0 ? lock_release+0x640/0x640 ? pwq_dec_nr_in_flight+0x320/0x320 ? rwlock_bug.part.0+0x90/0x90 worker_thread+0x8b/0xd10 ?
__kthread_parkme+0xd9/0x1d0 ? pr ---truncated--- (CVE-2022-50551)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50551
https://ubuntu.com/security/CVE-2022-50551

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50551

Plugin Information
Published: 2025/10/13, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271601 - Linux Distros Unpatched Vulnerability : CVE-2022-50561
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: iio: fix memory leak in iio_device_register_eventset() When iio_device_register_sysfs_group() returns failed, iio_device_register_eventset() needs to free attrs array. Otherwise, kmemleak would scan & report memory leak as below: unreferenced object 0xffff88810a1cc3c0 (size 32): comm 100-i2c-vcnl302, pid 728, jiffies 4295052307 (age 156.027s) backtrace: __kmalloc+0x46/0x1b0 iio_device_register_eventset at drivers/iio/industrialio-event.c:541 __iio_device_register at drivers/iio/industrialio-core.c:1959
__devm_iio_device_register at drivers/iio/industrialio-core.c:2040 (CVE-2022-50561)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50561
https://ubuntu.com/security/CVE-2022-50561

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50561

Plugin Information
Published: 2025/10/27, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271605 - Linux Distros Unpatched Vulnerability : CVE-2022-50566
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mtd: Fix device name leak when register device failed in add_mtd_device() There is a kmemleak when register device failed: unreferenced object 0xffff888101aab550 (size 8): comm insmod, pid 3922, jiffies 4295277753 (age 925.408s) hex dump (first 8 bytes): 6d 74 64 30 00 88 ff ff mtd0.... backtrace:
[<00000000bde26724>] __kmalloc_node_track_caller+0x4e/0x150 [<000000003c32b416>] kvasprintf+0xb0/0x130 [<000000001f7a8f15>] kobject_set_name_vargs+0x2f/0xb0 [<000000006e781163>] dev_set_name+0xab/0xe0 [<00000000e30d0c78>] add_mtd_device+0x4bb/0x700 [<00000000f3d34de7>] mtd_device_parse_register+0x2ac/0x3f0 [<00000000c0d88488>] 0xffffffffa0238457 [<00000000b40d0922>] 0xffffffffa02a008f [<0000000023d17b9d>] do_one_initcall+0x87/0x2a0 [<00000000770f6ca6>] do_init_module+0xdf/0x320 [<000000007b6768fe>] load_module+0x2f98/0x3330 [<00000000346bed5a>] __do_sys_finit_module+0x113/0x1b0 [<00000000674c2290>] do_syscall_64+0x35/0x80 [<000000004c6a8d97>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 If register device failed, should call put_device() to give up the reference. (CVE-2022-50566)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50566
https://ubuntu.com/security/CVE-2022-50566

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50566

Plugin Information
Published: 2025/10/27, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271594 - Linux Distros Unpatched Vulnerability : CVE-2022-50575
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource() As 'kdata.num' is user-controlled data, if user tries to allocate memory larger than(>=) MAX_ORDER, then kcalloc() will fail, it creates a stack trace and messes up dmesg with a warning. Call trace: -> privcmd_ioctl --> privcmd_ioctl_mmap_resource Add __GFP_NOWARN in order to avoid too large allocation warning. This is detected by static analysis using smatch. (CVE-2022-50575)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50575
https://ubuntu.com/security/CVE-2022-50575

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50575

Plugin Information
Published: 2025/10/27, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271596 - Linux Distros Unpatched Vulnerability : CVE-2022-50577
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ima: Fix memory leak in
__ima_inode_hash() Commit f3cc6b25dcc5 (ima: always measure and audit files in policy) lets measurement or audit happen even if the file digest cannot be calculated. As a result, iint->ima_hash could have been allocated despite ima_collect_measurement() returning an error. Since ima_hash belongs to a temporary inode metadata structure, declared at the beginning of __ima_inode_hash(), just add a kfree() call if ima_collect_measurement() returns an error different from -ENOMEM (in that case, ima_hash should not have been allocated). (CVE-2022-50577)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50577
https://ubuntu.com/security/CVE-2022-50577

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50577

Plugin Information
Published: 2025/10/27, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277770 - Linux Distros Unpatched Vulnerability : CVE-2022-50614
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- misc: pci_endpoint_test: Fix pci_endpoint_test_{copy,write,read}() panic The dma_map_single() doesn't permit zero length mapping. It causes a follow panic. A panic was reported on arm64: [ 60.137988]
------------[ cut here ]------------ [ 60.142630] kernel BUG at kernel/dma/swiotlb.c:624! [ 60.147508] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 60.152992] Modules linked in: dw_hdmi_cec crct10dif_ce simple_bridge rcar_fdp1 vsp1 rcar_vin videobuf2_vmalloc rcar_csi2 v4l 2_mem2mem videobuf2_dma_contig videobuf2_memops pci_endpoint_test videobuf2_v4l2 videobuf2_common rcar_fcp v4l2_fwnode v4l2_asyn c videodev mc gpio_bd9571mwv max9611 pwm_rcar ccree at24 authenc libdes phy_rcar_gen3_usb3 usb_dmac display_connector pwm_bl [ 60.186252] CPU: 0 PID: 508 Comm: pcitest Not tainted 6.0.0-rc1rpci-dev+ #237 [ 60.193387] Hardware name: Renesas Salvator-X 2nd version board based on r8a77951 (DT) [ 60.201302] pstate:
00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 60.208263] pc :
swiotlb_tbl_map_single+0x2c0/0x590 [ 60.213149] lr : swiotlb_map+0x88/0x1f0 [ 60.216982] sp :
ffff80000a883bc0 [ 60.220292] x29: ffff80000a883bc0 x28: 0000000000000000 x27: 0000000000000000 [ 60.227430] x26: 0000000000000000 x25: ffff0004c0da20d0 x24: ffff80000a1f77c0 [ 60.234567] x23:
0000000000000002 x22: 0001000040000010 x21: 000000007a000000 [ 60.241703] x20: 0000000000200000 x19:
0000000000000000 x18: 0000000000000000 [ 60.248840] x17: 0000000000000000 x16: 0000000000000000 x15:
ffff0006ff7b9180 [ 60.255977] x14: ffff0006ff7b9180 x13: 0000000000000000 x12: 0000000000000000 [ 60.263113] x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 [ 60.270249] x8 :
0001000000000010 x7 : ffff0004c6754b20 x6 : 0000000000000000 [ 60.277385] x5 : ffff0004c0da2090 x4 :
0000000000000000 x3 : 0000000000000001 [ 60.284521] x2 : 0000000040000000 x1 : 0000000000000000 x0 :
0000000040000010 [ 60.291658] Call trace: [ 60.294100] swiotlb_tbl_map_single+0x2c0/0x590 [ 60.298629] swiotlb_map+0x88/0x1f0 [ 60.302115] dma_map_page_attrs+0x188/0x230 [ 60.306299] pci_endpoint_test_ioctl+0x5e4/0xd90 [pci_endpoint_test] [ 60.312660] __arm64_sys_ioctl+0xa8/0xf0 [ 60.316583] invoke_syscall+0x44/0x108 [ 60.320334] el0_svc_common.constprop.0+0xcc/0xf0 [ 60.325038] do_el0_svc+0x2c/0xb8 [ 60.328351] el0_svc+0x2c/0x88 [ 60.331406] el0t_64_sync_handler+0xb8/0xc0 [ 60.335587] el0t_64_sync+0x18c/0x190 [ 60.339251] Code: 52800013 d2e00414 35fff45c d503201f (d4210000) [ 60.345344] ---[ end trace 0000000000000000 ]--- To fix it, this patch adds a checking the payload length if it is zero. (CVE-2022-50614)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50614
https://ubuntu.com/security/CVE-2022-50614

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50614

Plugin Information
Published: 2025/12/08, Modified: 2025/12/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277781 - Linux Distros Unpatched Vulnerability : CVE-2022-50618
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mmc: meson-gx: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, it will lead two issues: 1. The memory that allocated in mmc_alloc_host() is leaked. 2. In the remove() path, mmc_remove_host() will be called to delete device, but it's not added yet, it will lead a kernel crash because of null-ptr-deref in device_del(). Fix this by checking the return value and goto error path which will call mmc_free_host(). (CVE-2022-50618)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50618
https://ubuntu.com/security/CVE-2022-50618

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50618

Plugin Information
Published: 2025/12/08, Modified: 2025/12/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277780 - Linux Distros Unpatched Vulnerability : CVE-2022-50621
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dm: verity-loadpin: Only trust verity targets with enforcement Verity targets can be configured to ignore corrupted data blocks. LoadPin must only trust verity targets that are configured to perform some kind of enforcement when data corruption is detected, like returning an error, restarting the system or triggering a panic. (CVE-2022-50621)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50621
https://ubuntu.com/security/CVE-2022-50621

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50621

Plugin Information
Published: 2025/12/08, Modified: 2025/12/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278092 - Linux Distros Unpatched Vulnerability : CVE-2022-50646
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: hpsa: Fix possible memory leak in hpsa_init_one() The hpda_alloc_ctlr_info() allocates h and its field reply_map. However, in hpsa_init_one(), if alloc_percpu() failed, the hpsa_init_one() jumps to clean1 directly, which frees h and leaks the h->reply_map. Fix by calling hpda_free_ctlr_info() to release h->replay_map and h instead free h directly. (CVE-2022-50646)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50646
https://ubuntu.com/security/CVE-2022-50646

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50646

Plugin Information
Published: 2025/12/10, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278093 - Linux Distros Unpatched Vulnerability : CVE-2022-50648
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ftrace: Fix recursive locking direct_mutex in ftrace_modify_direct_caller Naveen reported recursive locking of direct_mutex with sample ftrace-direct-modify.ko: [ 74.762406] WARNING: possible recursive locking detected [ 74.762887] 6.0.0-rc6+ #33 Not tainted [ 74.763216]
-------------------------------------------- [ 74.763672] event-sample-fn/1084 is trying to acquire lock:
[ 74.764152] ffffffff86c9d6b0 (direct_mutex){+.+.}-{3:3}, at: \ register_ftrace_function+0x1f/0x180 [ 74.764922] [ 74.764922] but task is already holding lock: [ 74.765421] ffffffff86c9d6b0 (direct_mutex){+.+.}-{3:3}, at: \ modify_ftrace_direct+0x34/0x1f0 [ 74.766142] [ 74.766142] other info that might help us debug this: [ 74.766701] Possible unsafe locking scenario: [ 74.766701] [ 74.767216] CPU0 [ 74.767437] ---- [ 74.767656] lock(direct_mutex); [ 74.767952] lock(direct_mutex); [ 74.768245] [ 74.768245] *** DEADLOCK *** [ 74.768245] [ 74.768750] May be due to missing lock nesting notation [ 74.768750] [ 74.769332] 1 lock held by event-sample-fn/1084: [ 74.769731] #0: ffffffff86c9d6b0 (direct_mutex){+.+.}-{3:3}, at: \ modify_ftrace_direct+0x34/0x1f0 [ 74.770496] [ 74.770496] stack backtrace: [ 74.770884] CPU: 4 PID: 1084 Comm: event-sample-fn Not tainted ... [ 74.771498] Hardware name:
QEMU Standard PC (i440FX + PIIX, 1996), ... [ 74.772474] Call Trace: [ 74.772696] <TASK> [ 74.772896] dump_stack_lvl+0x44/0x5b [ 74.773223] __lock_acquire.cold.74+0xac/0x2b7 [ 74.773616] lock_acquire+0xd2/0x310 [ 74.773936] ? register_ftrace_function+0x1f/0x180 [ 74.774357] ? lock_is_held_type+0xd8/0x130 [ 74.774744] ? my_tramp2+0x11/0x11 [ftrace_direct_modify] [ 74.775213]
__mutex_lock+0x99/0x1010 [ 74.775536] ? register_ftrace_function+0x1f/0x180 [ 74.775954] ? slab_free_freelist_hook.isra.43+0x115/0x160 [ 74.776424] ? ftrace_set_hash+0x195/0x220 [ 74.776779] ? register_ftrace_function+0x1f/0x180 [ 74.777194] ? kfree+0x3e1/0x440 [ 74.777482] ? my_tramp2+0x11/0x11 [ftrace_direct_modify] [ 74.777941] ? __schedule+0xb40/0xb40 [ 74.778258] ? register_ftrace_function+0x1f/0x180 [ 74.778672] ? my_tramp1+0xf/0xf [ftrace_direct_modify] [ 74.779128] register_ftrace_function+0x1f/0x180 [ 74.779527] ? ftrace_set_filter_ip+0x33/0x70 [ 74.779910] ?
__schedule+0xb40/0xb40 [ 74.780231] ? my_tramp1+0xf/0xf [ftrace_direct_modify] [ 74.780678] ? my_tramp2+0x11/0x11 [ftrace_direct_modify] [ 74.781147] ftrace_modify_direct_caller+0x5b/0x90 [ 74.781563] ? 0xffffffffa0201000 [ 74.781859] ? my_tramp1+0xf/0xf [ftrace_direct_modify] [ 74.782309] modify_ftrace_direct+0x1b2/0x1f0 [ 74.782690] ? __schedule+0xb40/0xb40 [ 74.783014] ? simple_thread+0x2a/0xb0 [ftrace_direct_modify] [ 74.783508] ? __schedule+0xb40/0xb40 [ 74.783832] ? my_tramp2+0x11/0x11 [ftrace_direct_modify] [ 74.784294] simple_thread+0x76/0xb0 [ftrace_direct_modify] [ 74.784766] kthread+0xf5/0x120 [ 74.785052] ? kthread_complete_and_exit+0x20/0x20 [ 74.785464] ret_from_fork+0x22/0x30 [ 74.785781] </TASK> Fix this by using register_ftrace_function_nolock in ftrace_modify_direct_caller. (CVE-2022-50648)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50648
https://ubuntu.com/security/CVE-2022-50648

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
3.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
3.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50648

Plugin Information
Published: 2025/12/10, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278087 - Linux Distros Unpatched Vulnerability : CVE-2022-50651
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ethtool: eeprom: fix null-deref on genl_info in dump The similar fix as commit 46cdedf2a0fa (ethtool:
pse-pd: fix null-deref on genl_info in dump) is also needed for ethtool eeprom. (CVE-2022-50651)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50651
https://ubuntu.com/security/CVE-2022-50651

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50651

Plugin Information
Published: 2025/12/10, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278091 - Linux Distros Unpatched Vulnerability : CVE-2022-50653
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mmc: atmel-mci: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, it will lead two issues: 1. The memory that allocated in mmc_alloc_host() is leaked. 2. In the remove() path, mmc_remove_host() will be called to delete device, but it's not added yet, it will lead a kernel crash because of null-ptr-deref in device_del(). So fix this by checking the return value and calling mmc_free_host() in the error path. (CVE-2022-50653)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50653
https://ubuntu.com/security/CVE-2022-50653

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50653

Plugin Information
Published: 2025/12/10, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278038 - Linux Distros Unpatched Vulnerability : CVE-2022-50654
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Fix panic due to wrong pageattr of im->image In the scenario where livepatch and kretfunc coexist, the pageattr of im->image is rox after arch_prepare_bpf_trampoline in bpf_trampoline_update, and then modify_fentry or register_fentry returns -EAGAIN from bpf_tramp_ftrace_ops_func, the BPF_TRAMP_F_ORIG_STACK flag will be configured, and arch_prepare_bpf_trampoline will be re-executed. At this time, because the pageattr of im->image is rox, arch_prepare_bpf_trampoline will read and write im->image, which causes a fault. as follows: insmod livepatch-sample.ko # samples/livepatch/livepatch- sample.c bpftrace -e 'kretfunc:cmdline_proc_show {}' BUG: unable to handle page fault for address:
ffffffffa0206000 PGD 322d067 P4D 322d067 PUD 322e063 PMD 1297e067 PTE d428061 Oops: 0003 [#1] PREEMPT SMP PTI CPU: 2 PID: 270 Comm: bpftrace Tainted: G E K 6.1.0 #5 RIP:
0010:arch_prepare_bpf_trampoline+0xed/0x8c0 RSP: 0018:ffffc90001083ad8 EFLAGS: 00010202 RAX:
ffffffffa0206000 RBX: 0000000000000020 RCX: 0000000000000000 RDX: ffffffffa0206001 RSI: ffffffffa0206000 RDI: 0000000000000030 RBP: ffffc90001083b70 R08: 0000000000000066 R09: ffff88800f51b400 R10:
000000002e72c6e5 R11: 00000000d0a15080 R12: ffff8880110a68c8 R13: 0000000000000000 R14: ffff88800f51b400 R15: ffffffff814fec10 FS: 00007f87bc0dc780(0000) GS:ffff88803e600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffa0206000 CR3: 0000000010b70000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6:
00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> bpf_trampoline_update+0x25a/0x6b0
__bpf_trampoline_link_prog+0x101/0x240 bpf_trampoline_link_prog+0x2d/0x50 bpf_tracing_prog_attach+0x24c/0x530 bpf_raw_tp_link_attach+0x73/0x1d0 __sys_bpf+0x100e/0x2570
__x64_sys_bpf+0x1c/0x30 do_syscall_64+0x5b/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd With this patch, when modify_fentry or register_fentry returns -EAGAIN from bpf_tramp_ftrace_ops_func, the pageattr of im->image will be reset to nx+rw. (CVE-2022-50654)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50654
https://ubuntu.com/security/CVE-2022-50654

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50654

Plugin Information
Published: 2025/12/10, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278094 - Linux Distros Unpatched Vulnerability : CVE-2022-50655
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ppp: associate skb with a device at tx Syzkaller triggered flow dissector warning with the following: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSACTIVE(r0, 0x40107446, &(0x7f0000000240)={0x2, &(0x7f0000000180)=[{0x20, 0x0, 0x0, 0xfffff034}, {0x6}]}) pwritev(r0, &(0x7f0000000040)=[{&(0x7f0000000140)='\x00!', 0x2}], 0x1, 0x0, 0x0) [ 9.485814] WARNING: CPU: 3 PID: 329 at net/core/flow_dissector.c:1016
__skb_flow_dissect+0x1ee0/0x1fa0 [ 9.485929] skb_get_poff+0x53/0xa0 [ 9.485937] bpf_skb_get_pay_offset+0xe/0x20 [ 9.485944] ? ppp_send_frame+0xc2/0x5b0 [ 9.485949] ?
_raw_spin_unlock_irqrestore+0x40/0x60 [ 9.485958] ? __ppp_xmit_process+0x7a/0xe0 [ 9.485968] ? ppp_xmit_process+0x5b/0xb0 [ 9.485974] ? ppp_write+0x12a/0x190 [ 9.485981] ? do_iter_write+0x18e/0x2d0 [ 9.485987] ? __import_iovec+0x30/0x130 [ 9.485997] ? do_pwritev+0x1b6/0x240 [ 9.486016] ? trace_hardirqs_on+0x47/0x50 [ 9.486023] ? __x64_sys_pwritev+0x24/0x30 [ 9.486026] ? do_syscall_64+0x3d/0x80 [ 9.486031] ? entry_SYSCALL_64_after_hwframe+0x63/0xcd Flow dissector tries to find skb net namespace either via device or via socket. Neigher is set in ppp_send_frame, so let's manually use ppp->dev. (CVE-2022-50655)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50655
https://ubuntu.com/security/CVE-2022-50655

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50655

Plugin Information
Published: 2025/12/10, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277969 - Linux Distros Unpatched Vulnerability : CVE-2022-50665
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath11k: fix failed to find the peer with peer_id 0 when disconnected It has a fail log which is ath11k_dbg in ath11k_dp_rx_process_mon_status(), as below, it will not print when debug_mask is not set ATH11K_DBG_DATA. ath11k_dbg(ab, ATH11K_DBG_DATA, failed to find the peer with peer_id %d , ppdu_info.peer_id); When run scan with station disconnected, the peer_id is 0 for case HAL_RX_MPDU_START in ath11k_hal_rx_parse_mon_status_tlv() which called from ath11k_dp_rx_process_mon_status(), and the peer_id of ppdu_info is reset to 0 in the while loop, so it does not match condition of the check if (ppdu_info->peer_id == HAL_INVALID_PEERID in the loop, and then the log failed to find the peer with peer_id 0 print after the check in the loop, it is below call stack when debug_mask is set ATH11K_DBG_DATA. The reason is this commit 01d2f285e3e5 (ath11k: decode HE status tlv) add memset(ppdu_info, 0, sizeof(struct hal_rx_mon_ppdu_info)) in ath11k_dp_rx_process_mon_status(), but the commit does not initialize the peer_id to HAL_INVALID_PEERID, then lead the check mis-match. Callstack of the failed log: [12335.689072] RIP: 0010:ath11k_dp_rx_process_mon_status+0x9ea/0x1020 [ath11k] [12335.689157] Code: 89 ff e8 f9 10 00 00 be 01 00 00 00 4c 89 f7 e8 dc 4b 4e de 48 8b 85 38 ff ff ff c7 80 e4 07 00 00 01 00 00 00 e9 20 f8 ff ff <0f> 0b 41 0f b7 96 be 06 00 00 48 c7 c6 b8 50 44 c1 4c 89 ff e8 fd [12335.689180] RSP: 0018:ffffb874001a4ca0 EFLAGS: 00010246 [12335.689210] RAX: 0000000000000000 RBX:
ffff995642cbd100 RCX: 0000000000000000 [12335.689229] RDX: 0000000000000000 RSI: 0000000000000000 RDI:
ffff99564212cd18 [12335.689248] RBP: ffffb874001a4dc0 R08: 0000000000000001 R09: 0000000000000000 [12335.689268] R10: 0000000000000220 R11: ffffb874001a48e8 R12: ffff995642473d40 [12335.689286] R13:
ffff99564212c5b8 R14: ffff9956424736a0 R15: ffff995642120000 [12335.689303] FS: 0000000000000000(0000) GS:ffff995739000000(0000) knlGS:0000000000000000 [12335.689323] CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 [12335.689341] CR2: 00007f43c5d5e039 CR3: 000000011c012005 CR4: 00000000000606e0 [12335.689360] Call Trace: [12335.689377] <IRQ> [12335.689418] ? rcu_read_lock_held_common+0x12/0x50 [12335.689447] ? rcu_read_lock_sched_held+0x25/0x80 [12335.689471] ? rcu_read_lock_held_common+0x12/0x50 [12335.689504] ath11k_dp_rx_process_mon_rings+0x8d/0x4f0 [ath11k] [12335.689578] ? ath11k_dp_rx_process_mon_rings+0x8d/0x4f0 [ath11k] [12335.689653] ? lock_acquire+0xef/0x360 [12335.689681] ? rcu_read_lock_sched_held+0x25/0x80 [12335.689713] ath11k_dp_service_mon_ring+0x38/0x60 [ath11k] [12335.689784] ? ath11k_dp_rx_process_mon_rings+0x4f0/0x4f0 [ath11k] [12335.689860] call_timer_fn+0xb2/0x2f0 [12335.689897] ? ath11k_dp_rx_process_mon_rings+0x4f0/0x4f0 [ath11k] [12335.689970] run_timer_softirq+0x21f/0x540 [12335.689999] ? ktime_get+0xad/0x160 [12335.690025] ? lapic_next_deadline+0x2c/0x40 [12335.690053] ? clockevents_program_event+0x82/0x100 [12335.690093]
__do_softirq+0x151/0x4a8 [12335.690135] irq_exit_rcu+0xc9/0x100 [12335.690165] sysvec_apic_timer_interrupt+0xa8/0xd0 [12335.690189] </IRQ> [12335.690204] <TASK> [12335.690225] asm_sysvec_apic_timer_interrupt+0x12/0x20 Reset the default value to HAL_INVALID_PEERID each time after memset of ppdu_info as well as others memset which existed in function ath11k_dp_rx_process_mon_status(), then the failed log disappeared. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3 (CVE-2022-50665)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50665
https://ubuntu.com/security/CVE-2022-50665

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50665

Plugin Information
Published: 2025/12/09, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279937 - Linux Distros Unpatched Vulnerability : CVE-2022-50698
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ASoC: da7219: Fix an error handling path in da7219_register_dai_clks() If clk_hw_register() fails, the corresponding clk should not be unregistered. To handle errors from loops, clean up partial iterations before doing the goto. So add a clk_hw_unregister(). Then use a while (--i >= 0) loop in the unwind section. (CVE-2022-50698)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50698
https://ubuntu.com/security/CVE-2022-50698

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50698

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279932 - Linux Distros Unpatched Vulnerability : CVE-2022-50699
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context() The following warning was triggered on a hardware environment: SELinux: Converting 162 SID table entries... BUG: sleeping function called from invalid context at __might_sleep+0x60/0x74 0x0 in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 5943, name: tar CPU: 7 PID: 5943 Comm: tar Tainted: P O 5.10.0 #1 Call trace:
dump_backtrace+0x0/0x1c8 show_stack+0x18/0x28 dump_stack+0xe8/0x15c ___might_sleep+0x168/0x17c
__might_sleep+0x60/0x74 __kmalloc_track_caller+0xa0/0x7dc kstrdup+0x54/0xac convert_context+0x48/0x2e4 sidtab_context_to_sid+0x1c4/0x36c security_context_to_sid_core+0x168/0x238 security_context_to_sid_default+0x14/0x24 inode_doinit_use_xattr+0x164/0x1e4 inode_doinit_with_dentry+0x1c0/0x488 selinux_d_instantiate+0x20/0x34 security_d_instantiate+0x70/0xbc d_splice_alias+0x4c/0x3c0 ext4_lookup+0x1d8/0x200 [ext4] __lookup_slow+0x12c/0x1e4 walk_component+0x100/0x200 path_lookupat+0x88/0x118 filename_lookup+0x98/0x130 user_path_at_empty+0x48/0x60 vfs_statx+0x84/0x140 vfs_fstatat+0x20/0x30 __se_sys_newfstatat+0x30/0x74
__arm64_sys_newfstatat+0x1c/0x2c el0_svc_common.constprop.0+0x100/0x184 do_el0_svc+0x1c/0x2c el0_svc+0x20/0x34 el0_sync_handler+0x80/0x17c el0_sync+0x13c/0x140 SELinux: Context system_u:object_r:pssp_rsyslog_log_t:s0:c0 is not valid (left unmapped). It was found that within a critical section of spin_lock_irqsave in sidtab_context_to_sid(), convert_context() (hooked by sidtab_convert_params.func) might cause the process to sleep via allocating memory with GFP_KERNEL, which is problematic. As Ondrej pointed out [1], convert_context()/sidtab_convert_params.func has another caller sidtab_convert_tree(), which is okay with GFP_KERNEL. Therefore, fix this problem by adding a gfp_t argument for convert_context()/sidtab_convert_params.func and pass GFP_KERNEL/_ATOMIC properly in individual callers. [PM: wrap long BUG() output lines, tweak subject line] (CVE-2022-50699)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50699
https://ubuntu.com/security/CVE-2022-50699

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50699

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279742 - Linux Distros Unpatched Vulnerability : CVE-2022-50700
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath10k: Delay the unmapping of the buffer On WCN3990, we are seeing a rare scenario where copy engine hardware is sending a copy complete interrupt to the host driver while still processing the buffer that the driver has sent, this is leading into an SMMU fault triggering kernel panic. This is happening on copy engine channel 3 (CE3) where the driver normally enqueues WMI commands to the firmware. Upon receiving a copy complete interrupt, host driver will immediately unmap and frees the buffer presuming that hardware has processed the buffer. In the issue case, upon receiving copy complete interrupt, host driver will unmap and free the buffer but since hardware is still accessing the buffer (which in this case got unmapped in parallel), SMMU hardware will trigger an SMMU fault resulting in a kernel panic. In order to avoid this, as a work around, add a delay before unmapping the copy engine source DMA buffer. This is conditionally done for WCN3990 and only for the CE3 channel where issue is seen. Below is the crash signature: wifi smmu error: kernel: [ 10.120965] arm-smmu 15000000.iommu: Unhandled context fault:
fsr=0x402, iova=0x7fdfd8ac0, fsynr=0x500003,cbfrsynra=0xc1, cb=6 arm-smmu 15000000.iommu: Unhandled context fault:fsr=0x402, iova=0x7fe06fdc0, fsynr=0x710003, cbfrsynra=0xc1, cb=6 qcom-q6v5-mss 4080000.remoteproc: fatal error received: err_qdi.c:1040:EF:wlan_process:0x1:WLAN RT:0x2091:
cmnos_thread.c:3998:Asserted in copy_engine.c:AXI_ERROR_DETECTED:2149 remoteproc remoteproc0: crash detected in 4080000.remoteproc: type fatal error <3> remoteproc remoteproc0: handling crash #1 in 4080000.remoteproc pc : __arm_lpae_unmap+0x500/0x514 lr : __arm_lpae_unmap+0x4bc/0x514 sp :
ffffffc011ffb530 x29: ffffffc011ffb590 x28: 0000000000000000 x27: 0000000000000000 x26: 0000000000000004 x25: 0000000000000003 x24: ffffffc011ffb890 x23: ffffffa762ef9be0 x22: ffffffa77244ef00 x21:
0000000000000009 x20: 00000007fff7c000 x19: 0000000000000003 x18: 0000000000000000 x17: 0000000000000004 x16: ffffffd7a357d9f0 x15: 0000000000000000 x14: 00fd5d4fa7ffffff x13: 000000000000000e x12:
0000000000000000 x11: 00000000ffffffff x10: 00000000fffffe00 x9 : 000000000000017c x8 : 000000000000000c x7 : 0000000000000000 x6 : ffffffa762ef9000 x5 : 0000000000000003 x4 : 0000000000000004 x3 :
0000000000001000 x2 : 00000007fff7c000 x1 : ffffffc011ffb890 x0 : 0000000000000000 Call trace:
__arm_lpae_unmap+0x500/0x514 __arm_lpae_unmap+0x4bc/0x514 __arm_lpae_unmap+0x4bc/0x514 arm_lpae_unmap_pages+0x78/0xa4 arm_smmu_unmap_pages+0x78/0x104 __iommu_unmap+0xc8/0x1e4 iommu_unmap_fast+0x38/0x48 __iommu_dma_unmap+0x84/0x104 iommu_dma_free+0x34/0x50 dma_free_attrs+0xa4/0xd0 ath10k_htt_rx_free+0xc4/0xf4 [ath10k_core] ath10k_core_stop+0x64/0x7c [ath10k_core] ath10k_halt+0x11c/0x180 [ath10k_core] ath10k_stop+0x54/0x94 [ath10k_core] drv_stop+0x48/0x1c8 [mac80211] ieee80211_do_open+0x638/0x77c [mac80211] ieee80211_open+0x48/0x5c [mac80211] __dev_open+0xb4/0x174
__dev_change_flags+0xc4/0x1dc dev_change_flags+0x3c/0x7c devinet_ioctl+0x2b4/0x580 inet_ioctl+0xb0/0x1b4 sock_do_ioctl+0x4c/0x16c compat_ifreq_ioctl+0x1cc/0x35c compat_sock_ioctl+0x110/0x2ac
__arm64_compat_sys_ioctl+0xf4/0x3e0 el0_svc_common+0xb4/0x17c el0_svc_compat_handler+0x2c/0x58 el0_svc_compat+0x8/0x2c Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.2.0-01387-QCAHLSWMTPLZ-1 (CVE-2022-50700)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50700
https://security-tracker.debian.org/tracker/CVE-2022-50700
https://ubuntu.com/security/CVE-2022-50700

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50700

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279918 - Linux Distros Unpatched Vulnerability : CVE-2022-50701
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host SDIO may need addtional 511 bytes to align bus operation. If the tailroom of this skb is not big enough, we would access invalid memory region. For low level operation, increase skb size to keep valid memory access in SDIO host. Error message: [69.951] BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0xe9/0x1a0 [69.951] Read of size 64 at addr ffff88811c9cf000 by task kworker/u16:7/451 [69.951] CPU: 4 PID: 451 Comm: kworker/u16:7 Tainted: G W OE 6.1.0-rc5 #1 [69.951] Workqueue: kvub300c vub300_cmndwork_thread [vub300] [69.951] Call Trace: [69.951] <TASK> [69.952] dump_stack_lvl+0x49/0x63 [69.952] print_report+0x171/0x4a8 [69.952] kasan_report+0xb4/0x130 [69.952] kasan_check_range+0x149/0x1e0 [69.952] memcpy+0x24/0x70 [69.952] sg_copy_buffer+0xe9/0x1a0 [69.952] sg_copy_to_buffer+0x12/0x20 [69.952]
__command_write_data.isra.0+0x23c/0xbf0 [vub300] [69.952] vub300_cmndwork_thread+0x17f3/0x58b0 [vub300] [69.952] process_one_work+0x7ee/0x1320 [69.952] worker_thread+0x53c/0x1240 [69.952] kthread+0x2b8/0x370 [69.952] ret_from_fork+0x1f/0x30 [69.952] </TASK> [69.952] Allocated by task 854: [69.952] kasan_save_stack+0x26/0x50 [69.952] kasan_set_track+0x25/0x30 [69.952] kasan_save_alloc_info+0x1b/0x30 [69.952] __kasan_kmalloc+0x87/0xa0 [69.952] __kmalloc_node_track_caller+0x63/0x150 [69.952] kmalloc_reserve+0x31/0xd0 [69.952] __alloc_skb+0xfc/0x2b0 [69.952] __mt76_mcu_msg_alloc+0xbf/0x230 [mt76] [69.952] mt76_mcu_send_and_get_msg+0xab/0x110 [mt76] [69.952] __mt76_mcu_send_firmware.cold+0x94/0x15d [mt76] [69.952] mt76_connac_mcu_send_ram_firmware+0x415/0x54d [mt76_connac_lib] [69.952] mt76_connac2_load_ram.cold+0x118/0x4bc [mt76_connac_lib] [69.952] mt7921_run_firmware.cold+0x2e9/0x405 [mt7921_common] [69.952] mt7921s_mcu_init+0x45/0x80 [mt7921s] [69.953] mt7921_init_work+0xe1/0x2a0 [mt7921_common] [69.953] process_one_work+0x7ee/0x1320 [69.953] worker_thread+0x53c/0x1240 [69.953] kthread+0x2b8/0x370 [69.953] ret_from_fork+0x1f/0x30 [69.953] The buggy address belongs to the object at ffff88811c9ce800 which belongs to the cache kmalloc-2k of size 2048 [69.953] The buggy address is located 0 bytes to the right of 2048-byte region [ffff88811c9ce800, ffff88811c9cf000) [69.953] Memory state around the buggy address: [69.953] ffff88811c9cef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [69.953] ffff88811c9cef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [69.953] >ffff88811c9cf000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [69.953] ^ [69.953] ffff88811c9cf080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [69.953] ffff88811c9cf100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc (CVE-2022-50701)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50701
https://ubuntu.com/security/CVE-2022-50701

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)
CVSS v3.0 Temporal Score
5.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.0
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50701

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279945 - Linux Distros Unpatched Vulnerability : CVE-2022-50702
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vdpa_sim: fix possible memory leak in vdpasim_net_init() and vdpasim_blk_init() Inject fault while probing module, if device_register() fails in vdpasim_net_init() or vdpasim_blk_init(), but the refcount of kobject is not decreased to 0, the name allocated in dev_set_name() is leaked. Fix this by calling put_device(), so that name can be freed in callback function kobject_cleanup(). (vdpa_sim_net) unreferenced object 0xffff88807eebc370 (size 16): comm modprobe, pid 3848, jiffies 4362982860 (age 18.153s) hex dump (first 16 bytes): 76 64 70 61 73 69 6d 5f 6e 65 74 00 6b 6b 6b a5 vdpasim_net.kkk.
backtrace: [<ffffffff8174f19e>] __kmalloc_node_track_caller+0x4e/0x150 [<ffffffff81731d53>] kstrdup+0x33/0x60 [<ffffffff83a5d421>] kobject_set_name_vargs+0x41/0x110 [<ffffffff82d87aab>] dev_set_name+0xab/0xe0 [<ffffffff82d91a23>] device_add+0xe3/0x1a80 [<ffffffffa0270013>] 0xffffffffa0270013 [<ffffffff81001c27>] do_one_initcall+0x87/0x2e0 [<ffffffff813739cb>] do_init_module+0x1ab/0x640 [<ffffffff81379d20>] load_module+0x5d00/0x77f0 [<ffffffff8137bc40>] __do_sys_finit_module+0x110/0x1b0 [<ffffffff83c4d505>] do_syscall_64+0x35/0x80 [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 (vdpa_sim_blk) unreferenced object 0xffff8881070c1250 (size 16): comm modprobe, pid 6844, jiffies 4364069319 (age 17.572s) hex dump (first 16 bytes): 76 64 70 61 73 69 6d 5f 62 6c 6b 00 6b 6b 6b a5 vdpasim_blk.kkk. backtrace: [<ffffffff8174f19e>] __kmalloc_node_track_caller+0x4e/0x150 [<ffffffff81731d53>] kstrdup+0x33/0x60 [<ffffffff83a5d421>] kobject_set_name_vargs+0x41/0x110 [<ffffffff82d87aab>] dev_set_name+0xab/0xe0 [<ffffffff82d91a23>] device_add+0xe3/0x1a80 [<ffffffffa0220013>] 0xffffffffa0220013 [<ffffffff81001c27>] do_one_initcall+0x87/0x2e0 [<ffffffff813739cb>] do_init_module+0x1ab/0x640 [<ffffffff81379d20>] load_module+0x5d00/0x77f0 [<ffffffff8137bc40>] __do_sys_finit_module+0x110/0x1b0 [<ffffffff83c4d505>] do_syscall_64+0x35/0x80 [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 (CVE-2022-50702)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50702
https://ubuntu.com/security/CVE-2022-50702

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50702

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279785 - Linux Distros Unpatched Vulnerability : CVE-2022-50704
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- USB: gadget: Fix use-after-free during usb config switch In the process of switching USB config from rndis to other config, if the hardware does not support the ->pullup callback, or the hardware encounters a low probability fault, both of them may cause the ->pullup callback to fail, which will then cause a system panic (use after free). The gadget drivers sometimes need to be unloaded regardless of the hardware's behavior. Analysis as follows: ======================================================================= (1) write /config/usb_gadget/g1/UDC none gether_disconnect+0x2c/0x1f8 rndis_disable+0x4c/0x74 composite_disconnect+0x74/0xb0 configfs_composite_disconnect+0x60/0x7c usb_gadget_disconnect+0x70/0x124 usb_gadget_unregister_driver+0xc8/0x1d8 gadget_dev_desc_UDC_store+0xec/0x1e4 (2) rm /config/usb_gadget/g1/configs/b.1/f1 rndis_deregister+0x28/0x54 rndis_free+0x44/0x7c usb_put_function+0x14/0x1c config_usb_cfg_unlink+0xc4/0xe0 configfs_unlink+0x124/0x1c8 vfs_unlink+0x114/0x1dc (3) rmdir /config/usb_gadget/g1/functions/rndis.gs4 panic+0x1fc/0x3d0 do_page_fault+0xa8/0x46c do_mem_abort+0x3c/0xac el1_sync_handler+0x40/0x78 0xffffff801138f880 rndis_close+0x28/0x34 eth_stop+0x74/0x110 dev_close_many+0x48/0x194 rollback_registered_many+0x118/0x814 unregister_netdev+0x20/0x30 gether_cleanup+0x1c/0x38 rndis_attr_release+0xc/0x14 kref_put+0x74/0xb8 configfs_rmdir+0x314/0x374 If gadget->ops->pullup() return an error, function rndis_close() will be called, then it will causes a use-after-free problem.
======================================================================= (CVE-2022-50704)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50704
https://security-tracker.debian.org/tracker/CVE-2022-50704
https://ubuntu.com/security/CVE-2022-50704

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50704

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279931 - Linux Distros Unpatched Vulnerability : CVE-2022-50705
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- io_uring/rw: defer fsnotify calls to task context We can't call these off the kiocb completion as that might be off soft/hard irq context. Defer the calls to when we process the task_work for this request.
That avoids valid complaints like: stack backtrace: CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.0.0-rc6-syzkaller-00321-g105a36f3694e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_usage_bug kernel/locking/lockdep.c:3961 [inline] valid_state kernel/locking/lockdep.c:3973 [inline] mark_lock_irq kernel/locking/lockdep.c:4176 [inline] mark_lock.part.0.cold+0x18/0xd8 kernel/locking/lockdep.c:4632 mark_lock kernel/locking/lockdep.c:4596 [inline] mark_usage kernel/locking/lockdep.c:4527 [inline] __lock_acquire+0x11d9/0x56d0 kernel/locking/lockdep.c:5007 lock_acquire kernel/locking/lockdep.c:5666 [inline] lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5631 __fs_reclaim_acquire mm/page_alloc.c:4674 [inline] fs_reclaim_acquire+0x115/0x160 mm/page_alloc.c:4688 might_alloc include/linux/sched/mm.h:271 [inline] slab_pre_alloc_hook mm/slab.h:700 [inline] slab_alloc mm/slab.c:3278 [inline] __kmem_cache_alloc_lru mm/slab.c:3471 [inline] kmem_cache_alloc+0x39/0x520 mm/slab.c:3491 fanotify_alloc_fid_event fs/notify/fanotify/fanotify.c:580 [inline] fanotify_alloc_event fs/notify/fanotify/fanotify.c:813 [inline] fanotify_handle_event+0x1130/0x3f40 fs/notify/fanotify/fanotify.c:948 send_to_group fs/notify/fsnotify.c:360 [inline] fsnotify+0xafb/0x1680 fs/notify/fsnotify.c:570
__fsnotify_parent+0x62f/0xa60 fs/notify/fsnotify.c:230 fsnotify_parent include/linux/fsnotify.h:77 [inline] fsnotify_file include/linux/fsnotify.h:99 [inline] fsnotify_access include/linux/fsnotify.h:309 [inline] __io_complete_rw_common+0x485/0x720 io_uring/rw.c:195 io_complete_rw+0x1a/0x1f0 io_uring/rw.c:228 iomap_dio_complete_work fs/iomap/direct-io.c:144 [inline] iomap_dio_bio_end_io+0x438/0x5e0 fs/iomap/direct-io.c:178 bio_endio+0x5f9/0x780 block/bio.c:1564 req_bio_endio block/blk-mq.c:695 [inline] blk_update_request+0x3fc/0x1300 block/blk-mq.c:825 scsi_end_request+0x7a/0x9a0 drivers/scsi/scsi_lib.c:541 scsi_io_completion+0x173/0x1f70 drivers/scsi/scsi_lib.c:971 scsi_complete+0x122/0x3b0 drivers/scsi/scsi_lib.c:1438 blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1022 __do_softirq+0x1d3/0x9c6 kernel/softirq.c:571 invoke_softirq kernel/softirq.c:445 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662 common_interrupt+0xa9/0xc0 arch/x86/kernel/irq.c:240 (CVE-2022-50705)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50705
https://ubuntu.com/security/CVE-2022-50705

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50705

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279917 - Linux Distros Unpatched Vulnerability : CVE-2022-50706
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/ieee802154: don't warn zero-sized raw_sendmsg() syzbot is hitting skb_assert_len() warning at
__dev_queue_xmit() [1], for PF_IEEE802154 socket's zero-sized raw_sendmsg() request is hitting
__dev_queue_xmit() with skb->len == 0. Since PF_IEEE802154 socket's zero-sized raw_sendmsg() request was able to return 0, don't call __dev_queue_xmit() if packet length is 0. ---------- #include <sys/socket.h>
#include <netinet/in.h> int main(int argc, char *argv[]) { struct sockaddr_in addr = { .sin_family = AF_INET, .sin_addr.s_addr = htonl(INADDR_LOOPBACK) }; struct iovec iov = { }; struct msghdr hdr = { .msg_name = &addr, .msg_namelen = sizeof(addr), .msg_iov = &iov, .msg_iovlen = 1 };
sendmsg(socket(PF_IEEE802154, SOCK_RAW, 0), &hdr, 0); return 0; } ---------- Note that this might be a sign that commit fd1894224407c484 (bpf: Don't redirect packets with invalid pkt_len) should be reverted, for skb->len == 0 was acceptable for at least PF_IEEE802154 socket. (CVE-2022-50706)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50706
https://ubuntu.com/security/CVE-2022-50706

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50706

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279841 - Linux Distros Unpatched Vulnerability : CVE-2022-50710
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ice: set tx_tstamps when creating new Tx rings via ethtool When the user changes the number of queues via ethtool, the driver allocates new rings. This allocation did not initialize tx_tstamps. This results in the tx_tstamps field being zero (due to kcalloc allocation), and would result in a NULL pointer dereference when attempting a transmit timestamp on the new ring. (CVE-2022-50710)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50710
https://ubuntu.com/security/CVE-2022-50710

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50710

Plugin Information
Published: 2025/12/24, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279927 - Linux Distros Unpatched Vulnerability : CVE-2022-50712
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- devlink: hold region lock when flushing snapshots Netdevsim triggers a splat on reload, when it destroys regions with snapshots pending: WARNING: CPU: 1 PID: 787 at net/core/devlink.c:6291 devlink_region_snapshot_del+0x12e/0x140 CPU: 1 PID: 787 Comm: devlink Not tainted 6.1.0-07460-g7ae9888d6e1c #580 RIP: 0010:devlink_region_snapshot_del+0x12e/0x140 Call Trace: <TASK>
devl_region_destroy+0x70/0x140 nsim_dev_reload_down+0x2f/0x60 [netdevsim] devlink_reload+0x1f7/0x360 devlink_nl_cmd_reload+0x6ce/0x860 genl_family_rcv_msg_doit.isra.0+0x145/0x1c0 This is the locking assert in devlink_region_snapshot_del(), we're supposed to be holding the region->snapshot_lock here.
(CVE-2022-50712)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50712
https://ubuntu.com/security/CVE-2022-50712

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50712

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279944 - Linux Distros Unpatched Vulnerability : CVE-2022-50714
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: mt76: mt7921e: fix rmmod crash in driver reload test In insmod/rmmod stress test, the following crash dump shows up immediately. The problem is caused by missing mt76_dev in mt7921_pci_remove(). We should make sure the drvdata is ready before probe() finished. [168.862789] ================================================================== [168.862797] BUG: KASAN: user-memory- access in try_to_grab_pending+0x59/0x480 [168.862805] Write of size 8 at addr 0000000000006df0 by task rmmod/5361 [168.862812] CPU: 7 PID: 5361 Comm: rmmod Tainted: G OE 5.19.0-rc6 #1 [168.862816] Hardware name: Intel(R) Client Systems NUC8i7BEH/NUC8BEB, 05/04/2020 [168.862820] Call Trace: [168.862822] <TASK>
[168.862825] dump_stack_lvl+0x49/0x63 [168.862832] print_report.cold+0x493/0x6b7 [168.862845] kasan_report+0xa7/0x120 [168.862857] kasan_check_range+0x163/0x200 [168.862861]
__kasan_check_write+0x14/0x20 [168.862866] try_to_grab_pending+0x59/0x480 [168.862870]
__cancel_work_timer+0xbb/0x340 [168.862898] cancel_work_sync+0x10/0x20 [168.862902] mt7921_pci_remove+0x61/0x1c0 [mt7921e] [168.862909] pci_device_remove+0xa3/0x1d0 [168.862914] device_remove+0xc4/0x170 [168.862920] device_release_driver_internal+0x163/0x300 [168.862925] driver_detach+0xc7/0x1a0 [168.862930] bus_remove_driver+0xeb/0x2d0 [168.862935] driver_unregister+0x71/0xb0 [168.862939] pci_unregister_driver+0x30/0x230 [168.862944] mt7921_pci_driver_exit+0x10/0x1b [mt7921e] [168.862949] __x64_sys_delete_module+0x2f9/0x4b0 [168.862968] do_syscall_64+0x38/0x90 [168.862973] entry_SYSCALL_64_after_hwframe+0x63/0xcd Test steps: 1. insmode 2. do not ifup 3. rmmod quickly (within 1 second) (CVE-2022-50714)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50714
https://ubuntu.com/security/CVE-2022-50714

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50714

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279870 - Linux Distros Unpatched Vulnerability : CVE-2022-50715
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- md/raid1: stop mdx_raid1 thread when raid1 array run failed fail run raid1 array when we assemble array with the inactive disk only, but the mdx_raid1 thread were not stop, Even if the associated resources have been released. it will caused a NULL dereference when we do poweroff. This causes the following Oops: [ 287.587787] BUG: kernel NULL pointer dereference, address: 0000000000000070 [ 287.594762] #PF: supervisor read access in kernel mode [ 287.599912] #PF: error_code(0x0000) - not-present page [ 287.605061] PGD 0 P4D 0 [ 287.607612] Oops: 0000 [#1] SMP NOPTI [ 287.611287] CPU: 3 PID: 5265 Comm: md0_raid1 Tainted: G U 5.10.146 #0 [ 287.619029] Hardware name: xxxxxxx/To be filled by O.E.M, BIOS 5.19 06/16/2022 [ 287.626775] RIP: 0010:md_check_recovery+0x57/0x500 [md_mod] [ 287.632357] Code: fe 01 00 00 48 83 bb 10 03 00 00 00 74 08 48 89 ...... [ 287.651118] RSP: 0018:ffffc90000433d78 EFLAGS: 00010202 [ 287.656347] RAX:
0000000000000000 RBX: ffff888105986800 RCX: 0000000000000000 [ 287.663491] RDX: ffffc90000433bb0 RSI:
00000000ffffefff RDI: ffff888105986800 [ 287.670634] RBP: ffffc90000433da0 R08: 0000000000000000 R09:
c0000000ffffefff [ 287.677771] R10: 0000000000000001 R11: ffffc90000433ba8 R12: ffff888105986800 [ 287.684907] R13: 0000000000000000 R14: fffffffffffffe00 R15: ffff888100b6b500 [ 287.692052] FS:
0000000000000000(0000) GS:ffff888277f80000(0000) knlGS:0000000000000000 [ 287.700149] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 287.705897] CR2: 0000000000000070 CR3: 000000000320a000 CR4:
0000000000350ee0 [ 287.713033] Call Trace: [ 287.715498] raid1d+0x6c/0xbbb [raid1] [ 287.719256] ?
__schedule+0x1ff/0x760 [ 287.722930] ? schedule+0x3b/0xb0 [ 287.726260] ? schedule_timeout+0x1ed/0x290 [ 287.730456] ? __switch_to+0x11f/0x400 [ 287.734219] md_thread+0xe9/0x140 [md_mod] [ 287.738328] ? md_thread+0xe9/0x140 [md_mod] [ 287.742601] ? wait_woken+0x80/0x80 [ 287.746097] ? md_register_thread+0xe0/0xe0 [md_mod] [ 287.751064] kthread+0x11a/0x140 [ 287.754300] ? kthread_park+0x90/0x90 [ 287.757974] ret_from_fork+0x1f/0x30 In fact, when raid1 array run fail, we need to do md_unregister_thread() before raid1_free(). (CVE-2022-50715)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50715
https://ubuntu.com/security/CVE-2022-50715

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50715

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279765 - Linux Distros Unpatched Vulnerability : CVE-2022-50720
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- x86/apic: Don't disable x2APIC if locked The APIC supports two modes, legacy APIC (or xAPIC), and Extended APIC (or x2APIC). X2APIC mode is mostly compatible with legacy APIC, but it disables the memory-mapped APIC interface in favor of one that uses MSRs. The APIC mode is controlled by the EXT bit in the APIC MSR.
The MMIO/xAPIC interface has some problems, most notably the APIC LEAK [1]. This bug allows an attacker to use the APIC MMIO interface to extract data from the SGX enclave. Introduce support for a new feature that will allow the BIOS to lock the APIC in x2APIC mode. If the APIC is locked in x2APIC mode and the kernel tries to disable the APIC or revert to legacy APIC mode a GP fault will occur. Introduce support for a new MSR (IA32_XAPIC_DISABLE_STATUS) and handle the new locked mode when the LEGACY_XAPIC_DISABLED bit is set by preventing the kernel from trying to disable the x2APIC. On platforms with the IA32_XAPIC_DISABLE_STATUS MSR, if SGX or TDX are enabled the LEGACY_XAPIC_DISABLED will be set by the BIOS. If legacy APIC is required, then it SGX and TDX need to be disabled in the BIOS. [1]:
https://aepicleak.com/aepicleak.pdf (CVE-2022-50720)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50720
https://security-tracker.debian.org/tracker/CVE-2022-50720
https://ubuntu.com/security/CVE-2022-50720

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50720

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279873 - Linux Distros Unpatched Vulnerability : CVE-2022-50721
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dmaengine: qcom-adm: fix wrong calling convention for prep_slave_sg The calling convention for pre_slave_sg is to return NULL on error and provide an error log to the system. Qcom-adm instead provide error pointer when an error occur. This indirectly cause kernel panic for example for the nandc driver that checks only if the pointer returned by device_prep_slave_sg is not NULL. Returning an error pointer makes nandc think the device_prep_slave_sg function correctly completed and makes the kernel panics later in the code. While nandc is the one that makes the kernel crash, it was pointed out that the real problem is qcom-adm not following calling convention for that function. To fix this, drop returning error pointer and return NULL with an error log. (CVE-2022-50721)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50721
https://ubuntu.com/security/CVE-2022-50721

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50721

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279862 - Linux Distros Unpatched Vulnerability : CVE-2022-50724
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- regulator: core: fix resource leak in regulator_register() I got some resource leak reports while doing fault injection test: OF: ERROR: memory leak, expected refcount 1 instead of 100, of_node_get()/of_node_put() unbalanced - destroy cset entry: attach overlay node /i2c/pmic@64/regulators/buck1 unreferenced object 0xffff88810deea000 (size 512): comm 490-i2c-rt5190a, pid 253, jiffies 4294859840 (age 5061.046s) hex dump (first 32 bytes): 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... ff ff ff ff ff ff ff ff a0 1e 00 a1 ff ff ff ff ................ backtrace:
[<00000000d78541e2>] kmalloc_trace+0x21/0x110 [<00000000b343d153>] device_private_init+0x32/0xd0 [<00000000be1f0c70>] device_add+0xb2d/0x1030 [<00000000e3e6344d>] regulator_register+0xaf2/0x12a0 [<00000000e2f5e754>] devm_regulator_register+0x57/0xb0 [<000000008b898197>] rt5190a_probe+0x52a/0x861 [rt5190a_regulator] unreferenced object 0xffff88810b617b80 (size 32): comm 490-i2c-rt5190a, pid 253, jiffies 4294859904 (age 5060.983s) hex dump (first 32 bytes): 72 65 67 75 6c 61 74 6f 72 2e 32 38 36 38 2d 53 regulator.2868-S 55 50 50 4c 59 00 ff ff 29 00 00 00 2b 00 00 00 UPPLY...)...+... backtrace:
[<000000009da9280d>] __kmalloc_node_track_caller+0x44/0x1b0 [<0000000025c6a4e5>] kstrdup+0x3a/0x70 [<00000000790efb69>] create_regulator+0xc0/0x4e0 [<0000000005ed203a>] regulator_resolve_supply+0x2d4/0x440 [<0000000045796214>] regulator_register+0x10b3/0x12a0 [<00000000e2f5e754>] devm_regulator_register+0x57/0xb0 [<000000008b898197>] rt5190a_probe+0x52a/0x861 [rt5190a_regulator] After calling regulator_resolve_supply(), the 'rdev->supply' is set by set_supply(), after this set, in the error path, the resources need be released, so call regulator_put() to avoid the leaks. (CVE-2022-50724)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50724
https://ubuntu.com/security/CVE-2022-50724

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50724

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279923 - Linux Distros Unpatched Vulnerability : CVE-2022-50733
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: idmouse: fix an uninit-value in idmouse_open In idmouse_create_image, if any ftip_command fails, it will go to the reset label. However, this leads to the data in bulk_in_buffer[HEADER..IMGSIZE] uninitialized. And the check for valid image incurs an uninitialized dereference. Fix this by moving the check before reset label since this check only be valid if the data after bulk_in_buffer[HEADER] has concrete data. Note that this is found by KMSAN, so only kernel compilation is tested. (CVE-2022-50733)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50733
https://ubuntu.com/security/CVE-2022-50733

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50733

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279724 - Linux Distros Unpatched Vulnerability : CVE-2022-50735
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: mt76: do not run mt76u_status_worker if the device is not running Fix the following NULL pointer dereference avoiding to run mt76u_status_worker thread if the device is not running yet. KASAN: null-ptr- deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 PID: 98 Comm: kworker/u2:2 Not tainted 5.14.0+ #78 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 Workqueue: mt76 mt76u_tx_status_data RIP:
0010:mt76x02_mac_fill_tx_status.isra.0+0x82c/0x9e0 Code: c5 48 b8 00 00 00 00 00 fc ff df 80 3c 02 00 0f 85 94 01 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 34 24 4c 89 f2 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 89 01 00 00 41 8b 16 41 0f b7 RSP: 0018:ffffc900005af988 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffffc900005afae8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff832fc661 RDI:
ffffc900005afc2a RBP: ffffc900005afae0 R08: 0000000000000001 R09: fffff520000b5f3c R10: 0000000000000003 R11: fffff520000b5f3b R12: ffff88810b6132d8 R13: 000000000000ffff R14: 0000000000000000 R15:
ffffc900005afc28 FS: 0000000000000000(0000) GS:ffff88811aa00000(0000) knlGS:0000000000000000 CS: 0010 DS:
0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa0eda6a000 CR3: 0000000118f17000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: mt76x02_send_tx_status+0x1d2/0xeb0 mt76x02_tx_status_data+0x8e/0xd0 mt76u_tx_status_data+0xe1/0x240 process_one_work+0x92b/0x1460 worker_thread+0x95/0xe00 kthread+0x3a1/0x480 ret_from_fork+0x1f/0x30 Modules linked in: --[ end trace 8df5d20fc5040f65 ]-- RIP:
0010:mt76x02_mac_fill_tx_status.isra.0+0x82c/0x9e0 Code: c5 48 b8 00 00 00 00 00 fc ff df 80 3c 02 00 0f 85 94 01 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 34 24 4c 89 f2 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 89 01 00 00 41 8b 16 41 0f b7 RSP: 0018:ffffc900005af988 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffffc900005afae8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff832fc661 RDI:
ffffc900005afc2a RBP: ffffc900005afae0 R08: 0000000000000001 R09: fffff520000b5f3c R10: 0000000000000003 R11: fffff520000b5f3b R12: ffff88810b6132d8 R13: 000000000000ffff R14: 0000000000000000 R15:
ffffc900005afc28 FS: 0000000000000000(0000) GS:ffff88811aa00000(0000) knlGS:0000000000000000 CS: 0010 DS:
0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa0eda6a000 CR3: 0000000118f17000 CR4: 0000000000750ef0 PKRU: 55555554 Moreover move stat_work schedule out of the for loop. (CVE-2022-50735)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50735
https://ubuntu.com/security/CVE-2022-50735

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50735

Plugin Information
Published: 2025/12/24, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279876 - Linux Distros Unpatched Vulnerability : CVE-2022-50738
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vhost-vdpa: fix an iotlb memory leak Before commit 3d5698793897 (vhost-vdpa: introduce asid based IOTLB) we called vhost_vdpa_iotlb_unmap(v, iotlb, 0ULL, 0ULL - 1) during release to free all the resources allocated when processing user IOTLB messages through vhost_vdpa_process_iotlb_update(). That commit changed the handling of IOTLB a bit, and we accidentally removed some code called during the release. We partially fixed this with commit 037d4305569a (vhost-vdpa: call vhost_vdpa_cleanup during the release) but a potential memory leak is still there as showed by kmemleak if the application does not send VHOST_IOTLB_INVALIDATE or crashes: unreferenced object 0xffff888007fbaa30 (size 16): comm blkio-bench, pid 914, jiffies 4294993521 (age 885.500s) hex dump (first 16 bytes): 40 73 41 07 80 88 ff ff 00 00 00 00 00 00 00 00 @sA............. backtrace: [<0000000087736d2a>] kmem_cache_alloc_trace+0x142/0x1c0 [<0000000060740f50>] vhost_vdpa_process_iotlb_msg+0x68c/0x901 [vhost_vdpa] [<0000000083e8e205>] vhost_chr_write_iter+0xc0/0x4a0 [vhost] [<000000008f2f414a>] vhost_vdpa_chr_write_iter+0x18/0x20 [vhost_vdpa] [<00000000de1cd4a0>] vfs_write+0x216/0x4b0 [<00000000a2850200>] ksys_write+0x71/0xf0 [<00000000de8e720b>] __x64_sys_write+0x19/0x20 [<0000000018b12cbb>] do_syscall_64+0x3f/0x90 [<00000000986ec465>] entry_SYSCALL_64_after_hwframe+0x63/0xcd Let's fix this calling vhost_vdpa_iotlb_unmap() on the whole range in vhost_vdpa_remove_as(). We move that call before vhost_dev_cleanup() since we need a valid v->vdev.mm in vhost_vdpa_pa_unmap(). vhost_iotlb_reset() call can be removed, since vhost_vdpa_iotlb_unmap() on the whole range removes all the entries. The kmemleak log reported was observed with a vDPA device that has `use_va` set to true (e.g. VDUSE). This patch has been tested with both types of devices. (CVE-2022-50738)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50738
https://ubuntu.com/security/CVE-2022-50738

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50738

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279867 - Linux Distros Unpatched Vulnerability : CVE-2022-50740
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() Syzkaller reports a long- known leak of urbs in ath9k_hif_usb_dealloc_tx_urbs(). The cause of the leak is that usb_get_urb() is called but usb_free_urb() (or usb_put_urb()) is not called inside usb_kill_urb() as urb->dev or urb->ep fields have not been initialized and usb_kill_urb() returns immediately. The patch removes trying to kill urbs located in hif_dev->tx.tx_buf because hif_dev->tx.tx_buf is not supposed to contain urbs which are in pending state (the pending urbs are stored in hif_dev->tx.tx_pending). The tx.tx_lock is acquired so there should not be any changes in the list. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. (CVE-2022-50740)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50740
https://ubuntu.com/security/CVE-2022-50740

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50740

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279847 - Linux Distros Unpatched Vulnerability : CVE-2022-50743
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- erofs: Fix pcluster memleak when its block address is zero syzkaller reported a memleak:
https://syzkaller.appspot.com/bug?id=62f37ff612f0021641eda5b17f056f1668aa9aed unreferenced object 0xffff88811009c7f8 (size 136): ... backtrace: [<ffffffff821db19b>] z_erofs_do_read_page+0x99b/0x1740 [<ffffffff821dee9e>] z_erofs_readahead+0x24e/0x580 [<ffffffff814bc0d6>] read_pages+0x86/0x3d0 ...
syzkaller constructed a case: in z_erofs_register_pcluster(), ztailpacking = false and map->m_pa = zero.
This makes pcl->obj.index be zero although pcl is not a inline pcluster. Then following path adds refcount for grp, but the refcount won't be put because pcl is inline. z_erofs_readahead() z_erofs_do_read_page() # for another page z_erofs_collector_begin() erofs_find_workgroup() erofs_workgroup_get() Since it's illegal for the block address of a non-inlined pcluster to be zero, add check here to avoid registering the pcluster which would be leaked. (CVE-2022-50743)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50743
https://ubuntu.com/security/CVE-2022-50743

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50743

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279776 - Linux Distros Unpatched Vulnerability : CVE-2022-50744
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: lpfc: Fix hard lockup when reading the rx_monitor from debugfs During I/O and simultaneous cat of /sys/kernel/debug/lpfc/fnX/rx_monitor, a hard lockup similar to the call trace below may occur. The spin_lock_bh in lpfc_rx_monitor_report is not protecting from timer interrupts as expected, so change the strength of the spin lock to _irq. Kernel panic - not syncing: Hard LOCKUP CPU: 3 PID: 110402 Comm: cat Kdump: loaded exception RIP: native_queued_spin_lock_slowpath+91 [IRQ stack] native_queued_spin_lock_slowpath at ffffffffb814e30b _raw_spin_lock at ffffffffb89a667a lpfc_rx_monitor_record at ffffffffc0a73a36 [lpfc] lpfc_cmf_timer at ffffffffc0abbc67 [lpfc]
__hrtimer_run_queues at ffffffffb8184250 hrtimer_interrupt at ffffffffb8184ab0 smp_apic_timer_interrupt at ffffffffb8a026ba apic_timer_interrupt at ffffffffb8a01c4f [End of IRQ stack] apic_timer_interrupt at ffffffffb8a01c4f lpfc_rx_monitor_report at ffffffffc0a73c80 [lpfc] lpfc_rx_monitor_read at ffffffffc0addde1 [lpfc] full_proxy_read at ffffffffb83e7fc3 vfs_read at ffffffffb833fe71 ksys_read at ffffffffb83402af do_syscall_64 at ffffffffb800430b entry_SYSCALL_64_after_hwframe at ffffffffb8a000ad (CVE-2022-50744)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50744
https://ubuntu.com/security/CVE-2022-50744

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50744

Plugin Information
Published: 2025/12/24, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279810 - Linux Distros Unpatched Vulnerability : CVE-2022-50748
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipc: mqueue: fix possible memory leak in init_mqueue_fs() commit db7cfc380900 (ipc: Free mq_sysctls if ipc namespace creation failed) Here's a similar memory leak to the one fixed by the patch above.
retire_mq_sysctls need to be called when init_mqueue_fs fails after setup_mq_sysctls. (CVE-2022-50748)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50748
https://ubuntu.com/security/CVE-2022-50748

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50748

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279762 - Linux Distros Unpatched Vulnerability : CVE-2022-50750
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure In case mipi_dsi_attach() fails, call drm_panel_remove() to avoid memory leak. (CVE-2022-50750)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50750
https://ubuntu.com/security/CVE-2022-50750

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50750

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279790 - Linux Distros Unpatched Vulnerability : CVE-2022-50751
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- configfs: fix possible memory leak in configfs_create_dir() kmemleak reported memory leaks in configfs_create_dir(): unreferenced object 0xffff888009f6af00 (size 192): comm modprobe, pid 3777, jiffies 4295537735 (age 233.784s) backtrace: kmem_cache_alloc (mm/slub.c:3250 mm/slub.c:3256 mm/slub.c:3263 mm/slub.c:3273) new_fragment (./include/linux/slab.h:600 fs/configfs/dir.c:163) configfs_register_subsystem (fs/configfs/dir.c:1857) basic_write (drivers/hwtracing/stm/p_basic.c:14) stm_p_basic do_one_initcall (init/main.c:1296) do_init_module (kernel/module/main.c:2455) ... unreferenced object 0xffff888003ba7180 (size 96): comm modprobe, pid 3777, jiffies 4295537735 (age 233.784s) backtrace: kmem_cache_alloc (mm/slub.c:3250 mm/slub.c:3256 mm/slub.c:3263 mm/slub.c:3273) configfs_new_dirent (./include/linux/slab.h:723 fs/configfs/dir.c:194) configfs_make_dirent (fs/configfs/dir.c:248) configfs_create_dir (fs/configfs/dir.c:296) configfs_attach_group.isra.28 (fs/configfs/dir.c:816 fs/configfs/dir.c:852) configfs_register_subsystem (fs/configfs/dir.c:1881) basic_write (drivers/hwtracing/stm/p_basic.c:14) stm_p_basic do_one_initcall (init/main.c:1296) do_init_module (kernel/module/main.c:2455) ... This is because the refcount is not correct in configfs_make_dirent(). For normal stage, the refcount is changing as: configfs_register_subsystem() configfs_create_dir() configfs_make_dirent() configfs_new_dirent() # set s_count = 1 dentry->d_fsdata = configfs_get(sd); # s_count = 2 ... configfs_unregister_subsystem() configfs_remove_dir() remove_dir() configfs_remove_dirent() # s_count = 1 dput() ... *dentry_unlink_inode()* configfs_d_iput() # s_count = 0, release However, if we failed in configfs_create(): configfs_register_subsystem() configfs_create_dir() configfs_make_dirent() # s_count = 2 ... configfs_create() # fail ->out_remove:
configfs_remove_dirent(dentry) configfs_put(sd) # s_count = 1 return PTR_ERR(inode); There is no inode in the error path, so the configfs_d_iput() is lost and makes sd and fragment memory leaked. To fix this, when we failed in configfs_create(), manually call configfs_put(sd) to keep the refcount correct.
(CVE-2022-50751)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50751
https://ubuntu.com/security/CVE-2022-50751

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50751

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279851 - Linux Distros Unpatched Vulnerability : CVE-2022-50755
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- udf: Avoid double brelse() in udf_rename() syzbot reported a warning like below [1]: VFS: brelse: Trying to free free buffer WARNING: CPU: 2 PID: 7301 at fs/buffer.c:1145 __brelse+0x67/0xa0 ... Call Trace:
<TASK> invalidate_bh_lru+0x99/0x150 smp_call_function_many_cond+0xe2a/0x10c0 ? generic_remap_file_range_prep+0x50/0x50 ? __brelse+0xa0/0xa0 ? __mutex_lock+0x21c/0x12d0 ? smp_call_on_cpu+0x250/0x250 ? rcu_read_lock_sched_held+0xb/0x60 ? lock_release+0x587/0x810 ?
__brelse+0xa0/0xa0 ? generic_remap_file_range_prep+0x50/0x50 on_each_cpu_cond_mask+0x3c/0x80 blkdev_flush_mapping+0x13a/0x2f0 blkdev_put_whole+0xd3/0xf0 blkdev_put+0x222/0x760 deactivate_locked_super+0x96/0x160 deactivate_super+0xda/0x100 cleanup_mnt+0x222/0x3d0 task_work_run+0x149/0x240 ? task_work_cancel+0x30/0x30 do_exit+0xb29/0x2a40 ? reacquire_held_locks+0x4a0/0x4a0 ? do_raw_spin_lock+0x12a/0x2b0 ? mm_update_next_owner+0x7c0/0x7c0 ? rwlock_bug.part.0+0x90/0x90 ? zap_other_threads+0x234/0x2d0 do_group_exit+0xd0/0x2a0
__x64_sys_exit_group+0x3a/0x50 do_syscall_64+0x34/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd The cause of the issue is that brelse() is called on both ofibh.sbh and ofibh.ebh by udf_find_entry() when it returns NULL. However, brelse() is called by udf_rename(), too. So, b_count on buffer_head becomes unbalanced. This patch fixes the issue by not calling brelse() by udf_rename() when udf_find_entry() returns NULL. (CVE-2022-50755)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50755
https://ubuntu.com/security/CVE-2022-50755

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50755

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279893 - Linux Distros Unpatched Vulnerability : CVE-2022-50760
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() As comment of pci_get_class() says, it returns a pci_device with its refcount increased and decreased the refcount for the input parameter @from if it is not NULL. If we break the loop in amdgpu_atrm_get_bios() with 'pdev' not NULL, we need to call pci_dev_put() to decrease the refcount. Add the missing pci_dev_put() to avoid refcount leak.
(CVE-2022-50760)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50760
https://ubuntu.com/security/CVE-2022-50760

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50760

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279897 - Linux Distros Unpatched Vulnerability : CVE-2022-50761
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- x86/xen: Fix memory leak in xen_init_lock_cpu() In xen_init_lock_cpu(), the @name has allocated new string by kasprintf(), if bind_ipi_to_irqhandler() fails, it should be freed, otherwise may lead to a memory leak issue, fix it. (CVE-2022-50761)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50761
https://ubuntu.com/security/CVE-2022-50761

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50761

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279819 - Linux Distros Unpatched Vulnerability : CVE-2022-50768
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: smartpqi: Correct device removal for multi-actuator devices Correct device count for multi-actuator drives which can cause kernel panics. (CVE-2022-50768)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50768
https://ubuntu.com/security/CVE-2022-50768

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50768

Plugin Information
Published: 2025/12/24, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279863 - Linux Distros Unpatched Vulnerability : CVE-2022-50769
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mmc: mxcmmc: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and goto error path which will call mmc_free_host(). (CVE-2022-50769)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50769
https://ubuntu.com/security/CVE-2022-50769

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50769

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279887 - Linux Distros Unpatched Vulnerability : CVE-2022-50771
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state() Running rcutorture with non-zero fqs_duration module parameter in a kernel built with CONFIG_PREEMPTION=y results in the following splat:
BUG: using __this_cpu_read() in preemptible [00000000] code: rcu_torture_fqs/398 caller is
__this_cpu_preempt_check+0x13/0x20 CPU: 3 PID: 398 Comm: rcu_torture_fqs Not tainted 6.0.0-rc1-yoctodev- standard+ Call Trace: <TASK> dump_stack_lvl+0x5b/0x86 dump_stack+0x10/0x16 check_preemption_disabled+0xe5/0xf0 __this_cpu_preempt_check+0x13/0x20 rcu_force_quiescent_state.part.0+0x1c/0x170 rcu_force_quiescent_state+0x1e/0x30 rcu_torture_fqs+0xca/0x160 ? rcu_torture_boost+0x430/0x430 kthread+0x192/0x1d0 ? kthread_complete_and_exit+0x30/0x30 ret_from_fork+0x22/0x30 </TASK> The problem is that rcu_force_quiescent_state() uses __this_cpu_read() in preemptible code instead of the proper raw_cpu_read(). This commit therefore changes __this_cpu_read() to raw_cpu_read(). (CVE-2022-50771)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50771
https://ubuntu.com/security/CVE-2022-50771

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50771

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279748 - Linux Distros Unpatched Vulnerability : CVE-2022-50773
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt I got a null-ptr-defer error report when I do the following tests on the qemu platform: make defconfig and CONFIG_PARPORT=m, CONFIG_PARPORT_PC=m, CONFIG_SND_MTS64=m Then making test scripts: cat>test_mod1.sh<<EOF modprobe snd-mts64 modprobe snd-mts64 EOF Executing the script, perhaps several times, we will get a null-ptr-defer report, as follow:
syzkaller:~# ./test_mod.sh snd_mts64: probe of snd_mts64.0 failed with error -5 modprobe: ERROR: could not insert 'snd_mts64': No such device BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF:
supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP PTI CPU: 0 PID: 205 Comm: modprobe Not tainted 6.1.0-rc8-00588-g76dcd734eca2 #6 Call Trace: <IRQ> snd_mts64_interrupt+0x24/0xa0 [snd_mts64] parport_irq_handler+0x37/0x50 [parport]
__handle_irq_event_percpu+0x39/0x190 handle_irq_event_percpu+0xa/0x30 handle_irq_event+0x2f/0x50 handle_edge_irq+0x99/0x1b0 __common_interrupt+0x5d/0x100 common_interrupt+0xa0/0xc0 </IRQ> <TASK>
asm_common_interrupt+0x22/0x40 RIP: 0010:_raw_write_unlock_irqrestore+0x11/0x30 parport_claim+0xbd/0x230 [parport] snd_mts64_probe+0x14a/0x465 [snd_mts64] platform_probe+0x3f/0xa0 really_probe+0x129/0x2c0
__driver_probe_device+0x6d/0xc0 driver_probe_device+0x1a/0xa0 __device_attach_driver+0x7a/0xb0 bus_for_each_drv+0x62/0xb0 __device_attach+0xe4/0x180 bus_probe_device+0x82/0xa0 device_add+0x550/0x920 platform_device_add+0x106/0x220 snd_mts64_attach+0x2e/0x80 [snd_mts64] port_check+0x14/0x20 [parport] bus_for_each_dev+0x6e/0xc0 __parport_register_driver+0x7c/0xb0 [parport] snd_mts64_module_init+0x31/0x1000 [snd_mts64] do_one_initcall+0x3c/0x1f0 do_init_module+0x46/0x1c6 load_module+0x1d8d/0x1e10
__do_sys_finit_module+0xa2/0xf0 do_syscall_64+0x37/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK>
Kernel panic - not syncing: Fatal exception in interrupt Rebooting in 1 seconds.. The mts wa not initialized during interrupt, we add check for mts to fix this bug. (CVE-2022-50773)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50773
https://ubuntu.com/security/CVE-2022-50773

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50773

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279718 - Linux Distros Unpatched Vulnerability : CVE-2022-50778
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fortify: Fix __compiletime_strlen() under UBSAN_BOUNDS_LOCAL With CONFIG_FORTIFY=y and CONFIG_UBSAN_LOCAL_BOUNDS=y enabled, we observe a runtime panic while running Android's Compatibility Test Suite's (CTS) android.hardware.input.cts.tests. This is stemming from a strlen() call in hidinput_allocate(). __compiletime_strlen() is implemented in terms of __builtin_object_size(), then does an array access to check for NUL-termination. A quirk of __builtin_object_size() is that for strings whose values are runtime dependent, __builtin_object_size(str, 1 or 0) returns the maximum size of possible values when those sizes are determinable at compile time. Example: static const char *v = FOO BAR;
static const char *y = FOO BA; unsigned long x (int z) { // Returns 8, which is: // max(__builtin_object_size(v, 1), __builtin_object_size(y, 1)) return __builtin_object_size(z ? v : y, 1);
} So when FORTIFY_SOURCE is enabled, the current implementation of __compiletime_strlen() will try to access beyond the end of y at runtime using the size of v. Mixed with UBSAN_LOCAL_BOUNDS we get a fault.
hidinput_allocate() has a local C string whose value is control flow dependent on a switch statement, so
__builtin_object_size(str, 1) evaluates to the maximum string length, making all other cases fault on the last character check. hidinput_allocate() could be cleaned up to avoid runtime calls to strlen() since the local variable can only have literal values, so there's no benefit to trying to fortify the strlen call site there. Perform a __builtin_constant_p() check against index 0 earlier in the macro to filter out the control-flow-dependant case. Add a KUnit test for checking the expected behavioral characteristics of FORTIFY_SOURCE internals. (CVE-2022-50778)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50778
https://ubuntu.com/security/CVE-2022-50778

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50778

Plugin Information
Published: 2025/12/24, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279896 - Linux Distros Unpatched Vulnerability : CVE-2022-50783
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mptcp: use proper req destructor for IPv6 Before, only the destructor from TCP request sock in IPv4 was called even if the subflow was IPv6. It is important to use the right destructor to avoid memory leaks with some advanced IPv6 features, e.g. when the request socks contain specific IPv6 options.
(CVE-2022-50783)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50783
https://ubuntu.com/security/CVE-2022-50783

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50783

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281551 - Linux Distros Unpatched Vulnerability : CVE-2022-50809
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: xhci: dbc: Fix memory leak in xhci_alloc_dbc() If DbC is already in use, then the allocated memory for the xhci_dbc struct doesn't get freed before returning NULL, which leads to a memleak. (CVE-2022-50809)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50809

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50809

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281559 - Linux Distros Unpatched Vulnerability : CVE-2022-50821
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails (CVE-2022-50821)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50821

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50821

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280810 - Linux Distros Unpatched Vulnerability : CVE-2022-50824
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak In check_acpi_tpm2(), we get the TPM2 table just to make sure the table is there, not used after the init, so the acpi_put_table() should be added to release the ACPI memory. (CVE-2022-50824)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50824

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50824

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281467 - Linux Distros Unpatched Vulnerability : CVE-2022-50827
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix memory leak in lpfc_create_port() Commit 5e633302ace1 (scsi: lpfc: vmid: Add support for VMID in mailbox command) introduced allocations for the VMID resources in lpfc_create_port() after the call to scsi_host_alloc().
Upon failure on the VMID allocations, the new code would branch to the 'out' label, which returns NULL without unwinding anything, thus skipping the call to scsi_host_put(). Fix the problem by creating a separate label 'out_free_vmid' to unwind the VMID resources and make the 'out_put_shost' label call only scsi_host_put(), as was done before the introduction of allocations for VMID. (CVE-2022-50827)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50827

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50827

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281539 - Linux Distros Unpatched Vulnerability : CVE-2022-50832
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix potential memory leak in wilc_mac_xmit() The wilc_mac_xmit() returns NETDEV_TX_OK without freeing skb, add dev_kfree_skb() to fix it. Compile tested only. (CVE-2022-50832)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50832

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50832

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281524 - Linux Distros Unpatched Vulnerability : CVE-2022-50835
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: jbd2: add miss release buffer head in fc_do_one_pass() In fc_do_one_pass() miss release buffer head after use which will lead to reference count leak. (CVE-2022-50835)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50835

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
6.0
EPSS Score
0.0002
References

CVE | CVE-2022-50835

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280793 - Linux Distros Unpatched Vulnerability : CVE-2022-50838
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: stream: purge sk_error_queue in sk_stream_kill_queues() Changheon Lee reported TCP socket leaks, with a nice repro. It seems we leak TCP sockets with the following sequence: 1) SOF_TIMESTAMPING_TX_ACK is enabled on the socket. Each ACK will cook an skb put in error queue, from __skb_tstamp_tx(). __skb_tstamp_tx() is using skb_clone(), unless SOF_TIMESTAMPING_OPT_TSONLY was also requested. 2) If the application is also using MSG_ZEROCOPY, then we put in the error queue cloned skbs that had a struct ubuf_info attached to them. Whenever an struct ubuf_info is allocated, sock_zerocopy_alloc() does a sock_hold(). As long as the cloned skbs are still in sk_error_queue, socket refcount is kept elevated. 3) Application closes the socket, while error queue is not empty. Since tcp_close() no longer purges the socket error queue, we might end up with a TCP socket with at least one skb in error queue keeping the socket alive forever. This bug can be (ab)used to consume all kernel memory and freeze the host. We need to purge the error queue, with proper synchronization against concurrent writers. (CVE-2022-50838)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50838

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.2
EPSS Score
0.0003
References

CVE | CVE-2022-50838

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280802 - Linux Distros Unpatched Vulnerability : CVE-2022-50843
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: dm clone: Fix UAF in clone_dtr() Dm_clone also has the same UAF problem when dm_resume() and dm_destroy() are concurrent. Therefore, cancelling timer again in clone_dtr(). (CVE-2022-50843)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50843

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
3.6
EPSS Score
0.0002
References

CVE | CVE-2022-50843

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280777 - Linux Distros Unpatched Vulnerability : CVE-2022-50844
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. A proposed warning in clang aims to catch these at compile time, which reveals:
drivers/gpu/drm/amd/amdgpu/../pm/swsmu/amdgpu_smu.c:3008:29: error: incompatible function pointer types initializing 'int (*)(void *, uint32_t, long *, uint32_t)' (aka 'int (*)(void *, unsigned int, long *, unsigned int)') with an expression of type 'int (void *, enum PP_OD_DPM_TABLE_COMMAND, long *, uint32_t)'
(aka 'int (void *, enum PP_OD_DPM_TABLE_COMMAND, long *, unsigned int)') [-Werror,-Wincompatible-function- pointer-types-strict] .odn_edit_dpm_table = smu_od_edit_dpm_table, ^~~~~~~~~~~~~~~~~~~~~ 1 error generated. There are only two implementations of ->odn_edit_dpm_table() in 'struct amd_pm_funcs':
smu_od_edit_dpm_table() and pp_odn_edit_dpm_table(). One has a second parameter type of 'enum PP_OD_DPM_TABLE_COMMAND' and the other uses 'u32'. Ultimately, smu_od_edit_dpm_table() calls
->od_edit_dpm_table() from 'struct pptable_funcs' and pp_odn_edit_dpm_table() calls ->odn_edit_dpm_table() from 'struct pp_hwmgr_func', which both have a second parameter type of 'enum PP_OD_DPM_TABLE_COMMAND'.
Update the type parameter in both the prototype in 'struct amd_pm_funcs' and pp_odn_edit_dpm_table() to 'enum PP_OD_DPM_TABLE_COMMAND', which cleans up the warning. (CVE-2022-50844)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50844

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
6.0
EPSS Score
0.0002
References

CVE | CVE-2022-50844

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281474 - Linux Distros Unpatched Vulnerability : CVE-2022-50846
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, it will lead two issues:
1. The memory that allocated in mmc_alloc_host() is leaked. 2. In the remove() path, mmc_remove_host() will be called to delete device, but it's not added yet, it will lead a kernel crash because of null-ptr- deref in device_del(). Fix this by checking the return value and goto error path which will call mmc_free_host(). (CVE-2022-50846)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50846

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.4
EPSS Score
0.0003
References

CVE | CVE-2022-50846

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281535 - Linux Distros Unpatched Vulnerability : CVE-2022-50849
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP An oops can be induced by running 'cat /proc/kcore > /dev/null' on devices using pstore with the ram backend because kmap_atomic() assumes lowmem pages are accessible with __va(). Unable to handle kernel paging request at virtual address ffffff807ff2b000 Mem abort info: ESR = 0x96000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000081d87000 [ffffff807ff2b000] pgd=180000017fe18003, p4d=180000017fe18003, pud=180000017fe18003, pmd=0000000000000000 Internal error: Oops: 96000006 [#1] PREEMPT SMP Modules linked in: dm_integrity CPU:
7 PID: 21179 Comm: perf Not tainted 5.15.67-10882-ge4eb2eb988cd #1 baa443fb8e8477896a370b31a821eb2009f9bfba Hardware name: Google Lazor (rev3 - 8) (DT) pstate: a0400009 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __memcpy+0x110/0x260 lr : vread+0x194/0x294 sp :
ffffffc013ee39d0 x29: ffffffc013ee39f0 x28: 0000000000001000 x27: ffffff807ff2b000 x26: 0000000000001000 x25: ffffffc0085a2000 x24: ffffff802d4b3000 x23: ffffff80f8a60000 x22: ffffff802d4b3000 x21:
ffffffc0085a2000 x20: ffffff8080b7bc68 x19: 0000000000001000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: ffffffd3073f2e60 x14: ffffffffad588000 x13: 0000000000000000 x12:
0000000000000001 x11: 00000000000001a2 x10: 00680000fff2bf0b x9 : 03fffffff807ff2b x8 : 0000000000000001 x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffffff802d4b4000 x4 : ffffff807ff2c000 x3 :
ffffffc013ee3a78 x2 : 0000000000001000 x1 : ffffff807ff2b000 x0 : ffffff802d4b3000 Call trace:
__memcpy+0x110/0x260 read_kcore+0x584/0x778 proc_reg_read+0xb4/0xe4 During early boot, memblock reserves the pages for the ramoops reserved memory node in DT that would otherwise be part of the direct lowmem mapping. Pstore's ram backend reuses those reserved pages to change the memory type (writeback or non- cached) by passing the pages to vmap() (see pfn_to_page() usage in persistent_ram_vmap() for more details) with specific flags. When read_kcore() starts iterating over the vmalloc region, it runs over the virtual address that vmap() returned for ramoops. In aligned_vread() the virtual address is passed to vmalloc_to_page() which returns the page struct for the reserved lowmem area. That lowmem page is passed to kmap_atomic(), which effectively calls page_to_virt() that assumes a lowmem page struct must be directly accessible with __va() and friends. These pages are mapped via vmap() though, and the lowmem mapping was never made, so accessing them via the lowmem virtual address oopses like above. Let's side- step this problem by passing VM_IOREMAP to vmap(). This will tell vread() to not include the ramoops region in the kcore. Instead the area will look like a bunch of zeros. The alternative is to teach kmap() about vmalloc areas that intersect with lowmem. Presumably such a change isn't a one-liner, and there isn't much interest in inspecting the ramoops region in kcore files anyway, so the most expedient route is taken for now. (CVE-2022-50849)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50849

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.4
EPSS Score
0.0003
References

CVE | CVE-2022-50849

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280716 - Linux Distros Unpatched Vulnerability : CVE-2022-50851
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vhost_vdpa: fix the crash in unmap a large memory While testing in vIOMMU, sometimes Guest will unmap very large memory, which will cause the crash. To fix this, add a new function vhost_vdpa_general_unmap(). This function will only unmap the memory that saved in iotlb. Call Trace: [ 647.820144] ------------[ cut here ]------------ [ 647.820848] kernel BUG at drivers/iommu/intel/iommu.c:1174! [ 647.821486] invalid opcode:
0000 [#1] PREEMPT SMP PTI [ 647.822082] CPU: 10 PID: 1181 Comm: qemu-system-x86 Not tainted 6.0.0-rc1home_lulu_2452_lulu7_vhost+ #62 [ 647.823139] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.15.0-29-g6a62e0cb0dfe-prebuilt.qem4 [ 647.824365] RIP: 0010:domain_unmap+0x48/0x110 [ 647.825424] Code: 48 89 fb 8d 4c f6 1e 39 c1 0f 4f c8 83 e9 0c 83 f9 3f 7f 18 48 89 e8 48 d3 e8 48 85 c0 75 59 [ 647.828064] RSP: 0018:ffffae5340c0bbf0 EFLAGS: 00010202 [ 647.828973] RAX: 0000000000000001 RBX:
ffff921793d10540 RCX: 000000000000001b [ 647.830083] RDX: 00000000080000ff RSI: 0000000000000001 RDI:
ffff921793d10540 [ 647.831214] RBP: 0000000007fc0100 R08: ffffae5340c0bcd0 R09: 0000000000000003 [ 647.832388] R10: 0000007fc0100000 R11: 0000000000100000 R12: 00000000080000ff [ 647.833668] R13:
ffffae5340c0bcd0 R14: ffff921793d10590 R15: 0000008000100000 [ 647.834782] FS: 00007f772ec90640(0000) GS:ffff921ce7a80000(0000) knlGS:0000000000000000 [ 647.836004] CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 [ 647.836990] CR2: 00007f02c27a3a20 CR3: 0000000101b0c006 CR4: 0000000000372ee0 [ 647.838107] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 647.839283] DR3:
0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 647.840666] Call Trace: [ 647.841437] <TASK> [ 647.842107] intel_iommu_unmap_pages+0x93/0x140 [ 647.843112] __iommu_unmap+0x91/0x1b0 [ 647.844003] iommu_unmap+0x6a/0x95 [ 647.844885] vhost_vdpa_unmap+0x1de/0x1f0 [vhost_vdpa] [ 647.845985] vhost_vdpa_process_iotlb_msg+0xf0/0x90b [vhost_vdpa] [ 647.847235] ? _raw_spin_unlock+0x15/0x30 [ 647.848181] ? _copy_from_iter+0x8c/0x580 [ 647.849137] vhost_chr_write_iter+0xb3/0x430 [vhost] [ 647.850126] vfs_write+0x1e4/0x3a0 [ 647.850897] ksys_write+0x53/0xd0 [ 647.851688] do_syscall_64+0x3a/0x90 [ 647.852508] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 647.853457] RIP: 0033:0x7f7734ef9f4f [ 647.854408] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 29 76 f8 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c8 [ 647.857217] RSP: 002b:00007f772ec8f040 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 647.858486] RAX: ffffffffffffffda RBX: 00000000fef00000 RCX: 00007f7734ef9f4f [ 647.859713] RDX: 0000000000000048 RSI:
00007f772ec8f090 RDI: 0000000000000010 [ 647.860942] RBP: 00007f772ec8f1a0 R08: 0000000000000000 R09:
0000000000000000 [ 647.862206] R10: 0000000000000001 R11: 0000000000000293 R12: 0000000000000010 [ 647.863446] R13: 0000000000000002 R14: 0000000000000000 R15: ffffffff01100000 [ 647.864692] </TASK> [ 647.865458] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs v] [ 647.874688] ---[ end trace 0000000000000000 ]--- (CVE-2022-50851)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50851
https://security-tracker.debian.org/tracker/CVE-2022-50851

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50851

Plugin Information
Published: 2025/12/30, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280751 - Linux Distros Unpatched Vulnerability : CVE-2022-50852
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix use after free in mt7921_acpi_read() Don't dereference sar_root after it has been freed. (CVE-2022-50852)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50852

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
7.4
EPSS Score
0.0002
References

CVE | CVE-2022-50852

Plugin Information
Published: 2025/12/30, Modified: 2025/12/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281529 - Linux Distros Unpatched Vulnerability : CVE-2022-50858
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mmc: alcor: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and calling mmc_free_host() in the error path.
(CVE-2022-50858)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50858

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.4
EPSS Score
0.0002
References

CVE | CVE-2022-50858

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281517 - Linux Distros Unpatched Vulnerability : CVE-2022-50859
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message Commit d5c7076b772a (smb3: add smb3.1.1 to default dialect list) extend the dialects from 3 to 4, but forget to decrease the extended length when specific the dialect, then the message length is larger than expected. This maybe leak some info through network because not initialize the message body. After apply this patch, the VALIDATE_NEGOTIATE_INFO message length is reduced from 28 bytes to 26 bytes. (CVE-2022-50859)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50859

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.5
EPSS Score
0.0002
References

CVE | CVE-2022-50859

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281542 - Linux Distros Unpatched Vulnerability : CVE-2022-50862
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf: prevent decl_tag from being referenced in func_proto Syzkaller was able to hit the following issue: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 3609 at kernel/bpf/btf.c:1946 btf_type_id_size+0x2d5/0x9d0 kernel/bpf/btf.c:1946 Modules linked in: CPU: 0 PID: 3609 Comm: syz-executor361 Not tainted 6.0.0-syzkaller-02734-g0326074ff465 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 RIP: 0010:btf_type_id_size+0x2d5/0x9d0 kernel/bpf/btf.c:1946 Code: ef e8 7f 8e e4 ff 41 83 ff 0b 77 28 f6 44 24 10 18 75 3f e8 6d 91 e4 ff 44 89 fe bf 0e 00 00 00 e8 20 8e e4 ff e8 5b 91 e4 ff <0f> 0b 45 31 f6 e9 98 02 00 00 41 83 ff 12 74 18 e8 46 91 e4 ff 44 RSP: 0018:ffffc90003cefb40 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000 RDX: ffff8880259c0000 RSI: ffffffff81968415 RDI: 0000000000000005 RBP: ffff88801270ca00 R08: 0000000000000005 R09:
000000000000000e R10: 0000000000000011 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000011 R14: ffff888026ee6424 R15: 0000000000000011 FS: 000055555641b300(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000f2e258 CR3:
000000007110e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> btf_func_proto_check kernel/bpf/btf.c:4447 [inline] btf_check_all_types kernel/bpf/btf.c:4723 [inline] btf_parse_type_sec kernel/bpf/btf.c:4752 [inline] btf_parse kernel/bpf/btf.c:5026 [inline] btf_new_fd+0x1926/0x1e70 kernel/bpf/btf.c:6892 bpf_btf_load kernel/bpf/syscall.c:4324 [inline] __sys_bpf+0xb7d/0x4cf0 kernel/bpf/syscall.c:5010 __do_sys_bpf kernel/bpf/syscall.c:5069 [inline] __se_sys_bpf kernel/bpf/syscall.c:5067 [inline] __x64_sys_bpf+0x75/0xb0 kernel/bpf/syscall.c:5067 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f0fbae41c69 Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc8aeb6228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0fbae41c69 RDX:
0000000000000020 RSI: 0000000020000140 RDI: 0000000000000012 RBP: 00007f0fbae05e10 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000246 R12: 00007f0fbae05ea0 R13:
0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> Looks like it tries to create a func_proto which return type is decl_tag. For the details, see Martin's spot on analysis in [0]. 0: https:
//lore.kernel.org/bpf/CAKH8qBuQDLva_hHxxBuZzyAcYNO4ejhovz6TQeVSk8HY- 2SO6g@mail.gmail.com/T/#mea6524b3fcd6298347432226e81b1e6155efc62c (CVE-2022-50862)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50862

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
6.3
EPSS Score
0.0002
References

CVE | CVE-2022-50862

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280704 - Linux Distros Unpatched Vulnerability : CVE-2022-50871
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath11k: Fix qmi_msg_handler data structure initialization qmi_msg_handler is required to be null terminated by QMI module. There might be a case where a handler for a msg id is not present in the handlers array which can lead to infinite loop while searching the handler and therefore out of bound access in qmi_invoke_handler(). Hence update the initialization in qmi_msg_handler data structure. Tested- on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1 (CVE-2022-50871)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50871
https://security-tracker.debian.org/tracker/CVE-2022-50871

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50871

Plugin Information
Published: 2025/12/30, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281540 - Linux Distros Unpatched Vulnerability : CVE-2022-50878
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611_connector_init() A NULL check for bridge->encoder shows that it may be NULL, but it already been dereferenced on all paths leading to the check. 812 if (!bridge->encoder) { Dereference the pointer bridge->encoder. 810 drm_connector_attach_encoder(<9611->connector, bridge->encoder);
(CVE-2022-50878)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50878

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50878

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281504 - Linux Distros Unpatched Vulnerability : CVE-2022-50879
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: objtool: Fix SEGFAULT find_insn() will return NULL in case of failure. Check insn in order to avoid a kernel Oops for NULL pointer dereference.
(CVE-2022-50879)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50879

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
3.6
EPSS Score
0.0002
References

CVE | CVE-2022-50879

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280784 - Linux Distros Unpatched Vulnerability : CVE-2022-50881
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() This patch fixes a use-after-free in ath9k that occurs in ath9k_hif_usb_disconnect() when ath9k_destroy_wmi() is trying to access 'drv_priv' that has already been freed by ieee80211_free_hw(), called by ath9k_htc_hw_deinit(). The patch moves ath9k_destroy_wmi() before ieee80211_free_hw(). Note that urbs from the driver should be killed before freeing 'wmi' with ath9k_destroy_wmi() as their callbacks will access 'wmi'. Found by a modified version of syzkaller.
================================================================== BUG: KASAN: use-after-free in ath9k_destroy_wmi+0x38/0x40 Read of size 8 at addr ffff8881069132a0 by task kworker/0:1/7 CPU: 0 PID: 7 Comm: kworker/0:1 Tainted: G O 5.14.0+ #131 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 Workqueue: usb_hub_wq hub_event Call Trace:
dump_stack_lvl+0x8e/0xd1 print_address_description.constprop.0.cold+0x93/0x334 ? ath9k_destroy_wmi+0x38/0x40 ? ath9k_destroy_wmi+0x38/0x40 kasan_report.cold+0x83/0xdf ? ath9k_destroy_wmi+0x38/0x40 ath9k_destroy_wmi+0x38/0x40 ath9k_hif_usb_disconnect+0x329/0x3f0 ? ath9k_hif_usb_suspend+0x120/0x120 ? usb_disable_interface+0xfc/0x180 usb_unbind_interface+0x19b/0x7e0 ? usb_autoresume_device+0x50/0x50 device_release_driver_internal+0x44d/0x520 bus_remove_device+0x2e5/0x5a0 device_del+0x5b2/0xe30 ? __device_link_del+0x370/0x370 ? usb_remove_ep_devs+0x43/0x80 ? remove_intf_ep_devs+0x112/0x1a0 usb_disable_device+0x1e3/0x5a0 usb_disconnect+0x267/0x870 hub_event+0x168d/0x3950 ? rcu_read_lock_sched_held+0xa1/0xd0 ? hub_port_debounce+0x2e0/0x2e0 ? check_irq_usage+0x860/0xf20 ? drain_workqueue+0x281/0x360 ? lock_release+0x640/0x640 ? rcu_read_lock_sched_held+0xa1/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ? lockdep_hardirqs_on_prepare+0x273/0x3e0 process_one_work+0x92b/0x1460 ? pwq_dec_nr_in_flight+0x330/0x330 ? rwlock_bug.part.0+0x90/0x90 worker_thread+0x95/0xe00 ? __kthread_parkme+0x115/0x1e0 ? process_one_work+0x1460/0x1460 kthread+0x3a1/0x480 ? set_kthread_struct+0x120/0x120 ret_from_fork+0x1f/0x30 The buggy address belongs to the page: page:ffffea00041a44c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106913 flags: 0x200000000000000(node=0|zone=2) raw:
0200000000000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 3, migratetype Unmovable, gfp_mask 0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), pid 7, ts 38347963444, free_ts 41399957635 prep_new_page+0x1aa/0x240 get_page_from_freelist+0x159a/0x27c0 __alloc_pages+0x2da/0x6a0 alloc_pages+0xec/0x1e0 kmalloc_order+0x39/0xf0 kmalloc_order_trace+0x19/0x120 __kmalloc+0x308/0x390 wiphy_new_nm+0x6f5/0x1dd0 ieee80211_alloc_hw_nm+0x36d/0x2230 ath9k_htc_probe_device+0x9d/0x1e10 ath9k_htc_hw_init+0x34/0x50 ath9k_hif_usb_firmware_cb+0x25f/0x4e0 request_firmware_work_func+0x131/0x240 process_one_work+0x92b/0x1460 worker_thread+0x95/0xe00 kthread+0x3a1/0x480 page last free stack trace:
free_pcp_prepare+0x3d3/0x7f0 free_unref_page+0x1e/0x3d0 device_release+0xa4/0x240 kobject_put+0x186/0x4c0 put_device+0x20/0x30 ath9k_htc_disconnect_device+0x1cf/0x2c0 ath9k_htc_hw_deinit+0x26/0x30 ath9k_hif_usb_disconnect+0x2d9/0x3f0 usb_unbind_interface+0x19b/0x7e0 device_release_driver_internal+0x44d/0x520 bus_remove_device+0x2e5/0x5a0 device_del+0x5b2/0xe30 usb_disable_device+0x1e3/0x5a0 usb_disconnect+0x267/0x870 hub_event+0x168d/0x3950 process_one_work+0x92b/0x1460 Memory state around the buggy address: ffff888106913180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888106913200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff888
---truncated--- (CVE-2022-50881)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50881

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
7.3
EPSS Score
0.0002
References

CVE | CVE-2022-50881

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280779 - Linux Distros Unpatched Vulnerability : CVE-2022-50882
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix memory leak in uvc_gpio_parse Previously the unit buffer was allocated before checking the IRQ for privacy GPIO. In case of error, the unit buffer was leaked. Allocate the unit buffer after the IRQ to avoid it. Addresses- Coverity-ID: 1474639 (Resource leak) (CVE-2022-50882)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50882

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50882

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280786 - Linux Distros Unpatched Vulnerability : CVE-2022-50883
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf: Prevent decl_tag from being referenced in func_proto arg Syzkaller managed to hit another decl_tag issue: btf_func_proto_check kernel/bpf/btf.c:4506 [inline] btf_check_all_types kernel/bpf/btf.c:4734 [inline] btf_parse_type_sec+0x1175/0x1980 kernel/bpf/btf.c:4763 btf_parse kernel/bpf/btf.c:5042 [inline] btf_new_fd+0x65a/0xb00 kernel/bpf/btf.c:6709 bpf_btf_load+0x6f/0x90 kernel/bpf/syscall.c:4342
__sys_bpf+0x50a/0x6c0 kernel/bpf/syscall.c:5034 __do_sys_bpf kernel/bpf/syscall.c:5093 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5091 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5091 do_syscall_64+0x54/0x70 arch/x86/entry/common.c:48 This seems similar to commit ea68376c8bed (bpf:
prevent decl_tag from being referenced in func_proto) but for the argument. (CVE-2022-50883)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50883

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
5.9
EPSS Score
0.0002
References

CVE | CVE-2022-50883

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280787 - Linux Distros Unpatched Vulnerability : CVE-2022-50884
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm: Prevent drm_copy_field() to attempt copying a NULL pointer There are some struct drm_driver fields that are required by drivers since drm_copy_field() attempts to copy them to user-space via DRM_IOCTL_VERSION. But it can be possible that a driver has a bug and did not set some of the fields, which leads to drm_copy_field() attempting to copy a NULL pointer: [ +10.395966] Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000000 [ +0.010955] Mem abort info: [ +0.002835] ESR = 0x0000000096000004 [ +0.003872] EC = 0x25: DABT (current EL), IL = 32 bits [ +0.005395] SET = 0, FnV = 0 [ +0.003113] EA = 0, S1PTW = 0 [ +0.003182] FSC = 0x04: level 0 translation fault [ +0.004964] Data abort info: [ +0.002919] ISV = 0, ISS = 0x00000004 [ +0.003886] CM = 0, WnR = 0 [ +0.003040] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000115dad000 [ +0.006536] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ +0.006925] Internal error: Oops: 96000004 [#1] SMP ... [ +0.011113] pstate: 80400005 (Nzcv daif +PAN -UAO
-TCO -DIT -SSBS BTYPE=--) [ +0.007061] pc : __pi_strlen+0x14/0x150 [ +0.003895] lr :
drm_copy_field+0x30/0x1a4 [ +0.004156] sp : ffff8000094b3a50 [ +0.003355] x29: ffff8000094b3a50 x28:
ffff8000094b3b70 x27: 0000000000000040 [ +0.007242] x26: ffff443743c2ba00 x25: 0000000000000000 x24:
0000000000000040 [ +0.007243] x23: ffff443743c2ba00 x22: ffff8000094b3b70 x21: 0000000000000000 [ +0.007241] x20: 0000000000000000 x19: ffff8000094b3b90 x18: 0000000000000000 [ +0.007241] x17:
0000000000000000 x16: 0000000000000000 x15: 0000aaab14b9af40 [ +0.007241] x14: 0000000000000000 x13:
0000000000000000 x12: 0000000000000000 [ +0.007239] x11: 0000000000000000 x10: 0000000000000000 x9 :
ffffa524ad67d4d8 [ +0.007242] x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : 6c6e6263606e7141 [ +0.007239] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 [ +0.007241] x2 :
0000000000000000 x1 : ffff8000094b3b90 x0 : 0000000000000000 [ +0.007240] Call trace: [ +0.002475]
__pi_strlen+0x14/0x150 [ +0.003537] drm_version+0x84/0xac [ +0.003448] drm_ioctl_kernel+0xa8/0x16c [ +0.003975] drm_ioctl+0x270/0x580 [ +0.003448] __arm64_sys_ioctl+0xb8/0xfc [ +0.003978] invoke_syscall+0x78/0x100 [ +0.003799] el0_svc_common.constprop.0+0x4c/0xf4 [ +0.004767] do_el0_svc+0x38/0x4c [ +0.003357] el0_svc+0x34/0x100 [ +0.003185] el0t_64_sync_handler+0x11c/0x150 [ +0.004418] el0t_64_sync+0x190/0x194 [ +0.003716] Code: 92402c04 b200c3e8 f13fc09f 5400088c (a9400c02) [ +0.006180] ---[ end trace 0000000000000000 ]--- (CVE-2022-50884)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50884

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50884

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281514 - Linux Distros Unpatched Vulnerability : CVE-2022-50885
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed There is a null-ptr-deref when mount.cifs over rdma: BUG:
KASAN: null-ptr-deref in rxe_qp_do_cleanup+0x2f3/0x360 [rdma_rxe] Read of size 8 at addr 0000000000000018 by task mount.cifs/3046 CPU: 2 PID: 3046 Comm: mount.cifs Not tainted 6.1.0-rc5+ #62 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc3 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 kasan_report+0xad/0x130 rxe_qp_do_cleanup+0x2f3/0x360 [rdma_rxe] execute_in_process_context+0x25/0x90
__rxe_cleanup+0x101/0x1d0 [rdma_rxe] rxe_create_qp+0x16a/0x180 [rdma_rxe] create_qp.part.0+0x27d/0x340 ib_create_qp_kernel+0x73/0x160 rdma_create_qp+0x100/0x230 _smbd_get_connection+0x752/0x20f0 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The root cause of the issue is the socket create failed in rxe_qp_init_req(). So move the reset rxe_qp_do_cleanup() after the NULL ptr check. (CVE-2022-50885)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50885

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50885

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281534 - Linux Distros Unpatched Vulnerability : CVE-2022-50886
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mmc: toshsd: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and goto error path which will call mmc_free_host(), besides, free_irq() also needs be called. (CVE-2022-50886)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50886

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.2
EPSS Score
0.0003
References

CVE | CVE-2022-50886

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226171 - Linux Distros Unpatched Vulnerability : CVE-2023-0465
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. (CVE-2023-0465)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-0465
https://ubuntu.com/security/CVE-2023-0465

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0034
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-0465

Plugin Information
Published: 2025/03/05, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- compat-openssl11
- shim-x64
226902 - Linux Distros Unpatched Vulnerability : CVE-2023-0466
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification.
As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument.
Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications.
(CVE-2023-0466)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-0466
https://ubuntu.com/security/CVE-2023-0466

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0042
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-0466

Plugin Information
Published: 2025/03/05, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- compat-openssl11
- shim-x64
226768 - Linux Distros Unpatched Vulnerability : CVE-2023-0778
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system. (CVE-2023-0778)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-0778
https://ubuntu.com/security/CVE-2023-0778

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.8 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.2
EPSS Score
0.001
References

CVE | CVE-2023-0778

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- podman
226422 - Linux Distros Unpatched Vulnerability : CVE-2023-1170
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376. (CVE-2023-1170)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-1170
https://security-tracker.debian.org/tracker/CVE-2023-1170

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.6 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
5.5
EPSS Score
0.0005
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-1170

Plugin Information
Published: 2025/03/05, Modified: 2025/10/08
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
226332 - Linux Distros Unpatched Vulnerability : CVE-2023-1175
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378. (CVE-2023-1175)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-1175

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
6.6 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
5.5
EPSS Score
0.0004
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-1175

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
225867 - Linux Distros Unpatched Vulnerability : CVE-2023-1264
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392. (CVE-2023-1264)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-1264
https://security-tracker.debian.org/tracker/CVE-2023-1264
https://ubuntu.com/security/CVE-2023-1264

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-1264

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
258556 - Linux Distros Unpatched Vulnerability : CVE-2023-1916
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x.
(CVE-2023-1916)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-1916
https://security-tracker.debian.org/tracker/CVE-2023-1916

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
CVSS v3.0 Temporal Score
5.5 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
5.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-1916

Plugin Information
Published: 2025/08/30, Modified: 2025/09/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libtiff
- libtiff-devel
227197 - Linux Distros Unpatched Vulnerability : CVE-2023-1972
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A potential heap based buffer overflow was found in _bfd_elf_slurp_version_tables() in bfd/elf.c. This may lead to loss of availability. (CVE-2023-1972)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-1972
https://security-tracker.debian.org/tracker/CVE-2023-1972

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-1972

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-12-binutils
- gcc-toolset-12-binutils-devel
- gcc-toolset-12-binutils-gold
226448 - Linux Distros Unpatched Vulnerability : CVE-2023-2019
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in the Linux kernel's netdevsim device driver, within the scheduling of events. This issue results from the improper management of a reference count. This may allow an attacker to create a denial of service condition on the system. (CVE-2023-2019)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-2019
https://ubuntu.com/security/CVE-2023-2019

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.4 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
3.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-2019

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226324 - Linux Distros Unpatched Vulnerability : CVE-2023-20592
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of guest virtual machine (VM) memory integrity. (CVE-2023-20592)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-20592
https://ubuntu.com/security/CVE-2023-20592

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0027
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-20592

Plugin Information
Published: 2025/03/05, Modified: 2025/09/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- iwl100-firmware
- iwl1000-firmware
- iwl105-firmware
- iwl135-firmware
- iwl2000-firmware
- iwl2030-firmware
- iwl3160-firmware
- iwl5000-firmware
- iwl5150-firmware
- iwl6000g2a-firmware
- iwl6000g2b-firmware
- iwl6050-firmware
- iwl7260-firmware
- libertas-sd8787-firmware
- linux-firmware
- linux-firmware-whence
- netronome-firmware
226194 - Linux Distros Unpatched Vulnerability : CVE-2023-2162
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information.
(CVE-2023-2162)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-2162
https://ubuntu.com/security/CVE-2023-2162

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-2162

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226476 - Linux Distros Unpatched Vulnerability : CVE-2023-23908
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Improper access control in some 3rd Generation Intel(R) Xeon(R) Scalable processors may allow a privileged user to potentially enable information disclosure via local access. (CVE-2023-23908)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-23908
https://ubuntu.com/security/CVE-2023-23908

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
4.4 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
3.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-23908

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- microcode_ctl
227077 - Linux Distros Unpatched Vulnerability : CVE-2023-24056
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes. (CVE-2023-24056)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-24056
https://security-tracker.debian.org/tracker/CVE-2023-24056
https://ubuntu.com/security/CVE-2023-24056

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.001
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-24056

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libpkgconf
- pkgconf
- pkgconf-m4
- pkgconf-pkg-config
227251 - Linux Distros Unpatched Vulnerability : CVE-2023-25433
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size after rotateImage() in tiffcrop cause heap-buffer-overflow and SEGV. (CVE-2023-25433)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-25433

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-25433

Plugin Information
Published: 2025/03/05, Modified: 2025/09/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libtiff
- libtiff-devel
226660 - Linux Distros Unpatched Vulnerability : CVE-2023-25435
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesShifted8bits() at /libtiff/tools/tiffcrop.c:3753. (CVE-2023-25435)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-25435

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-25435

Plugin Information
Published: 2025/03/05, Modified: 2025/09/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libtiff
- libtiff-devel
226191 - Linux Distros Unpatched Vulnerability : CVE-2023-2609
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531. (CVE-2023-2609)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-2609
https://security-tracker.debian.org/tracker/CVE-2023-2609

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0011
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-2609

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
252505 - Linux Distros Unpatched Vulnerability : CVE-2023-2650
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit.
OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods. When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time. The time complexity is O(n^2) with 'n'
being the size of the sub-identifiers in bytes (*). With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced. This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms. Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data. Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL. If the use is for the mere purpose of display, the severity is considered low. In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 certificates, including simple things like verifying its signature. The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer's certificate chain. Additionally, this only impacts clients, or servers that have explicitly enabled client authentication. In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates. This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low. (CVE-2023-2650)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-2650
https://ubuntu.com/security/CVE-2023-2650

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.9186
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-2650

Plugin Information
Published: 2025/08/20, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- compat-openssl11
- shim-x64
226211 - Linux Distros Unpatched Vulnerability : CVE-2023-28327
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In unix_diag_get_exact in the Linux Kernel. The newly allocated skb does not have sk, leading to a NULL pointer. This flaw allows a local user to crash or potentially cause a denial of service. (CVE-2023-28327)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-28327
https://ubuntu.com/security/CVE-2023-28327

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-28327

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226103 - Linux Distros Unpatched Vulnerability : CVE-2023-3006
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted branches can cause cache allocation. This issue leads to obtaining information that should not be accessible. (CVE-2023-3006)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-3006
https://ubuntu.com/security/CVE-2023-3006

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-3006

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227386 - Linux Distros Unpatched Vulnerability : CVE-2023-30571
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low- privileged local user can delete and rename files inside those directories. (CVE-2023-30571)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-30571
https://security-tracker.debian.org/tracker/CVE-2023-30571
https://ubuntu.com/security/CVE-2023-30571

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H)
CVSS v3.0 Temporal Score
4.6 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.2
EPSS Score
0.0002
CVSS v2.0 Base Score
3.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
2.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-30571

Plugin Information
Published: 2025/03/05, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libarchive
226712 - Linux Distros Unpatched Vulnerability : CVE-2023-31082
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in drivers/tty/n_gsm.c in the Linux kernel 6.2. There is a sleeping function called from an invalid context in gsmld_write, which will block the kernel. Note: This has been disputed by 3rd parties as not a valid vulnerability. (CVE-2023-31082)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-31082
https://security-tracker.debian.org/tracker/CVE-2023-31082
https://ubuntu.com/security/CVE-2023-31082

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-31082

Plugin Information
Published: 2025/03/05, Modified: 2025/12/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227190 - Linux Distros Unpatched Vulnerability : CVE-2023-31085
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error in do_div(sz,mtd->erasesize), used indirectly by ctrl_cdev_ioctl, when mtd->erasesize is 0.
(CVE-2023-31085)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-31085
https://security-tracker.debian.org/tracker/CVE-2023-31085
https://ubuntu.com/security/CVE-2023-31085

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-31085

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226442 - Linux Distros Unpatched Vulnerability : CVE-2023-3164
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file. (CVE-2023-3164)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-3164
https://security-tracker.debian.org/tracker/CVE-2023-3164

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-3164

Plugin Information
Published: 2025/03/05, Modified: 2025/09/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libtiff
- libtiff-devel
227337 - Linux Distros Unpatched Vulnerability : CVE-2023-3301
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an assertion and cause a denial of service. (CVE-2023-3301)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-3301

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.6 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-3301

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- qemu-guest-agent
227154 - Linux Distros Unpatched Vulnerability : CVE-2023-3446
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary:
Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulernable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the '-check' option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. (CVE-2023-3446)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-3446
https://ubuntu.com/security/CVE-2023-3446

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.0095
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-3446

Plugin Information
Published: 2025/03/05, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- compat-openssl11
226923 - Linux Distros Unpatched Vulnerability : CVE-2023-37454
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in the Linux kernel through 6.4.2. A crafted UDF filesystem image causes a use- after-free write operation in the udf_put_super and udf_close_lvid functions in fs/udf/super.c. NOTE: the suse.com reference has a different perspective about this. (CVE-2023-37454)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-37454
https://security-tracker.debian.org/tracker/CVE-2023-37454
https://ubuntu.com/security/CVE-2023-37454

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.2 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2023-37454

Plugin Information
Published: 2025/03/05, Modified: 2025/12/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227070 - Linux Distros Unpatched Vulnerability : CVE-2023-3817
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary:
Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check().
Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the -check option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. (CVE-2023-3817)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-3817
https://ubuntu.com/security/CVE-2023-3817

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.004
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-3817

Plugin Information
Published: 2025/03/05, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- compat-openssl11
227128 - Linux Distros Unpatched Vulnerability : CVE-2023-39128
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a stack overflow via the function ada_decode at /gdb/ada-lang.c. (CVE-2023-39128)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-39128
https://security-tracker.debian.org/tracker/CVE-2023-39128

Solution
There is no known solution at this time.
Risk Factor
Critical
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.8 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-39128

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gcc-toolset-12-gdb
227179 - Linux Distros Unpatched Vulnerability : CVE-2023-39129
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap use after free via the function add_pe_exported_sym() at /gdb/coff-pe-read.c. (CVE-2023-39129)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-39129
https://security-tracker.debian.org/tracker/CVE-2023-39129

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-39129

Plugin Information
Published: 2025/03/05, Modified: 2025/09/07
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gcc-toolset-12-gdb
225868 - Linux Distros Unpatched Vulnerability : CVE-2023-39130
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap buffer overflow via the function pe_as16() at /gdb/coff-pe-read.c. (CVE-2023-39130)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-39130
https://security-tracker.debian.org/tracker/CVE-2023-39130

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-39130

Plugin Information
Published: 2025/03/05, Modified: 2025/09/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gcc-toolset-12-gdb
226025 - Linux Distros Unpatched Vulnerability : CVE-2023-39327
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal. (CVE-2023-39327)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-39327
https://security-tracker.debian.org/tracker/CVE-2023-39327
https://ubuntu.com/security/CVE-2023-39327

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
4.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0014
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-39327

Plugin Information
Published: 2025/03/05, Modified: 2025/10/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- openjpeg2
227116 - Linux Distros Unpatched Vulnerability : CVE-2023-39328
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file. (CVE-2023-39328)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-39328
https://security-tracker.debian.org/tracker/CVE-2023-39328
https://ubuntu.com/security/CVE-2023-39328

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-39328

Plugin Information
Published: 2025/03/05, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- openjpeg2
225855 - Linux Distros Unpatched Vulnerability : CVE-2023-39329
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service. (CVE-2023-39329)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-39329
https://security-tracker.debian.org/tracker/CVE-2023-39329
https://ubuntu.com/security/CVE-2023-39329

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0039
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-39329

Plugin Information
Published: 2025/03/05, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- openjpeg2
226167 - Linux Distros Unpatched Vulnerability : CVE-2023-39742
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- giflib v5.2.1 was discovered to contain a segmentation fault via the component getarg.c. (CVE-2023-39742)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-39742
https://security-tracker.debian.org/tracker/CVE-2023-39742

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-39742

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- giflib
260352 - Linux Distros Unpatched Vulnerability : CVE-2023-39804
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c. (CVE-2023-39804)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-39804

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0008
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-39804

Plugin Information
Published: 2025/09/02, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- tar
258895 - Linux Distros Unpatched Vulnerability : CVE-2023-40403
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14.
Processing web content may disclose sensitive information. (CVE-2023-40403)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-40403

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0057
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-40403

Plugin Information
Published: 2025/08/30, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libxslt
225876 - Linux Distros Unpatched Vulnerability : CVE-2023-4459
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with normal user privilege to cause a denial of service due to a missing sanity check during cleanup.
(CVE-2023-4459)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-4459
https://ubuntu.com/security/CVE-2023-4459

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-4459

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260357 - Linux Distros Unpatched Vulnerability : CVE-2023-45322
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails.
This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail. (CVE-2023-45322)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-45322

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0043
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-45322

Plugin Information
Published: 2025/09/02, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libxml2
- libxml2-devel
- python3-libxml2
250986 - Linux Distros Unpatched Vulnerability : CVE-2023-45803
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs.
Although this behavior is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers. Because the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised.
This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve this issue. Users unable to update should disable redirects for services that aren't expecting to respond with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle 301, 302, and 303 redirects manually by stripping the HTTP request body. (CVE-2023-45803)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-45803
https://ubuntu.com/security/CVE-2023-45803

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.2 (CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
3.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-45803

Plugin Information
Published: 2025/08/18, Modified: 2025/11/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- python3-pip-wheel
226584 - Linux Distros Unpatched Vulnerability : CVE-2023-45862
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before 6.2.5. An object could potentially extend beyond the end of an allocation. (CVE-2023-45862)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-45862
https://ubuntu.com/security/CVE-2023-45862

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-45862

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226679 - Linux Distros Unpatched Vulnerability : CVE-2023-46246
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function `ga_grow_inner` in in the file `src/alloc.c` at line 748, which is freed in the file `src/ex_docmd.c` in the function `do_cmdline` at line 1010 and then used again in `src/cmdhist.c` at line 759. When using the `:history` command, it's possible that the provided argument overflows the accepted value. Causing an Integer Overflow and potentially later an use-after-free. This vulnerability has been patched in version 9.0.2068. (CVE-2023-46246)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-46246
https://security-tracker.debian.org/tracker/CVE-2023-46246

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0009
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-46246

Plugin Information
Published: 2025/03/05, Modified: 2025/10/08
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
247902 - Linux Distros Unpatched Vulnerability : CVE-2023-47233
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The brcm80211 component in the Linux kernel through 6.5.10 has a brcmf_cfg80211_detach use-after-free in the device unplugging (disconnect the USB by hotplug) code. For physically proximate attackers with local access, this could be exploited in a real world scenario. This is related to brcmf_cfg80211_escan_timeout_worker in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c.
(CVE-2023-47233)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-47233
https://ubuntu.com/security/CVE-2023-47233

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0017
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-47233

Plugin Information
Published: 2025/08/11, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227146 - Linux Distros Unpatched Vulnerability : CVE-2023-48231
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to be viable. This issue has been addressed in commit `25aabc2b` which has been included in release version 9.0.2106. Users are advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-48231)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-48231
https://security-tracker.debian.org/tracker/CVE-2023-48231

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-48231

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
227198 - Linux Distros Unpatched Vulnerability : CVE-2023-48232
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vim is an open source command line text editor. A floating point exception may occur when calculating the line offset for overlong lines and smooth scrolling is enabled and the cpo-settings include the 'n' flag.
This may happen when a window border is present and when the wrapped line continues on the next physical line directly in the window border because the 'cpo' setting includes the 'n' flag. Only users with non- default settings are affected and the exception should only result in a crash. This issue has been addressed in commit `cb0b99f0` which has been included in release version 9.0.2107. Users are advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-48232)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-48232
https://security-tracker.debian.org/tracker/CVE-2023-48232

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.0031
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-48232

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
226663 - Linux Distros Unpatched Vulnerability : CVE-2023-48233
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vim is an open source command line text editor. If the count after the :s command is larger than what fits into a (signed) long variable, abort with e_value_too_large. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `ac6378773` which has been included in release version 9.0.2108. Users are advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-48233)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-48233
https://security-tracker.debian.org/tracker/CVE-2023-48233

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.0031
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-48233

Plugin Information
Published: 2025/03/05, Modified: 2025/10/08
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
226566 - Linux Distros Unpatched Vulnerability : CVE-2023-48234
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vim is an open source command line text editor. When getting the count for a normal mode z command, it may overflow for large counts given. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `58f9befca1` which has been included in release version 9.0.2109. Users are advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-48234)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-48234
https://security-tracker.debian.org/tracker/CVE-2023-48234

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.0031
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-48234

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
227090 - Linux Distros Unpatched Vulnerability : CVE-2023-48235
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vim is an open source command line text editor. When parsing relative ex addresses one may unintentionally cause an overflow. Ironically this happens in the existing overflow check, because the line number becomes negative and LONG_MAX - lnum will cause the overflow. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `060623e` which has been included in release version 9.0.2110. Users are advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-48235)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-48235
https://security-tracker.debian.org/tracker/CVE-2023-48235

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.0031
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-48235

Plugin Information
Published: 2025/03/05, Modified: 2025/10/08
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
226785 - Linux Distros Unpatched Vulnerability : CVE-2023-48236
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vim is an open source command line text editor. When using the z= command, the user may overflow the count with values larger than MAX_INT. Impact is low, user interaction is required and a crash may not even happen in all situations. This vulnerability has been addressed in commit `73b2d379` which has been included in release version 9.0.2111. Users are advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-48236)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-48236
https://security-tracker.debian.org/tracker/CVE-2023-48236

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.0031
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-48236

Plugin Information
Published: 2025/03/05, Modified: 2025/10/08
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
226808 - Linux Distros Unpatched Vulnerability : CVE-2023-48237
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may be possible to overflow the size of integer. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `6bf131888` which has been included in version 9.0.2112. Users are advised to upgrade.
There are no known workarounds for this vulnerability. (CVE-2023-48237)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-48237
https://security-tracker.debian.org/tracker/CVE-2023-48237

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.0031
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-48237

Plugin Information
Published: 2025/03/05, Modified: 2025/10/08
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
227225 - Linux Distros Unpatched Vulnerability : CVE-2023-48706
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive `:s` call causes free-ing of memory which may later then be accessed by the initial `:s` command. The user must intentionally execute the payload and the whole process is a bit tricky to do since it seems to work only reliably for the very first :s command. It may also cause a crash of Vim. Version 9.0.2121 contains a fix for this issue. (CVE-2023-48706)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-48706
https://security-tracker.debian.org/tracker/CVE-2023-48706

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.2 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.001
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-48706

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
226621 - Linux Distros Unpatched Vulnerability : CVE-2023-49990
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Espeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable at synthdata.c. (CVE-2023-49990)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-49990

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.2
EPSS Score
0.0005
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-49990

Plugin Information
Published: 2025/03/05, Modified: 2025/09/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- espeak-ng
227318 - Linux Distros Unpatched Vulnerability : CVE-2023-49991
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c. (CVE-2023-49991)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-49991

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.2
EPSS Score
0.0005
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-49991

Plugin Information
Published: 2025/03/05, Modified: 2025/09/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- espeak-ng
227043 - Linux Distros Unpatched Vulnerability : CVE-2023-49992
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Overflow via the function RemoveEnding at dictionary.c. (CVE-2023-49992)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-49992

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.2
EPSS Score
0.0005
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-49992

Plugin Information
Published: 2025/03/05, Modified: 2025/09/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- espeak-ng
227394 - Linux Distros Unpatched Vulnerability : CVE-2023-49993
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Espeak-ng 1.52-dev was discovered to contain a Buffer Overflow via the function ReadClause at readclause.c. (CVE-2023-49993)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-49993

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.2
EPSS Score
0.0005
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-49993

Plugin Information
Published: 2025/03/05, Modified: 2025/09/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- espeak-ng
226155 - Linux Distros Unpatched Vulnerability : CVE-2023-49994
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Espeak-ng 1.52-dev was discovered to contain a Floating Point Exception via the function PeaksToHarmspect at wavegen.c. (CVE-2023-49994)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-49994

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-49994

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- espeak-ng
227011 - Linux Distros Unpatched Vulnerability : CVE-2023-50495
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().
(CVE-2023-50495)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-50495
https://security-tracker.debian.org/tracker/CVE-2023-50495
https://ubuntu.com/security/CVE-2023-50495

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0039
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-50495

Plugin Information
Published: 2025/03/05, Modified: 2025/09/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- ncurses
- ncurses-base
- ncurses-libs
225940 - Linux Distros Unpatched Vulnerability : CVE-2023-5197
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free. We recommend upgrading past commit f15f29fd4779be8a418b66e9d52979bb6d6c2325. (CVE-2023-5197)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-5197
https://ubuntu.com/security/CVE-2023-5197

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
6.6 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
CVSS v3.0 Temporal Score
6.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.5
EPSS Score
0.0006
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-5197

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226559 - Linux Distros Unpatched Vulnerability : CVE-2023-52447
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf: Defer the free of inner map when necessary When updating or deleting an inner map in map array or map htab, the map may still be accessed by non-sleepable program or sleepable program. However bpf_map_fd_put_ptr() decreases the ref-counter of the inner map directly through bpf_map_put(), if the ref-counter is the last one (which is true for most cases), the inner map will be freed by ops->map_free() in a kworker. But for now, most .map_free() callbacks don't use synchronize_rcu() or its variants to wait for the elapse of a RCU grace period, so after the invocation of ops->map_free completes, the bpf program which is accessing the inner map may incur use-after-free problem. Fix the free of inner map by invoking bpf_map_free_deferred() after both one RCU grace period and one tasks trace RCU grace period if the inner map has been removed from the outer map before. The deferment is accomplished by using call_rcu() or call_rcu_tasks_trace() when releasing the last ref-counter of bpf map. The newly-added rcu_head field in bpf_map shares the same storage space with work field to reduce the size of bpf_map. (CVE-2023-52447)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52447
https://ubuntu.com/security/CVE-2023-52447

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.7 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0009
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52447

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227104 - Linux Distros Unpatched Vulnerability : CVE-2023-52465
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: power: supply: Fix null pointer dereference in smb2_probe devm_kasprintf and devm_kzalloc return a pointer to dynamically allocated memory which can be NULL upon failure. (CVE-2023-52465)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52465
https://ubuntu.com/security/CVE-2023-52465

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52465

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226809 - Linux Distros Unpatched Vulnerability : CVE-2023-52481
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- arm64: errata: Add Cortex-A520 speculative unprivileged load workaround Implement the workaround for ARM Cortex-A520 erratum 2966298. On an affected Cortex-A520 core, a speculatively executed unprivileged load might leak data from a privileged load via a cache side channel. The issue only exists for loads within a translation regime with the same translation (e.g. same ASID and VMID). Therefore, the issue only affects the return to EL0. The workaround is to execute a TLBI before returning to EL0 after all loads of privileged data. A non-shareable TLBI to any address is sufficient. The workaround isn't necessary if page table isolation (KPTI) is enabled, but for simplicity it will be. Page table isolation should normally be disabled for Cortex-A520 as it supports the CSV3 feature and the E0PD feature (used when KASLR is enabled). (CVE-2023-52481)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52481
https://security-tracker.debian.org/tracker/CVE-2023-52481
https://ubuntu.com/security/CVE-2023-52481

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.2
EPSS Score
0.0035
CVSS v2.0 Base Score
5.9 (CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52481

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226795 - Linux Distros Unpatched Vulnerability : CVE-2023-52487
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix peer flow lists handling The cited change refactored mlx5e_tc_del_fdb_peer_flow() to only clear DUP flag when list of peer flows has become empty. However, if any concurrent user holds a reference to a peer flow (for example, the neighbor update workqueue task is updating peer flow's parent encap entry concurrently), then the flow will not be removed from the peer list and, consecutively, DUP flag will remain set. Since mlx5e_tc_del_fdb_peers_flow() calls mlx5e_tc_del_fdb_peer_flow() for every possible peer index the algorithm will try to remove the flow from eswitch instances that it has never peered with causing either NULL pointer dereference when trying to remove the flow peer list head of peer_index that was never initialized or a warning if the list debug config is enabled[0]. Fix the issue by always removing the peer flow from the list even when not releasing the last reference to it. [0]: [ 3102.985806] ------------[ cut here ]------------ [ 3102.986223] list_del corruption, ffff888139110698->next is NULL [ 3102.986757] WARNING: CPU: 2 PID: 22109 at lib/list_debug.c:53 __list_del_entry_valid_or_report+0x4f/0xc0 [ 3102.987561] Modules linked in: act_ct nf_flow_table bonding act_tunnel_key act_mirred act_skbedit vxlan cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress mlx5_vdpa vringh vhost_iotlb vdpa openvswitch nsh xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcg ss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5_core [last unloaded: bonding] [ 3102.991113] CPU: 2 PID: 22109 Comm: revalidator28 Not tainted 6.6.0-rc6+ #3 [ 3102.991695] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 3102.992605] RIP:
0010:__list_del_entry_valid_or_report+0x4f/0xc0 [ 3102.993122] Code: 39 c2 74 56 48 8b 32 48 39 fe 75 62 48 8b 51 08 48 39 f2 75 73 b8 01 00 00 00 c3 48 89 fe 48 c7 c7 48 fd 0a 82 e8 41 0b ad ff <0f> 0b 31 c0 c3 48 89 fe 48 c7 c7 70 fd 0a 82 e8 2d 0b ad ff 0f 0b [ 3102.994615] RSP: 0018:ffff8881383e7710 EFLAGS:
00010286 [ 3102.995078] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000 [ 3102.995670] RDX: 0000000000000001 RSI: ffff88885f89b640 RDI: ffff88885f89b640 [ 3102.997188] DEL flow 00000000be367878 on port 0 [ 3102.998594] RBP: dead000000000122 R08: 0000000000000000 R09: c0000000ffffdfff [ 3102.999604] R10: 0000000000000008 R11: ffff8881383e7598 R12: dead000000000100 [ 3103.000198] R13: 0000000000000002 R14: ffff888139110000 R15: ffff888101901240 [ 3103.000790] FS: 00007f424cde4700(0000) GS:ffff88885f880000(0000) knlGS:0000000000000000 [ 3103.001486] CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 [ 3103.001986] CR2: 00007fd42e8dcb70 CR3: 000000011e68a003 CR4: 0000000000370ea0 [ 3103.002596] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 3103.003190] DR3:
0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 3103.003787] Call Trace: [ 3103.004055] <TASK> [ 3103.004297] ? __warn+0x7d/0x130 [ 3103.004623] ? __list_del_entry_valid_or_report+0x4f/0xc0 [ 3103.005094] ? report_bug+0xf1/0x1c0 [ 3103.005439] ? console_unlock+0x4a/0xd0 [ 3103.005806] ? handle_bug+0x3f/0x70 [ 3103.006149] ? exc_invalid_op+0x13/0x60 [ 3103.006531] ? asm_exc_invalid_op+0x16/0x20 [ 3103.007430] ? __list_del_entry_valid_or_report+0x4f/0xc0 [ 3103.007910] mlx5e_tc_del_fdb_peers_flow+0xcf/0x240 [mlx5_core] [ 3103.008463] mlx5e_tc_del_flow+0x46/0x270 [mlx5_core] [ 3103.008944] mlx5e_flow_put+0x26/0x50 [mlx5_core] [ 3103.009401] mlx5e_delete_flower+0x25f/0x380 [mlx5_core] [ 3103.009901] tc_setup_cb_destroy+0xab/0x180 [ 3103.010292] fl_hw_destroy_filter+0x99/0xc0 [cls_flower] [ 3103.010779] __fl_delete+0x2d4/0x2f0 [cls_flower] [ 3103.0 ---truncated--- (CVE-2023-52487)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52487
https://ubuntu.com/security/CVE-2023-52487

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52487

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226051 - Linux Distros Unpatched Vulnerability : CVE-2023-52508
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid() The nvme_fc_fcp_op structure describing an AEN operation is initialized with a null request structure pointer. An FC LLDD may make a call to nvme_fc_io_getuuid passing a pointer to an nvmefc_fcp_req for an AEN operation. Add validation of the request structure pointer before dereference. (CVE-2023-52508)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52508
https://ubuntu.com/security/CVE-2023-52508

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52508

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226772 - Linux Distros Unpatched Vulnerability : CVE-2023-52516
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock
__dma_entry_alloc_check_leak() calls into printk -> serial console output (qcom geni) and grabs port->lock under free_entries_lock spin lock, which is a reverse locking dependency chain as qcom_geni IRQ handler can call into dma-debug code and grab free_entries_lock under port->lock. Move
__dma_entry_alloc_check_leak() call out of free_entries_lock scope so that we don't acquire serial console's port->lock under it. Trimmed-down lockdep splat: The existing dependency chain (in reverse order) is: -> #2 (free_entries_lock){-.-.}-{2:2}: _raw_spin_lock_irqsave+0x60/0x80 dma_entry_alloc+0x38/0x110 debug_dma_map_page+0x60/0xf8 dma_map_page_attrs+0x1e0/0x230 dma_map_single_attrs.constprop.0+0x6c/0xc8 geni_se_rx_dma_prep+0x40/0xcc qcom_geni_serial_isr+0x310/0x510
__handle_irq_event_percpu+0x110/0x244 handle_irq_event_percpu+0x20/0x54 handle_irq_event+0x50/0x88 handle_fasteoi_irq+0xa4/0xcc handle_irq_desc+0x28/0x40 generic_handle_domain_irq+0x24/0x30 gic_handle_irq+0xc4/0x148 do_interrupt_handler+0xa4/0xb0 el1_interrupt+0x34/0x64 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x64/0x68 arch_local_irq_enable+0x4/0x8 ____do_softirq+0x18/0x24 ... -> #1 (&port_lock_key){-.-.}-{2:2}: _raw_spin_lock_irqsave+0x60/0x80 qcom_geni_serial_console_write+0x184/0x1dc console_flush_all+0x344/0x454 console_unlock+0x94/0xf0 vprintk_emit+0x238/0x24c vprintk_default+0x3c/0x48 vprintk+0xb4/0xbc _printk+0x68/0x90 register_console+0x230/0x38c uart_add_one_port+0x338/0x494 qcom_geni_serial_probe+0x390/0x424 platform_probe+0x70/0xc0 really_probe+0x148/0x280 __driver_probe_device+0xfc/0x114 driver_probe_device+0x44/0x100 __device_attach_driver+0x64/0xdc bus_for_each_drv+0xb0/0xd8
__device_attach+0xe4/0x140 device_initial_probe+0x1c/0x28 bus_probe_device+0x44/0xb0 device_add+0x538/0x668 of_device_add+0x44/0x50 of_platform_device_create_pdata+0x94/0xc8 of_platform_bus_create+0x270/0x304 of_platform_populate+0xac/0xc4 devm_of_platform_populate+0x60/0xac geni_se_probe+0x154/0x160 platform_probe+0x70/0xc0 ... -> #0 (console_owner){-...}-{0:0}:
__lock_acquire+0xdf8/0x109c lock_acquire+0x234/0x284 console_flush_all+0x330/0x454 console_unlock+0x94/0xf0 vprintk_emit+0x238/0x24c vprintk_default+0x3c/0x48 vprintk+0xb4/0xbc
_printk+0x68/0x90 dma_entry_alloc+0xb4/0x110 debug_dma_map_sg+0xdc/0x2f8 __dma_map_sg_attrs+0xac/0xe4 dma_map_sgtable+0x30/0x4c get_pages+0x1d4/0x1e4 [msm] msm_gem_pin_pages_locked+0x38/0xac [msm] msm_gem_pin_vma_locked+0x58/0x88 [msm] msm_ioctl_gem_submit+0xde4/0x13ac [msm] drm_ioctl_kernel+0xe0/0x15c drm_ioctl+0x2e8/0x3f4 vfs_ioctl+0x30/0x50 ... Chain exists of: console_owner --> &port_lock_key -->
free_entries_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(free_entries_lock);
lock(&port_lock_key); lock(free_entries_lock); lock(console_owner); *** DEADLOCK *** Call trace:
dump_backtrace+0xb4/0xf0 show_stack+0x20/0x30 dump_stack_lvl+0x60/0x84 dump_stack+0x18/0x24 print_circular_bug+0x1cc/0x234 check_noncircular+0x78/0xac __lock_acquire+0xdf8/0x109c lock_acquire+0x234/0x284 console_flush_all+0x330/0x454 consol ---truncated--- (CVE-2023-52516)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52516
https://ubuntu.com/security/CVE-2023-52516

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.001
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52516

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227435 - Linux Distros Unpatched Vulnerability : CVE-2023-52518
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_codec: Fix leaking content of local_codecs The following memory leak can be observed when the controller supports codecs which are stored in local_codecs list but the elements are never freed: unreferenced object 0xffff88800221d840 (size 32): comm kworker/u3:0, pid 36, jiffies 4294898739 (age 127.060s) hex dump (first 32 bytes): f8 d3 02 03 80 88 ff ff 80 d8 21 02 80 88 ff ff ..........!..... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffffb324f557>] __kmalloc+0x47/0x120 [<ffffffffb39ef37d>] hci_codec_list_add.isra.0+0x2d/0x160 [<ffffffffb39ef643>] hci_read_codec_capabilities+0x183/0x270 [<ffffffffb39ef9ab>] hci_read_supported_codecs+0x1bb/0x2d0 [<ffffffffb39f162e>] hci_read_local_codecs_sync+0x3e/0x60 [<ffffffffb39ff1b3>] hci_dev_open_sync+0x943/0x11e0 [<ffffffffb396d55d>] hci_power_on+0x10d/0x3f0 [<ffffffffb30c99b4>] process_one_work+0x404/0x800 [<ffffffffb30ca134>] worker_thread+0x374/0x670 [<ffffffffb30d9108>] kthread+0x188/0x1c0 [<ffffffffb304db6b>] ret_from_fork+0x2b/0x50 [<ffffffffb300206a>] ret_from_fork_asm+0x1a/0x30 (CVE-2023-52518)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52518
https://ubuntu.com/security/CVE-2023-52518

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52518

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225873 - Linux Distros Unpatched Vulnerability : CVE-2023-52568
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Resolves SECS reclaim vs.
page fault for EAUG race The SGX EPC reclaimer (ksgxd) may reclaim the SECS EPC page for an enclave and set secs.epc_page to NULL. The SECS page is used for EAUG and ELDU in the SGX page fault handler. However, the NULL check for secs.epc_page is only done for ELDU, not EAUG before being used. Fix this by doing the same NULL check and reloading of the SECS page as needed for both EAUG and ELDU. The SECS page holds global enclave metadata. It can only be reclaimed when there are no other enclave pages remaining. At that point, virtually nothing can be done with the enclave until the SECS page is paged back in. An enclave can not run nor generate page faults without a resident SECS page. But it is still possible for a #PF for a non-SECS page to race with paging out the SECS page: when the last resident non-SECS page A triggers a #PF in a non-resident page B, and then page A and the SECS both are paged out before the #PF on B is handled.
Hitting this bug requires that race triggered with a #PF for EAUG. Following is a trace when it happens.
BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:sgx_encl_eaug_page+0xc7/0x210 Call Trace: ? __kmem_cache_alloc_node+0x16a/0x440 ? xa_load+0x6e/0xa0 sgx_vma_fault+0x119/0x230
__do_fault+0x36/0x140 do_fault+0x12f/0x400 __handle_mm_fault+0x728/0x1110 handle_mm_fault+0x105/0x310 do_user_addr_fault+0x1ee/0x750 ? __this_cpu_preempt_check+0x13/0x20 exc_page_fault+0x76/0x180 asm_exc_page_fault+0x27/0x30 (CVE-2023-52568)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52568
https://ubuntu.com/security/CVE-2023-52568

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52568

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227426 - Linux Distros Unpatched Vulnerability : CVE-2023-52582
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfs: Only call folio_start_fscache() one time for each folio If a network filesystem using netfs implements a clamp_length() function, it can set subrequest lengths smaller than a page size. When we loop through the folios in netfs_rreq_unlock_folios() to set any folios to be written back, we need to make sure we only call folio_start_fscache() once for each folio. Otherwise, this simple testcase: mount -o fsc,rsize=1024,wsize=1024 127.0.0.1:/export /mnt/nfs dd if=/dev/zero of=/mnt/nfs/file.bin bs=4096 count=1 1+0 records in 1+0 records out 4096 bytes (4.1 kB, 4.0 KiB) copied, 0.0126359 s, 324 kB/s echo 3 >
/proc/sys/vm/drop_caches cat /mnt/nfs/file.bin > /dev/null will trigger an oops similar to the following:
page dumped because: VM_BUG_ON_FOLIO(folio_test_private_2(folio)) ------------[ cut here ]------------ kernel BUG at include/linux/netfs.h:44! ... CPU: 5 PID: 134 Comm: kworker/u16:5 Kdump: loaded Not tainted 6.4.0-rc5 ... RIP: 0010:netfs_rreq_unlock_folios+0x68e/0x730 [netfs] ... Call Trace:
netfs_rreq_assess+0x497/0x660 [netfs] netfs_subreq_terminated+0x32b/0x610 [netfs] nfs_netfs_read_completion+0x14e/0x1a0 [nfs] nfs_read_completion+0x2f9/0x330 [nfs] rpc_free_task+0x72/0xa0 [sunrpc] rpc_async_release+0x46/0x70 [sunrpc] process_one_work+0x3bd/0x710 worker_thread+0x89/0x610 kthread+0x181/0x1c0 ret_from_fork+0x29/0x50 (CVE-2023-52582)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52582
https://ubuntu.com/security/CVE-2023-52582

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52582

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226952 - Linux Distros Unpatched Vulnerability : CVE-2023-52583
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ceph: fix deadlock or deadcode of misusing dget() The lock order is incorrect between denty and its parent, we should always make sure that the parent get the lock first. But since this deadcode is never used and the parent dir will always be set from the callers, let's just remove it. (CVE-2023-52583)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52583
https://ubuntu.com/security/CVE-2023-52583

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52583

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227241 - Linux Distros Unpatched Vulnerability : CVE-2023-52623
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- SUNRPC: Fix a suspicious RCU usage warning I received the following warning while running cthon against an ontap server running pNFS: [ 57.202521] ============================= [ 57.202522] WARNING: suspicious RCU usage [ 57.202523] 6.7.0-rc3-g2cc14f52aeb7 #41492 Not tainted [ 57.202525] ----------------------------- [ 57.202525] net/sunrpc/xprtmultipath.c:349 RCU-list traversed in non-reader section!! [ 57.202527] other info that might help us debug this: [ 57.202528] rcu_scheduler_active = 2, debug_locks = 1 [ 57.202529] no locks held by test5/3567. [ 57.202530] stack backtrace: [ 57.202532] CPU: 0 PID: 3567 Comm: test5 Not tainted 6.7.0-rc3-g2cc14f52aeb7 #41492 5b09971b4965c0aceba19f3eea324a4a806e227e [ 57.202534] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 2/2/2022 [ 57.202536] Call Trace: [ 57.202537] <TASK> [ 57.202540] dump_stack_lvl+0x77/0xb0 [ 57.202551] lockdep_rcu_suspicious+0x154/0x1a0 [ 57.202556] rpc_xprt_switch_has_addr+0x17c/0x190 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202596] rpc_clnt_setup_test_and_add_xprt+0x50/0x180 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202621] ? rpc_clnt_add_xprt+0x254/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202646] rpc_clnt_add_xprt+0x27a/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202671] ?
__pfx_rpc_clnt_setup_test_and_add_xprt+0x10/0x10 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202696] nfs4_pnfs_ds_connect+0x345/0x760 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202728] ? __pfx_nfs4_test_session_trunk+0x10/0x10 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202754] nfs4_fl_prepare_ds+0x75/0xc0 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a] [ 57.202760] filelayout_write_pagelist+0x4a/0x200 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a] [ 57.202765] pnfs_generic_pg_writepages+0xbe/0x230 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202788] __nfs_pageio_add_request+0x3fd/0x520 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202813] nfs_pageio_add_request+0x18b/0x390 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202831] nfs_do_writepage+0x116/0x1e0 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202849] nfs_writepages_callback+0x13/0x30 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202866] write_cache_pages+0x265/0x450 [ 57.202870] ?
__pfx_nfs_writepages_callback+0x10/0x10 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202891] nfs_writepages+0x141/0x230 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202913] do_writepages+0xd2/0x230 [ 57.202917] ? filemap_fdatawrite_wbc+0x5c/0x80 [ 57.202921] filemap_fdatawrite_wbc+0x67/0x80 [ 57.202924] filemap_write_and_wait_range+0xd9/0x170 [ 57.202930] nfs_wb_all+0x49/0x180 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202947] nfs4_file_flush+0x72/0xb0 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202969]
__se_sys_close+0x46/0xd0 [ 57.202972] do_syscall_64+0x68/0x100 [ 57.202975] ? do_syscall_64+0x77/0x100 [ 57.202976] ? do_syscall_64+0x77/0x100 [ 57.202979] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 57.202982] RIP: 0033:0x7fe2b12e4a94 [ 57.202985] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d d5 18 0e 00 00 74 13 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 44 c3 0f 1f 00 48 83 ec 18 89 7c 24 0c e8 c3 [ 57.202987] RSP: 002b:00007ffe857ddb38 EFLAGS: 00000202 ORIG_RAX:
0000000000000003 [ 57.202989] RAX: ffffffffffffffda RBX: 00007ffe857dfd68 RCX: 00007fe2b12e4a94 [ 57.202991] RDX: 0000000000002000 RSI: 00007ffe857ddc40 RDI: 0000000000000003 [ 57.202992] RBP:
00007ffe857dfc50 R08: 7fffffffffffffff R09: 0000000065650f49 [ 57.202993] R10: 00007f ---truncated--- (CVE-2023-52623)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52623
https://ubuntu.com/security/CVE-2023-52623

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0008
CVSS v2.0 Base Score
9.0 (CVSS2#AV:N/AC:M/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
7.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52623

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227148 - Linux Distros Unpatched Vulnerability : CVE-2023-52646
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- aio: fix mremap after fork null-deref Commit e4a0d3e720e7 (aio: Make it possible to remap aio ring) introduced a null-deref if mremap is called on an old aio mapping after fork as mm->ioctx_table will be set to NULL. [jmoyer@redhat.com: fix 80 column issue] (CVE-2023-52646)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52646
https://ubuntu.com/security/CVE-2023-52646

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0009
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52646

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226220 - Linux Distros Unpatched Vulnerability : CVE-2023-52653
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- SUNRPC: fix a memleak in gss_import_v2_context The ctx->mech_used.data allocated by kmemdup is not freed in neither gss_import_v2_context nor it only caller gss_krb5_import_sec_context, which frees ctx on error.
Thus, this patch reform the last call of gss_import_v2_context to the gss_krb5_import_ctx_v2, preventing the memleak while keepping the return formation. (CVE-2023-52653)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52653
https://security-tracker.debian.org/tracker/CVE-2023-52653
https://ubuntu.com/security/CVE-2023-52653

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0009
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52653

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226010 - Linux Distros Unpatched Vulnerability : CVE-2023-52675
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- powerpc/imc-pmu: Add a null pointer check in update_events_in_group() kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. (CVE-2023-52675)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52675
https://ubuntu.com/security/CVE-2023-52675

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0011
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52675

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227156 - Linux Distros Unpatched Vulnerability : CVE-2023-52700
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tipc: fix kernel warning when sending SYN message When sending a SYN message, this kernel stack trace is observed: ... [ 13.396352] RIP: 0010:_copy_from_iter+0xb4/0x550 ... [ 13.398494] Call Trace: [ 13.398630] <TASK> [ 13.398630] ? __alloc_skb+0xed/0x1a0 [ 13.398630] tipc_msg_build+0x12c/0x670 [tipc] [ 13.398630] ? shmem_add_to_page_cache.isra.71+0x151/0x290 [ 13.398630] __tipc_sendmsg+0x2d1/0x710 [tipc] [ 13.398630] ? tipc_connect+0x1d9/0x230 [tipc] [ 13.398630] ? __local_bh_enable_ip+0x37/0x80 [ 13.398630] tipc_connect+0x1d9/0x230 [tipc] [ 13.398630] ? __sys_connect+0x9f/0xd0 [ 13.398630]
__sys_connect+0x9f/0xd0 [ 13.398630] ? preempt_count_add+0x4d/0xa0 [ 13.398630] ? fpregs_assert_state_consistent+0x22/0x50 [ 13.398630] __x64_sys_connect+0x16/0x20 [ 13.398630] do_syscall_64+0x42/0x90 [ 13.398630] entry_SYSCALL_64_after_hwframe+0x63/0xcd It is because commit a41dad905e5a (iov_iter: saner checks for attempt to copy to/from iterator) has introduced sanity check for copying from/to iov iterator. Lacking of copy direction from the iterator viewpoint would lead to kernel stack trace like above. This commit fixes this issue by initializing the iov iterator with the correct copy direction when sending SYN or ACK without data. (CVE-2023-52700)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52700
https://security-tracker.debian.org/tracker/CVE-2023-52700
https://ubuntu.com/security/CVE-2023-52700

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
References

CVE | CVE-2023-52700

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227407 - Linux Distros Unpatched Vulnerability : CVE-2023-52702
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix possible memory leak in ovs_meter_cmd_set() old_meter needs to be free after it is detached regardless of whether the new meter is successfully attached. (CVE-2023-52702)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52702
https://ubuntu.com/security/CVE-2023-52702

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0009
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52702

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226242 - Linux Distros Unpatched Vulnerability : CVE-2023-52704
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: freezer,umh: Fix call_usermode_helper_exec() vs SIGKILL Tetsuo-San noted that commit f5d39b020809 (freezer,sched: Rewrite core freezer logic) broke call_usermodehelper_exec() for the KILLABLE case. Specifically it was missed that the second, unconditional, wait_for_completion() was not optional and ensures the on-stack completion is unused before going out-of-scope. (CVE-2023-52704)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52704
https://ubuntu.com/security/CVE-2023-52704

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52704

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226252 - Linux Distros Unpatched Vulnerability : CVE-2023-52706
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: gpio: sim: fix a memory leak Fix an inverted logic bug in gpio_sim_remove_hogs() that leads to GPIO hog structures never being freed.
(CVE-2023-52706)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52706
https://ubuntu.com/security/CVE-2023-52706

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52706

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225982 - Linux Distros Unpatched Vulnerability : CVE-2023-52722
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in Artifex Ghostscript before 10.03.1. psi/zmisc1.c, when SAFER mode is used, allows eexec seeds other than the Type 1 standard. (CVE-2023-52722)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52722

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52722

Plugin Information
Published: 2025/03/05, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- ghostscript
- ghostscript-tools-fonts
- ghostscript-tools-printing
- libgs
225860 - Linux Distros Unpatched Vulnerability : CVE-2023-52732
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ceph: blocklist the kclient when receiving corrupted snap trace When received corrupted snap trace we don't know what exactly has happened in MDS side. And we shouldn't continue IOs and metadatas access to MDS, which may corrupt or get incorrect contents. This patch will just block all the further IO/MDS requests immediately and then evict the kclient itself. The reason why we still need to evict the kclient just after blocking all the further IOs is that the MDS could revoke the caps faster. (CVE-2023-52732)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52732
https://security-tracker.debian.org/tracker/CVE-2023-52732
https://ubuntu.com/security/CVE-2023-52732

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0008
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52732

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226572 - Linux Distros Unpatched Vulnerability : CVE-2023-52736
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: hda: Do not unset preset when cleaning up codec Several functions that take part in codec's initialization and removal are re-used by ASoC codec drivers implementations. Drivers mimic the behavior of hda_codec_driver_probe/remove() found in sound/pci/hda/hda_bind.c with their component->probe/remove() instead. One of the reasons for that is the expectation of snd_hda_codec_device_new() to receive a valid pointer to an instance of struct snd_card. This expectation can be met only once sound card components probing commences. As ASoC sound card may be unbound without codec device being actually removed from the system, unsetting ->preset in snd_hda_codec_cleanup_for_unbind() interferes with module unload -> load scenario causing null-ptr-deref. Preset is assigned only once, during device/driver matching whereas ASoC codec driver's module reloading may occur several times throughout the lifetime of an audio stack.
(CVE-2023-52736)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52736
https://ubuntu.com/security/CVE-2023-52736

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.001
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52736

Plugin Information
Published: 2025/03/05, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226580 - Linux Distros Unpatched Vulnerability : CVE-2023-52738
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/fence: Fix oops due to non- matching drm_sched init/fini Currently amdgpu calls drm_sched_fini() from the fence driver sw fini routine
- such function is expected to be called only after the respective init function - drm_sched_init() - was executed successfully. Happens that we faced a driver probe failure in the Steam Deck recently, and the function drm_sched_fini() was called even without its counter-part had been previously called, causing the following oops: amdgpu: probe of 0000:04:00.0 failed with error -110 BUG: kernel NULL pointer dereference, address: 0000000000000090 PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 609 Comm: systemd- udevd Not tainted 6.2.0-rc3-gpiccoli #338 Hardware name: Valve Jupiter/Jupiter, BIOS F7A0113 11/04/2022 RIP: 0010:drm_sched_fini+0x84/0xa0 [gpu_sched] [...] Call Trace: <TASK>
amdgpu_fence_driver_sw_fini+0xc8/0xd0 [amdgpu] amdgpu_device_fini_sw+0x2b/0x3b0 [amdgpu] amdgpu_driver_release_kms+0x16/0x30 [amdgpu] devm_drm_dev_init_release+0x49/0x70 [...] To prevent that, check if the drm_sched was properly initialized for a given ring before calling its fini counter-part.
Notice ideally we'd use sched.ready for that; such field is set as the latest thing on drm_sched_init().
But amdgpu seems to override the meaning of such field - in the above oops for example, it was a GFX ring causing the crash, and the sched.ready field was set to true in the ring init routine, regardless of the state of the DRM scheduler. Hence, we ended-up using sched.ops as per Christian's suggestion [0], and also removed the no_scheduler check [1]. [0] https://lore.kernel.org/amd-gfx/984ee981-2906-0eaf- ccec-9f80975cb136@amd.com/ [1] https://lore.kernel.org/amd- gfx/cd0e2994-f85f-d837-609f-7056d5fb7231@amd.com/ (CVE-2023-52738)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52738
https://ubuntu.com/security/CVE-2023-52738

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
4.6 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
2.2
EPSS Score
0.0027
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52738

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226919 - Linux Distros Unpatched Vulnerability : CVE-2023-52743
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ice: Do not use WQ_MEM_RECLAIM flag for workqueue When both ice and the irdma driver are loaded, a warning in check_flush_dependency is being triggered. This is due to ice driver workqueue being allocated with the WQ_MEM_RECLAIM flag and the irdma one is not. According to kernel documentation, this flag should be set if the workqueue will be involved in the kernel's memory reclamation flow. Since it is not, there is no need for the ice driver's WQ to have this flag set so remove it. Example trace: [ +0.000004] workqueue: WQ_MEM_RECLAIM ice:ice_service_task [ice] is flushing !WQ_MEM_RECLAIM infiniband:0x0 [ +0.000139] WARNING: CPU: 0 PID: 728 at kernel/workqueue.c:2632 check_flush_dependency+0x178/0x1a0 [ +0.000011] Modules linked in: bonding tls xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_cha in_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink bridge stp llc rfkill vfat fat intel_rapl_msr intel _rapl_common isst_if_common skx_edac nfit libnvdimm x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm irqbypass crct1 0dif_pclmul crc32_pclmul ghash_clmulni_intel rapl intel_cstate rpcrdma sunrpc rdma_ucm ib_srpt ib_isert iscsi_target_mod target_ core_mod ib_iser libiscsi scsi_transport_iscsi rdma_cm ib_cm iw_cm iTCO_wdt iTCO_vendor_support ipmi_ssif irdma mei_me ib_uverbs ib_core intel_uncore joydev pcspkr i2c_i801 acpi_ipmi mei lpc_ich i2c_smbus intel_pch_thermal ioatdma ipmi_si acpi_power_meter acpi_pad xfs libcrc32c sd_mod t10_pi crc64_rocksoft crc64 sg ahci ixgbe libahci ice i40e igb crc32c_intel mdio i2c_algo_bit liba ta dca wmi dm_mirror dm_region_hash dm_log dm_mod ipmi_devintf ipmi_msghandler fuse [ +0.000161] [last unloaded: bonding] [ +0.000006] CPU: 0 PID: 728 Comm:
kworker/0:2 Tainted: G S 6.2.0-rc2_next-queue-13jan-00458-gc20aabd57164 #1 [ +0.000006] Hardware name:
Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0010.010620200716 01/06/2020 [ +0.000003] Workqueue: ice ice_service_task [ice] [ +0.000127] RIP: 0010:check_flush_dependency+0x178/0x1a0 [ +0.000005] Code: 89 8e 02 01 e8 49 3d 40 00 49 8b 55 18 48 8d 8d d0 00 00 00 48 8d b3 d0 00 00 00 4d 89 e0 48 c7 c7 e0 3b 08 9f e8 bb d3 07 01 <0f> 0b e9 be fe ff ff 80 3d 24 89 8e 02 00 0f 85 6b ff ff ff e9 06 [ +0.000004] RSP: 0018:ffff88810a39f990 EFLAGS: 00010282 [ +0.000005] RAX: 0000000000000000 RBX:
ffff888141bc2400 RCX: 0000000000000000 [ +0.000004] RDX: 0000000000000001 RSI: dffffc0000000000 RDI:
ffffffffa1213a80 [ +0.000003] RBP: ffff888194bf3400 R08: ffffed117b306112 R09: ffffed117b306112 [ +0.000003] R10: ffff888bd983088b R11: ffffed117b306111 R12: 0000000000000000 [ +0.000003] R13:
ffff888111f84d00 R14: ffff88810a3943ac R15: ffff888194bf3400 [ +0.000004] FS: 0000000000000000(0000) GS:ffff888bd9800000(0000) knlGS:0000000000000000 [ +0.000003] CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 [ +0.000003] CR2: 000056035b208b60 CR3: 000000017795e005 CR4: 00000000007706f0 [ +0.000003] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ +0.000003] DR3:
0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ +0.000002] PKRU: 55555554 [ +0.000003] Call Trace: [ +0.000002] <TASK> [ +0.000003] __flush_workqueue+0x203/0x840 [ +0.000006] ? mutex_unlock+0x84/0xd0 [ +0.000008] ? __pfx_mutex_unlock+0x10/0x10 [ +0.000004] ?
__pfx___flush_workqueue+0x10/0x10 [ +0.000006] ? mutex_lock+0xa3/0xf0 [ +0.000005] ib_cache_cleanup_one+0x39/0x190 [ib_core] [ +0.000174] __ib_unregister_device+0x84/0xf0 [ib_core] [ +0.000094] ib_unregister_device+0x25/0x30 [ib_core] [ +0.000093] irdma_ib_unregister_device+0x97/0xc0 [irdma] [ +0.000064] ? __pfx_irdma_ib_unregister_device+0x10/0x10 [irdma] [ +0.000059] ? up_write+0x5c/0x90 [ +0.000005] irdma_remove+0x36/0x90 [irdma] [ +0.000062] auxiliary_bus_remove+0x32/0x50 [ +0.000007] device_r ---truncated--- (CVE-2023-52743)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52743
https://ubuntu.com/security/CVE-2023-52743

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0014
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52743

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225996 - Linux Distros Unpatched Vulnerability : CVE-2023-52744
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix potential NULL-ptr- dereference in_dev_get() can return NULL which will cause a failure once idev is dereferenced in in_dev_for_each_ifa_rtnl(). This patch adds a check for NULL value in idev beforehand. Found by Linux Verification Center (linuxtesting.org) with SVACE. (CVE-2023-52744)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52744
https://ubuntu.com/security/CVE-2023-52744

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52744

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227015 - Linux Distros Unpatched Vulnerability : CVE-2023-52747
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Restore allocated resources on failed copyout Fix a resource leak if an error occurs. (CVE-2023-52747)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52747
https://ubuntu.com/security/CVE-2023-52747

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0015
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52747

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226470 - Linux Distros Unpatched Vulnerability : CVE-2023-52750
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer Prior to LLVM 15.0.0, LLVM's integrated assembler would incorrectly byte-swap NOP when compiling for big-endian, and the resulting series of bytes happened to match the encoding of FNMADD S21, S30, S0, S0. This went unnoticed until commit:
34f66c4c4d5518c1 (arm64: Use a positive cpucap for FP/SIMD) Prior to that commit, the kernel would always enable the use of FPSIMD early in boot when __cpu_setup() initialized CPACR_EL1, and so usage of FNMADD within the kernel was not detected, but could result in the corruption of user or kernel FPSIMD state. After that commit, the instructions happen to trap during boot prior to FPSIMD being detected and enabled, e.g. | Unhandled 64-bit el1h sync exception on CPU0, ESR 0x000000001fe00000 -- ASIMD | CPU: 0 PID: 0 Comm: swapper Not tainted 6.6.0-rc3-00013-g34f66c4c4d55 #1 | Hardware name: linux,dummy-virt (DT) | pstate: 400000c9 (nZcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : __pi_strcmp+0x1c/0x150 | lr :
populate_properties+0xe4/0x254 | sp : ffffd014173d3ad0 | x29: ffffd014173d3af0 x28: fffffbfffddffcb8 x27:
0000000000000000 | x26: 0000000000000058 x25: fffffbfffddfe054 x24: 0000000000000008 | x23:
fffffbfffddfe000 x22: fffffbfffddfe000 x21: fffffbfffddfe044 | x20: ffffd014173d3b70 x19: 0000000000000001 x18: 0000000000000005 | x17: 0000000000000010 x16: 0000000000000000 x15: 00000000413e7000 | x14:
0000000000000000 x13: 0000000000001bcc x12: 0000000000000000 | x11: 00000000d00dfeed x10: ffffd414193f2cd0 x9 : 0000000000000000 | x8 : 0101010101010101 x7 : ffffffffffffffc0 x6 : 0000000000000000 | x5 :
0000000000000000 x4 : 0101010101010101 x3 : 000000000000002a | x2 : 0000000000000001 x1 : ffffd014171f2988 x0 : fffffbfffddffcb8 | Kernel panic - not syncing: Unhandled exception | CPU: 0 PID: 0 Comm: swapper Not tainted 6.6.0-rc3-00013-g34f66c4c4d55 #1 | Hardware name: linux,dummy-virt (DT) | Call trace: | dump_backtrace+0xec/0x108 | show_stack+0x18/0x2c | dump_stack_lvl+0x50/0x68 | dump_stack+0x18/0x24 | panic+0x13c/0x340 | el1t_64_irq_handler+0x0/0x1c | el1_abort+0x0/0x5c | el1h_64_sync+0x64/0x68 |
__pi_strcmp+0x1c/0x150 | unflatten_dt_nodes+0x1e8/0x2d8 | __unflatten_device_tree+0x5c/0x15c | unflatten_device_tree+0x38/0x50 | setup_arch+0x164/0x1e0 | start_kernel+0x64/0x38c |
__primary_switched+0xbc/0xc4 Restrict CONFIG_CPU_BIG_ENDIAN to a known good assembler, which is either GNU as or LLVM's IAS 15.0.0 and newer, which contains the linked commit. (CVE-2023-52750)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52750
https://ubuntu.com/security/CVE-2023-52750

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52750

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226086 - Linux Distros Unpatched Vulnerability : CVE-2023-52778
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mptcp: deal with large GSO size After the blamed commit below, the TCP sockets (and the MPTCP subflows) can build egress packets larger than 64K. That exceeds the maximum DSS data size, the length being misrepresent on the wire and the stream being corrupted, as later observed on the receiver: WARNING: CPU: 0 PID: 9696 at net/mptcp/protocol.c:705
__mptcp_move_skbs_from_subflow+0x2604/0x26e0 CPU: 0 PID: 9696 Comm: syz-executor.7 Not tainted 6.6.0-rc5-gcd8bdf563d46 #45 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. RIP:
0010:__mptcp_move_skbs_from_subflow+0x2604/0x26e0 net/mptcp/protocol.c:705 RSP: 0018:ffffc90000006e80 EFLAGS: 00010246 RAX: ffffffff83e9f674 RBX: ffff88802f45d870 RCX: ffff888102ad0000 netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. RDX: 0000000080000303 RSI: 0000000000013908 RDI: 0000000000003908 RBP: ffffc90000007110 R08: ffffffff83e9e078 R09: 1ffff1100e548c8a R10:
dffffc0000000000 R11: ffffed100e548c8b R12: 0000000000013908 R13: dffffc0000000000 R14: 0000000000003908 R15: 000000000031cf29 FS: 00007f239c47e700(0000) GS:ffff88811b200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f239c45cd78 CR3: 000000006a66c006 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6:
00000000fffe0ff0 DR7: 0000000000000600 PKRU: 55555554 Call Trace: <IRQ> mptcp_data_ready+0x263/0xac0 net/mptcp/protocol.c:819 subflow_data_ready+0x268/0x6d0 net/mptcp/subflow.c:1409 tcp_data_queue+0x21a1/0x7a60 net/ipv4/tcp_input.c:5151 tcp_rcv_established+0x950/0x1d90 net/ipv4/tcp_input.c:6098 tcp_v6_do_rcv+0x554/0x12f0 net/ipv6/tcp_ipv6.c:1483 tcp_v6_rcv+0x2e26/0x3810 net/ipv6/tcp_ipv6.c:1749 ip6_protocol_deliver_rcu+0xd6b/0x1ae0 net/ipv6/ip6_input.c:438 ip6_input+0x1c5/0x470 net/ipv6/ip6_input.c:483 ipv6_rcv+0xef/0x2c0 include/linux/netfilter.h:304
__netif_receive_skb+0x1ea/0x6a0 net/core/dev.c:5532 process_backlog+0x353/0x660 net/core/dev.c:5974
__napi_poll+0xc6/0x5a0 net/core/dev.c:6536 net_rx_action+0x6a0/0xfd0 net/core/dev.c:6603
__do_softirq+0x184/0x524 kernel/softirq.c:553 do_softirq+0xdd/0x130 kernel/softirq.c:454 Address the issue explicitly bounding the maximum GSO size to what MPTCP actually allows. (CVE-2023-52778)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52778
https://ubuntu.com/security/CVE-2023-52778

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0012
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52778

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226178 - Linux Distros Unpatched Vulnerability : CVE-2023-52781
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: config: fix iteration issue in 'usb_get_bos_descriptor()' The BOS descriptor defines a root descriptor and is the base descriptor for accessing a family of related descriptors. Function 'usb_get_bos_descriptor()' encounters an iteration issue when skipping the 'USB_DT_DEVICE_CAPABILITY'
descriptor type. This results in the same descriptor being read repeatedly. To address this issue, a 'goto' statement is introduced to ensure that the pointer and the amount read is updated correctly. This ensures that the function iterates to the next descriptor instead of reading the same descriptor repeatedly. (CVE-2023-52781)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52781
https://ubuntu.com/security/CVE-2023-52781

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0019
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52781

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226292 - Linux Distros Unpatched Vulnerability : CVE-2023-52782
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Track xmit submission to PTP WQ after populating metadata map Ensure the skb is available in metadata mapping to skbs before tracking the metadata index for detecting undelivered CQEs. If the metadata index is put in the tracking list before putting the skb in the map, the metadata index might be used for detecting undelivered CQEs before the relevant skb is available in the map, which can lead to a null-ptr-deref. Log: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN KASAN: null- ptr-deref in range [0x0000000000000028-0x000000000000002f] CPU: 0 PID: 1243 Comm: kworker/0:2 Not tainted 6.6.0-rc4+ #108 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: events mlx5e_rx_dim_work [mlx5_core] RIP: 0010:mlx5e_ptp_napi_poll+0x9a4/0x2290 [mlx5_core] Code: 8c 24 38 cc ff ff 4c 8d 3c c1 4c 89 f9 48 c1 e9 03 42 80 3c 31 00 0f 85 97 0f 00 00 4d 8b 3f 49 8d 7f 28 48 89 f9 48 c1 e9 03 <42> 80 3c 31 00 0f 85 8b 0f 00 00 49 8b 47 28 48 85 c0 0f 84 05 07 RSP: 0018:ffff8884d3c09c88 EFLAGS: 00010206 RAX:
0000000000000069 RBX: ffff8881160349d8 RCX: 0000000000000005 RDX: ffffed10218f48cf RSI: 0000000000000004 RDI: 0000000000000028 RBP: ffff888122707700 R08: 0000000000000001 R09: ffffed109a781383 R10:
0000000000000003 R11: 0000000000000003 R12: ffff88810c7a7a40 R13: ffff888122707700 R14: dffffc0000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8884d3c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4f878dd6e0 CR3: 000000014d108002 CR4: 0000000000370eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6:
00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> ? die_addr+0x3c/0xa0 ? exc_general_protection+0x144/0x210 ? asm_exc_general_protection+0x22/0x30 ? mlx5e_ptp_napi_poll+0x9a4/0x2290 [mlx5_core] ? mlx5e_ptp_napi_poll+0x8f6/0x2290 [mlx5_core]
__napi_poll.constprop.0+0xa4/0x580 net_rx_action+0x460/0xb80 ? _raw_spin_unlock_irqrestore+0x32/0x60 ?
__napi_poll.constprop.0+0x580/0x580 ? tasklet_action_common.isra.0+0x2ef/0x760 __do_softirq+0x26c/0x827 irq_exit_rcu+0xc2/0x100 common_interrupt+0x7f/0xa0 </IRQ> <TASK> asm_common_interrupt+0x22/0x40 RIP:
0010:__kmem_cache_alloc_node+0xb/0x330 Code: 41 5d 41 5e 41 5f c3 8b 44 24 14 8b 4c 24 10 09 c8 eb d5 e8 b7 43 ca 01 0f 1f 80 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 57 <41> 56 41 89 d6 41 55 41 89 f5 41 54 49 89 fc 53 48 83 e4 f0 48 83 RSP: 0018:ffff88812c4079c0 EFLAGS: 00000246 RAX: 1ffffffff083c7fe RBX:
ffff888100042dc0 RCX: 0000000000000218 RDX: 00000000ffffffff RSI: 0000000000000dc0 RDI: ffff888100042dc0 RBP: ffff88812c4079c8 R08: ffffffffa0289f96 R09: ffffed1025880ea9 R10: ffff888138839f80 R11:
0000000000000002 R12: 0000000000000dc0 R13: 0000000000000100 R14: 000000000000008c R15: ffff8881271fc450 ? cmd_exec+0x796/0x2200 [mlx5_core] kmalloc_trace+0x26/0xc0 cmd_exec+0x796/0x2200 [mlx5_core] mlx5_cmd_do+0x22/0xc0 [mlx5_core] mlx5_cmd_exec+0x17/0x30 [mlx5_core] mlx5_core_modify_cq_moderation+0x139/0x1b0 [mlx5_core] ? mlx5_add_cq_to_tasklet+0x280/0x280 [mlx5_core] ? lockdep_set_lock_cmp_fn+0x190/0x190 ? process_one_work+0x659/0x1220 mlx5e_rx_dim_work+0x9d/0x100 [mlx5_core] process_one_work+0x730/0x1220 ? lockdep_hardirqs_on_prepare+0x400/0x400 ? max_active_store+0xf0/0xf0 ? assign_work+0x168/0x240 worker_thread+0x70f/0x12d0 ?
__kthread_parkme+0xd1/0x1d0 ? process_one_work+0x1220/0x1220 kthread+0x2d9/0x3b0 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x2d/0x70 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork_as ---truncated--- (CVE-2023-52782)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52782
https://ubuntu.com/security/CVE-2023-52782

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52782

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227428 - Linux Distros Unpatched Vulnerability : CVE-2023-52786
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ext4: fix racy may inline data check in dio write syzbot reports that the following warning from ext4_iomap_begin() triggers as of the commit referenced below: if (WARN_ON_ONCE(ext4_has_inline_data(inode))) return -ERANGE; This occurs during a dio write, which is never expected to encounter an inode with inline data. To enforce this behavior, ext4_dio_write_iter() checks the current inline state of the inode and clears the MAY_INLINE_DATA state flag to either fall back to buffered writes, or enforce that any other writers in progress on the inode are not allowed to create inline data. The problem is that the check for existing inline data and the state flag can span a lock cycle. For example, if the ilock is originally locked shared and subsequently upgraded to exclusive, another writer may have reacquired the lock and created inline data before the dio write task acquires the lock and proceeds. The commit referenced below loosens the lock requirements to allow some forms of unaligned dio writes to occur under shared lock, but AFAICT the inline data check was technically already racy for any dio write that would have involved a lock cycle. Regardless, lift clearing of the state bit to the same lock critical section that checks for preexisting inline data on the inode to close the race. (CVE-2023-52786)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52786
https://ubuntu.com/security/CVE-2023-52786

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0009
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52786

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226440 - Linux Distros Unpatched Vulnerability : CVE-2023-52787
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: blk-mq: make sure active queue usage is held for bio_integrity_prep() blk_integrity_unregister() can come if queue usage counter isn't held for one bio with integrity prepared, so this request may be completed with calling profile->complete_fn, then kernel panic. Another constraint is that bio_integrity_prep() needs to be called before bio merge. Fix the issue by: - call bio_integrity_prep() with one queue usage counter grabbed reliably - call bio_integrity_prep() before bio merge (CVE-2023-52787)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52787
https://ubuntu.com/security/CVE-2023-52787

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.001
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52787

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226588 - Linux Distros Unpatched Vulnerability : CVE-2023-52792
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cxl/region: Do not try to cleanup after cxl_region_setup_targets() fails Commit 5e42bcbc3fef (cxl/region: decrement ->nr_targets on error in cxl_region_attach()) tried to avoid 'eiw' initialization errors when ->nr_targets exceeded 16, by just decrementing ->nr_targets when cxl_region_setup_targets() failed. Commit 86987c766276 (cxl/region:
Cleanup target list on attach error) extended that cleanup to also clear cxled->pos and p->targets[pos].
The initialization error was incidentally fixed separately by: Commit 8d4285425714 (cxl/region: Fix port setup uninitialized variable warnings) which was merged a few days after 5e42bcbc3fef. But now the original cleanup when cxl_region_setup_targets() fails prevents endpoint and switch decoder resources from being reused: 1) the cleanup does not set the decoder's region to NULL, which results in future dpa_size_store() calls returning -EBUSY 2) the decoder is not properly freed, which results in future commit errors associated with the upstream switch Now that the initialization errors were fixed separately, the proper cleanup for this case is to just return immediately. Then the resources associated with this target get cleanup up as normal when the failed region is deleted. The ->nr_targets decrement in the error case also helped prevent a p->targets[] array overflow, so add a new check to prevent against that overflow. Tested by trying to create an invalid region for a 2 switch * 2 endpoint topology, and then following up with creating a valid region. (CVE-2023-52792)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52792
https://ubuntu.com/security/CVE-2023-52792

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0013
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52792

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225831 - Linux Distros Unpatched Vulnerability : CVE-2023-52800
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix htt pktlog locking The ath11k active pdevs are protected by RCU but the htt pktlog handling code calling ath11k_mac_get_ar_by_pdev_id() was not marked as a read-side critical section. Mark the code in question as an RCU read-side critical section to avoid any potential use-after-free issues. Compile tested only.
(CVE-2023-52800)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52800
https://ubuntu.com/security/CVE-2023-52800

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.4 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0009
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52800

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226629 - Linux Distros Unpatched Vulnerability : CVE-2023-52803
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- SUNRPC: Fix RPC client cleaned up the freed pipefs dentries RPC client pipefs dentries cleanup is in separated rpc_remove_pipedir() workqueue,which takes care about pipefs superblock locking. In some special scenarios, when kernel frees the pipefs sb of the current client and immediately alloctes a new pipefs sb, rpc_remove_pipedir function would misjudge the existence of pipefs sb which is not the one it used to hold. As a result, the rpc_remove_pipedir would clean the released freed pipefs dentries. To fix this issue, rpc_remove_pipedir should check whether the current pipefs sb is consistent with the original pipefs sb. This error can be catched by KASAN: ========================================================= [ 250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200 [ 250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503 [ 250.500549] Workqueue: events rpc_free_client_work [ 250.501001] Call Trace: [ 250.502880] kasan_report+0xb6/0xf0 [ 250.503209] ? dget_parent+0x195/0x200 [ 250.503561] dget_parent+0x195/0x200 [ 250.503897] ? __pfx_rpc_clntdir_depopulate+0x10/0x10 [ 250.504384] rpc_rmdir_depopulate+0x1b/0x90 [ 250.504781] rpc_remove_client_dir+0xf5/0x150 [ 250.505195] rpc_free_client_work+0xe4/0x230 [ 250.505598] process_one_work+0x8ee/0x13b0 ... [ 22.039056] Allocated by task 244: [ 22.039390] kasan_save_stack+0x22/0x50 [ 22.039758] kasan_set_track+0x25/0x30 [ 22.040109]
__kasan_slab_alloc+0x59/0x70 [ 22.040487] kmem_cache_alloc_lru+0xf0/0x240 [ 22.040889]
__d_alloc+0x31/0x8e0 [ 22.041207] d_alloc+0x44/0x1f0 [ 22.041514]
__rpc_lookup_create_exclusive+0x11c/0x140 [ 22.041987] rpc_mkdir_populate.constprop.0+0x5f/0x110 [ 22.042459] rpc_create_client_dir+0x34/0x150 [ 22.042874] rpc_setup_pipedir_sb+0x102/0x1c0 [ 22.043284] rpc_client_register+0x136/0x4e0 [ 22.043689] rpc_new_client+0x911/0x1020 [ 22.044057] rpc_create_xprt+0xcb/0x370 [ 22.044417] rpc_create+0x36b/0x6c0 ... [ 22.049524] Freed by task 0: [ 22.049803] kasan_save_stack+0x22/0x50 [ 22.050165] kasan_set_track+0x25/0x30 [ 22.050520] kasan_save_free_info+0x2b/0x50 [ 22.050921] __kasan_slab_free+0x10e/0x1a0 [ 22.051306] kmem_cache_free+0xa5/0x390 [ 22.051667] rcu_core+0x62c/0x1930 [ 22.051995] __do_softirq+0x165/0x52a [ 22.052347] [ 22.052503] Last potentially related work creation: [ 22.052952] kasan_save_stack+0x22/0x50 [ 22.053313] __kasan_record_aux_stack+0x8e/0xa0 [ 22.053739] __call_rcu_common.constprop.0+0x6b/0x8b0 [ 22.054209] dentry_free+0xb2/0x140 [ 22.054540] __dentry_kill+0x3be/0x540 [ 22.054900] shrink_dentry_list+0x199/0x510 [ 22.055293] shrink_dcache_parent+0x190/0x240 [ 22.055703] do_one_tree+0x11/0x40 [ 22.056028] shrink_dcache_for_umount+0x61/0x140 [ 22.056461] generic_shutdown_super+0x70/0x590 [ 22.056879] kill_anon_super+0x3a/0x60 [ 22.057234] rpc_kill_sb+0x121/0x200 (CVE-2023-52803)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52803
https://ubuntu.com/security/CVE-2023-52803

Solution
There is no known solution at this time.
Risk Factor
Critical
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0027
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
8.5 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52803

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227385 - Linux Distros Unpatched Vulnerability : CVE-2023-52806
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: hda: Fix possible null-ptr-deref when assigning a stream While AudioDSP drivers assign streams exclusively of HOST or LINK type, nothing blocks a user to attempt to assign a COUPLED stream. As supplied substream instance may be a stub, what is the case when code-loading, such scenario ends with null-ptr- deref. (CVE-2023-52806)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52806
https://ubuntu.com/security/CVE-2023-52806

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0007
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52806

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226316 - Linux Distros Unpatched Vulnerability : CVE-2023-52808
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs If init debugfs failed during device registration due to memory allocation failure, debugfs_remove_recursive() is called, after which debugfs_dir is not set to NULL. debugfs_remove_recursive() will be called again during device removal. As a result, illegal pointer is accessed. [ 1665.467244] hisi_sas_v3_hw 0000:b4:02.0: failed to init debugfs! ... [ 1669.836708] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a0 [ 1669.872669] pc : down_write+0x24/0x70 [ 1669.876315] lr : down_write+0x1c/0x70 [ 1669.879961] sp :
ffff000036f53a30 [ 1669.883260] x29: ffff000036f53a30 x28: ffffa027c31549f8 [ 1669.888547] x27:
ffffa027c3140000 x26: 0000000000000000 [ 1669.893834] x25: ffffa027bf37c270 x24: ffffa027bf37c270 [ 1669.899122] x23: ffff0000095406b8 x22: ffff0000095406a8 [ 1669.904408] x21: 0000000000000000 x20:
ffffa027bf37c310 [ 1669.909695] x19: 00000000000000a0 x18: ffff8027dcd86f10 [ 1669.914982] x17:
0000000000000000 x16: 0000000000000000 [ 1669.920268] x15: 0000000000000000 x14: ffffa0274014f870 [ 1669.925555] x13: 0000000000000040 x12: 0000000000000228 [ 1669.930842] x11: 0000000000000020 x10:
0000000000000bb0 [ 1669.936129] x9 : ffff000036f537f0 x8 : ffff80273088ca10 [ 1669.941416] x7 :
000000000000001d x6 : 00000000ffffffff [ 1669.946702] x5 : ffff000008a36310 x4 : ffff80273088be00 [ 1669.951989] x3 : ffff000009513e90 x2 : 0000000000000000 [ 1669.957276] x1 : 00000000000000a0 x0 :
ffffffff00000001 [ 1669.962563] Call trace: [ 1669.965000] down_write+0x24/0x70 [ 1669.968301] debugfs_remove_recursive+0x5c/0x1b0 [ 1669.972905] hisi_sas_debugfs_exit+0x24/0x30 [hisi_sas_main] [ 1669.978541] hisi_sas_v3_remove+0x130/0x150 [hisi_sas_v3_hw] [ 1669.984175] pci_device_remove+0x48/0xd8 [ 1669.988082] device_release_driver_internal+0x1b4/0x250 [ 1669.993282] device_release_driver+0x28/0x38 [ 1669.997534] pci_stop_bus_device+0x84/0xb8 [ 1670.001611] pci_stop_and_remove_bus_device_locked+0x24/0x40 [ 1670.007244] remove_store+0xfc/0x140 [ 1670.010802] dev_attr_store+0x44/0x60 [ 1670.014448] sysfs_kf_write+0x58/0x80 [ 1670.018095] kernfs_fop_write+0xe8/0x1f0 [ 1670.022000] __vfs_write+0x60/0x190 [ 1670.025472] vfs_write+0xac/0x1c0 [ 1670.028771] ksys_write+0x6c/0xd8 [ 1670.032071]
__arm64_sys_write+0x24/0x30 [ 1670.035977] el0_svc_common+0x78/0x130 [ 1670.039710] el0_svc_handler+0x38/0x78 [ 1670.043442] el0_svc+0x8/0xc To fix this, set debugfs_dir to NULL after debugfs_remove_recursive(). (CVE-2023-52808)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52808
https://security-tracker.debian.org/tracker/CVE-2023-52808
https://ubuntu.com/security/CVE-2023-52808

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0009
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52808

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226934 - Linux Distros Unpatched Vulnerability : CVE-2023-52815
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/amdgpu/vkms: fix a possible null pointer dereference In amdgpu_vkms_conn_get_modes(), the return value of drm_cvt_mode() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_cvt_mode(). Add a check to avoid null pointer dereference. (CVE-2023-52815)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52815
https://security-tracker.debian.org/tracker/CVE-2023-52815
https://ubuntu.com/security/CVE-2023-52815

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0013
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52815

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226486 - Linux Distros Unpatched Vulnerability : CVE-2023-52828
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Detect IP == ksym.end as part of BPF program Now that bpf_throw kfunc is the first such call instruction that has noreturn semantics within the verifier, this also kicks in dead code elimination in unprecedented ways. For one, any instruction following a bpf_throw call will never be marked as seen.
Moreover, if a callchain ends up throwing, any instructions after the call instruction to the eventually throwing subprog in callers will also never be marked as seen. The tempting way to fix this would be to emit extra 'int3' instructions which bump the jited_len of a program, and ensure that during runtime when a program throws, we can discover its boundaries even if the call instruction to bpf_throw (or to subprogs that always throw) is emitted as the final instruction in the program. An example of such a program would be this: do_something(): ... r0 = 0 exit foo(): r1 = 0 call bpf_throw r0 = 0 exit bar(cond): if r1 != 0 goto pc+2 call do_something exit call foo r0 = 0 // Never seen by verifier exit // main(ctx): r1 = ...
call bar r0 = 0 exit Here, if we do end up throwing, the stacktrace would be the following: bpf_throw foo bar main In bar, the final instruction emitted will be the call to foo, as such, the return address will be the subsequent instruction (which the JIT emits as int3 on x86). This will end up lying outside the jited_len of the program, thus, when unwinding, we will fail to discover the return address as belonging to any program and end up in a panic due to the unreliable stack unwinding of BPF programs that we never expect. To remedy this case, make bpf_prog_ksym_find treat IP == ksym.end as part of the BPF program, so that is_bpf_text_address returns true when such a case occurs, and we are able to unwind reliably when the final instruction ends up being a call instruction. (CVE-2023-52828)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52828
https://ubuntu.com/security/CVE-2023-52828

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.001
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52828

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225817 - Linux Distros Unpatched Vulnerability : CVE-2023-52845
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING syzbot reported the following uninit- value access issue [1]: ===================================================== BUG: KMSAN: uninit-value in strlen lib/string.c:418 [inline] BUG: KMSAN: uninit-value in strstr+0xb8/0x2f0 lib/string.c:756 strlen lib/string.c:418 [inline] strstr+0xb8/0x2f0 lib/string.c:756 tipc_nl_node_reset_link_stats+0x3ea/0xb50 net/tipc/node.c:2595 genl_family_rcv_msg_doit net/netlink/genetlink.c:971 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1051 [inline] genl_rcv_msg+0x11ec/0x1290 net/netlink/genetlink.c:1066 netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2545 genl_rcv+0x40/0x60 net/netlink/genetlink.c:1075 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] netlink_unicast+0xf47/0x1250 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:730 [inline] sock_sendmsg net/socket.c:753 [inline]
____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595 __sys_sendmsg net/socket.c:2624 [inline] __do_sys_sendmsg net/socket.c:2633 [inline] __se_sys_sendmsg net/socket.c:2631 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2631 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was created at: slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:559 __alloc_skb+0x318/0x740 net/core/skbuff.c:650 alloc_skb include/linux/skbuff.h:1286 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1214 [inline] netlink_sendmsg+0xb34/0x13d0 net/netlink/af_netlink.c:1885 sock_sendmsg_nosec net/socket.c:730 [inline] sock_sendmsg net/socket.c:753 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595
__sys_sendmsg net/socket.c:2624 [inline] __do_sys_sendmsg net/socket.c:2633 [inline] __se_sys_sendmsg net/socket.c:2631 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2631 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd TIPC bearer-related names including link names must be null- terminated strings. If a link name which is not null-terminated is passed through netlink, strstr() and similar functions can cause buffer overrun. This causes the above issue. This patch changes the nla_policy for bearer-related names from NLA_STRING to NLA_NUL_STRING. This resolves the issue by ensuring that only null-terminated strings are accepted as bearer-related names. syzbot reported similar uninit-value issue related to bearer names [2]. The root cause of this issue is that a non-null-terminated bearer name was passed. This patch also resolved this issue. (CVE-2023-52845)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52845
https://ubuntu.com/security/CVE-2023-52845

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0009
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52845

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246015 - Linux Distros Unpatched Vulnerability : CVE-2023-52849
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cxl/mem: Fix shutdown order Ira reports that removing cxl_mock_mem causes a crash with the following trace: BUG: kernel NULL pointer dereference, address: 0000000000000044 [..] RIP: 0010:cxl_region_decode_reset+0x7f/0x180 [cxl_core] [..] Call Trace: <TASK> cxl_region_detach+0xe8/0x210 [cxl_core] cxl_decoder_kill_region+0x27/0x40 [cxl_core] cxld_unregister+0x29/0x40 [cxl_core] devres_release_all+0xb8/0x110 device_unbind_cleanup+0xe/0x70 device_release_driver_internal+0x1d2/0x210 bus_remove_device+0xd7/0x150 device_del+0x155/0x3e0 device_unregister+0x13/0x60 devm_release_action+0x4d/0x90 ? __pfx_unregister_port+0x10/0x10 [cxl_core] delete_endpoint+0x121/0x130 [cxl_core] devres_release_all+0xb8/0x110 device_unbind_cleanup+0xe/0x70 device_release_driver_internal+0x1d2/0x210 bus_remove_device+0xd7/0x150 device_del+0x155/0x3e0 ? lock_release+0x142/0x290 cdev_device_del+0x15/0x50 cxl_memdev_unregister+0x54/0x70 [cxl_core] This crash is due to the clearing out the cxl_memdev's driver context (@cxlds) before the subsystem is done with it.
This is ultimately due to the region(s), that this memdev is a member, being torn down and expecting to be able to de-reference @cxlds, like here: static int cxl_region_decode_reset(struct cxl_region *cxlr, int count) ... if (cxlds->rcd) goto endpoint_reset; ... Fix it by keeping the driver context valid until memdev-device unregistration, and subsequently the entire stack of related dependencies, unwinds.
(CVE-2023-52849)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52849
https://ubuntu.com/security/CVE-2023-52849

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0009
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52849

Plugin Information
Published: 2025/08/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226781 - Linux Distros Unpatched Vulnerability : CVE-2023-52872
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: fix race condition in status line change on dead connections gsm_cleanup_mux() cleans up the gsm by closing all DLCIs, stopping all timers, removing the virtual tty devices and clearing the data queues. This procedure, however, may cause subsequent changes of the virtual modem status lines of a DLCI. More data is being added the outgoing data queue and the deleted kick timer is restarted to handle this. At this point many resources have already been removed by the cleanup procedure. Thus, a kernel panic occurs. Fix this by proving in gsm_modem_update() that the cleanup procedure has not been started and the mux is still alive. Note that writing to a virtual tty is already protected by checks against the DLCI specific connection state.
(CVE-2023-52872)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52872
https://ubuntu.com/security/CVE-2023-52872

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52872

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225975 - Linux Distros Unpatched Vulnerability : CVE-2023-52877
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() It is possible that typec_register_partner() returns ERR_PTR on failure.
When port->partner is an error, a NULL pointer dereference may occur as shown below. [91222.095236][ T319] typec port0: failed to register partner (-17) ... [91225.061491][ T319] Unable to handle kernel NULL pointer dereference at virtual address 000000000000039f [91225.274642][ T319] pc :
tcpm_pd_data_request+0x310/0x13fc [91225.274646][ T319] lr : tcpm_pd_data_request+0x298/0x13fc [91225.308067][ T319] Call trace: [91225.308070][ T319] tcpm_pd_data_request+0x310/0x13fc [91225.308073][ T319] tcpm_pd_rx_handler+0x100/0x9e8 [91225.355900][ T319] kthread_worker_fn+0x178/0x58c [91225.355902][ T319] kthread+0x150/0x200 [91225.355905][ T319] ret_from_fork+0x10/0x30 Add a check for port->partner to avoid dereferencing a NULL pointer. (CVE-2023-52877)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52877
https://ubuntu.com/security/CVE-2023-52877

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0009
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52877

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226489 - Linux Distros Unpatched Vulnerability : CVE-2023-52886
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() Syzbot reported an out-of-bounds read in sysfs.c:read_descriptors():
BUG: KASAN: slab-out-of-bounds in read_descriptors+0x263/0x280 drivers/usb/core/sysfs.c:883 Read of size 8 at addr ffff88801e78b8c8 by task udevd/5011 CPU: 0 PID: 5011 Comm: udevd Not tainted 6.4.0-rc6-syzkaller-00195-g40f71e7cd3c6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106 print_address_description.constprop.0+0x2c/0x3c0 mm/kasan/report.c:351 print_report mm/kasan/report.c:462 [inline] kasan_report+0x11c/0x130 mm/kasan/report.c:572 read_descriptors+0x263/0x280 drivers/usb/core/sysfs.c:883 ... Allocated by task 758:
... __do_kmalloc_node mm/slab_common.c:966 [inline] __kmalloc+0x5e/0x190 mm/slab_common.c:979 kmalloc include/linux/slab.h:563 [inline] kzalloc include/linux/slab.h:680 [inline] usb_get_configuration+0x1f7/0x5170 drivers/usb/core/config.c:887 usb_enumerate_device drivers/usb/core/hub.c:2407 [inline] usb_new_device+0x12b0/0x19d0 drivers/usb/core/hub.c:2545 As analyzed by Khazhy Kumykov, the cause of this bug is a race between read_descriptors() and hub_port_init(): The first routine uses a field in udev->descriptor, not expecting it to change, while the second overwrites it. Prior to commit 45bf39f8df7f (USB: core: Don't hold device lock while reading the descriptors sysfs file) this race couldn't occur, because the routines were mutually exclusive thanks to the device locking. Removing that locking from read_descriptors() exposed it to the race. The best way to fix the bug is to keep hub_port_init() from changing udev->descriptor once udev has been initialized and registered.
Drivers expect the descriptors stored in the kernel to be immutable; we should not undermine this expectation. In fact, this change should have been made long ago. So now hub_port_init() will take an additional argument, specifying a buffer in which to store the device descriptor it reads. (If udev has not yet been initialized, the buffer pointer will be NULL and then hub_port_init() will store the device descriptor in udev as before.) This eliminates the data race responsible for the out-of-bounds read. The changes to hub_port_init() appear more extensive than they really are, because of indentation changes resulting from an attempt to avoid writing to other parts of the usb_device structure after it has been initialized. Similar changes should be made to the code that reads the BOS descriptor, but that can be handled in a separate patch later on. This patch is sufficient to fix the bug found by syzbot.
(CVE-2023-52886)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52886
https://ubuntu.com/security/CVE-2023-52886

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.4 (CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0022
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52886

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246397 - Linux Distros Unpatched Vulnerability : CVE-2023-52887
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new This patch enhances error handling in scenarios with RTS (Request to Send) messages arriving closely. It replaces the less informative WARN_ON_ONCE backtraces with a new error handling method. This provides clearer error messages and allows for the early termination of problematic sessions. Previously, sessions were only released at the end of j1939_xtp_rx_rts(). Potentially this could be reproduced with something like: testj1939 -r vcan0:0x80 &
while true; do # send first RTS cansend vcan0 18EC8090#1014000303002301; # send second RTS cansend vcan0 18EC8090#1014000303002301; # send abort cansend vcan0 18EC8090#ff00000000002301; done (CVE-2023-52887)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52887
https://ubuntu.com/security/CVE-2023-52887

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0015
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52887

Plugin Information
Published: 2025/08/08, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227315 - Linux Distros Unpatched Vulnerability : CVE-2023-52898
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xhci: Fix null pointer dereference when host dies Make sure xhci_free_dev() and xhci_kill_endpoint_urbs() do not race and cause null pointer dereference when host suddenly dies. Usb core may call xhci_free_dev() which frees the xhci->devs[slot_id] virt device at the same time that xhci_kill_endpoint_urbs() tries to loop through all the device's endpoints, checking if there are any cancelled urbs left to give back. hold the xhci spinlock while freeing the virt device (CVE-2023-52898)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52898
https://ubuntu.com/security/CVE-2023-52898

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52898

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226433 - Linux Distros Unpatched Vulnerability : CVE-2023-52901
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: xhci: Check endpoint is valid before dereferencing it When the host controller is not responding, all URBs queued to all endpoints need to be killed. This can cause a kernel panic if we dereference an invalid endpoint. Fix this by using xhci_get_virt_ep() helper to find the endpoint and checking if the endpoint is valid before dereferencing it. [233311.853271] xhci-hcd xhci-hcd.1.auto: xHCI host controller not responding, assume dead [233311.853393] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000e8 [233311.853964] pc : xhci_hc_died+0x10c/0x270 [233311.853971] lr :
xhci_hc_died+0x1ac/0x270 [233311.854077] Call trace: [233311.854085] xhci_hc_died+0x10c/0x270 [233311.854093] xhci_stop_endpoint_command_watchdog+0x100/0x1a4 [233311.854105] call_timer_fn+0x50/0x2d4 [233311.854112] expire_timers+0xac/0x2e4 [233311.854118] run_timer_softirq+0x300/0xabc [233311.854127]
__do_softirq+0x148/0x528 [233311.854135] irq_exit+0x194/0x1a8 [233311.854143]
__handle_domain_irq+0x164/0x1d0 [233311.854149] gic_handle_irq.22273+0x10c/0x188 [233311.854156] el1_irq+0xfc/0x1a8 [233311.854175] lpm_cpuidle_enter+0x25c/0x418 [msm_pm] [233311.854185] cpuidle_enter_state+0x1f0/0x764 [233311.854194] do_idle+0x594/0x6ac [233311.854201] cpu_startup_entry+0x7c/0x80 [233311.854209] secondary_start_kernel+0x170/0x198 (CVE-2023-52901)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52901
https://ubuntu.com/security/CVE-2023-52901

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52901

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226381 - Linux Distros Unpatched Vulnerability : CVE-2023-52908
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix potential NULL dereference Fix potential NULL dereference, in the case when man, the resource manager might be NULL, when/if we print debug information. (CVE-2023-52908)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52908
https://ubuntu.com/security/CVE-2023-52908

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52908

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226581 - Linux Distros Unpatched Vulnerability : CVE-2023-52909
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: nfsd: fix handling of cached open files in nfsd4_open codepath Commit fb70bf124b05 (NFSD: Instantiate a struct file when creating a regular NFSv4 file) added the ability to cache an open fd over a compound. There are a couple of problems with the way this currently works: It's racy, as a newly-created nfsd_file can end up with its PENDING bit cleared while the nf is hashed, and the nf_file pointer is still zeroed out. Other tasks can find it in this state and they expect to see a valid nf_file, and can oops if nf_file is NULL. Also, there is no guarantee that we'll end up creating a new nfsd_file if one is already in the hash. If an extant entry is in the hash with a valid nf_file, nfs4_get_vfs_file will clobber its nf_file pointer with the value of op_file and the old nf_file will leak. Fix both issues by making a new nfsd_file_acquirei_opened variant that takes an optional file pointer. If one is present when this is called, we'll take a new reference to it instead of trying to open the file. If the nfsd_file already has a valid nf_file, we'll just ignore the optional file and pass the nfsd_file back as-is. Also rework the tracepoints a bit to allow for an opened variant and don't try to avoid counting acquisitions in the case where we already have a cached open file. (CVE-2023-52909)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52909
https://ubuntu.com/security/CVE-2023-52909

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
3.3 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
2.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52909

Plugin Information
Published: 2025/03/05, Modified: 2025/09/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226701 - Linux Distros Unpatched Vulnerability : CVE-2023-52910
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: iommu/iova: Fix alloc iova overflows issue In __alloc_and_insert_iova_range, there is an issue that retry_pfn overflows. The value of iovad->anchor.pfn_hi is ~0UL, then when iovad->cached_node is iovad->anchor, curr_iova->pfn_hi + 1 will overflow. As a result, if the retry logic is executed, low_pfn is updated to 0, and then new_pfn < low_pfn returns false to make the allocation successful. This issue occurs in the following two situations: 1. The first iova size exceeds the domain size. When initializing iova domain, iovad->cached_node is assigned as iovad->anchor. For example, the iova domain size is 10M, start_pfn is 0x1_F000_0000, and the iova size allocated for the first time is 11M. The following is the log information, new->pfn_lo is smaller than iovad->cached_node. Example log as follows: [ 223.798112][T1705487] sh:
[name:iova&]__alloc_and_insert_iova_range start_pfn:0x1f0000,retry_pfn:0x0,size:0xb00,limit_pfn:0x1f0a00 [ 223.799590][T1705487] sh: [name:iova&]__alloc_and_insert_iova_range success start_pfn:0x1f0000,new->pfn_lo:0x1efe00,new->pfn_hi:0x1f08ff 2. The node with the largest iova->pfn_lo value in the iova domain is deleted, iovad->cached_node will be updated to iovad->anchor, and then the alloc iova size exceeds the maximum iova size that can be allocated in the domain. After judging that retry_pfn is less than limit_pfn, call retry_pfn+1 to fix the overflow issue. (CVE-2023-52910)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52910
https://ubuntu.com/security/CVE-2023-52910

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52910

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226386 - Linux Distros Unpatched Vulnerability : CVE-2023-52912
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fixed bug on error when unloading amdgpu Fixed bug on error when unloading amdgpu. The error message is as follows: [ 377.706202] kernel BUG at drivers/gpu/drm/drm_buddy.c:278! [ 377.706215] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 377.706222] CPU: 4 PID: 8610 Comm: modprobe Tainted: G IOE 6.0.0-thomas #1 [ 377.706231] Hardware name:
ASUS System Product Name/PRIME Z390-A, BIOS 2004 11/02/2021 [ 377.706238] RIP:
0010:drm_buddy_free_block+0x26/0x30 [drm_buddy] [ 377.706264] Code: 00 00 00 90 0f 1f 44 00 00 48 8b 0e 89 c8 25 00 0c 00 00 3d 00 04 00 00 75 10 48 8b 47 18 48 d3 e0 48 01 47 28 e9 fa fe ff ff <0f> 0b 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 41 54 55 48 89 f5 53 [ 377.706282] RSP: 0018:ffffad2dc4683cb8 EFLAGS: 00010287 [ 377.706289] RAX: 0000000000000000 RBX: ffff8b1743bd5138 RCX: 0000000000000000 [ 377.706297] RDX:
ffff8b1743bd5160 RSI: ffff8b1743bd5c78 RDI: ffff8b16d1b25f70 [ 377.706304] RBP: ffff8b1743bd59e0 R08:
0000000000000001 R09: 0000000000000001 [ 377.706311] R10: ffff8b16c8572400 R11: ffffad2dc4683cf0 R12:
ffff8b16d1b25f70 [ 377.706318] R13: ffff8b16d1b25fd0 R14: ffff8b1743bd59c0 R15: ffff8b16d1b25f70 [ 377.706325] FS: 00007fec56c72c40(0000) GS:ffff8b1836500000(0000) knlGS:0000000000000000 [ 377.706334] CS:
0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 377.706340] CR2: 00007f9b88c1ba50 CR3: 0000000110450004 CR4: 00000000003706e0 [ 377.706347] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 377.706354] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 377.706361] Call Trace: [ 377.706365] <TASK> [ 377.706369] drm_buddy_free_list+0x2a/0x60 [drm_buddy] [ 377.706376] amdgpu_vram_mgr_fini+0xea/0x180 [amdgpu] [ 377.706572] amdgpu_ttm_fini+0x12e/0x1a0 [amdgpu] [ 377.706650] amdgpu_bo_fini+0x22/0x90 [amdgpu] [ 377.706727] gmc_v11_0_sw_fini+0x26/0x30 [amdgpu] [ 377.706821] amdgpu_device_fini_sw+0xa1/0x3c0 [amdgpu] [ 377.706897] amdgpu_driver_release_kms+0x12/0x30 [amdgpu] [ 377.706975] drm_dev_release+0x20/0x40 [drm] [ 377.707006] release_nodes+0x35/0xb0 [ 377.707014] devres_release_all+0x8b/0xc0 [ 377.707020] device_unbind_cleanup+0xe/0x70 [ 377.707027] device_release_driver_internal+0xee/0x160 [ 377.707033] driver_detach+0x44/0x90 [ 377.707039] bus_remove_driver+0x55/0xe0 [ 377.707045] pci_unregister_driver+0x3b/0x90 [ 377.707052] amdgpu_exit+0x11/0x6c [amdgpu] [ 377.707194] __x64_sys_delete_module+0x142/0x2b0 [ 377.707201] ? fpregs_assert_state_consistent+0x22/0x50 [ 377.707208] ? exit_to_user_mode_prepare+0x3e/0x190 [ 377.707215] do_syscall_64+0x38/0x90 [ 377.707221] entry_SYSCALL_64_after_hwframe+0x63/0xcd (CVE-2023-52912)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52912
https://ubuntu.com/security/CVE-2023-52912

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52912

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
225936 - Linux Distros Unpatched Vulnerability : CVE-2023-52920
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: support non-r10 register spill/fill to/from stack in precision tracking Use instruction (jump) history to record instructions that performed register spill/fill to/from stack, regardless if this was done through read-only r10 register, or any other register after copying r10 into it *and* potentially adjusting offset. To make this work reliably, we push extra per-instruction flags into instruction history, encoding stack slot index (spi) and stack frame number in extra 10 bit flags we take away from prev_idx in instruction history. We don't touch idx field for maximum performance, as it's checked most frequently during backtracking. This change removes basically the last remaining practical limitation of precision backtracking logic in BPF verifier. It fixes known deficiencies, but also opens up new opportunities to reduce number of verified states, explored in the subsequent patches. There are only three differences in selftests' BPF object files according to veristat, all in the positive direction (less states). File Program Insns (A) Insns (B) Insns (DIFF) States (A) States (B) States (DIFF)
-------------------------------------- ------------- --------- --------- ------------- ----------
---------- ------------- test_cls_redirect_dynptr.bpf.linked3.o cls_redirect 2987 2864 -123 (-4.12%) 240 231 -9 (-3.75%) xdp_synproxy_kern.bpf.linked3.o syncookie_tc 82848 82661 -187 (-0.23%) 5107 5073 -34 (-0.67%) xdp_synproxy_kern.bpf.linked3.o syncookie_xdp 85116 84964 -152 (-0.18%) 5162 5130 -32 (-0.62%) Note, I avoided renaming jmp_history to more generic insn_hist to minimize number of lines changed and potential merge conflicts between bpf and bpf-next trees. Notice also cur_hist_entry pointer reset to NULL at the beginning of instruction verification loop. This pointer avoids the problem of relying on last jump history entry's insn_idx to determine whether we already have entry for current instruction or not. It can happen that we added jump history entry because current instruction is_jmp_point(), but also we need to add instruction flags for stack access. In this case, we don't want to entries, so we need to reuse last added entry, if it is present. Relying on insn_idx comparison has the same ambiguity problem as the one that was fixed recently in [0], so we avoid that. [0] https://patchwork.kernel.org/project/netdevbpf/patch/20231110002638.4168352-3-andrii@kernel.org/ (CVE-2023-52920)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52920
https://security-tracker.debian.org/tracker/CVE-2023-52920
https://ubuntu.com/security/CVE-2023-52920

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52920

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246749 - Linux Distros Unpatched Vulnerability : CVE-2023-52928
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Skip invalid kfunc call in backtrack_insn The verifier skips invalid kfunc call in check_kfunc_call(), which would be captured in fixup_kfunc_call() if such insn is not eliminated by dead code elimination. However, this can lead to the following warning in backtrack_insn(), also see [1]:
------------[ cut here ]------------ verifier backtracking bug WARNING: CPU: 6 PID: 8646 at kernel/bpf/verifier.c:2756 backtrack_insn kernel/bpf/verifier.c:2756 __mark_chain_precision kernel/bpf/verifier.c:3065 mark_chain_precision kernel/bpf/verifier.c:3165 adjust_reg_min_max_vals kernel/bpf/verifier.c:10715 check_alu_op kernel/bpf/verifier.c:10928 do_check kernel/bpf/verifier.c:13821 [inline] do_check_common kernel/bpf/verifier.c:16289 [...] So make backtracking conservative with this by returning ENOTSUPP. [1] https://lore.kernel.org/bpf/CACkBjsaXNceR8ZjkLG=dT3P=4A8SBsg0Z5h5PWLryF5=ghKq=g@mail.gmail.com/ (CVE-2023-52928)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52928
https://ubuntu.com/security/CVE-2023-52928

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52928

Plugin Information
Published: 2025/08/09, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245540 - Linux Distros Unpatched Vulnerability : CVE-2023-52936
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. (CVE-2023-52936)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52936
https://ubuntu.com/security/CVE-2023-52936

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-52936

Plugin Information
Published: 2025/08/07, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246063 - Linux Distros Unpatched Vulnerability : CVE-2023-52941
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: can: isotp: split tx timer into transmission and timeout The timer for the transmission of isotp PDUs formerly had two functions: 1. send two consecutive frames with a given time gap 2. monitor the timeouts for flow control frames and the echo frames This led to larger txstate checks and potentially to a problem discovered by syzbot which enabled the panic_on_warn feature while testing. The former 'txtimer' function is split into 'txfrtimer' and 'txtimer' to handle the two above functionalities with separate timer callbacks. The two simplified timers now run in one-shot mode and make the state transitions (especially with isotp_rcv_echo) better understandable. (CVE-2023-52941)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52941
https://ubuntu.com/security/CVE-2023-52941

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52941

Plugin Information
Published: 2025/08/08, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248173 - Linux Distros Unpatched Vulnerability : CVE-2023-52942
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask() It was found that the check to see if a partition could use up all the cpus from the parent cpuset in update_parent_subparts_cpumask() was incorrect. As a result, it is possible to leave parent with no effective cpu left even if there are tasks in the parent cpuset. This can lead to system panic as reported in [1]. Fix this probem by updating the check to fail the enabling the partition if parent's effective_cpus is a subset of the child's cpus_allowed. Also record the error code when an error happens in update_prstate() and add a test case where parent partition and child have the same cpu list and parent has task. Enabling partition in the child will fail in this case. [1] https://www.spinics.net/lists/cgroups/msg36254.html (CVE-2023-52942)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-52942
https://ubuntu.com/security/CVE-2023-52942

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52942

Plugin Information
Published: 2025/08/11, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249795 - Linux Distros Unpatched Vulnerability : CVE-2023-53005
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: trace_events_hist: add check for return value of 'create_hist_field' Function 'create_hist_field' is called recursively at trace_events_hist.c:1954 and can return NULL-value that's why we have to check it to avoid null pointer dereference. Found by Linux Verification Center (linuxtesting.org) with SVACE. (CVE-2023-53005)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53005
https://ubuntu.com/security/CVE-2023-53005

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53005

Plugin Information
Published: 2025/08/15, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244631 - Linux Distros Unpatched Vulnerability : CVE-2023-53007
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tracing: Make sure trace_printk() can output as soon as it can be used Currently trace_printk() can be used as soon as early_trace_init() is called from start_kernel(). But if a crash happens, and ftrace_dump_on_oops is set on the kernel command line, all you get will be: [ 0.456075] <idle>-0 0dN.2. 347519us : Unknown type 6 [ 0.456075] <idle>-0 0dN.2. 353141us : Unknown type 6 [ 0.456075] <idle>-0 0dN.2. 358684us : Unknown type 6 This is because the trace_printk() event (type 6) hasn't been registered yet. That gets done via an early_initcall(), which may be early, but not early enough. Instead of registering the trace_printk() event (and other ftrace events, which are not trace events) via an early_initcall(), have them registered at the same time that trace_printk() can be used. This way, if there is a crash before early_initcall(), then the trace_printk()s will actually be useful. (CVE-2023-53007)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53007
https://ubuntu.com/security/CVE-2023-53007

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53007

Plugin Information
Published: 2025/08/07, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246994 - Linux Distros Unpatched Vulnerability : CVE-2023-53008
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cifs: fix potential memory leaks in session setup Make sure to free cifs_ses::auth_key.response before allocating it as we might end up leaking memory in reconnect or mounting. (CVE-2023-53008)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53008
https://security-tracker.debian.org/tracker/CVE-2023-53008
https://ubuntu.com/security/CVE-2023-53008

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53008

Plugin Information
Published: 2025/08/09, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249354 - Linux Distros Unpatched Vulnerability : CVE-2023-53011
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: stmmac: enable all safety features by default In the original implementation of dwmac5 commit 8bf993a5877e (net: stmmac: Add support for DWMAC5 and implement Safety Features) all safety features were enabled by default. Later it seems some implementations didn't have support for all the features, so in commit 5ac712dcdfef (net:
stmmac: enable platform specific safety features) the safety_feat_cfg structure was added to the callback and defined for some platforms to selectively enable these safety features. The problem is that only certain platforms were given that software support. If the automotive safety package bit is set in the hardware features register the safety feature callback is called for the platform, and for platforms that didn't get a safety_feat_cfg defined this results in the following NULL pointer dereference: [ 7.933303] Call trace: [ 7.935812] dwmac5_safety_feat_config+0x20/0x170 [stmmac] [ 7.941455]
__stmmac_open+0x16c/0x474 [stmmac] [ 7.946117] stmmac_open+0x38/0x70 [stmmac] [ 7.950414]
__dev_open+0x100/0x1dc [ 7.954006] __dev_change_flags+0x18c/0x204 [ 7.958297] dev_change_flags+0x24/0x6c [ 7.962237] do_setlink+0x2b8/0xfa4 [ 7.965827] __rtnl_newlink+0x4ec/0x840 [ 7.969766] rtnl_newlink+0x50/0x80 [ 7.973353] rtnetlink_rcv_msg+0x12c/0x374 [ 7.977557] netlink_rcv_skb+0x5c/0x130 [ 7.981500] rtnetlink_rcv+0x18/0x2c [ 7.985172] netlink_unicast+0x2e8/0x340 [ 7.989197] netlink_sendmsg+0x1a8/0x420 [ 7.993222] ____sys_sendmsg+0x218/0x280 [ 7.997249] ___sys_sendmsg+0xac/0x100 [ 8.001103]
__sys_sendmsg+0x84/0xe0 [ 8.004776] __arm64_sys_sendmsg+0x24/0x30 [ 8.008983] invoke_syscall+0x48/0x114 [ 8.012840] el0_svc_common.constprop.0+0xcc/0xec [ 8.017665] do_el0_svc+0x38/0xb0 [ 8.021071] el0_svc+0x2c/0x84 [ 8.024212] el0t_64_sync_handler+0xf4/0x120 [ 8.028598] el0t_64_sync+0x190/0x194 Go back to the original behavior, if the automotive safety package is found to be supported in hardware enable all the features unless safety_feat_cfg is passed in saying this particular platform only supports a subset of the features. (CVE-2023-53011)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53011
https://ubuntu.com/security/CVE-2023-53011

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53011

Plugin Information
Published: 2025/08/15, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246947 - Linux Distros Unpatched Vulnerability : CVE-2023-53037
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: mpi3mr: Bad drive in topology results kernel crash When the SAS Transport Layer support is enabled and a device exposed to the OS by the driver fails INQUIRY commands, the driver frees up the memory allocated for an internal HBA port data structure. However, in some places, the reference to the freed memory is not cleared. When the firmware sends the Device Info change event for the same device again, the freed memory is accessed and that leads to memory corruption and OS crash. (CVE-2023-53037)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53037
https://ubuntu.com/security/CVE-2023-53037

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53037

Plugin Information
Published: 2025/08/09, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250026 - Linux Distros Unpatched Vulnerability : CVE-2023-53048
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: typec: tcpm: fix warning when handle discover_identity message Since both source and sink device can send discover_identity message in PD3, kernel may dump below warning: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 169 at drivers/usb/typec/tcpm/tcpm.c:1446 tcpm_queue_vdm+0xe0/0xf0 Modules linked in:
CPU: 0 PID: 169 Comm: 1-0050 Not tainted 6.1.1-00038-g6a3c36cf1da2-dirty #567 Hardware name: NXP i.MX8MPlus EVK board (DT) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc :
tcpm_queue_vdm+0xe0/0xf0 lr : tcpm_queue_vdm+0x2c/0xf0 sp : ffff80000c19bcd0 x29: ffff80000c19bcd0 x28:
0000000000000001 x27: ffff0000d11c8ab8 x26: ffff0000d11cc000 x25: 0000000000000000 x24: 00000000ff008081 x23: 0000000000000001 x22: 00000000ff00a081 x21: ffff80000c19bdbc x20: 0000000000000000 x19:
ffff0000d11c8080 x18: ffffffffffffffff x17: 0000000000000000 x16: 0000000000000000 x15: ffff0000d716f580 x14: 0000000000000001 x13: ffff0000d716f507 x12: 0000000000000001 x11: 0000000000000000 x10:
0000000000000020 x9 : 00000000000ee098 x8 : 00000000ffffffff x7 : 000000000000001c x6 : ffff0000d716f580 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffff80000c19bdbc x1 :
00000000ff00a081 x0 : 0000000000000004 Call trace: tcpm_queue_vdm+0xe0/0xf0 tcpm_pd_rx_handler+0x340/0x1ab0 kthread_worker_fn+0xcc/0x18c kthread+0x10c/0x110 ret_from_fork+0x10/0x20
---[ end trace 0000000000000000 ]--- Below sequences may trigger this warning:
tcpm_send_discover_work(work) tcpm_send_vdm(port, USB_SID_PD, CMD_DISCOVER_IDENT, NULL, 0);
tcpm_queue_vdm(port, header, data, count); port->vdm_state = VDM_STATE_READY;
vdm_state_machine_work(work); <-- received discover_identity from partner vdm_run_state_machine(port);
port->vdm_state = VDM_STATE_SEND_MESSAGE; mod_vdm_delayed_work(port, x); tcpm_pd_rx_handler(work);
tcpm_pd_data_request(port, msg); tcpm_handle_vdm_request(port, msg->payload, cnt); tcpm_queue_vdm(port, response[0], &response[1], rlen - 1); --> WARN_ON(port->vdm_state > VDM_STATE_DONE); For this case, the state machine could still send out discover identity message later if we skip current discover_identity message. So we should handle the received message firstly and override the pending discover_identity message without warning in this case. Then, a delayed send_discover work will send discover_identity message again. (CVE-2023-53048)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53048
https://ubuntu.com/security/CVE-2023-53048

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53048

Plugin Information
Published: 2025/08/15, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247320 - Linux Distros Unpatched Vulnerability : CVE-2023-53049
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: usb: ucsi: Fix NULL pointer deref in ucsi_connector_change() When ucsi_init() fails, ucsi->connector is NULL, yet in case of ucsi_acpi we may still get events which cause the ucs_acpi code to call ucsi_connector_change(), which then derefs the NULL ucsi->connector pointer. Fix this by not setting ucsi->ntfy inside ucsi_init() until ucsi_init() has succeeded, so that ucsi_connector_change() ignores the events because UCSI_ENABLE_NTFY_CONNECTOR_CHANGE is not set in the ntfy mask. (CVE-2023-53049)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53049
https://ubuntu.com/security/CVE-2023-53049

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53049

Plugin Information
Published: 2025/08/10, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248941 - Linux Distros Unpatched Vulnerability : CVE-2023-53055
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fscrypt: destroy keyring after security_sb_delete() fscrypt_destroy_keyring() must be called after all potentially-encrypted inodes were evicted; otherwise it cannot safely destroy the keyring. Since inodes that are in-use by the Landlock LSM don't get evicted until security_sb_delete(), this means that fscrypt_destroy_keyring() must be called *after* security_sb_delete(). This fixes a WARN_ON followed by a NULL dereference, only possible if Landlock was being used on encrypted files. (CVE-2023-53055)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53055
https://security-tracker.debian.org/tracker/CVE-2023-53055
https://ubuntu.com/security/CVE-2023-53055

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53055

Plugin Information
Published: 2025/08/12, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246066 - Linux Distros Unpatched Vulnerability : CVE-2023-53062
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: usb: smsc95xx: Limit packet length to skb->len Packet length retrieved from descriptor may be larger than the actual socket buffer length. In such case the cloned skb passed up the network stack will leak kernel memory contents. (CVE-2023-53062)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53062
https://ubuntu.com/security/CVE-2023-53062

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53062

Plugin Information
Published: 2025/08/08, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
252995 - Linux Distros Unpatched Vulnerability : CVE-2023-53069
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: octeontx2-vf: Add missing free for alloc_percpu Add the free_percpu for the allocated vf->hw.lmt_info in order to avoid memory leak, same as the pf->hw.lmt_info in `drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c`. (CVE-2023-53069)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53069
https://ubuntu.com/security/CVE-2023-53069

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53069

Plugin Information
Published: 2025/08/20, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245261 - Linux Distros Unpatched Vulnerability : CVE-2023-53074
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/amdgpu: fix ttm_bo calltrace warning in psp_hw_fini The call trace occurs when the amdgpu is removed after the mode1 reset. During mode1 reset, from suspend to resume, there is no need to reinitialize the ta firmware buffer which caused the bo pin_count increase redundantly. [ 489.885525] Call Trace: [ 489.885525] <TASK> [ 489.885526] amdttm_bo_put+0x34/0x50 [amdttm] [ 489.885529] amdgpu_bo_free_kernel+0xe8/0x130 [amdgpu] [ 489.885620] psp_free_shared_bufs+0xb7/0x150 [amdgpu] [ 489.885720] psp_hw_fini+0xce/0x170 [amdgpu] [ 489.885815] amdgpu_device_fini_hw+0x2ff/0x413 [amdgpu] [ 489.885960] ? blocking_notifier_chain_unregister+0x56/0xb0 [ 489.885962] amdgpu_driver_unload_kms+0x51/0x60 [amdgpu] [ 489.886049] amdgpu_pci_remove+0x5a/0x140 [amdgpu] [ 489.886132] ? __pm_runtime_resume+0x60/0x90 [ 489.886134] pci_device_remove+0x3e/0xb0 [ 489.886135]
__device_release_driver+0x1ab/0x2a0 [ 489.886137] driver_detach+0xf3/0x140 [ 489.886138] bus_remove_driver+0x6c/0xf0 [ 489.886140] driver_unregister+0x31/0x60 [ 489.886141] pci_unregister_driver+0x40/0x90 [ 489.886142] amdgpu_exit+0x15/0x451 [amdgpu] (CVE-2023-53074)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53074
https://security-tracker.debian.org/tracker/CVE-2023-53074
https://ubuntu.com/security/CVE-2023-53074

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53074

Plugin Information
Published: 2025/08/07, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247148 - Linux Distros Unpatched Vulnerability : CVE-2023-53093
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tracing: Do not let histogram values have some modifiers Histogram values can not be strings, stacktraces, graphs, symbols, syscalls, or grouped in buckets or log. Give an error if a value is set to do so. Note, the histogram code was not prepared to handle these modifiers for histograms and caused a bug. Mark Rutland reported: # echo 'p:copy_to_user __arch_copy_to_user n=$arg2' >> /sys/kernel/tracing/kprobe_events # echo 'hist:keys=n:vals=hitcount.buckets=8:sort=hitcount' >
/sys/kernel/tracing/events/kprobes/copy_to_user/trigger # cat /sys/kernel/tracing/events/kprobes/copy_to_user/hist [ 143.694628] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 143.695190] Mem abort info: [ 143.695362] ESR = 0x0000000096000004 [ 143.695604] EC = 0x25: DABT (current EL), IL = 32 bits [ 143.695889] SET = 0, FnV = 0 [ 143.696077] EA = 0, S1PTW = 0 [ 143.696302] FSC = 0x04: level 0 translation fault [ 143.702381] Data abort info: [ 143.702614] ISV = 0, ISS = 0x00000004 [ 143.702832] CM = 0, WnR = 0 [ 143.703087] user pgtable: 4k pages, 48-bit VAs, pgdp=00000000448f9000 [ 143.703407] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 143.704137] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 143.704714] Modules linked in: [ 143.705273] CPU: 0 PID: 133 Comm: cat Not tainted 6.2.0-00003-g6fc512c10a7c #3 [ 143.706138] Hardware name: linux,dummy-virt (DT) [ 143.706723] pstate:
80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 143.707120] pc :
hist_field_name.part.0+0x14/0x140 [ 143.707504] lr : hist_field_name.part.0+0x104/0x140 [ 143.707774] sp :
ffff800008333a30 [ 143.707952] x29: ffff800008333a30 x28: 0000000000000001 x27: 0000000000400cc0 [ 143.708429] x26: ffffd7a653b20260 x25: 0000000000000000 x24: ffff10d303ee5800 [ 143.708776] x23:
ffffd7a6539b27b0 x22: ffff10d303fb8c00 x21: 0000000000000001 [ 143.709127] x20: ffff10d303ec2000 x19:
0000000000000000 x18: 0000000000000000 [ 143.709478] x17: 0000000000000000 x16: 0000000000000000 x15:
0000000000000000 [ 143.709824] x14: 0000000000000000 x13: 203a6f666e692072 x12: 6567676972742023 [ 143.710179] x11: 0a230a6d6172676f x10: 000000000000002c x9 : ffffd7a6521e018c [ 143.710584] x8 :
000000000000002c x7 : 7f7f7f7f7f7f7f7f x6 : 000000000000002c [ 143.710915] x5 : ffff10d303b0103e x4 :
ffffd7a653b20261 x3 : 000000000000003d [ 143.711239] x2 : 0000000000020001 x1 : 0000000000000001 x0 :
0000000000000000 [ 143.711746] Call trace: [ 143.712115] hist_field_name.part.0+0x14/0x140 [ 143.712642] hist_field_name.part.0+0x104/0x140 [ 143.712925] hist_field_print+0x28/0x140 [ 143.713125] event_hist_trigger_print+0x174/0x4d0 [ 143.713348] hist_show+0xf8/0x980 [ 143.713521] seq_read_iter+0x1bc/0x4b0 [ 143.713711] seq_read+0x8c/0xc4 [ 143.713876] vfs_read+0xc8/0x2a4 [ 143.714043] ksys_read+0x70/0xfc [ 143.714218] __arm64_sys_read+0x24/0x30 [ 143.714400] invoke_syscall+0x50/0x120 [ 143.714587] el0_svc_common.constprop.0+0x4c/0x100 [ 143.714807] do_el0_svc+0x44/0xd0 [ 143.714970] el0_svc+0x2c/0x84 [ 143.715134] el0t_64_sync_handler+0xbc/0x140 [ 143.715334] el0t_64_sync+0x190/0x194 [ 143.715742] Code: a9bd7bfd 910003fd a90153f3 aa0003f3 (f9400000) [ 143.716510] ---[ end trace 0000000000000000 ]--- Segmentation fault (CVE-2023-53093)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53093
https://security-tracker.debian.org/tracker/CVE-2023-53093
https://ubuntu.com/security/CVE-2023-53093

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53093

Plugin Information
Published: 2025/08/10, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245006 - Linux Distros Unpatched Vulnerability : CVE-2023-53109
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: tunnels: annotate lockless accesses to dev->needed_headroom IP tunnels can apparently update dev->needed_headroom in their xmit path. This patch takes care of three tunnels xmit, and also the core LL_RESERVED_SPACE() and LL_RESERVED_SPACE_EXTRA() helpers. More changes might be needed for completeness.
BUG: KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit read to 0xffff88815b9da0ec of 2 bytes by task 888 on cpu 1: ip_tunnel_xmit+0x1270/0x1730 net/ipv4/ip_tunnel.c:803 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596
__dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596
__dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/i
---truncated--- (CVE-2023-53109)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53109
https://ubuntu.com/security/CVE-2023-53109

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.4 (CVSS2#AV:A/AC:M/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53109

Plugin Information
Published: 2025/08/07, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246856 - Linux Distros Unpatched Vulnerability : CVE-2023-53111
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- loop: Fix use-after-free issues do_req_filebacked() calls blk_mq_complete_request() synchronously or asynchronously when using asynchronous I/O unless memory allocation fails. Hence, modify loop_handle_cmd() such that it does not dereference 'cmd' nor 'rq' after do_req_filebacked() finished unless we are sure that the request has not yet been completed. This patch fixes the following kernel crash: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000054 Call trace: css_put.42938+0x1c/0x1ac loop_process_work+0xc8c/0xfd4 loop_rootcg_workfn+0x24/0x34 process_one_work+0x244/0x558 worker_thread+0x400/0x8fc kthread+0x16c/0x1e0 ret_from_fork+0x10/0x20 (CVE-2023-53111)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53111
https://security-tracker.debian.org/tracker/CVE-2023-53111
https://ubuntu.com/security/CVE-2023-53111

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53111

Plugin Information
Published: 2025/08/09, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247538 - Linux Distros Unpatched Vulnerability : CVE-2023-53115
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: mpi3mr: Fix memory leaks in mpi3mr_init_ioc() Don't allocate memory again when IOC is being reinitialized. (CVE-2023-53115)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53115
https://ubuntu.com/security/CVE-2023-53115

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53115

Plugin Information
Published: 2025/08/10, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246405 - Linux Distros Unpatched Vulnerability : CVE-2023-53118
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix a procfs host directory removal regression scsi_proc_hostdir_rm() decreases a reference counter and hence must only be called once per host that is removed. This change does not require a scsi_add_host_with_dma() change since scsi_add_host_with_dma() will return 0 (success) if scsi_proc_host_add() is called. (CVE-2023-53118)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53118
https://ubuntu.com/security/CVE-2023-53118

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-53118

Plugin Information
Published: 2025/08/08, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245161 - Linux Distros Unpatched Vulnerability : CVE-2023-53123
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: PCI: s390: Fix use-after-free of PCI resources with per-function hotplug On s390 PCI functions may be hotplugged individually even when they belong to a multi-function device. In particular on an SR-IOV device VFs may be removed and later re- added. In commit a50297cf8235 (s390/pci: separate zbus creation from scanning) it was missed however that struct pci_bus and struct zpci_bus's resource list retained a reference to the PCI functions MMIO resources even though those resources are released and freed on hot-unplug. These stale resources may subsequently be claimed when the PCI function re-appears resulting in use-after-free. One idea of fixing this use-after-free in s390 specific code that was investigated was to simply keep resources around from the moment a PCI function first appeared until the whole virtual PCI bus created for a multi-function device disappears. The problem with this however is that due to the requirement of artificial MMIO addreesses (address cookies) extra logic is then needed to keep the address cookies compatible on re-plug.
At the same time the MMIO resources semantically belong to the PCI function so tying their lifecycle to the function seems more logical. Instead a simpler approach is to remove the resources of an individually hot-unplugged PCI function from the PCI bus's resource list while keeping the resources of other PCI functions on the PCI bus untouched. This is done by introducing pci_bus_remove_resource() to remove an individual resource. Similarly the resource also needs to be removed from the struct zpci_bus's resource list. It turns out however, that there is really no need to add the MMIO resources to the struct zpci_bus's resource list at all and instead we can simply use the zpci_bar_struct's resource pointer directly. (CVE-2023-53123)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53123
https://ubuntu.com/security/CVE-2023-53123

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
6.7 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
3.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
3.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53123

Plugin Information
Published: 2025/08/07, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243756 - Linux Distros Unpatched Vulnerability : CVE-2023-53128
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix throttle_groups memory leak Add a missing kfree(). (CVE-2023-53128)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53128
https://ubuntu.com/security/CVE-2023-53128

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-53128

Plugin Information
Published: 2025/08/05, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246135 - Linux Distros Unpatched Vulnerability : CVE-2023-53131
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- SUNRPC: Fix a server shutdown leak Fix a race where kthread_stop() may prevent the threadfn from ever getting called. If that happens the svc_rqst will not be cleaned up. (CVE-2023-53131)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53131
https://ubuntu.com/security/CVE-2023-53131

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53131

Plugin Information
Published: 2025/08/08, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248952 - Linux Distros Unpatched Vulnerability : CVE-2023-53133
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() When the buffer length of the recvmsg system call is 0, we got the flollowing soft lockup problem: watchdog: BUG: soft lockup - CPU#3 stuck for 27s! [a.out:6149] CPU: 3 PID: 6149 Comm: a.out Kdump: loaded Not tainted 6.2.0+ #30 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 RIP:
0010:remove_wait_queue+0xb/0xc0 Code: 5e 41 5f c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 57 <41> 56 41 55 41 54 55 48 89 fd 53 48 89 f3 4c 8d 6b 18 4c 8d 73 20 RSP: 0018:ffff88811b5978b8 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff88811a7d3780 RCX: ffffffffb7a4d768 RDX: dffffc0000000000 RSI: ffff88811b597908 RDI: ffff888115408040 RBP:
1ffff110236b2f1b R08: 0000000000000000 R09: ffff88811a7d37e7 R10: ffffed10234fa6fc R11: 0000000000000001 R12: ffff88811179b800 R13: 0000000000000001 R14: ffff88811a7d38a8 R15: ffff88811a7d37e0 FS:
00007f6fb5398740(0000) GS:ffff888237180000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 CR2: 0000000020000000 CR3: 000000010b6ba002 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400 Call Trace: <TASK> tcp_msg_wait_data+0x279/0x2f0 tcp_bpf_recvmsg_parser+0x3c6/0x490 inet_recvmsg+0x280/0x290 sock_recvmsg+0xfc/0x120 ____sys_recvmsg+0x160/0x3d0 ___sys_recvmsg+0xf0/0x180
__sys_recvmsg+0xea/0x1a0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc The logic in tcp_bpf_recvmsg_parser is as follows: msg_bytes_ready: copied = sk_msg_recvmsg(sk, psock, msg, len, flags); if (!copied) { wait data; goto msg_bytes_ready; } In this case, copied always is 0, the infinite loop occurs. According to the Linux system call man page, 0 should be returned in this case. Therefore, in tcp_bpf_recvmsg_parser(), if the length is 0, directly return. Also modify several other functions with the same problem. (CVE-2023-53133)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53133
https://security-tracker.debian.org/tracker/CVE-2023-53133
https://ubuntu.com/security/CVE-2023-53133

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53133

Plugin Information
Published: 2025/08/12, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244109 - Linux Distros Unpatched Vulnerability : CVE-2023-53142
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ice: copy last block omitted in ice_get_module_eeprom() ice_get_module_eeprom() is broken since commit e9c9692c8a81 (ice: Reimplement module reads used by ethtool) In this refactor, ice_get_module_eeprom() reads the eeprom in blocks of size 8. But the condition that should protect the buffer overflow ignores the last block. The last block always contains zeros. Bug uncovered by ethtool upstream commit 9538f384b535 (netlink: eeprom: Defer page requests to individual parsers) After this commit, ethtool reads a block with length = 1; to read the SFF-8024 identifier value. unpatched driver: $ ethtool -m enp65s0f0np0 offset 0x90 length 8 Offset Values ------ ------ 0x0090: 00 00 00 00 00 00 00 00 $ ethtool -m enp65s0f0np0 offset 0x90 length 12 Offset Values ------ ------ 0x0090: 00 00 01 a0 4d 65 6c 6c 00 00 00 00 $ $ ethtool -m enp65s0f0np0 Offset Values ------ ------ 0x0000: 11 06 06 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 01 08 00 0x0070: 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 patched driver: $ ethtool
-m enp65s0f0np0 offset 0x90 length 8 Offset Values ------ ------ 0x0090: 00 00 01 a0 4d 65 6c 6c $ ethtool
-m enp65s0f0np0 offset 0x90 length 12 Offset Values ------ ------ 0x0090: 00 00 01 a0 4d 65 6c 6c 61 6e 6f 78 $ ethtool -m enp65s0f0np0 Identifier : 0x11 (QSFP28) Extended identifier : 0x00 Extended identifier description : 1.5W max. Power consumption Extended identifier description : No CDR in TX, No CDR in RX Extended identifier description : High Power Class (> 3.5 W) not enabled Connector : 0x23 (No separable connector) Transceiver codes : 0x88 0x00 0x00 0x00 0x00 0x00 0x00 0x00 Transceiver type : 40G Ethernet:
40G Base-CR4 Transceiver type : 25G Ethernet: 25G Base-CR CA-N Encoding : 0x05 (64B/66B) BR, Nominal :
25500Mbps Rate identifier : 0x00 Length (SMF,km) : 0km Length (OM3 50um) : 0m Length (OM2 50um) : 0m Length (OM1 62.5um) : 0m Length (Copper or Active cable) : 1m Transmitter technology : 0xa0 (Copper cable unequalized) Attenuation at 2.5GHz : 4db Attenuation at 5.0GHz : 5db Attenuation at 7.0GHz : 7db Attenuation at 12.9GHz : 10db ........ .... (CVE-2023-53142)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53142
https://ubuntu.com/security/CVE-2023-53142

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.7 (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53142

Plugin Information
Published: 2025/08/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247436 - Linux Distros Unpatched Vulnerability : CVE-2023-53144
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: erofs: fix wrong kunmap when using LZMA on HIGHMEM platforms As the call trace shown, the root cause is kunmap incorrect pages: BUG: kernel NULL pointer dereference, address: 00000000 CPU: 1 PID: 40 Comm: kworker/u5:0 Not tainted 6.2.0-rc5 #4 Workqueue: erofs_worker z_erofs_decompressqueue_work EIP: z_erofs_lzma_decompress+0x34b/0x8ac z_erofs_decompress+0x12/0x14 z_erofs_decompress_queue+0x7e7/0xb1c z_erofs_decompressqueue_work+0x32/0x60 process_one_work+0x24b/0x4d8 ? process_one_work+0x1a4/0x4d8 worker_thread+0x14c/0x3fc kthread+0xe6/0x10c ? rescuer_thread+0x358/0x358 ? kthread_complete_and_exit+0x18/0x18 ret_from_fork+0x1c/0x28 ---[ end trace 0000000000000000 ]--- The bug is trivial and should be fixed now. It has no impact on !HIGHMEM platforms.
(CVE-2023-53144)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53144
https://ubuntu.com/security/CVE-2023-53144

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-53144

Plugin Information
Published: 2025/08/10, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265045 - Linux Distros Unpatched Vulnerability : CVE-2023-53147
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xfrm: add NULL check in xfrm_update_ae_params Normally, x->replay_esn and x->preplay_esn should be allocated at xfrm_alloc_replay_state_esn(...) in xfrm_state_construct(...), hence the xfrm_update_ae_params(...) is okay to update them. However, the current implementation of xfrm_new_ae(...) allows a malicious user to directly dereference a NULL pointer and crash the kernel like below. BUG:
kernel NULL pointer dereference, address: 0000000000000000 PGD 8253067 P4D 8253067 PUD 8e0e067 PMD 0 Oops:
0002 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 98 Comm: poc.npd Not tainted 6.4.0-rc7-00072-gdad9774deaf1 #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.o4 RIP: 0010:memcpy_orig+0xad/0x140 Code: e8 4c 89 5f e0 48 8d 7f e0 73 d2 83 c2 20 48 29 d6 48 29 d7 83 fa 10 72 34 4c 8b 06 4c 8b 4e 08 c RSP: 0018:ffff888008f57658 EFLAGS: 00000202 RAX: 0000000000000000 RBX:
ffff888008bd0000 RCX: ffffffff8238e571 RDX: 0000000000000018 RSI: ffff888007f64844 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11:
0000000000000000 R12: ffff888008f57818 R13: ffff888007f64aa4 R14: 0000000000000000 R15: 0000000000000000 FS: 00000000014013c0(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000054d8000 CR4: 00000000000006f0 Call Trace: <TASK>
? __die+0x1f/0x70 ? page_fault_oops+0x1e8/0x500 ? __pfx_is_prefetch.constprop.0+0x10/0x10 ?
__pfx_page_fault_oops+0x10/0x10 ? _raw_spin_unlock_irqrestore+0x11/0x40 ? fixup_exception+0x36/0x460 ?
_raw_spin_unlock_irqrestore+0x11/0x40 ? exc_page_fault+0x5e/0xc0 ? asm_exc_page_fault+0x26/0x30 ? xfrm_update_ae_params+0xd1/0x260 ? memcpy_orig+0xad/0x140 ? __pfx__raw_spin_lock_bh+0x10/0x10 xfrm_update_ae_params+0xe7/0x260 xfrm_new_ae+0x298/0x4e0 ? __pfx_xfrm_new_ae+0x10/0x10 ?
__pfx_xfrm_new_ae+0x10/0x10 xfrm_user_rcv_msg+0x25a/0x410 ? __pfx_xfrm_user_rcv_msg+0x10/0x10 ?
__alloc_skb+0xcf/0x210 ? stack_trace_save+0x90/0xd0 ? filter_irq_stacks+0x1c/0x70 ?
__stack_depot_save+0x39/0x4e0 ? __kasan_slab_free+0x10a/0x190 ? kmem_cache_free+0x9c/0x340 ? netlink_recvmsg+0x23c/0x660 ? sock_recvmsg+0xeb/0xf0 ? __sys_recvfrom+0x13c/0x1f0 ?
__x64_sys_recvfrom+0x71/0x90 ? do_syscall_64+0x3f/0x90 ? entry_SYSCALL_64_after_hwframe+0x72/0xdc ? copyout+0x3e/0x50 netlink_rcv_skb+0xd6/0x210 ? __pfx_xfrm_user_rcv_msg+0x10/0x10 ?
__pfx_netlink_rcv_skb+0x10/0x10 ? __pfx_sock_has_perm+0x10/0x10 ? mutex_lock+0x8d/0xe0 ?
__pfx_mutex_lock+0x10/0x10 xfrm_netlink_rcv+0x44/0x50 netlink_unicast+0x36f/0x4c0 ?
__pfx_netlink_unicast+0x10/0x10 ? netlink_recvmsg+0x500/0x660 netlink_sendmsg+0x3b7/0x700 This Null-ptr- deref bug is assigned CVE-2023-3772. And this commit adds additional NULL check in xfrm_update_ae_params to fix the NPD. (CVE-2023-53147)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53147
https://ubuntu.com/security/CVE-2023-53147

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53147

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264960 - Linux Distros Unpatched Vulnerability : CVE-2023-53150
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: qla2xxx: Pointer may be dereferenced Klocwork tool reported pointer 'rport' returned from call to function fc_bsg_to_rport() may be NULL and will be dereferenced. Add a fix to validate rport before dereferencing. (CVE-2023-53150)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53150
https://ubuntu.com/security/CVE-2023-53150

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53150

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265042 - Linux Distros Unpatched Vulnerability : CVE-2023-53151
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- md/raid10: prevent soft lockup while flush writes Currently, there is no limit for raid1/raid10 plugged bio. While flushing writes, raid1 has cond_resched() while raid10 doesn't, and too many writes can cause soft lockup. Follow up soft lockup can be triggered easily with writeback test for raid10 with ramdisks:
watchdog: BUG: soft lockup - CPU#10 stuck for 27s! [md0_raid10:1293] Call Trace: <TASK> call_rcu+0x16/0x20 put_object+0x41/0x80 __delete_object+0x50/0x90 delete_object_full+0x2b/0x40 kmemleak_free+0x46/0xa0 slab_free_freelist_hook.constprop.0+0xed/0x1a0 kmem_cache_free+0xfd/0x300 mempool_free_slab+0x1f/0x30 mempool_free+0x3a/0x100 bio_free+0x59/0x80 bio_put+0xcf/0x2c0 free_r10bio+0xbf/0xf0 raid_end_bio_io+0x78/0xb0 one_write_done+0x8a/0xa0 raid10_end_write_request+0x1b4/0x430 bio_endio+0x175/0x320 brd_submit_bio+0x3b9/0x9b7 [brd] __submit_bio+0x69/0xe0 submit_bio_noacct_nocheck+0x1e6/0x5a0 submit_bio_noacct+0x38c/0x7e0 flush_pending_writes+0xf0/0x240 raid10d+0xac/0x1ed0 Fix the problem by adding cond_resched() to raid10 like what raid1 did. Note that unlimited plugged bio still need to be optimized, for example, in the case of lots of dirty pages writeback, this will take lots of memory and io will spend a long time in plug, hence io latency is bad.
(CVE-2023-53151)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53151
https://ubuntu.com/security/CVE-2023-53151

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53151

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264957 - Linux Distros Unpatched Vulnerability : CVE-2023-53167
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tracing: Fix null pointer dereference in tracing_err_log_open() Fix an issue in function 'tracing_err_log_open'. The function doesn't call 'seq_open' if the file is opened only with write permissions, which results in 'file->private_data' being left as null. If we then use 'lseek' on that opened file, 'seq_lseek' dereferences 'file->private_data' in 'mutex_lock(&m->lock)', resulting in a kernel panic. Writing to this node requires root privileges, therefore this bug has very little security impact. Tracefs node: /sys/kernel/tracing/error_log Example Kernel panic: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000038 Call trace: mutex_lock+0x30/0x110 seq_lseek+0x34/0xb8 __arm64_sys_lseek+0x6c/0xb8 invoke_syscall+0x58/0x13c el0_svc_common+0xc4/0x10c do_el0_svc+0x24/0x98 el0_svc+0x24/0x88 el0t_64_sync_handler+0x84/0xe4 el0t_64_sync+0x1b4/0x1b8 Code:
d503201f aa0803e0 aa1f03e1 aa0103e9 (c8e97d02) ---[ end trace 561d1b49c12cf8a5 ]--- Kernel panic - not syncing: Oops: Fatal exception (CVE-2023-53167)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53167
https://ubuntu.com/security/CVE-2023-53167

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53167

Plugin Information
Published: 2025/09/16, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264963 - Linux Distros Unpatched Vulnerability : CVE-2023-53174
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: core: Fix possible memory leak if device_add() fails If device_add() returns error, the name allocated by dev_set_name() needs be freed. As the comment of device_add() says, put_device() should be used to decrease the reference count in the error path. So fix this by calling put_device(), then the name can be freed in kobject_cleanp(). (CVE-2023-53174)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53174
https://ubuntu.com/security/CVE-2023-53174

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53174

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265046 - Linux Distros Unpatched Vulnerability : CVE-2023-53188
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: openvswitch: fix race on port output assume the following setup on a single machine: 1. An openvswitch instance with one bridge and default flows 2. two network namespaces server and client 3.
two ovs interfaces server and client on the bridge 4. for each ovs interface a veth pair with a matching name and 32 rx and tx queues 5. move the ends of the veth pairs to the respective network namespaces 6. assign ip addresses to each of the veth ends in the namespaces (needs to be the same subnet) 7. start some http server on the server network namespace 8. test if a client in the client namespace can reach the http server when following the actions below the host has a chance of getting a cpu stuck in a infinite loop: 1. send a large amount of parallel requests to the http server (around 3000 curls should work) 2. in parallel delete the network namespace (do not delete interfaces or stop the server, just kill the namespace) there is a low chance that this will cause the below kernel cpu stuck message. If this does not happen just retry. Below there is also the output of bpftrace for the functions mentioned in the output. The series of events happening here is: 1. the network namespace is deleted calling `unregister_netdevice_many_notify` somewhere in the process 2. this sets first `NETREG_UNREGISTERING` on both ends of the veth and then runs `synchronize_net` 3. it then calls `call_netdevice_notifiers` with `NETDEV_UNREGISTER` 4. this is then handled by `dp_device_event` which calls `ovs_netdev_detach_dev` (if a vport is found, which is the case for the veth interface attached to ovs) 5. this removes the rx_handlers of the device but does not prevent packages to be sent to the device 6. `dp_device_event` then queues the vport deletion to work in background as a ovs_lock is needed that we do not hold in the unregistration path 7. `unregister_netdevice_many_notify` continues to call `netdev_unregister_kobject` which sets `real_num_tx_queues` to 0 8. port deletion continues (but details are not relevant for this issue) 9. at some future point the background task deletes the vport If after 7. but before 9. a packet is send to the ovs vport (which is not deleted at this point in time) which forwards it to the `dev_queue_xmit` flow even though the device is unregistering. In `skb_tx_hash` (which is called in the `dev_queue_xmit`) path there is a while loop (if the packet has a rx_queue recorded) that is infinite if `dev->real_num_tx_queues` is zero. To prevent this from happening we update `do_output` to handle devices without carrier the same as if the device is not found (which would be the code path after 9. is done). Additionally we now produce a warning in `skb_tx_hash` if we will hit the infinite loop. bpftrace (first word is function name):
__dev_queue_xmit server: real_num_tx_queues: 1, cpu: 2, pid: 28024, tid: 28024, skb_addr:
0xffff9edb6f207000, reg_state: 1 netdev_core_pick_tx server: addr: 0xffff9f0a46d4a000 real_num_tx_queues:
1, cpu: 2, pid: 28024, tid: 28024, skb_addr: 0xffff9edb6f207000, reg_state: 1 dp_device_event server:
real_num_tx_queues: 1 cpu 9, pid: 21024, tid: 21024, event 2, reg_state: 1 synchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024 synchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024 synchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024 synchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024 dp_device_event server: real_num_tx_queues: 1 cpu 9, pid: 21024, tid: 21024, event 6, reg_state: 2 ovs_netdev_detach_dev server: real_num_tx_queues: 1 cpu 9, pid: 21024, tid: 21024, reg_state:
2 netdev_rx_handler_unregister server: real_num_tx_queues: 1, cpu: 9, pid: 21024, tid: 21024, reg_state: 2 synchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024 netdev_rx_handler_unregister ret server:
real_num_tx_queues: 1, cpu: 9, pid: 21024, tid: 21024, reg_state: 2 dp_ ---truncated--- (CVE-2023-53188)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53188
https://ubuntu.com/security/CVE-2023-53188

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.1
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53188

Plugin Information
Published: 2025/09/16, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264971 - Linux Distros Unpatched Vulnerability : CVE-2023-53190
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix memory leaks in error path The memory allocated by vxlan_vnigroup_init() is not freed in the error path, leading to memory leaks [1].
Fix by calling vxlan_vnigroup_uninit() in the error path. The leaks can be reproduced by annotating gro_cells_init() with ALLOW_ERROR_INJECTION() and then running: # echo 100 >
/sys/kernel/debug/fail_function/probability # echo 1 > /sys/kernel/debug/fail_function/times # echo gro_cells_init > /sys/kernel/debug/fail_function/inject # printf %#x -12 >
/sys/kernel/debug/fail_function/gro_cells_init/retval # ip link add name vxlan0 type vxlan dstport 4789 external vnifilter RTNETLINK answers: Cannot allocate memory [1] unreferenced object 0xffff88810db84a00 (size 512): comm ip, pid 330, jiffies 4295010045 (age 66.016s) hex dump (first 32 bytes): f8 d5 76 0e 81 88 ff ff 01 00 00 00 00 00 00 02 ..v............. 03 00 04 00 48 00 00 00 00 00 00 01 04 00 01 00 ....H........... backtrace: [<ffffffff81a3097a>] kmalloc_trace+0x2a/0x60 [<ffffffff82f049fc>] vxlan_vnigroup_init+0x4c/0x160 [<ffffffff82ecd69e>] vxlan_init+0x1ae/0x280 [<ffffffff836858ca>] register_netdevice+0x57a/0x16d0 [<ffffffff82ef67b7>] __vxlan_dev_create+0x7c7/0xa50 [<ffffffff82ef6ce6>] vxlan_newlink+0xd6/0x130 [<ffffffff836d02ab>] __rtnl_newlink+0x112b/0x18a0 [<ffffffff836d0a8c>] rtnl_newlink+0x6c/0xa0 [<ffffffff836c0ddf>] rtnetlink_rcv_msg+0x43f/0xd40 [<ffffffff83908ce0>] netlink_rcv_skb+0x170/0x440 [<ffffffff839066af>] netlink_unicast+0x53f/0x810 [<ffffffff839072d8>] netlink_sendmsg+0x958/0xe70 [<ffffffff835c319f>] ____sys_sendmsg+0x78f/0xa90 [<ffffffff835cd6da>]
___sys_sendmsg+0x13a/0x1e0 [<ffffffff835cd94c>] __sys_sendmsg+0x11c/0x1f0 [<ffffffff8424da78>] do_syscall_64+0x38/0x80 unreferenced object 0xffff88810e76d5f8 (size 192): comm ip, pid 330, jiffies 4295010045 (age 66.016s) hex dump (first 32 bytes): 04 00 00 00 00 00 00 00 db e1 4f e7 00 00 00 00 ..........O..... 08 d6 76 0e 81 88 ff ff 08 d6 76 0e 81 88 ff ff ..v.......v..... backtrace:
[<ffffffff81a3162e>] __kmalloc_node+0x4e/0x90 [<ffffffff81a0e166>] kvmalloc_node+0xa6/0x1f0 [<ffffffff8276e1a3>] bucket_table_alloc.isra.0+0x83/0x460 [<ffffffff8276f18b>] rhashtable_init+0x43b/0x7c0 [<ffffffff82f04a1c>] vxlan_vnigroup_init+0x6c/0x160 [<ffffffff82ecd69e>] vxlan_init+0x1ae/0x280 [<ffffffff836858ca>] register_netdevice+0x57a/0x16d0 [<ffffffff82ef67b7>] __vxlan_dev_create+0x7c7/0xa50 [<ffffffff82ef6ce6>] vxlan_newlink+0xd6/0x130 [<ffffffff836d02ab>] __rtnl_newlink+0x112b/0x18a0 [<ffffffff836d0a8c>] rtnl_newlink+0x6c/0xa0 [<ffffffff836c0ddf>] rtnetlink_rcv_msg+0x43f/0xd40 [<ffffffff83908ce0>] netlink_rcv_skb+0x170/0x440 [<ffffffff839066af>] netlink_unicast+0x53f/0x810 [<ffffffff839072d8>] netlink_sendmsg+0x958/0xe70 [<ffffffff835c319f>] ____sys_sendmsg+0x78f/0xa90 (CVE-2023-53190)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53190
https://ubuntu.com/security/CVE-2023-53190

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-53190

Plugin Information
Published: 2025/09/16, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265276 - Linux Distros Unpatched Vulnerability : CVE-2023-53199
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails Syzkaller detected a memory leak of skbs in ath9k_hif_usb_rx_stream(). While processing skbs in ath9k_hif_usb_rx_stream(), the already allocated skbs in skb_pool are not freed if ath9k_hif_usb_rx_stream() fails. If we have an incorrect pkt_len or pkt_tag, the input skb is considered invalid and dropped. All the associated packets already in skb_pool should be dropped and freed. Added a comment describing this issue. The patch also makes remain_skb NULL after being processed so that it cannot be referenced after potential free. The initialization of hif_dev fields which are associated with remain_skb (rx_remain_len, rx_transfer_len and rx_pad_len) is moved after a new remain_skb is allocated. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. (CVE-2023-53199)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53199
https://ubuntu.com/security/CVE-2023-53199

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53199

Plugin Information
Published: 2025/09/17, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264928 - Linux Distros Unpatched Vulnerability : CVE-2023-53200
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfilter: x_tables: fix percpu counter block leak on error path when creating new netns Here is the stack where we allocate percpu counter block: +-< __alloc_percpu +-< xt_percpu_counter_alloc +-<
find_check_entry # {arp,ip,ip6}_tables.c +-< translate_table And it can be leaked on this code path: +->
ip6t_register_table +-> translate_table # allocates percpu counter block +-> xt_register_table # fails there is no freeing of the counter block on xt_register_table fail. Note: xt_percpu_counter_free should be called to free it like we do in do_replace through cleanup_entry helper (or in __ip6t_unregister_table).
Probability of hitting this error path is low AFAICS (xt_register_table can only return ENOMEM here, as it is not replacing anything, as we are creating new netns, and it is hard to imagine that all previous allocations succeeded and after that one in xt_register_table failed). But it's worth fixing even the rare leak. (CVE-2023-53200)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53200
https://security-tracker.debian.org/tracker/CVE-2023-53200
https://ubuntu.com/security/CVE-2023-53200

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53200

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265047 - Linux Distros Unpatched Vulnerability : CVE-2023-53211
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: driver core: location: Free struct acpi_pld_info *pld before return false struct acpi_pld_info *pld should be freed before the return of allocation failure, to prevent memory leak, add the ACPI_FREE() to fix it. (CVE-2023-53211)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53211
https://ubuntu.com/security/CVE-2023-53211

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-53211

Plugin Information
Published: 2025/09/16, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264916 - Linux Distros Unpatched Vulnerability : CVE-2023-53215
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sched/fair: Don't balance task to its current running CPU We've run into the case that the balancer tries to balance a migration disabled task and trigger the warning in set_task_cpu() like below: ------------[ cut here ]------------ WARNING: CPU: 7 PID: 0 at kernel/sched/core.c:3115 set_task_cpu+0x188/0x240 Modules linked in: hclgevf xt_CHECKSUM ipt_REJECT nf_reject_ipv4 <...snip> CPU: 7 PID: 0 Comm: swapper/7 Kdump:
loaded Tainted: G O 6.1.0-rc4+ #1 Hardware name: Huawei TaiShan 2280 V2/BC82AMDC, BIOS 2280-V2 CS V5.B221.01 12/09/2021 pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc :
set_task_cpu+0x188/0x240 lr : load_balance+0x5d0/0xc60 sp : ffff80000803bc70 x29: ffff80000803bc70 x28:
ffff004089e190e8 x27: ffff004089e19040 x26: ffff007effcabc38 x25: 0000000000000000 x24: 0000000000000001 x23: ffff80000803be84 x22: 000000000000000c x21: ffffb093e79e2a78 x20: 000000000000000c x19:
ffff004089e19040 x18: 0000000000000000 x17: 0000000000001fad x16: 0000000000000030 x15: 0000000000000000 x14: 0000000000000003 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000001 x10:
0000000000000400 x9 : ffffb093e4cee530 x8 : 00000000fffffffe x7 : 0000000000ce168a x6 : 000000000000013e x5 : 00000000ffffffe1 x4 : 0000000000000001 x3 : 0000000000000b2a x2 : 0000000000000b2a x1 :
ffffb093e6d6c510 x0 : 0000000000000001 Call trace: set_task_cpu+0x188/0x240 load_balance+0x5d0/0xc60 rebalance_domains+0x26c/0x380 _nohz_idle_balance.isra.0+0x1e0/0x370 run_rebalance_domains+0x6c/0x80
__do_softirq+0x128/0x3d8 ____do_softirq+0x18/0x24 call_on_irq_stack+0x2c/0x38 do_softirq_own_stack+0x24/0x3c __irq_exit_rcu+0xcc/0xf4 irq_exit_rcu+0x18/0x24 el1_interrupt+0x4c/0xe4 el1h_64_irq_handler+0x18/0x2c el1h_64_irq+0x74/0x78 arch_cpu_idle+0x18/0x4c default_idle_call+0x58/0x194 do_idle+0x244/0x2b0 cpu_startup_entry+0x30/0x3c secondary_start_kernel+0x14c/0x190
__secondary_switched+0xb0/0xb4 ---[ end trace 0000000000000000 ]--- Further investigation shows that the warning is superfluous, the migration disabled task is just going to be migrated to its current running CPU. This is because that on load balance if the dst_cpu is not allowed by the task, we'll re-select a new_dst_cpu as a candidate. If no task can be balanced to dst_cpu we'll try to balance the task to the new_dst_cpu instead. In this case when the migration disabled task is not on CPU it only allows to run on its current CPU, load balance will select its current CPU as new_dst_cpu and later triggers the warning above. The new_dst_cpu is chosen from the env->dst_grpmask. Currently it contains CPUs in sched_group_span() and if we have overlapped groups it's possible to run into this case. This patch makes env->dst_grpmask of group_balance_mask() which exclude any CPUs from the busiest group and solve the issue. For balancing in a domain with no overlapped groups the behaviour keeps same as before.
(CVE-2023-53215)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53215
https://ubuntu.com/security/CVE-2023-53215

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53215

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264926 - Linux Distros Unpatched Vulnerability : CVE-2023-53225
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- spi: imx: Don't skip cleanup in remove's error path Returning early in a platform driver's remove callback is wrong. In this case the dma resources are not released in the error path. this is never retried later and so this is a permanent leak. To fix this, only skip hardware disabling if waking the device fails.
(CVE-2023-53225)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53225
https://ubuntu.com/security/CVE-2023-53225

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53225

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264938 - Linux Distros Unpatched Vulnerability : CVE-2023-53233
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/smc: fix deadlock triggered by cancel_delayed_work_syn() The following LOCKDEP was detected: Workqueue: events smc_lgr_free_work [smc] WARNING: possible circular locking dependency detected 6.1.0-20221027.rc2.git8.56bc5b569087.300.fc36.s390x+debug #1 Not tainted
------------------------------------------------------ kworker/3:0/176251 is trying to acquire lock:
00000000f1467148 ((wq_completion)smc_tx_wq-00000000#2){+.+.}-{0:0}, at: __flush_workqueue+0x7a/0x4f0 but task is already holding lock: 0000037fffe97dc8 ((work_completion)(&(&lgr->free_work)->work)){+.+.}-{0:0}, at: process_one_work+0x232/0x730 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #4 ((work_completion)(&(&lgr->free_work)->work)){+.+.}-{0:0}:
__lock_acquire+0x58e/0xbd8 lock_acquire.part.0+0xe2/0x248 lock_acquire+0xac/0x1c8 __flush_work+0x76/0xf0
__cancel_work_timer+0x170/0x220 __smc_lgr_terminate.part.0+0x34/0x1c0 [smc] smc_connect_rdma+0x15e/0x418 [smc] __smc_connect+0x234/0x480 [smc] smc_connect+0x1d6/0x230 [smc] __sys_connect+0x90/0xc0
__do_sys_socketcall+0x186/0x370 __do_syscall+0x1da/0x208 system_call+0x82/0xb0 -> #3 (smc_client_lgr_pending){+.+.}-{3:3}: __lock_acquire+0x58e/0xbd8 lock_acquire.part.0+0xe2/0x248 lock_acquire+0xac/0x1c8 __mutex_lock+0x96/0x8e8 mutex_lock_nested+0x32/0x40 smc_connect_rdma+0xa4/0x418 [smc] __smc_connect+0x234/0x480 [smc] smc_connect+0x1d6/0x230 [smc] __sys_connect+0x90/0xc0
__do_sys_socketcall+0x186/0x370 __do_syscall+0x1da/0x208 system_call+0x82/0xb0 -> #2 (sk_lock- AF_SMC){+.+.}-{0:0}: __lock_acquire+0x58e/0xbd8 lock_acquire.part.0+0xe2/0x248 lock_acquire+0xac/0x1c8 lock_sock_nested+0x46/0xa8 smc_tx_work+0x34/0x50 [smc] process_one_work+0x30c/0x730 worker_thread+0x62/0x420 kthread+0x138/0x150 __ret_from_fork+0x3c/0x58 ret_from_fork+0xa/0x40 -> #1 ((work_completion)(&(&smc->conn.tx_work)->work)){+.+.}-{0:0}: __lock_acquire+0x58e/0xbd8 lock_acquire.part.0+0xe2/0x248 lock_acquire+0xac/0x1c8 process_one_work+0x2bc/0x730 worker_thread+0x62/0x420 kthread+0x138/0x150 __ret_from_fork+0x3c/0x58 ret_from_fork+0xa/0x40 -> #0 ((wq_completion)smc_tx_wq-00000000#2){+.+.}-{0:0}: check_prev_add+0xd8/0xe88 validate_chain+0x70c/0xb20
__lock_acquire+0x58e/0xbd8 lock_acquire.part.0+0xe2/0x248 lock_acquire+0xac/0x1c8
__flush_workqueue+0xaa/0x4f0 drain_workqueue+0xaa/0x158 destroy_workqueue+0x44/0x2d8 smc_lgr_free+0x9e/0xf8 [smc] process_one_work+0x30c/0x730 worker_thread+0x62/0x420 kthread+0x138/0x150
__ret_from_fork+0x3c/0x58 ret_from_fork+0xa/0x40 other info that might help us debug this: Chain exists of: (wq_completion)smc_tx_wq-00000000#2 --> smc_client_lgr_pending -->
(work_completion)(&(&lgr->free_work)->work) Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock((work_completion)(&(&lgr->free_work)->work)); lock(smc_client_lgr_pending); lock((work_completion) (&(&lgr->free_work)->work)); lock((wq_completion)smc_tx_wq-00000000#2); *** DEADLOCK *** 2 locks held by kworker/3:0/176251: #0: 0000000080183548 ((wq_completion)events){+.+.}-{0:0}, at:
process_one_work+0x232/0x730 #1: 0000037fffe97dc8 ((work_completion) (&(&lgr->free_work)->work)){+.+.}-{0:0}, at: process_one_work+0x232/0x730 stack backtr ---truncated--- (CVE-2023-53233)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53233
https://ubuntu.com/security/CVE-2023-53233

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53233

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265029 - Linux Distros Unpatched Vulnerability : CVE-2023-53234
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- watchdog: Fix kmemleak in watchdog_cdev_register kmemleak reports memory leaks in watchdog_dev_register, as follows: unreferenced object 0xffff888116233000 (size 2048): comm modprobe, pid 28147, jiffies 4353426116 (age 61.741s) hex dump (first 32 bytes): 80 fa b9 05 81 88 ff ff 08 30 23 16 81 88 ff ff .........0#..... 08 30 23 16 81 88 ff ff 00 00 00 00 00 00 00 00 .0#............. backtrace:
[<000000007f001ffd>] __kmem_cache_alloc_node+0x157/0x220 [<000000006a389304>] kmalloc_trace+0x21/0x110 [<000000008d640eea>] watchdog_dev_register+0x4e/0x780 [watchdog] [<0000000053c9f248>]
__watchdog_register_device+0x4f0/0x680 [watchdog] [<00000000b2979824>] watchdog_register_device+0xd2/0x110 [watchdog] [<000000001f730178>] 0xffffffffc10880ae [<000000007a1a8bcc>] do_one_initcall+0xcb/0x4d0 [<00000000b98be325>] do_init_module+0x1ca/0x5f0 [<0000000046d08e7c>] load_module+0x6133/0x70f0 ...
unreferenced object 0xffff888105b9fa80 (size 16): comm modprobe, pid 28147, jiffies 4353426116 (age 61.741s) hex dump (first 16 bytes): 77 61 74 63 68 64 6f 67 31 00 b9 05 81 88 ff ff watchdog1.......
backtrace: [<000000007f001ffd>] __kmem_cache_alloc_node+0x157/0x220 [<00000000486ab89b>]
__kmalloc_node_track_caller+0x44/0x1b0 [<000000005a39aab0>] kvasprintf+0xb5/0x140 [<0000000024806f85>] kvasprintf_const+0x55/0x180 [<000000009276cb7f>] kobject_set_name_vargs+0x56/0x150 [<00000000a92e820b>] dev_set_name+0xab/0xe0 [<00000000cec812c6>] watchdog_dev_register+0x285/0x780 [watchdog] [<0000000053c9f248>] __watchdog_register_device+0x4f0/0x680 [watchdog] [<00000000b2979824>] watchdog_register_device+0xd2/0x110 [watchdog] [<000000001f730178>] 0xffffffffc10880ae [<000000007a1a8bcc>] do_one_initcall+0xcb/0x4d0 [<00000000b98be325>] do_init_module+0x1ca/0x5f0 [<0000000046d08e7c>] load_module+0x6133/0x70f0 ... The reason is that put_device is not be called if cdev_device_add fails and wdd->id != 0. watchdog_cdev_register wd_data = kzalloc [1] err = dev_set_name [2] .. err = cdev_device_add if (err) { if (wdd->id == 0) { // wdd->id != 0 .. } return err; // [1],[2] would be leaked To fix it, call put_device in all wdd->id cases. (CVE-2023-53234)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53234
https://ubuntu.com/security/CVE-2023-53234

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53234

Plugin Information
Published: 2025/09/16, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265036 - Linux Distros Unpatched Vulnerability : CVE-2023-53240
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xsk: check IFF_UP earlier in Tx path Xsk Tx can be triggered via either sendmsg() or poll() syscalls.
These two paths share a call to common function xsk_xmit() which has two sanity checks within. A pseudo code example to show the two paths: __xsk_sendmsg() : xsk_poll(): if (unlikely(!xsk_is_bound(xs))) if (unlikely(!xsk_is_bound(xs))) return -ENXIO; return mask; if (unlikely(need_wait)) (...) return
-EOPNOTSUPP; xsk_xmit() mark napi id (...) xsk_xmit() xsk_xmit(): if (unlikely(!(xs->dev->flags &
IFF_UP))) return -ENETDOWN; if (unlikely(!xs->tx)) return -ENOBUFS; As it can be observed above, in sendmsg() napi id can be marked on interface that was not brought up and this causes a NULL ptr dereference: [31757.505631] BUG: kernel NULL pointer dereference, address: 0000000000000018 [31757.512710] #PF: supervisor read access in kernel mode [31757.517936] #PF: error_code(0x0000) - not-present page [31757.523149] PGD 0 P4D 0 [31757.525726] Oops: 0000 [#1] PREEMPT SMP NOPTI [31757.530154] CPU: 26 PID:
95641 Comm: xdpsock Not tainted 6.2.0-rc5+ #40 [31757.536871] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [31757.547457] RIP:
0010:xsk_sendmsg+0xde/0x180 [31757.551799] Code: 00 75 a2 48 8b 00 a8 04 75 9b 84 d2 74 69 8b 85 14 01 00 00 85 c0 75 1b 48 8b 85 28 03 00 00 48 8b 80 98 00 00 00 48 8b 40 20 <8b> 40 18 89 85 14 01 00 00 8b bd 14 01 00 00 81 ff 00 01 00 00 0f [31757.570840] RSP: 0018:ffffc90034f27dc0 EFLAGS: 00010246 [31757.576143] RAX: 0000000000000000 RBX: ffffc90034f27e18 RCX: 0000000000000000 [31757.583389] RDX: 0000000000000001 RSI: ffffc90034f27e18 RDI: ffff88984cf3c100 [31757.590631] RBP: ffff88984714a800 R08: ffff88984714a800 R09: 0000000000000000 [31757.597877] R10: 0000000000000001 R11: 0000000000000000 R12: 00000000fffffffa [31757.605123] R13: 0000000000000000 R14: 0000000000000003 R15: 0000000000000000 [31757.612364] FS:
00007fb4c5931180(0000) GS:ffff88afdfa00000(0000) knlGS:0000000000000000 [31757.620571] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [31757.626406] CR2: 0000000000000018 CR3: 000000184b41c003 CR4:
00000000007706e0 [31757.633648] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [31757.640894] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [31757.648139] PKRU:
55555554 [31757.650894] Call Trace: [31757.653385] <TASK> [31757.655524] sock_sendmsg+0x8f/0xa0 [31757.659077] ? sockfd_lookup_light+0x12/0x70 [31757.663416] __sys_sendto+0xfc/0x170 [31757.667051] ? do_sched_setscheduler+0xdb/0x1b0 [31757.671658] __x64_sys_sendto+0x20/0x30 [31757.675557] do_syscall_64+0x38/0x90 [31757.679197] entry_SYSCALL_64_after_hwframe+0x72/0xdc [31757.687969] Code: 8e f6 ff 44 8b 4c 24 2c 4c 8b 44 24 20 41 89 c4 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 3a 44 89 e7 48 89 44 24 08 e8 b5 8e f6 ff 48 [31757.707007] RSP:
002b:00007ffd49c73c70 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [31757.714694] RAX: ffffffffffffffda RBX: 000055a996565380 RCX: 00007fb4c5727c16 [31757.721939] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [31757.729184] RBP: 0000000000000040 R08: 0000000000000000 R09: 0000000000000000 [31757.736429] R10: 0000000000000040 R11: 0000000000000293 R12: 0000000000000000 [31757.743673] R13:
0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [31757.754940] </TASK> To fix this, let's make xsk_xmit a function that will be responsible for generic Tx, where RCU is handled accordingly and pull out sanity checks and xs->zc handling. Populate sanity checks to __xsk_sendmsg() and xsk_poll().
(CVE-2023-53240)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53240
https://ubuntu.com/security/CVE-2023-53240

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53240

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264997 - Linux Distros Unpatched Vulnerability : CVE-2023-53242
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/hisi: Drop second sensor hi3660 The commit 74c8e6bffbe1 (driver core: Add __alloc_size hint to devm allocators) exposes a panic BRK handler: Fatal exception on the hi3660_thermal_probe funciton. This is because the function allocates memory for only one sensors array entry, but tries to fill up a second one. Fix this by removing the unneeded second access. (CVE-2023-53242)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53242
https://ubuntu.com/security/CVE-2023-53242

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53242

Plugin Information
Published: 2025/09/16, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264909 - Linux Distros Unpatched Vulnerability : CVE-2023-53245
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: storvsc: Fix handling of virtual Fibre Channel timeouts Hyper-V provides the ability to connect Fibre Channel LUNs to the host system and present them in a guest VM as a SCSI device. I/O to the vFC device is handled by the storvsc driver. The storvsc driver includes a partial integration with the FC transport implemented in the generic portion of the Linux SCSI subsystem so that FC attributes can be displayed in /sys. However, the partial integration means that some aspects of vFC don't work properly.
Unfortunately, a full and correct integration isn't practical because of limitations in what Hyper-V provides to the guest. In particular, in the context of Hyper-V storvsc, the FC transport timeout function fc_eh_timed_out() causes a kernel panic because it can't find the rport and dereferences a NULL pointer.
The original patch that added the call from storvsc_eh_timed_out() to fc_eh_timed_out() is faulty in this regard. In many cases a timeout is due to a transient condition, so the situation can be improved by just continuing to wait like with other I/O requests issued by storvsc, and avoiding the guaranteed panic. For a permanent failure, continuing to wait may result in a hung thread instead of a panic, which again may be better. So fix the panic by removing the storvsc call to fc_eh_timed_out(). This allows storvsc to keep waiting for a response. The change has been tested by users who experienced a panic in fc_eh_timed_out() due to transient timeouts, and it solves their problem. In the future we may want to deprecate the vFC functionality in storvsc since it can't be fully fixed. But it has current users for whom it is working well enough, so it should probably stay for a while longer. (CVE-2023-53245)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53245
https://ubuntu.com/security/CVE-2023-53245

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53245

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265020 - Linux Distros Unpatched Vulnerability : CVE-2023-53246
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL When compiled with CONFIG_CIFS_DFS_UPCALL disabled, cifs_dfs_d_automount is NULL. cifs.ko logic for mapping CIFS_FATTR_DFS_REFERRAL attributes to S_AUTOMOUNT and corresponding dentry flags is retained regardless of CONFIG_CIFS_DFS_UPCALL, leading to a NULL pointer dereference in VFS follow_automount() when traversing a DFS referral link: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... Call Trace: <TASK> __traverse_mounts+0xb5/0x220 ? cifs_revalidate_mapping+0x65/0xc0 [cifs] step_into+0x195/0x610 ? lookup_fast+0xe2/0xf0 path_lookupat+0x64/0x140 filename_lookup+0xc2/0x140 ? __create_object+0x299/0x380 ? kmem_cache_alloc+0x119/0x220 ? user_path_at_empty+0x31/0x50 user_path_at_empty+0x31/0x50
__x64_sys_chdir+0x2a/0xd0 ? exit_to_user_mode_prepare+0xca/0x100 do_syscall_64+0x42/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc This fix adds an inline cifs_dfs_d_automount() {return -EREMOTE} handler when CONFIG_CIFS_DFS_UPCALL is disabled. An alternative would be to avoid flagging S_AUTOMOUNT, etc. without CONFIG_CIFS_DFS_UPCALL. This approach was chosen as it provides more control over the error path. (CVE-2023-53246)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53246
https://ubuntu.com/security/CVE-2023-53246

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53246

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264989 - Linux Distros Unpatched Vulnerability : CVE-2023-53250
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle KASAN reported a null-ptr-deref error: KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 1373 Comm:
modprobe Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:dmi_sysfs_entry_release ... Call Trace: <TASK> kobject_put dmi_sysfs_register_handle (drivers/firmware/dmi-sysfs.c:540) dmi_sysfs dmi_decode_table (drivers/firmware/dmi_scan.c:133) dmi_walk (drivers/firmware/dmi_scan.c:1115) dmi_sysfs_init (drivers/firmware/dmi-sysfs.c:149) dmi_sysfs do_one_initcall (init/main.c:1296) ... Kernel panic - not syncing: Fatal exception Kernel Offset: 0x4000000 from 0xffffffff81000000 ---[ end Kernel panic - not syncing: Fatal exception ]--- It is because previous patch added kobject_put() to release the memory which will call dmi_sysfs_entry_release() and list_del(). However, list_add_tail(entry->list) is called after the error block, so the list_head is uninitialized and cannot be deleted. Move error handling to after list_add_tail to fix this. (CVE-2023-53250)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53250
https://security-tracker.debian.org/tracker/CVE-2023-53250
https://ubuntu.com/security/CVE-2023-53250

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53250

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264961 - Linux Distros Unpatched Vulnerability : CVE-2023-53251
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: fix NULL pointer dereference in iwl_pcie_irq_rx_msix_handler() rxq can be NULL only when trans_pcie->rxq is NULL and entry->entry is zero. For the case when entry->entry is not equal to 0, rxq won't be NULL even if trans_pcie->rxq is NULL. Modify checker to check for trans_pcie->rxq. (CVE-2023-53251)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53251
https://ubuntu.com/security/CVE-2023-53251

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53251

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264987 - Linux Distros Unpatched Vulnerability : CVE-2023-53256
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix FFA device names for logical partitions Each physical partition can provide multiple services each with UUID. Each such service can be presented as logical partition with a unique combination of VM ID and UUID. The number of distinct UUID in a system will be less than or equal to the number of logical partitions. However, currently it fails to register more than one logical partition or service within a physical partition as the device name contains only VM ID while both VM ID and UUID are maintained in the partition information.
The kernel complains with the below message: | sysfs: cannot create duplicate filename '/devices/arm- ffa-8001' | CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.3.0-rc7 #8 | Hardware name: FVP Base RevC (DT) | Call trace: | dump_backtrace+0xf8/0x118 | show_stack+0x18/0x24 | dump_stack_lvl+0x50/0x68 | dump_stack+0x18/0x24 | sysfs_create_dir_ns+0xe0/0x13c | kobject_add_internal+0x220/0x3d4 | kobject_add+0x94/0x100 | device_add+0x144/0x5d8 | device_register+0x20/0x30 | ffa_device_register+0x88/0xd8 | ffa_setup_partitions+0x108/0x1b8 | ffa_init+0x2ec/0x3a4 | do_one_initcall+0xcc/0x240 | do_initcall_level+0x8c/0xac | do_initcalls+0x54/0x94 | do_basic_setup+0x1c/0x28 | kernel_init_freeable+0x100/0x16c | kernel_init+0x20/0x1a0 | ret_from_fork+0x10/0x20 | kobject_add_internal failed for arm-ffa-8001 with -EEXIST, don't try to | register things with the same name in the same directory. | arm_ffa arm-ffa: unable to register device arm-ffa-8001 err=-17 | ARM FF-A: ffa_setup_partitions: failed to register partition ID 0x8001 By virtue of being random enough to avoid collisions when generated in a distributed system, there is no way to compress UUID keys to the number of bits required to identify each. We can eliminate '-' in the name but it is not worth eliminating 4 bytes and add unnecessary logic for doing that. Also v1.0 doesn't provide the UUID of the partitions which makes it hard to use the same for the device name. So to keep it simple, let us alloc an ID using ida_alloc() and append the same to arm-ffa to make up a unique device name.
Also stash the id value in ffa_dev to help freeing the ID later when the device is destroyed.
(CVE-2023-53256)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53256
https://ubuntu.com/security/CVE-2023-53256

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53256

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265033 - Linux Distros Unpatched Vulnerability : CVE-2023-53259
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF The call to get_user_pages_fast() in vmci_host_setup_notify() can return NULL context->notify_page causing a GPF. To avoid GPF check if context->notify_page == NULL and return error if so. general protection fault, probably for non-canonical address 0xe0009d1000000060: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: maybe wild-memory- access in range [0x0005088000000300- 0x0005088000000307] CPU: 2 PID: 26180 Comm: repro_34802241 Not tainted 6.1.0-rc4 #1 Hardware name: Red Hat KVM, BIOS 1.15.0-2.module+el8.6.0 04/01/2014 RIP:
0010:vmci_ctx_check_signal_notify+0x91/0xe0 Call Trace: <TASK> vmci_host_unlocked_ioctl+0x362/0x1f40
__x64_sys_ioctl+0x1a1/0x230 do_syscall_64+0x3a/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd (CVE-2023-53259)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53259
https://ubuntu.com/security/CVE-2023-53259

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53259

Plugin Information
Published: 2025/09/16, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265181 - Linux Distros Unpatched Vulnerability : CVE-2023-53268
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl_mqs: move of_node_put() to the correct location of_node_put() should have been done directly after mqs_priv->regmap = syscon_node_to_regmap(gpr_np); otherwise it creates a reference leak on the success path. To fix this, of_node_put() is moved to the correct location, and change all the gotos to direct returns.
(CVE-2023-53268)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53268
https://ubuntu.com/security/CVE-2023-53268

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53268

Plugin Information
Published: 2025/09/17, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265233 - Linux Distros Unpatched Vulnerability : CVE-2023-53271
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() There is a memory leaks problem reported by kmemleak: unreferenced object 0xffff888102007a00 (size 128): comm ubirsvol, pid 32090, jiffies 4298464136 (age 2361.231s) hex dump (first 32 bytes): ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ backtrace:
[<ffffffff8176cecd>] __kmalloc+0x4d/0x150 [<ffffffffa02a9a36>] ubi_eba_create_table+0x76/0x170 [ubi] [<ffffffffa029764e>] ubi_resize_volume+0x1be/0xbc0 [ubi] [<ffffffffa02a3321>] ubi_cdev_ioctl+0x701/0x1850 [ubi] [<ffffffff81975d2d>] __x64_sys_ioctl+0x11d/0x170 [<ffffffff83c142a5>] do_syscall_64+0x35/0x80 [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 This is due to a mismatch between create and destroy interfaces, and in detail that new_eba_tbl created by ubi_eba_create_table() but destroyed by kfree(), while will causing new_eba_tbl->entries not freed. Fix it by replacing kfree(new_eba_tbl) with ubi_eba_destroy_table(new_eba_tbl) (CVE-2023-53271)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53271
https://ubuntu.com/security/CVE-2023-53271

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53271

Plugin Information
Published: 2025/09/17, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265260 - Linux Distros Unpatched Vulnerability : CVE-2023-53272
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: ena: fix shift-out-of-bounds in exponential backoff The ENA adapters on our instances occasionally reset. Once recently logged a UBSAN failure to console in the process: UBSAN: shift-out-of-bounds in build/linux/drivers/net/ethernet/amazon/ena/ena_com.c:540:13 shift exponent 32 is too large for 32-bit type 'unsigned int' CPU: 28 PID: 70012 Comm: kworker/u72:2 Kdump: loaded not tainted 5.15.117 Hardware name: Amazon EC2 c5d.9xlarge/, BIOS 1.0 10/16/2017 Workqueue: ena ena_fw_reset_device [ena] Call Trace:
<TASK> dump_stack_lvl+0x4a/0x63 dump_stack+0x10/0x16 ubsan_epilogue+0x9/0x36
__ubsan_handle_shift_out_of_bounds.cold+0x61/0x10e ? __const_udelay+0x43/0x50 ena_delay_exponential_backoff_us.cold+0x16/0x1e [ena] wait_for_reset_state+0x54/0xa0 [ena] ena_com_dev_reset+0xc8/0x110 [ena] ena_down+0x3fe/0x480 [ena] ena_destroy_device+0xeb/0xf0 [ena] ena_fw_reset_device+0x30/0x50 [ena] process_one_work+0x22b/0x3d0 worker_thread+0x4d/0x3f0 ? process_one_work+0x3d0/0x3d0 kthread+0x12a/0x150 ? set_kthread_struct+0x50/0x50 ret_from_fork+0x22/0x30 </TASK> Apparently, the reset delays are getting so large they can trigger a UBSAN panic. Looking at the code, the current timeout is capped at 5000us. Using a base value of 100us, the current code will overflow after (1<<29). Even at values before 32, this function wraps around, perhaps unintentionally. Cap the value of the exponent used for this backoff at (1<<16) which is larger than currently necessary, but large enough to support bigger values in the future. (CVE-2023-53272)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53272
https://ubuntu.com/security/CVE-2023-53272

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53272

Plugin Information
Published: 2025/09/17, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265157 - Linux Distros Unpatched Vulnerability : CVE-2023-53277
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: iwl3945: Add missing check for create_singlethread_workqueue Add the check for the return value of the create_singlethread_workqueue in order to avoid NULL pointer dereference. (CVE-2023-53277)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53277
https://ubuntu.com/security/CVE-2023-53277

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53277

Plugin Information
Published: 2025/09/17, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265251 - Linux Distros Unpatched Vulnerability : CVE-2023-53279
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- misc: vmw_balloon: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. (CVE-2023-53279)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53279
https://security-tracker.debian.org/tracker/CVE-2023-53279
https://ubuntu.com/security/CVE-2023-53279

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53279

Plugin Information
Published: 2025/09/17, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265168 - Linux Distros Unpatched Vulnerability : CVE-2023-53287
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: cdns3: Put the cdns set active part outside the spin lock The device may be scheduled during the resume process, so this cannot appear in atomic operations. Since pm_runtime_set_active will resume suppliers, put set active outside the spin lock, which is only used to protect the struct cdns data structure, otherwise the kernel will report the following warning: BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:1163 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 651, name: sh preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 CPU: 0 PID: 651 Comm: sh Tainted: G WC 6.1.20 #1 Hardware name: Freescale i.MX8QM MEK (DT) Call trace:
dump_backtrace.part.0+0xe0/0xf0 show_stack+0x18/0x30 dump_stack_lvl+0x64/0x80 dump_stack+0x1c/0x38
__might_resched+0x1fc/0x240 __might_sleep+0x68/0xc0 __pm_runtime_resume+0x9c/0xe0 rpm_get_suppliers+0x68/0x1b0 __pm_runtime_set_status+0x298/0x560 cdns_resume+0xb0/0x1c0 cdns3_controller_resume.isra.0+0x1e0/0x250 cdns3_plat_resume+0x28/0x40 (CVE-2023-53287)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53287
https://security-tracker.debian.org/tracker/CVE-2023-53287
https://ubuntu.com/security/CVE-2023-53287

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53287

Plugin Information
Published: 2025/09/17, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265192 - Linux Distros Unpatched Vulnerability : CVE-2023-53295
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- udf: Do not update file length for failed writes to inline files When write to inline file fails (or happens only partly), we still updated length of inline data as if the whole write succeeded. Fix the update of length of inline data to happen only if the write succeeds. (CVE-2023-53295)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53295
https://ubuntu.com/security/CVE-2023-53295

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53295

Plugin Information
Published: 2025/09/17, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265656 - Linux Distros Unpatched Vulnerability : CVE-2023-53302
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: iwl4965: Add missing check for create_singlethread_workqueue() Add the check for the return value of the create_singlethread_workqueue() in order to avoid NULL pointer dereference. (CVE-2023-53302)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53302
https://ubuntu.com/security/CVE-2023-53302

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53302

Plugin Information
Published: 2025/09/20, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265293 - Linux Distros Unpatched Vulnerability : CVE-2023-53319
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle kvm_arm_init failure correctly in finalize_pkvm Currently there is no synchronisation between finalize_pkvm() and kvm_arm_init() initcalls. The finalize_pkvm() proceeds happily even if kvm_arm_init() fails resulting in the following warning on all the CPUs and eventually a HYP panic: | kvm [1]: IPA Size Limit: 48 bits | kvm [1]: Failed to init hyp memory protection | kvm [1]: error initializing Hyp mode: -22 | | <snip> | | WARNING: CPU: 0 PID: 0 at arch/arm64/kvm/pkvm.c:226 _kvm_host_prot_finalize+0x30/0x50 | Modules linked in:
| CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0 #237 | Hardware name: FVP Base RevC (DT) | pstate:
634020c5 (nZCv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--) | pc : _kvm_host_prot_finalize+0x30/0x50 | lr :
__flush_smp_call_function_queue+0xd8/0x230 | | Call trace: | _kvm_host_prot_finalize+0x3c/0x50 | on_each_cpu_cond_mask+0x3c/0x6c | pkvm_drop_host_privileges+0x4c/0x78 | finalize_pkvm+0x3c/0x5c | do_one_initcall+0xcc/0x240 | do_initcall_level+0x8c/0xac | do_initcalls+0x54/0x94 | do_basic_setup+0x1c/0x28 | kernel_init_freeable+0x100/0x16c | kernel_init+0x20/0x1a0 | ret_from_fork+0x10/0x20 | Failed to finalize Hyp protection: -22 | dtb=fvp-base-revc.dtb | kvm [95]: nVHE hyp BUG at: arch/arm64/kvm/hyp/nvhe/mem_protect.c:540! | kvm [95]: nVHE call trace: | kvm [95]:
[<ffff800081052984>] __kvm_nvhe_hyp_panic+0xac/0xf8 | kvm [95]: [<ffff800081059644>]
__kvm_nvhe_handle_host_mem_abort+0x1a0/0x2ac | kvm [95]: [<ffff80008105511c>]
__kvm_nvhe_handle_trap+0x4c/0x160 | kvm [95]: [<ffff8000810540fc>] __kvm_nvhe___skip_pauth_save+0x4/0x4 | kvm [95]: ---[ end nVHE call trace ]--- | kvm [95]: Hyp Offset: 0xfffe8db00ffa0000 | Kernel panic - not syncing: HYP panic: | PS:a34023c9 PC:0000f250710b973c ESR:00000000f2000800 | FAR:ffff000800cb00d0 HPFAR:000000000880cb00 PAR:0000000000000000 | VCPU:0000000000000000 | CPU: 3 PID: 95 Comm: kworker/u16:2 Tainted: G W 6.4.0 #237 | Hardware name: FVP Base RevC (DT) | Workqueue: rpciod rpc_async_schedule | Call trace: | dump_backtrace+0xec/0x108 | show_stack+0x18/0x2c | dump_stack_lvl+0x50/0x68 | dump_stack+0x18/0x24 | panic+0x138/0x33c | nvhe_hyp_panic_handler+0x100/0x184 | new_slab+0x23c/0x54c |
___slab_alloc+0x3e4/0x770 | kmem_cache_alloc_node+0x1f0/0x278 | __alloc_skb+0xdc/0x294 | tcp_stream_alloc_skb+0x2c/0xf0 | tcp_sendmsg_locked+0x3d0/0xda4 | tcp_sendmsg+0x38/0x5c | inet_sendmsg+0x44/0x60 | sock_sendmsg+0x1c/0x34 | xprt_sock_sendmsg+0xdc/0x274 | xs_tcp_send_request+0x1ac/0x28c | xprt_transmit+0xcc/0x300 | call_transmit+0x78/0x90 |
__rpc_execute+0x114/0x3d8 | rpc_async_schedule+0x28/0x48 | process_one_work+0x1d8/0x314 | worker_thread+0x248/0x474 | kthread+0xfc/0x184 | ret_from_fork+0x10/0x20 | SMP: stopping secondary CPUs | Kernel Offset: 0x57c5cb460000 from 0xffff800080000000 | PHYS_OFFSET: 0x80000000 | CPU features:
0x00000000,1035b7a3,ccfe773f | Memory Limit: none | ---[ end Kernel panic - not syncing: HYP panic: | PS:a34023c9 PC:0000f250710b973c ESR:00000000f2000800 | FAR:ffff000800cb00d0 HPFAR:000000000880cb00 PAR:0000000000000000 | VCPU:0000000000000000 ]--- Fix it by checking for the successfull initialisation of kvm_arm_init() in finalize_pkvm() before proceeding any futher. (CVE-2023-53319)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53319
https://ubuntu.com/security/CVE-2023-53319

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-53319

Plugin Information
Published: 2025/09/17, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265299 - Linux Distros Unpatched Vulnerability : CVE-2023-53320
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info() The function mpi3mr_get_all_tgt_info() has four issues: 1) It calculates valid entry length in alltgt_info assuming the header part of the struct mpi3mr_device_map_info would equal to sizeof(u32). The correct size is sizeof(u64). 2) When it calculates the valid entry length kern_entrylen, it excludes one entry by subtracting 1 from num_devices. 3) It copies num_device by calling memcpy(). Substitution is enough. 4) It does not specify the calculated length to sg_copy_from_buffer(). Instead, it specifies the payload length which is larger than the alltgt_info size. It causes BUG: KASAN: slab-out-of-bounds. Fix the issues by using the correct header size, removing the subtraction from num_devices, replacing the memcpy() with substitution and specifying the correct length to sg_copy_from_buffer(). (CVE-2023-53320)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53320
https://ubuntu.com/security/CVE-2023-53320

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53320

Plugin Information
Published: 2025/09/17, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265294 - Linux Distros Unpatched Vulnerability : CVE-2023-53326
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- powerpc: Don't try to copy PPR for task with NULL pt_regs powerpc sets up PF_KTHREAD and PF_IO_WORKER with a NULL pt_regs, which from my (arguably very short) checking is not commonly done for other archs. This is fine, except when PF_IO_WORKER's have been created and the task does something that causes a coredump to be generated. Then we get this crash: Kernel attempted to read user page (160) - exploit attempt? (uid:
1000) BUG: Kernel NULL pointer dereference on read at 0x00000160 Faulting instruction address:
0xc0000000000c3a60 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=32 NUMA pSeries Modules linked in: bochs drm_vram_helper drm_kms_helper xts binfmt_misc ecb ctr syscopyarea sysfillrect cbc sysimgblt drm_ttm_helper aes_generic ttm sg libaes evdev joydev virtio_balloon vmx_crypto gf128mul drm dm_mod fuse loop configfs drm_panel_orientation_quirks ip_tables x_tables autofs4 hid_generic usbhid hid xhci_pci xhci_hcd usbcore usb_common sd_mod CPU: 1 PID: 1982 Comm: ppc-crash Not tainted 6.3.0-rc2+ #88 Hardware name: IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1202 0xf000005 of:SLOF,HEAD hv:linux,kvm pSeries NIP: c0000000000c3a60 LR: c000000000039944 CTR: c0000000000398e0 REGS:
c0000000041833b0 TRAP: 0300 Not tainted (6.3.0-rc2+) MSR: 800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 88082828 XER: 200400f8 ... NIP memcpy_power7+0x200/0x7d0 LR ppr_get+0x64/0xb0 Call Trace: ppr_get+0x40/0xb0 (unreliable) __regset_get+0x180/0x1f0 regset_get_alloc+0x64/0x90 elf_core_dump+0xb98/0x1b60 do_coredump+0x1c34/0x24a0 get_signal+0x71c/0x1410 do_notify_resume+0x140/0x6f0 interrupt_exit_user_prepare_main+0x29c/0x320 interrupt_exit_user_prepare+0x6c/0xa0 interrupt_return_srr_user+0x8/0x138 Because ppr_get() is trying to copy from a PF_IO_WORKER with a NULL pt_regs. Check for a valid pt_regs in both ppc_get/ppr_set, and return an error if not set. The actual error value doesn't seem to be important here, so just pick
-EINVAL. [mpe: Trim oops in change log, add Fixes & Cc stable] (CVE-2023-53326)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53326
https://ubuntu.com/security/CVE-2023-53326

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53326

Plugin Information
Published: 2025/09/17, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265262 - Linux Distros Unpatched Vulnerability : CVE-2023-53332
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask() If ipi_send_{mask|single}() is called with an invalid interrupt number, all the local variables there will be NULL. ipi_send_verify() which is invoked from these functions does verify its 'data' parameter, resulting in a kernel oops in irq_data_get_affinity_mask() as the passed NULL pointer gets dereferenced. Add a missing NULL pointer check in ipi_send_verify()... Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. (CVE-2023-53332)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53332
https://security-tracker.debian.org/tracker/CVE-2023-53332
https://ubuntu.com/security/CVE-2023-53332

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53332

Plugin Information
Published: 2025/09/17, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265587 - Linux Distros Unpatched Vulnerability : CVE-2023-53345
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential data race in rxrpc_wait_to_be_connected() Inside the loop in rxrpc_wait_to_be_connected() it checks call->error to see if it should exit the loop without first checking the call state. This is probably safe as if call->error is set, the call is dead anyway, but we should probably wait for the call state to have been set to completion first, lest it cause surprise on the way out. Fix this by only accessing call->error if the call is complete. We don't actually need to access the error inside the loop as we'll do that after. This caused the following report: BUG: KCSAN: data-race in rxrpc_send_data / rxrpc_set_call_completion write to 0xffff888159cf3c50 of 4 bytes by task 25673 on cpu 1: rxrpc_set_call_completion+0x71/0x1c0 net/rxrpc/call_state.c:22 rxrpc_send_data_packet+0xba9/0x1650 net/rxrpc/output.c:479 rxrpc_transmit_one+0x1e/0x130 net/rxrpc/output.c:714 rxrpc_decant_prepared_tx net/rxrpc/call_event.c:326 [inline] rxrpc_transmit_some_data+0x496/0x600 net/rxrpc/call_event.c:350 rxrpc_input_call_event+0x564/0x1220 net/rxrpc/call_event.c:464 rxrpc_io_thread+0x307/0x1d80 net/rxrpc/io_thread.c:461 kthread+0x1ac/0x1e0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 read to 0xffff888159cf3c50 of 4 bytes by task 25672 on cpu 0:
rxrpc_send_data+0x29e/0x1950 net/rxrpc/sendmsg.c:296 rxrpc_do_sendmsg+0xb7a/0xc20 net/rxrpc/sendmsg.c:726 rxrpc_sendmsg+0x413/0x520 net/rxrpc/af_rxrpc.c:565 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] ____sys_sendmsg+0x375/0x4c0 net/socket.c:2501 ___sys_sendmsg net/socket.c:2555 [inline] __sys_sendmmsg+0x263/0x500 net/socket.c:2641 __do_sys_sendmmsg net/socket.c:2670 [inline] __se_sys_sendmmsg net/socket.c:2667 [inline] __x64_sys_sendmmsg+0x57/0x60 net/socket.c:2667 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x00000000 ->
0xffffffea (CVE-2023-53345)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53345
https://ubuntu.com/security/CVE-2023-53345

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.1
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-53345

Plugin Information
Published: 2025/09/20, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265618 - Linux Distros Unpatched Vulnerability : CVE-2023-53347
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mlx5: Handle pairing of E-switch via uplink un/load APIs In case user switch a device from switchdev mode to legacy mode, mlx5 first unpair the E-switch and afterwards unload the uplink vport. From the other hand, in case user remove or reload a device, mlx5 first unload the uplink vport and afterwards unpair the E-switch. The latter is causing a bug[1], hence, handle pairing of E-switch as part of uplink un/load APIs. [1] In case VF_LAG is used, every tc fdb flow is duplicated to the peer esw. However, the original esw keeps a pointer to this duplicated flow, not the peer esw. e.g.: if user create tc fdb flow over esw0, the flow is duplicated over esw1, in FW/HW, but in SW, esw0 keeps a pointer to the duplicated flow. During module unload while a peer tc fdb flow is still offloaded, in case the first device to be removed is the peer device (esw1 in the example above), the peer net-dev is destroyed, and so the mlx5e_priv is memset to 0. Afterwards, the peer device is trying to unpair himself from the original device (esw0 in the example above). Unpair API invoke the original device to clear peer flow from its eswitch (esw0), but the peer flow, which is stored over the original eswitch (esw0), is trying to use the peer mlx5e_priv, which is memset to 0 and result in bellow kernel-oops. [ 157.964081 ] BUG: unable to handle page fault for address:
000000000002ce60 [ 157.964662 ] #PF: supervisor read access in kernel mode [ 157.965123 ] #PF:
error_code(0x0000) - not-present page [ 157.965582 ] PGD 0 P4D 0 [ 157.965866 ] Oops: 0000 [#1] SMP [ 157.967670 ] RIP: 0010:mlx5e_tc_del_fdb_flow+0x48/0x460 [mlx5_core] [ 157.976164 ] Call Trace: [ 157.976437 ] <TASK> [ 157.976690 ] __mlx5e_tc_del_fdb_peer_flow+0xe6/0x100 [mlx5_core] [ 157.977230 ] mlx5e_tc_clean_fdb_peer_flows+0x67/0x90 [mlx5_core] [ 157.977767 ] mlx5_esw_offloads_unpair+0x2d/0x1e0 [mlx5_core] [ 157.984653 ] mlx5_esw_offloads_devcom_event+0xbf/0x130 [mlx5_core] [ 157.985212 ] mlx5_devcom_send_event+0xa3/0xb0 [mlx5_core] [ 157.985714 ] esw_offloads_disable+0x5a/0x110 [mlx5_core] [ 157.986209 ] mlx5_eswitch_disable_locked+0x152/0x170 [mlx5_core] [ 157.986757 ] mlx5_eswitch_disable+0x51/0x80 [mlx5_core] [ 157.987248 ] mlx5_unload+0x2a/0xb0 [mlx5_core] [ 157.987678 ] mlx5_uninit_one+0x5f/0xd0 [mlx5_core] [ 157.988127 ] remove_one+0x64/0xe0 [mlx5_core] [ 157.988549 ] pci_device_remove+0x31/0xa0 [ 157.988933 ] device_release_driver_internal+0x18f/0x1f0 [ 157.989402 ] driver_detach+0x3f/0x80 [ 157.989754 ] bus_remove_driver+0x70/0xf0 [ 157.990129 ] pci_unregister_driver+0x34/0x90 [ 157.990537 ] mlx5_cleanup+0xc/0x1c [mlx5_core] [ 157.990972 ]
__x64_sys_delete_module+0x15a/0x250 [ 157.991398 ] ? exit_to_user_mode_prepare+0xea/0x110 [ 157.991840 ] do_syscall_64+0x3d/0x90 [ 157.992198 ] entry_SYSCALL_64_after_hwframe+0x46/0xb0 (CVE-2023-53347)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53347
https://security-tracker.debian.org/tracker/CVE-2023-53347
https://ubuntu.com/security/CVE-2023-53347

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.0 (CVSS2#AV:L/AC:M/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53347

Plugin Information
Published: 2025/09/20, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265665 - Linux Distros Unpatched Vulnerability : CVE-2023-53351
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/sched: Check scheduler work queue before calling timeout handling During an IGT GPU reset test we see again oops despite of commit 0c8c901aaaebc9 (drm/sched: Check scheduler ready before calling timeout handling). It uses ready condition whether to call drm_sched_fault which unwind the TDR leads to GPU reset. However it looks the ready condition is overloaded with other meanings, for example, for the following stack is related GPU reset : 0 gfx_v9_0_cp_gfx_start 1 gfx_v9_0_cp_gfx_resume 2 gfx_v9_0_cp_resume 3 gfx_v9_0_hw_init 4 gfx_v9_0_resume 5 amdgpu_device_ip_resume_phase2 does the following: /* start the ring */ gfx_v9_0_cp_gfx_start(adev);
ring->sched.ready = true; The same approach is for other ASICs as well : gfx_v8_0_cp_gfx_resume gfx_v10_0_kiq_resume, etc... As a result, our GPU reset test causes GPU fault which calls unconditionally gfx_v9_0_fault and then drm_sched_fault. However now it depends on whether the interrupt service routine drm_sched_fault is executed after gfx_v9_0_cp_gfx_start is completed which sets the ready field of the scheduler to true even for uninitialized schedulers and causes oops vs no fault or when ISR drm_sched_fault is completed prior gfx_v9_0_cp_gfx_start and NULL pointer dereference does not occur. Use the field timeout_wq to prevent oops for uninitialized schedulers. The field could be initialized by the work queue of resetting the domain. v1: Corrections to commit message (Luben) (CVE-2023-53351)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53351
https://ubuntu.com/security/CVE-2023-53351

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-53351

Plugin Information
Published: 2025/09/20, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265544 - Linux Distros Unpatched Vulnerability : CVE-2023-53375
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tracing: Free error logs of tracing instances When a tracing instance is removed, the error messages that hold errors that occurred in the instance needs to be freed. The following reports a memory leak: # cd /sys/kernel/tracing # mkdir instances/foo # echo 'hist:keys=x' > instances/foo/events/sched/sched_switch/trigger # cat instances/foo/error_log [ 117.404795] hist:sched:sched_switch: error: Couldn't find field Command:
hist:keys=x ^ # rmdir instances/foo Then check for memory leaks: # echo scan > /sys/kernel/debug/kmemleak # cat /sys/kernel/debug/kmemleak unreferenced object 0xffff88810d8ec700 (size 192): comm bash, pid 869, jiffies 4294950577 (age 215.752s) hex dump (first 32 bytes): 60 dd 68 61 81 88 ff ff 60 dd 68 61 81 88 ff ff `.ha....`.ha.... a0 30 8c 83 ff ff ff ff 26 00 0a 00 00 00 00 00 .0......&....... backtrace:
[<00000000dae26536>] kmalloc_trace+0x2a/0xa0 [<00000000b2938940>] tracing_log_err+0x277/0x2e0 [<000000004a0e1b07>] parse_atom+0x966/0xb40 [<0000000023b24337>] parse_expr+0x5f3/0xdb0 [<00000000594ad074>] event_hist_trigger_parse+0x27f8/0x3560 [<00000000293a9645>] trigger_process_regex+0x135/0x1a0 [<000000005c22b4f2>] event_trigger_write+0x87/0xf0 [<000000002cadc509>] vfs_write+0x162/0x670 [<0000000059c3b9be>] ksys_write+0xca/0x170 [<00000000f1cddc00>] do_syscall_64+0x3e/0xc0 [<00000000868ac68c>] entry_SYSCALL_64_after_hwframe+0x72/0xdc unreferenced object 0xffff888170c35a00 (size 32): comm bash, pid 869, jiffies 4294950577 (age 215.752s) hex dump (first 32 bytes): 0a 20 20 43 6f 6d 6d 61 6e 64 3a 20 68 69 73 74 . Command: hist 3a 6b 65 79 73 3d 78 0a 00 00 00 00 00 00 00 00 :keys=x......... backtrace: [<000000006a747de5>] __kmalloc+0x4d/0x160 [<000000000039df5f>] tracing_log_err+0x29b/0x2e0 [<000000004a0e1b07>] parse_atom+0x966/0xb40 [<0000000023b24337>] parse_expr+0x5f3/0xdb0 [<00000000594ad074>] event_hist_trigger_parse+0x27f8/0x3560 [<00000000293a9645>] trigger_process_regex+0x135/0x1a0 [<000000005c22b4f2>] event_trigger_write+0x87/0xf0 [<000000002cadc509>] vfs_write+0x162/0x670 [<0000000059c3b9be>] ksys_write+0xca/0x170 [<00000000f1cddc00>] do_syscall_64+0x3e/0xc0 [<00000000868ac68c>] entry_SYSCALL_64_after_hwframe+0x72/0xdc The problem is that the error log needs to be freed when the instance is removed. (CVE-2023-53375)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53375
https://ubuntu.com/security/CVE-2023-53375

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53375

Plugin Information
Published: 2025/09/19, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265599 - Linux Distros Unpatched Vulnerability : CVE-2023-53382
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/smc: Reset connection when trying to use SMCRv2 fails. We found a crash when using SMCRv2 with 2 Mellanox ConnectX-4. It can be reproduced by: - smc_run nginx - smc_run wrk -t 32 -c 500 -d 30 http://<ip>:<port> BUG: kernel NULL pointer dereference, address: 0000000000000014 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 8000000108713067 P4D 8000000108713067 PUD 151127067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 4 PID: 2441 Comm: kworker/4:249 Kdump: loaded Tainted: G W E 6.4.0-rc1+ #42 Workqueue: smc_hs_wq smc_listen_work [smc] RIP:
0010:smc_clc_send_confirm_accept+0x284/0x580 [smc] RSP: 0018:ffffb8294b2d7c78 EFLAGS: 00010a06 RAX:
ffff8f1873238880 RBX: ffffb8294b2d7dc8 RCX: 0000000000000000 RDX: 00000000000000b4 RSI: 0000000000000001 RDI: 0000000000b40c00 RBP: ffffb8294b2d7db8 R08: ffff8f1815c5860c R09: 0000000000000000 R10:
0000000000000400 R11: 0000000000000000 R12: ffff8f1846f56180 R13: ffff8f1815c5860c R14: 0000000000000001 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8f1aefd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000014 CR3: 00000001027a0001 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6:
00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? mlx5_ib_map_mr_sg+0xa1/0xd0 [mlx5_ib] ? smcr_buf_map_link+0x24b/0x290 [smc] ? __smc_buf_create+0x4ee/0x9b0 [smc] smc_clc_send_accept+0x4c/0xb0 [smc] smc_listen_work+0x346/0x650 [smc] ? __schedule+0x279/0x820 process_one_work+0x1e5/0x3f0 worker_thread+0x4d/0x2f0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe5/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 </TASK> During the CLC handshake, server sequentially tries available SMCRv2 and SMCRv1 devices in smc_listen_work(). If an SMCRv2 device is found. SMCv2 based link group and link will be assigned to the connection. Then assumed that some buffer assignment errors happen later in the CLC handshake, such as RMB registration failure, server will give up SMCRv2 and try SMCRv1 device instead. But the resources assigned to the connection won't be reset. When server tries SMCRv1 device, the connection creation process will be executed again. Since conn->lnk has been assigned when trying SMCRv2, it will not be set to the correct SMCRv1 link in smcr_lgr_conn_assign_link(). So in such situation, conn->lgr points to correct SMCRv1 link group but conn->lnk points to the SMCRv2 link mistakenly. Then in smc_clc_send_confirm_accept(), conn->rmb_desc->mr[link->link_idx] will be accessed. Since the link->link_idx is not correct, the related MR may not have been initialized, so crash happens. | Try SMCRv2 device first | |-> conn->lgr: assign existed SMCRv2 link group; | |-> conn->link: assign existed SMCRv2 link (link_idx may be 1 in SMC_LGR_SYMMETRIC); | |-> sndbuf & RMB creation fails, quit; | | Try SMCRv1 device then | |-> conn->lgr: create SMCRv1 link group and assign; | |-> conn->link: keep SMCRv2 link mistakenly; | |-> sndbuf & RMB creation succeed, only RMB->mr[link_idx = 0] | initialized. | | Then smc_clc_send_confirm_accept() accesses | conn->rmb_desc->mr[conn->link->link_idx, which is 1], then crash.
v This patch tries to fix this by cleaning conn->lnk before assigning link. In addition, it is better to reset the connection and clean the resources assigned if trying SMCRv2 failed in buffer creation or registration. (CVE-2023-53382)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53382
https://ubuntu.com/security/CVE-2023-53382

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.7 (CVSS2#AV:A/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53382

Plugin Information
Published: 2025/09/20, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265577 - Linux Distros Unpatched Vulnerability : CVE-2023-53387
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: ufs: core: Fix device management cmd timeout flow In the UFS error handling flow, the host will send a device management cmd (NOP OUT) to the device for link recovery. If this cmd times out and clearing the doorbell fails, ufshcd_wait_for_dev_cmd() will do nothing and return. hba->dev_cmd.complete struct is not set to NULL. When this happens, if cmd has been completed by device, then we will call complete() in
__ufshcd_transfer_req_compl(). Because the complete struct is allocated on the stack, the following crash will occur: ipanic_die+0x24/0x38 [mrdump] die+0x344/0x748 arm64_notify_die+0x44/0x104 do_debug_exception+0x104/0x1e0 el1_dbg+0x38/0x54 el1_sync_handler+0x40/0x88 el1_sync+0x8c/0x140 queued_spin_lock_slowpath+0x2e4/0x3c0 __ufshcd_transfer_req_compl+0x3b0/0x1164 ufshcd_trc_handler+0x15c/0x308 ufshcd_host_reset_and_restore+0x54/0x260 ufshcd_reset_and_restore+0x28c/0x57c ufshcd_err_handler+0xeb8/0x1b6c process_one_work+0x288/0x964 worker_thread+0x4bc/0xc7c kthread+0x15c/0x264 ret_from_fork+0x10/0x30 (CVE-2023-53387)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53387
https://security-tracker.debian.org/tracker/CVE-2023-53387
https://ubuntu.com/security/CVE-2023-53387

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53387

Plugin Information
Published: 2025/09/19, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265569 - Linux Distros Unpatched Vulnerability : CVE-2023-53411
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- PM: EM: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. (CVE-2023-53411)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53411
https://ubuntu.com/security/CVE-2023-53411

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53411

Plugin Information
Published: 2025/09/19, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265515 - Linux Distros Unpatched Vulnerability : CVE-2023-53419
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access For kernels built with CONFIG_PREEMPT_RCU=y, the following scenario can result in a NULL-pointer dereference: CPU1 CPU2 rcu_preempt_deferred_qs_irqrestore rcu_print_task_exp_stall if (special.b.blocked) READ_ONCE(rnp->exp_tasks) != NULL raw_spin_lock_rcu_node np = rcu_next_node_entry(t, rnp) if (&t->rcu_node_entry == rnp->exp_tasks) WRITE_ONCE(rnp->exp_tasks, np) ....
raw_spin_unlock_irqrestore_rcu_node raw_spin_lock_irqsave_rcu_node t = list_entry(rnp->exp_tasks->prev, struct task_struct, rcu_node_entry) (if rnp->exp_tasks is NULL, this will dereference a NULL pointer) The problem is that CPU2 accesses the rcu_node structure's->exp_tasks field without holding the rcu_node structure's ->lock and CPU2 did not observe CPU1's change to rcu_node structure's ->exp_tasks in time.
Therefore, if CPU1 sets rcu_node structure's->exp_tasks pointer to NULL, then CPU2 might dereference that NULL pointer. This commit therefore holds the rcu_node structure's ->lock while accessing that structure's->exp_tasks field. [ paulmck: Apply Frederic Weisbecker feedback. ] (CVE-2023-53419)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53419
https://ubuntu.com/security/CVE-2023-53419

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53419

Plugin Information
Published: 2025/09/19, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265518 - Linux Distros Unpatched Vulnerability : CVE-2023-53431
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: ses: Handle enclosure with just a primary component gracefully This reverts commit 3fe97ff3d949 (scsi: ses: Don't attach if enclosure has no components) and introduces proper handling of case where there are no detected secondary components, but primary component (enumerated in num_enclosures) does exist. That fix was originally proposed by Ding Hui <dinghui@sangfor.com.cn>. Completely ignoring devices that have one primary enclosure and no secondary one results in ses_intf_add() bailing completely scsi 2:0:0:254: enclosure has no enumerated components scsi 2:0:0:254: Failed to bind enclosure -12ven in valid configurations such even on valid configurations with 1 primary and 0 secondary enclosures as below: # sg_ses /dev/sg0 3PARdata SES 3321 Supported diagnostic pages: Supported Diagnostic Pages [sdp] [0x0] Configuration (SES) [cf] [0x1] Short Enclosure Status (SES) [ses] [0x8] # sg_ses -p cf /dev/sg0 3PARdata SES 3321 Configuration diagnostic page: number of secondary subenclosures: 0 generation code: 0x0 enclosure descriptor list Subenclosure identifier: 0 [primary] relative ES process id: 0, number of ES processes: 1 number of type descriptor headers: 1 enclosure logical identifier (hex): 20000002ac02068d enclosure vendor: 3PARdata product: VV rev: 3321 type descriptor header and text list Element type:
Unspecified, subenclosure id: 0 number of possible elements: 1 The changelog for the original fix follows ===== We can get a crash when disconnecting the iSCSI session, the call trace like this:
[ffff00002a00fb70] kfree at ffff00000830e224 [ffff00002a00fba0] ses_intf_remove at ffff000001f200e4 [ffff00002a00fbd0] device_del at ffff0000086b6a98 [ffff00002a00fc50] device_unregister at ffff0000086b6d58 [ffff00002a00fc70] __scsi_remove_device at ffff00000870608c [ffff00002a00fca0] scsi_remove_device at ffff000008706134 [ffff00002a00fcc0] __scsi_remove_target at ffff0000087062e4 [ffff00002a00fd10] scsi_remove_target at ffff0000087064c0 [ffff00002a00fd70] __iscsi_unbind_session at ffff000001c872c4 [ffff00002a00fdb0] process_one_work at ffff00000810f35c [ffff00002a00fe00] worker_thread at ffff00000810f648 [ffff00002a00fe70] kthread at ffff000008116e98 In ses_intf_add, components count could be 0, and kcalloc 0 size scomp, but not saved in edev->component[i].scratch In this situation, edev->component[0].scratch is an invalid pointer, when kfree it in ses_intf_remove_enclosure, a crash like above would happen The call trace also could be other random cases when kfree cannot catch the invalid pointer We should not use edev->component[] array when the components count is 0 We also need check index when use edev->component[] array in ses_enclosure_data_process ===== (CVE-2023-53431)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53431
https://ubuntu.com/security/CVE-2023-53431

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53431

Plugin Information
Published: 2025/09/19, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265520 - Linux Distros Unpatched Vulnerability : CVE-2023-53438
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- x86/MCE: Always save CS register on AMD Zen IF Poison errors The Instruction Fetch (IF) units on current AMD Zen-based systems do not guarantee a synchronous #MC is delivered for poison consumption errors.
Therefore, MCG_STATUS[EIPV|RIPV] will not be set. However, the microarchitecture does guarantee that the exception is delivered within the same context. In other words, the exact rIP is not known, but the context is known to not have changed. There is no architecturally-defined method to determine this behavior. The Code Segment (CS) register is always valid on such IF unit poison errors regardless of the value of MCG_STATUS[EIPV|RIPV]. Add a quirk to save the CS register for poison consumption from the IF unit banks. This is needed to properly determine the context of the error. Otherwise, the severity grading function will assume the context is IN_KERNEL due to the m->cs value being 0 (the initialized value). This leads to unnecessary kernel panics on data poison errors due to the kernel believing the poison consumption occurred in kernel context. (CVE-2023-53438)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53438
https://security-tracker.debian.org/tracker/CVE-2023-53438
https://ubuntu.com/security/CVE-2023-53438

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53438

Plugin Information
Published: 2025/09/19, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269588 - Linux Distros Unpatched Vulnerability : CVE-2023-53449
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix potential memleak in dasd_eckd_init() `dasd_reserve_req` is allocated before `dasd_vol_info_req`, and it also needs to be freed before the error returns, just like the other cases in this function. (CVE-2023-53449)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53449
https://ubuntu.com/security/CVE-2023-53449

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53449

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269536 - Linux Distros Unpatched Vulnerability : CVE-2023-53450
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: remove a BUG_ON in ext4_mb_release_group_pa() If a malicious fuzzer overwrites the ext4 superblock while it is mounted such that the s_first_data_block is set to a very large number, the calculation of the block group can underflow, and trigger a BUG_ON check. Change this to be an ext4_warning so that we don't crash the kernel. (CVE-2023-53450)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53450
https://ubuntu.com/security/CVE-2023-53450

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53450

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269521 - Linux Distros Unpatched Vulnerability : CVE-2023-53459
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: HID: mcp-2221: prevent UAF in delayed work If the device is plugged/unplugged without giving time for mcp_init_work() to complete, we might kick in the devm free code path and thus have unavailable struct mcp_2221 while in delayed work. Canceling the delayed_work item is enough to solve the issue, because cancel_delayed_work_sync will prevent the work item to requeue itself. (CVE-2023-53459)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53459
https://ubuntu.com/security/CVE-2023-53459

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53459

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269580 - Linux Distros Unpatched Vulnerability : CVE-2023-53460
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: rtw88: fix memory leak in rtw_usb_probe() drivers/net/wireless/realtek/rtw88/usb.c:876 rtw_usb_probe() warn: 'hw' from ieee80211_alloc_hw() not released on lines: 811 Fix this by modifying return to a goto statement. (CVE-2023-53460)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53460
https://security-tracker.debian.org/tracker/CVE-2023-53460
https://ubuntu.com/security/CVE-2023-53460

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53460

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269589 - Linux Distros Unpatched Vulnerability : CVE-2023-53461
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- io_uring: wait interruptibly for request completions on exit WHen the ring exits, cleanup is done and the final cancelation and waiting on completions is done by io_ring_exit_work. That function is invoked by kworker, which doesn't take any signals. Because of that, it doesn't really matter if we wait for completions in TASK_INTERRUPTIBLE or TASK_UNINTERRUPTIBLE state. However, it does matter to the hung task detection checker! Normally we expect cancelations and completions to happen rather quickly. Some test cases, however, will exit the ring and park the owning task stopped (eg via SIGSTOP). If the owning task needs to run task_work to complete requests, then io_ring_exit_work won't make any progress until the task is runnable again. Hence io_ring_exit_work can trigger the hung task detection, which is particularly problematic if panic-on-hung-task is enabled. As the ring exit doesn't take signals to begin with, have it wait interruptibly rather than uninterruptibly. io_uring has a separate stuck-exit warning that triggers independently anyway, so we're not really missing anything by making this switch. (CVE-2023-53461)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53461
https://ubuntu.com/security/CVE-2023-53461

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53461

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269596 - Linux Distros Unpatched Vulnerability : CVE-2023-53462
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: hsr: Fix uninit-value access in fill_frame_info() Syzbot reports the following uninit-value access problem.
===================================================== BUG: KMSAN: uninit-value in fill_frame_info net/hsr/hsr_forward.c:601 [inline] BUG: KMSAN: uninit-value in hsr_forward_skb+0x9bd/0x30f0 net/hsr/hsr_forward.c:616 fill_frame_info net/hsr/hsr_forward.c:601 [inline] hsr_forward_skb+0x9bd/0x30f0 net/hsr/hsr_forward.c:616 hsr_dev_xmit+0x192/0x330 net/hsr/hsr_device.c:223 __netdev_start_xmit include/linux/netdevice.h:4889 [inline] netdev_start_xmit include/linux/netdevice.h:4903 [inline] xmit_one net/core/dev.c:3544 [inline] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3560
__dev_queue_xmit+0x34d0/0x52a0 net/core/dev.c:4340 dev_queue_xmit include/linux/netdevice.h:3082 [inline] packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x8b1d/0x9f30 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:730 [inline] sock_sendmsg net/socket.c:753 [inline] __sys_sendto+0x781/0xa30 net/socket.c:2176 __do_sys_sendto net/socket.c:2188 [inline] __se_sys_sendto net/socket.c:2184 [inline] __ia32_sys_sendto+0x11f/0x1c0 net/socket.c:2184 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82 Uninit was created at: slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523 kmalloc_reserve+0x148/0x470 net/core/skbuff.c:559 __alloc_skb+0x318/0x740 net/core/skbuff.c:644 alloc_skb include/linux/skbuff.h:1286 [inline] alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6299 sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2794 packet_alloc_skb net/packet/af_packet.c:2936 [inline] packet_snd net/packet/af_packet.c:3030 [inline] packet_sendmsg+0x70e8/0x9f30 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:730 [inline] sock_sendmsg net/socket.c:753 [inline] __sys_sendto+0x781/0xa30 net/socket.c:2176 __do_sys_sendto net/socket.c:2188 [inline]
__se_sys_sendto net/socket.c:2184 [inline] __ia32_sys_sendto+0x11f/0x1c0 net/socket.c:2184 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82 It is because VLAN not yet supported in hsr driver. Return error when protocol is ETH_P_8021Q in fill_frame_info() now to fix it. (CVE-2023-53462)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53462
https://ubuntu.com/security/CVE-2023-53462

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53462

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269530 - Linux Distros Unpatched Vulnerability : CVE-2023-53463
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ibmvnic: Do not reset dql stats on NON_FATAL err All ibmvnic resets, make a call to netdev_tx_reset_queue() when re-opening the device. netdev_tx_reset_queue() resets the num_queued and num_completed byte counters. These stats are used in Byte Queue Limit (BQL) algorithms. The difference between these two stats tracks the number of bytes currently sitting on the physical NIC. ibmvnic increases the number of queued bytes though calls to netdev_tx_sent_queue() in the drivers xmit function.
When, VIOS reports that it is done transmitting bytes, the ibmvnic device increases the number of completed bytes through calls to netdev_tx_completed_queue(). It is important to note that the driver batches its transmit calls and num_queued is increased every time that an skb is added to the next batch, not necessarily when the batch is sent to VIOS for transmission. Unlike other reset types, a NON FATAL reset will not flush the sub crq tx buffers. Therefore, it is possible for the batched skb array to be partially full. So if there is call to netdev_tx_reset_queue() when re-opening the device, the value of num_queued (0) would not account for the skb's that are currently batched. Eventually, when the batch is sent to VIOS, the call to netdev_tx_completed_queue() would increase num_completed to a value greater than the num_queued. This causes a BUG_ON crash: ibmvnic 30000002: Firmware reports error, cause: adapter problem. Starting recovery... ibmvnic 30000002: tx error 600 ibmvnic 30000002: tx error 600 ibmvnic 30000002: tx error 600 ibmvnic 30000002: tx error 600 ------------[ cut here ]------------ kernel BUG at lib/dynamic_queue_limits.c:27! Oops: Exception in kernel mode, sig: 5 [....] NIP dql_completed+0x28/0x1c0 LR ibmvnic_complete_tx.isra.0+0x23c/0x420 [ibmvnic] Call Trace: ibmvnic_complete_tx.isra.0+0x3f8/0x420 [ibmvnic] (unreliable) ibmvnic_interrupt_tx+0x40/0x70 [ibmvnic] __handle_irq_event_percpu+0x98/0x270 ---[ end trace ]--- Therefore, do not reset the dql stats when performing a NON_FATAL reset. (CVE-2023-53463)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53463
https://ubuntu.com/security/CVE-2023-53463

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53463

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269545 - Linux Distros Unpatched Vulnerability : CVE-2023-53473
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: improve error handling from ext4_dirhash() The ext4_dirhash() will *almost* never fail, especially when the hash tree feature was first introduced. However, with the addition of support of encrypted, casefolded file names, that function can most certainly fail today. So make sure the callers of ext4_dirhash() properly check for failures, and reflect the errors back up to their callers.
(CVE-2023-53473)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53473
https://security-tracker.debian.org/tracker/CVE-2023-53473
https://ubuntu.com/security/CVE-2023-53473

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53473

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269644 - Linux Distros Unpatched Vulnerability : CVE-2023-53474
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: x86/MCE/AMD: Use an u64 for bank_map Thee maximum number of MCA banks is 64 (MAX_NR_BANKS), see a0bc32b3cacf (x86/mce: Increase maximum number of banks to 64). However, the bank_map which contains a bitfield of which banks to initialize is of type unsigned int and that overflows when those bit numbers are >= 32, leading to UBSAN complaining correctly:
UBSAN: shift-out-of-bounds in arch/x86/kernel/cpu/mce/amd.c:1365:38 shift exponent 32 is too large for 32-bit type 'int' Change the bank_map to a u64 and use the proper BIT_ULL() macro when modifying bits in there. [ bp: Rewrite commit message. ] (CVE-2023-53474)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53474
https://ubuntu.com/security/CVE-2023-53474

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53474

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269563 - Linux Distros Unpatched Vulnerability : CVE-2023-53475
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: usb: xhci: tegra: fix sleep in atomic call When we set the dual-role port to Host mode, we observed the following splat: [ 167.057718] BUG:
sleeping function called from invalid context at include/linux/sched/mm.h:229 [ 167.057872] Workqueue:
events tegra_xusb_usb_phy_work [ 167.057954] Call trace: [ 167.057962] dump_backtrace+0x0/0x210 [ 167.057996] show_stack+0x30/0x50 [ 167.058020] dump_stack_lvl+0x64/0x84 [ 167.058065] dump_stack+0x14/0x34 [ 167.058100] __might_resched+0x144/0x180 [ 167.058140] __might_sleep+0x64/0xd0 [ 167.058171] slab_pre_alloc_hook.constprop.0+0xa8/0x110 [ 167.058202] __kmalloc_track_caller+0x74/0x2b0 [ 167.058233] kvasprintf+0xa4/0x190 [ 167.058261] kasprintf+0x58/0x90 [ 167.058285] tegra_xusb_find_port_node.isra.0+0x58/0xd0 [ 167.058334] tegra_xusb_find_port+0x38/0xa0 [ 167.058380] tegra_xusb_padctl_get_usb3_companion+0x38/0xd0 [ 167.058430] tegra_xhci_id_notify+0x8c/0x1e0 [ 167.058473] notifier_call_chain+0x88/0x100 [ 167.058506] atomic_notifier_call_chain+0x44/0x70 [ 167.058537] tegra_xusb_usb_phy_work+0x60/0xd0 [ 167.058581] process_one_work+0x1dc/0x4c0 [ 167.058618] worker_thread+0x54/0x410 [ 167.058650] kthread+0x188/0x1b0 [ 167.058672] ret_from_fork+0x10/0x20 The function tegra_xusb_padctl_get_usb3_companion eventually calls tegra_xusb_find_port and this in turn calls kasprintf which might sleep and so cannot be called from an atomic context. Fix this by moving the call to tegra_xusb_padctl_get_usb3_companion to the tegra_xhci_id_work function where it is really needed.
(CVE-2023-53475)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53475
https://ubuntu.com/security/CVE-2023-53475

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53475

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269590 - Linux Distros Unpatched Vulnerability : CVE-2023-53480
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- kobject: Add sanity check for kset->kobj.ktype in kset_register() When I register a kset in the following way: static struct kset my_kset; kobject_set_name(&my_kset.kobj, my_kset); ret = kset_register(&my_kset); A null pointer dereference exception is occurred: [ 4453.568337] Unable to handle kernel NULL pointer dereference at \ virtual address 0000000000000028 ... ... [ 4453.810361] Call trace: [ 4453.813062] kobject_get_ownership+0xc/0x34 [ 4453.817493] kobject_add_internal+0x98/0x274 [ 4453.822005] kset_register+0x5c/0xb4 [ 4453.825820] my_kobj_init+0x44/0x1000 [my_kset] ... ... Because I didn't initialize my_kset.kobj.ktype. According to the description in Documentation/core-api/kobject.rst: - A ktype is the type of object that embeds a kobject. Every structure that embeds a kobject needs a corresponding ktype. So add sanity check to make sure kset->kobj.ktype is not NULL. (CVE-2023-53480)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53480
https://ubuntu.com/security/CVE-2023-53480

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53480

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269525 - Linux Distros Unpatched Vulnerability : CVE-2023-53481
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed Following process will trigger an infinite loop in ubi_wl_put_peb(): ubifs_bgt ubi_bgt ubifs_leb_unmap ubi_leb_unmap ubi_eba_unmap_leb ubi_wl_put_peb wear_leveling_worker e1 = rb_entry(rb_first(&ubi->used) e2 = get_peb_for_wl(ubi) ubi_io_read_vid_hdr // return err (flash fault) out_error: ubi->move_from = ubi->move_to = NULL wl_entry_destroy(ubi, e1) ubi->lookuptbl[e->pnum] = NULL retry: e = ubi->lookuptbl[pnum]; // return NULL if (e == ubi->move_from) { // NULL == NULL gets true goto retry; // infinite loop !!! $ top PID USER PR NI VIRT RES SHR S %CPU %MEM COMMAND 7676 root 20 0 0 0 0 R 100.0 0.0 ubifs_bgt0_0 Fix it by: 1) Letting ubi_wl_put_peb() returns directly if wearl leveling entry has been removed from 'ubi->lookuptbl'. 2) Using 'ubi->wl_lock' protecting wl entry deletion to preventing an use-after-free problem for wl entry in ubi_wl_put_peb(). Fetch a reproducer in [Link]. (CVE-2023-53481)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53481
https://ubuntu.com/security/CVE-2023-53481

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53481

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269606 - Linux Distros Unpatched Vulnerability : CVE-2023-53482
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- iommu: Fix error unwind in iommu_group_alloc() If either iommu_group_grate_file() fails then the iommu_group is leaked. Destroy it on these error paths. Found by kselftest/iommu/iommufd_fail_nth (CVE-2023-53482)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53482
https://security-tracker.debian.org/tracker/CVE-2023-53482
https://ubuntu.com/security/CVE-2023-53482

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53482

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269518 - Linux Distros Unpatched Vulnerability : CVE-2023-53487
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas_flash: allow user copy to flash block cache objects With hardened usercopy enabled (CONFIG_HARDENED_USERCOPY=y), using the /proc/powerpc/rtas/firmware_update interface to prepare a system firmware update yields a BUG(): kernel BUG at mm/usercopy.c:102! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries Modules linked in: CPU: 0 PID: 2232 Comm: dd Not tainted 6.5.0-rc3+ #2 Hardware name: IBM,8408-E8E POWER8E (raw) 0x4b0201 0xf000004 of:IBM,FW860.50 (SV860_146) hv:phyp pSeries NIP:
c0000000005991d0 LR: c0000000005991cc CTR: 0000000000000000 REGS: c0000000148c76a0 TRAP: 0700 Not tainted (6.5.0-rc3+) MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 24002242 XER: 0000000c CFAR:
c0000000001fbd34 IRQMASK: 0 [ ... GPRs omitted ... ] NIP usercopy_abort+0xa0/0xb0 LR usercopy_abort+0x9c/0xb0 Call Trace: usercopy_abort+0x9c/0xb0 (unreliable) __check_heap_object+0x1b4/0x1d0
__check_object_size+0x2d0/0x380 rtas_flash_write+0xe4/0x250 proc_reg_write+0xfc/0x160 vfs_write+0xfc/0x4e0 ksys_write+0x90/0x160 system_call_exception+0x178/0x320 system_call_common+0x160/0x2c4 The blocks of the firmware image are copied directly from user memory to objects allocated from flash_block_cache, so flash_block_cache must be created using kmem_cache_create_usercopy() to mark it safe for user access.
[mpe: Trim and indent oops] (CVE-2023-53487)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53487
https://ubuntu.com/security/CVE-2023-53487

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53487

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269562 - Linux Distros Unpatched Vulnerability : CVE-2023-53488
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- IB/hfi1: Fix possible panic during hotplug remove During hotplug remove it is possible that the update counters work might be pending, and may run after memory has been freed. Cancel the update counters work before freeing memory. (CVE-2023-53488)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53488
https://ubuntu.com/security/CVE-2023-53488

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53488

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269617 - Linux Distros Unpatched Vulnerability : CVE-2023-53489
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. syzkaller reported [0] memory leaks of an UDP socket and ZEROCOPY skbs. We can reproduce the problem with these sequences: sk = socket(AF_INET, SOCK_DGRAM, 0) sk.setsockopt(SOL_SOCKET, SO_TIMESTAMPING, SOF_TIMESTAMPING_TX_SOFTWARE) sk.setsockopt(SOL_SOCKET, SO_ZEROCOPY, 1) sk.sendto(b'', MSG_ZEROCOPY, ('127.0.0.1', 53)) sk.close() sendmsg() calls msg_zerocopy_alloc(), which allocates a skb, sets skb->cb->ubuf.refcnt to 1, and calls sock_hold(). Here, struct ubuf_info_msgzc indirectly holds a refcnt of the socket. When the skb is sent,
__skb_tstamp_tx() clones it and puts the clone into the socket's error queue with the TX timestamp. When the original skb is received locally, skb_copy_ubufs() calls skb_unclone(), and pskb_expand_head() increments skb->cb->ubuf.refcnt. This additional count is decremented while freeing the skb, but struct ubuf_info_msgzc still has a refcnt, so __msg_zerocopy_callback() is not called. The last refcnt is not released unless we retrieve the TX timestamped skb by recvmsg(). Since we clear the error queue in inet_sock_destruct() after the socket's refcnt reaches 0, there is a circular dependency. If we close() the socket holding such skbs, we never call sock_put() and leak the count, sk, and skb. TCP has the same problem, and commit e0c8bccd40fc (net: stream: purge sk_error_queue in sk_stream_kill_queues()) tried to fix it by calling skb_queue_purge() during close(). However, there is a small chance that skb queued in a qdisc or device could be put into the error queue after the skb_queue_purge() call. In __skb_tstamp_tx(), the cloned skb should not have a reference to the ubuf to remove the circular dependency, but skb_clone() does not call skb_copy_ubufs() for zerocopy skb. So, we need to call skb_orphan_frags_rx() for the cloned skb to call skb_copy_ubufs(). [0]: BUG: memory leak unreferenced object 0xffff88800c6d2d00 (size 1152):
comm syz-executor392, pid 264, jiffies 4294785440 (age 13.044s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 cd af e8 81 00 00 00 00 ................ 02 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ backtrace: [<0000000055636812>] sk_prot_alloc+0x64/0x2a0 net/core/sock.c:2024 [<0000000054d77b7a>] sk_alloc+0x3b/0x800 net/core/sock.c:2083 [<0000000066f3c7e0>] inet_create net/ipv4/af_inet.c:319 [inline] [<0000000066f3c7e0>] inet_create+0x31e/0xe40 net/ipv4/af_inet.c:245 [<000000009b83af97>] __sock_create+0x2ab/0x550 net/socket.c:1515 [<00000000b9b11231>] sock_create net/socket.c:1566 [inline] [<00000000b9b11231>] __sys_socket_create net/socket.c:1603 [inline] [<00000000b9b11231>] __sys_socket_create net/socket.c:1588 [inline] [<00000000b9b11231>]
__sys_socket+0x138/0x250 net/socket.c:1636 [<000000004fb45142>] __do_sys_socket net/socket.c:1649 [inline] [<000000004fb45142>] __se_sys_socket net/socket.c:1647 [inline] [<000000004fb45142>]
__x64_sys_socket+0x73/0xb0 net/socket.c:1647 [<0000000066999e0e>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<0000000066999e0e>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 [<0000000017f238c1>] entry_SYSCALL_64_after_hwframe+0x63/0xcd BUG: memory leak unreferenced object 0xffff888017633a00 (size 240): comm syz-executor392, pid 264, jiffies 4294785440 (age 13.044s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 2d 6d 0c 80 88 ff ff .........-m..... backtrace: [<000000002b1c4368>]
__alloc_skb+0x229/0x320 net/core/skbuff.c:497 [<00000000143579a6>] alloc_skb include/linux/skbuff.h:1265 [inline] [<00000000143579a6>] sock_omalloc+0xaa/0x190 net/core/sock.c:2596 [<00000000be626478>] msg_zerocopy_alloc net/core/skbuff.c:1294 [inline] [<00000000be626478>] ---truncated--- (CVE-2023-53489)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53489
https://ubuntu.com/security/CVE-2023-53489

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53489

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269577 - Linux Distros Unpatched Vulnerability : CVE-2023-53491
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- start_kernel: Add __no_stack_protector function attribute Back during the discussion of commit a9a3ed1eff36 (x86: Fix early boot crash on gcc-10, third try) we discussed the need for a function attribute to control the omission of stack protectors on a per-function basis; at the time Clang had support for no_stack_protector but GCC did not. This was fixed in gcc-11. Now that the function attribute is available, let's start using it. Callers of boot_init_stack_canary need to use this function attribute unless they're compiled with -fno-stack-protector, otherwise the canary stored in the stack slot of the caller will differ upon the call to boot_init_stack_canary. This will lead to a call to __stack_chk_fail() then panic. (CVE-2023-53491)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53491
https://security-tracker.debian.org/tracker/CVE-2023-53491
https://ubuntu.com/security/CVE-2023-53491

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53491

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269619 - Linux Distros Unpatched Vulnerability : CVE-2023-53496
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: x86/platform/uv: Use alternate source for socket to node data The UV code attempts to build a set of tables to allow it to do bidirectional socket<=>node lookups. But when nr_cpus is set to a smaller number than actually present, the cpu_to_node() mapping information for unused CPUs is not available to build_socket_tables(). This results in skipping some nodes or sockets when creating the tables and leaving some -1's for later code to trip.
over, causing oopses. The problem is that the socket<=>node lookups are created by doing a loop over all CPUs, then looking up the CPU's APICID and socket. But if a CPU is not present, there is no way to start this lookup. Instead of looping over all CPUs, take CPUs out of the equation entirely. Loop over all APICIDs which are mapped to a valid NUMA node. Then just extract the socket-id from the APICID. This avoid tripping over disabled CPUs. (CVE-2023-53496)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53496
https://ubuntu.com/security/CVE-2023-53496

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53496

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269605 - Linux Distros Unpatched Vulnerability : CVE-2023-53498
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/amd/display: Fix potential null dereference The adev->dm.dc pointer can be NULL and dereferenced in amdgpu_dm_fini() without checking. Add a NULL pointer check before calling dc_dmub_srv_destroy(). Found by Linux Verification Center (linuxtesting.org) with SVACE. (CVE-2023-53498)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53498
https://security-tracker.debian.org/tracker/CVE-2023-53498
https://ubuntu.com/security/CVE-2023-53498

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53498

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269623 - Linux Distros Unpatched Vulnerability : CVE-2023-53499
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- virtio_net: Fix error unwinding of XDP initialization When initializing XDP in virtnet_open(), some rq xdp initialization may hit an error causing net device open failed. However, previous rqs have already initialized XDP and enabled NAPI, which is not the expected behavior. Need to roll back the previous rq initialization to avoid leaks in error unwinding of init code. Also extract helper functions of disable and enable queue pairs. Use newly introduced disable helper function in error unwinding and virtnet_close.
Use enable helper function in virtnet_open. (CVE-2023-53499)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53499
https://security-tracker.debian.org/tracker/CVE-2023-53499
https://ubuntu.com/security/CVE-2023-53499

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53499

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269557 - Linux Distros Unpatched Vulnerability : CVE-2023-53501
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind When unbinding pasid - a race condition exists vs outstanding page faults. To prevent this, the pasid_state object contains a refcount. * set to 1 on pasid bind * incremented on each ppr notification start * decremented on each ppr notification done * decremented on pasid unbind Since refcount_dec assumes that refcount will never reach 0: the current implementation causes the following to be invoked on pasid unbind: REFCOUNT_WARN(decrement hit 0; leaking memory) Fix this issue by changing refcount_dec to refcount_dec_and_test to explicitly handle refcount=1.
(CVE-2023-53501)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53501
https://ubuntu.com/security/CVE-2023-53501

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53501

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269626 - Linux Distros Unpatched Vulnerability : CVE-2023-53504
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Properly order ib_device_unalloc() to avoid UAF ib_dealloc_device() should be called only after device cleanup. Fix the dealloc sequence. (CVE-2023-53504)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53504
https://ubuntu.com/security/CVE-2023-53504

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53504

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269615 - Linux Distros Unpatched Vulnerability : CVE-2023-53505
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- clk: tegra: tegra124-emc: Fix potential memory leak The tegra and tegra needs to be freed in the error handling path, otherwise it will be leaked. (CVE-2023-53505)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53505
https://ubuntu.com/security/CVE-2023-53505

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53505

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269538 - Linux Distros Unpatched Vulnerability : CVE-2023-53506
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- udf: Do not bother merging very long extents When merging very long extents we try to push as much length as possible to the first extent. However this is unnecessarily complicated and not really worth the trouble. Furthermore there was a bug in the logic resulting in corrupting extents in the file as syzbot reproducer shows. So just don't bother with the merging of extents that are too long together.
(CVE-2023-53506)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53506
https://ubuntu.com/security/CVE-2023-53506

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53506

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269609 - Linux Distros Unpatched Vulnerability : CVE-2023-53507
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Unregister devlink params in case interface is down Currently, in case an interface is down, mlx5 driver doesn't unregister its devlink params, which leads to this WARN[1]. Fix it by unregistering devlink params in that case as well. [1] [ 295.244769 ] WARNING: CPU: 15 PID: 1 at net/core/devlink.c:9042 devlink_free+0x174/0x1fc [ 295.488379 ] CPU: 15 PID: 1 Comm: shutdown Tainted: G S OE 5.15.0-1017.19.3.g0677e61-bluefield #g0677e61 [ 295.509330 ] Hardware name: https://www.mellanox.com BlueField SoC/BlueField SoC, BIOS 4.2.0.12761 Jun 6 2023 [ 295.543096 ] pc : devlink_free+0x174/0x1fc [ 295.551104 ] lr : mlx5_devlink_free+0x18/0x2c [mlx5_core] [ 295.561816 ] sp : ffff80000809b850 [ 295.711155 ] Call trace: [ 295.716030 ] devlink_free+0x174/0x1fc [ 295.723346 ] mlx5_devlink_free+0x18/0x2c [mlx5_core] [ 295.733351 ] mlx5_sf_dev_remove+0x98/0xb0 [mlx5_core] [ 295.743534 ] auxiliary_bus_remove+0x2c/0x50 [ 295.751893 ]
__device_release_driver+0x19c/0x280 [ 295.761120 ] device_release_driver+0x34/0x50 [ 295.769649 ] bus_remove_device+0xdc/0x170 [ 295.777656 ] device_del+0x17c/0x3a4 [ 295.784620 ] mlx5_sf_dev_remove+0x28/0xf0 [mlx5_core] [ 295.794800 ] mlx5_sf_dev_table_destroy+0x98/0x110 [mlx5_core] [ 295.806375 ] mlx5_unload+0x34/0xd0 [mlx5_core] [ 295.815339 ] mlx5_unload_one+0x70/0xe4 [mlx5_core] [ 295.824998 ] shutdown+0xb0/0xd8 [mlx5_core] [ 295.833439 ] pci_device_shutdown+0x3c/0xa0 [ 295.841651 ] device_shutdown+0x170/0x340 [ 295.849486 ] __do_sys_reboot+0x1f4/0x2a0 [ 295.857322 ]
__arm64_sys_reboot+0x2c/0x40 [ 295.865329 ] invoke_syscall+0x78/0x100 [ 295.872817 ] el0_svc_common.constprop.0+0x54/0x184 [ 295.882392 ] do_el0_svc+0x30/0xac [ 295.889008 ] el0_svc+0x48/0x160 [ 295.895278 ] el0t_64_sync_handler+0xa4/0x130 [ 295.903807 ] el0t_64_sync+0x1a4/0x1a8 [ 295.911120 ] ---[ end trace 4f1d2381d00d9dce ]--- (CVE-2023-53507)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53507
https://ubuntu.com/security/CVE-2023-53507

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
1.4
EPSS Score
0.0002
References

CVE | CVE-2023-53507

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269559 - Linux Distros Unpatched Vulnerability : CVE-2023-53509
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- qed: allow sleep in qed_mcp_trace_dump() By default, qed_mcp_cmd_and_union() delays 10us at a time in a loop that can run 500K times, so calls to qed_mcp_nvm_rd_cmd() may block the current thread for over 5s.
We observed thread scheduling delays over 700ms in production, with stacktraces pointing to this code as the culprit. qed_mcp_trace_dump() is called from ethtool, so sleeping is permitted. It already can sleep in qed_mcp_halt(), which calls qed_mcp_cmd(). Add a can sleep parameter to qed_find_nvram_image() and qed_nvram_read() so they can sleep during qed_mcp_trace_dump(). qed_mcp_trace_get_meta_info() and qed_mcp_trace_read_meta(), called only by qed_mcp_trace_dump(), allow these functions to sleep. I can't tell if the other caller (qed_grc_dump_mcp_hw_dump()) can sleep, so keep b_can_sleep set to false when it calls these functions. An example stacktrace from a custom warning we added to the kernel showing a thread that has not scheduled despite long needing resched: [ 2745.362925,17] ------------[ cut here ]------------ [ 2745.362941,17] WARNING: CPU: 23 PID: 5640 at arch/x86/kernel/irq.c:233 do_IRQ+0x15e/0x1a0() [ 2745.362946,17] Thread not rescheduled for 744 ms after irq 99 [ 2745.362956,17] Modules linked in: ... [ 2745.363339,17] CPU: 23 PID: 5640 Comm: lldpd Tainted: P O 4.4.182+ #202104120910+6d1da174272d.61x [ 2745.363343,17] Hardware name: FOXCONN MercuryB/Quicksilver Controller, BIOS H11P1N09 07/08/2020 [ 2745.363346,17] 0000000000000000 ffff885ec07c3ed8 ffffffff8131eb2f ffff885ec07c3f20 [ 2745.363358,17] ffffffff81d14f64 ffff885ec07c3f10 ffffffff81072ac2 ffff88be98ed0000 [ 2745.363369,17] 0000000000000063 0000000000000174 0000000000000074 0000000000000000 [ 2745.363379,17] Call Trace: [ 2745.363382,17] <IRQ> [<ffffffff8131eb2f>] dump_stack+0x8e/0xcf [ 2745.363393,17] [<ffffffff81072ac2>] warn_slowpath_common+0x82/0xc0 [ 2745.363398,17] [<ffffffff81072b4c>] warn_slowpath_fmt+0x4c/0x50 [ 2745.363404,17] [<ffffffff810d5a8e>] ? rcu_irq_exit+0xae/0xc0 [ 2745.363408,17] [<ffffffff817c99fe>] do_IRQ+0x15e/0x1a0 [ 2745.363413,17] [<ffffffff817c7ac9>] common_interrupt+0x89/0x89 [ 2745.363416,17] <EOI> [<ffffffff8132aa74>] ? delay_tsc+0x24/0x50 [ 2745.363425,17] [<ffffffff8132aa04>] __udelay+0x34/0x40 [ 2745.363457,17] [<ffffffffa04d45ff>] qed_mcp_cmd_and_union+0x36f/0x7d0 [qed] [ 2745.363473,17] [<ffffffffa04d5ced>] qed_mcp_nvm_rd_cmd+0x4d/0x90 [qed] [ 2745.363490,17] [<ffffffffa04e1dc7>] qed_mcp_trace_dump+0x4a7/0x630 [qed] [ 2745.363504,17] [<ffffffffa04e2556>] ? qed_fw_asserts_dump+0x1d6/0x1f0 [qed] [ 2745.363520,17] [<ffffffffa04e4ea7>] qed_dbg_mcp_trace_get_dump_buf_size+0x37/0x80 [qed] [ 2745.363536,17] [<ffffffffa04ea881>] qed_dbg_feature_size+0x61/0xa0 [qed] [ 2745.363551,17] [<ffffffffa04eb427>] qed_dbg_all_data_size+0x247/0x260 [qed] [ 2745.363560,17] [<ffffffffa0482c10>] qede_get_regs_len+0x30/0x40 [qede] [ 2745.363566,17] [<ffffffff816c9783>] ethtool_get_drvinfo+0xe3/0x190 [ 2745.363570,17] [<ffffffff816cc152>] dev_ethtool+0x1362/0x2140 [ 2745.363575,17] [<ffffffff8109bcc6>] ? finish_task_switch+0x76/0x260 [ 2745.363580,17] [<ffffffff817c2116>] ? __schedule+0x3c6/0x9d0 [ 2745.363585,17] [<ffffffff810dbd50>] ? hrtimer_start_range_ns+0x1d0/0x370 [ 2745.363589,17] [<ffffffff816c1e5b>] ? dev_get_by_name_rcu+0x6b/0x90 [ 2745.363594,17] [<ffffffff816de6a8>] dev_ioctl+0xe8/0x710 [ 2745.363599,17] [<ffffffff816a58a8>] sock_do_ioctl+0x48/0x60 [ 2745.363603,17] [<ffffffff816a5d87>] sock_ioctl+0x1c7/0x280 [ 2745.363608,17] [<ffffffff8111f393>] ? seccomp_phase1+0x83/0x220 [ 2745.363612,17] [<ffffffff811e3503>] do_vfs_ioctl+0x2b3/0x4e0 [ 2745.363616,17] [<ffffffff811e3771>] SyS_ioctl+0x41/0x70 [ 2745.363619,17] [<ffffffff817c6ffe>] entry_SYSCALL_64_fastpath+0x1e/0x79 [ 2745.363622,17] ---[ end trace f6954aa440266421 ]--- (CVE-2023-53509)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53509
https://security-tracker.debian.org/tracker/CVE-2023-53509
https://ubuntu.com/security/CVE-2023-53509

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
7.9 (CVSS2#AV:N/AC:M/Au:S/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
6.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53509

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269561 - Linux Distros Unpatched Vulnerability : CVE-2023-53511
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: io_uring: fix fget leak when fs don't support nowait buffered read Heming reported a BUG when using io_uring doing link-cp on ocfs2. [1] Do the following steps can reproduce this BUG: mount -t ocfs2 /dev/vdc /mnt/ocfs2 cp testfile /mnt/ocfs2/ ./link- cp /mnt/ocfs2/testfile /mnt/ocfs2/testfile.1 umount /mnt/ocfs2 Then umount will fail, and it outputs:
umount: /mnt/ocfs2: target is busy. While tracing umount, it blames mnt_get_count() not return as expected. Do a deep investigation for fget()/fput() on related code flow, I've finally found that fget() leaks since ocfs2 doesn't support nowait buffered read. io_issue_sqe |-io_assign_file // do fget() first |-io_read |-io_iter_do_read |-ocfs2_file_read_iter // return -EOPNOTSUPP |-kiocb_done |-io_rw_done |-__io_complete_rw_common // set REQ_F_REISSUE |-io_resubmit_prep |-io_req_prep_async // override req->file, leak happens This was introduced by commit a196c78b5443 in v5.18. Fix it by don't re-assign req->file if it has already been assigned. [1] https://lore.kernel.org/ocfs2-devel/ab580a75-91c8-d68a-3455-40361be1bfa8@linux.alibaba.com/T/#t (CVE-2023-53511)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53511
https://ubuntu.com/security/CVE-2023-53511

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53511

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269524 - Linux Distros Unpatched Vulnerability : CVE-2023-53514
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix memory leak of device names The device names allocated by dev_set_name() need be freed before module unloading, but they can not be freed because the kobject's refcount which was set in device_initialize() has not be decreased to 0. As comment of device_add() says, if it fails, use only put_device() drop the refcount, then the name will be freed in kobejct_cleanup(). device_del() and put_device() can be replaced with device_unregister(), so call it to unregister the added successfully devices, and just call put_device() to the not added device.
Add a release() function to device to avoid null release() function WARNING in device_release(), it's empty, because the context devices are freed together in host1x_memory_context_list_free().
(CVE-2023-53514)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53514
https://ubuntu.com/security/CVE-2023-53514

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53514

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269527 - Linux Distros Unpatched Vulnerability : CVE-2023-53517
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tipc: do not update mtu if msg_max is too small in mtu negotiation When doing link mtu negotiation, a malicious peer may send Activate msg with a very small mtu, e.g. 4 in Shuang's testing, without checking for the minimum mtu, l->mtu will be set to 4 in tipc_link_proto_rcv(), then n->links[bearer_id].mtu is set to 4294967228, which is a overflow of '4 - INT_H_SIZE - EMSG_OVERHEAD' in tipc_link_mss(). With tipc_link.mtu = 4, tipc_link_xmit() kept printing the warning: tipc: Too large msg, purging xmit list 1 5 0 40 4! tipc: Too large msg, purging xmit list 1 15 0 60 4! And with tipc_link_entry.mtu 4294967228, a huge skb was allocated in named_distribute(), and when purging it in tipc_link_xmit(), a crash was even caused: general protection fault, probably for non-canonical address 0x2100001011000dd: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 0 Comm: swapper/0 Kdump: loaded Not tainted 6.3.0.neta #19 RIP:
0010:kfree_skb_list_reason+0x7e/0x1f0 Call Trace: <IRQ> skb_release_data+0xf9/0x1d0 kfree_skb_reason+0x40/0x100 tipc_link_xmit+0x57a/0x740 [tipc] tipc_node_xmit+0x16c/0x5c0 [tipc] tipc_named_node_up+0x27f/0x2c0 [tipc] tipc_node_write_unlock+0x149/0x170 [tipc] tipc_rcv+0x608/0x740 [tipc] tipc_udp_recv+0xdc/0x1f0 [tipc] udp_queue_rcv_one_skb+0x33e/0x620 udp_unicast_rcv_skb.isra.72+0x75/0x90 __udp4_lib_rcv+0x56d/0xc20 ip_protocol_deliver_rcu+0x100/0x2d0 This patch fixes it by checking the new mtu against tipc_bearer_min_mtu(), and not updating mtu if it is too small. (CVE-2023-53517)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53517
https://ubuntu.com/security/CVE-2023-53517

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53517

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269616 - Linux Distros Unpatched Vulnerability : CVE-2023-53519
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- media: v4l2-mem2mem: add lock to protect parameter num_rdy Getting below error when using KCSAN to check the driver. Adding lock to protect parameter num_rdy when getting the value with function:
v4l2_m2m_num_src_bufs_ready/v4l2_m2m_num_dst_bufs_ready. kworker/u16:3: [name:report&]BUG: KCSAN: data- race in v4l2_m2m_buf_queue kworker/u16:3: [name:report&] kworker/u16:3: [name:report&]read-write to 0xffffff8105f35b94 of 1 bytes by task 20865 on cpu 7: kworker/u16:3: v4l2_m2m_buf_queue+0xd8/0x10c (CVE-2023-53519)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53519
https://ubuntu.com/security/CVE-2023-53519

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53519

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269556 - Linux Distros Unpatched Vulnerability : CVE-2023-53520
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: Fix hci_suspend_sync crash If hci_unregister_dev() frees the hci_dev object but hci_suspend_notifier may still be accessing it, it can cause the program to crash. Here's the call trace:
<4>[102152.653246] Call Trace: <4>[102152.653254] hci_suspend_sync+0x109/0x301 [bluetooth] <4>[102152.653259] hci_suspend_dev+0x78/0xcd [bluetooth] <4>[102152.653263] hci_suspend_notifier+0x42/0x7a [bluetooth] <4>[102152.653268] notifier_call_chain+0x43/0x6b <4>[102152.653271]
__blocking_notifier_call_chain+0x48/0x69 <4>[102152.653273] __pm_notifier_call_chain+0x22/0x39 <4>[102152.653276] pm_suspend+0x287/0x57c <4>[102152.653278] state_store+0xae/0xe5 <4>[102152.653281] kernfs_fop_write+0x109/0x173 <4>[102152.653284] __vfs_write+0x16f/0x1a2 <4>[102152.653287] ? selinux_file_permission+0xca/0x16f <4>[102152.653289] ? security_file_permission+0x36/0x109 <4>[102152.653291] vfs_write+0x114/0x21d <4>[102152.653293] __x64_sys_write+0x7b/0xdb <4>[102152.653296] do_syscall_64+0x59/0x194 <4>[102152.653299] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 This patch holds the reference count of the hci_dev object while processing it in hci_suspend_notifier to avoid potential crash caused by the race condition. (CVE-2023-53520)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53520
https://security-tracker.debian.org/tracker/CVE-2023-53520
https://ubuntu.com/security/CVE-2023-53520

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.7 (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
5.7 (CVSS2#AV:A/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53520

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269554 - Linux Distros Unpatched Vulnerability : CVE-2023-53522
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex syzbot is reporting circular locking dependency between cpu_hotplug_lock and freezer_mutex, for commit f5d39b020809 (freezer,sched: Rewrite core freezer logic) replaced atomic_inc() in freezer_apply_state() with static_branch_inc() which holds cpu_hotplug_lock. cpu_hotplug_lock =>
cgroup_threadgroup_rwsem => freezer_mutex cgroup_file_write() { cgroup_procs_write() {
__cgroup_procs_write() { cgroup_procs_write_start() { cgroup_attach_lock() { cpus_read_lock() { percpu_down_read(&cpu_hotplug_lock); } percpu_down_write(&cgroup_threadgroup_rwsem); } } cgroup_attach_task() { cgroup_migrate() { cgroup_migrate_execute() { freezer_attach() { mutex_lock(&freezer_mutex); (...snipped...) } } } } (...snipped...) } } } freezer_mutex =>
cpu_hotplug_lock cgroup_file_write() { freezer_write() { freezer_change_state() { mutex_lock(&freezer_mutex); freezer_apply_state() { static_branch_inc(&freezer_active) { static_key_slow_inc() { cpus_read_lock(); static_key_slow_inc_cpuslocked(); cpus_read_unlock(); } } } mutex_unlock(&freezer_mutex); } } } Swap locking order by moving cpus_read_lock() in freezer_apply_state() to before mutex_lock(&freezer_mutex) in freezer_change_state(). (CVE-2023-53522)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53522
https://ubuntu.com/security/CVE-2023-53522

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53522

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269592 - Linux Distros Unpatched Vulnerability : CVE-2023-53523
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- can: gs_usb: fix time stamp counter initialization If the gs_usb device driver is unloaded (or unbound) before the interface is shut down, the USB stack first calls the struct usb_driver::disconnect and then the struct net_device_ops::ndo_stop callback. In gs_usb_disconnect() all pending bulk URBs are killed, i.e. no more RX'ed CAN frames are send from the USB device to the host. Later in gs_can_close() a reset control message is send to each CAN channel to remove the controller from the CAN bus. In this race window the USB device can still receive CAN frames from the bus and internally queue them to be send to the host.
At least in the current version of the candlelight firmware, the queue of received CAN frames is not emptied during the reset command. After loading (or binding) the gs_usb driver, new URBs are submitted during the struct net_device_ops::ndo_open callback and the candlelight firmware starts sending its already queued CAN frames to the host. However, this scenario was not considered when implementing the hardware timestamp function. The cycle counter/time counter infrastructure is set up (gs_usb_timestamp_init()) after the USBs are submitted, resulting in a NULL pointer dereference if timecounter_cyc2time() (via the call chain: gs_usb_receive_bulk_callback() -> gs_usb_set_timestamp() ->
gs_usb_skb_set_timestamp()) is called too early. Move the gs_usb_timestamp_init() function before the URBs are submitted to fix this problem. For a comprehensive solution, we need to consider gs_usb devices with more than 1 channel. The cycle counter/time counter infrastructure is setup per channel, but the RX URBs are per device. Once gs_can_open() of _a_ channel has been called, and URBs have been submitted, the gs_usb_receive_bulk_callback() can be called for _all_ available channels, even for channels that are not running, yet. As cycle counter/time counter has not set up, this will again lead to a NULL pointer dereference. Convert the cycle counter/time counter from a per channel to a per device functionality.
Also set it up, before submitting any URBs to the device. Further in gs_usb_receive_bulk_callback(), don't process any URBs for not started CAN channels, only resubmit the URB. (CVE-2023-53523)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53523
https://security-tracker.debian.org/tracker/CVE-2023-53523
https://ubuntu.com/security/CVE-2023-53523

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53523

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269625 - Linux Distros Unpatched Vulnerability : CVE-2023-53527
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix memory leak in tb_handle_dp_bandwidth_request() The memory allocated in tb_queue_dp_bandwidth_request() needs to be released once the request is handled to avoid leaking it. (CVE-2023-53527)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53527
https://ubuntu.com/security/CVE-2023-53527

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53527

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269600 - Linux Distros Unpatched Vulnerability : CVE-2023-53529
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: rtw88: Fix memory leak in rtw88_usb Kmemleak shows the following leak arising from routine in the usb probe routine: unreferenced object 0xffff895cb29bba00 (size 512): comm (udev-worker), pid 534, jiffies 4294903932 (age 102751.088s) hex dump (first 32 bytes): 77 30 30 30 00 00 00 00 02 2f 2d 2b 30 00 00 00 w000...../-+0... 02 00 2a 28 00 00 00 00 ff 55 ff ff ff 00 00 00 ..*(.....U...... backtrace:
[<ffffffff9265fa36>] kmalloc_trace+0x26/0x90 [<ffffffffc17eec41>] rtw_usb_probe+0x2f1/0x680 [rtw_usb] [<ffffffffc03e19fd>] usb_probe_interface+0xdd/0x2e0 [usbcore] [<ffffffff92b4f2fe>] really_probe+0x18e/0x3d0 [<ffffffff92b4f5b8>] __driver_probe_device+0x78/0x160 [<ffffffff92b4f6bf>] driver_probe_device+0x1f/0x90 [<ffffffff92b4f8df>] __driver_attach+0xbf/0x1b0 [<ffffffff92b4d350>] bus_for_each_dev+0x70/0xc0 [<ffffffff92b4e51e>] bus_add_driver+0x10e/0x210 [<ffffffff92b50935>] driver_register+0x55/0xf0 [<ffffffffc03e0708>] usb_register_driver+0x88/0x140 [usbcore] [<ffffffff92401153>] do_one_initcall+0x43/0x210 [<ffffffff9254f42a>] do_init_module+0x4a/0x200 [<ffffffff92551d1c>] __do_sys_finit_module+0xac/0x120 [<ffffffff92ee6626>] do_syscall_64+0x56/0x80 [<ffffffff9300006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 The leak was verified to be real by unloading the driver, which resulted in a dangling pointer to the allocation. The allocated memory is freed in rtw_usb_intf_deinit(). (CVE-2023-53529)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53529
https://security-tracker.debian.org/tracker/CVE-2023-53529
https://ubuntu.com/security/CVE-2023-53529

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53529

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269539 - Linux Distros Unpatched Vulnerability : CVE-2023-53531
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: null_blk: fix poll request timeout handling When doing io_uring benchmark on /dev/nullb0, it's easy to crash the kernel if poll requests timeout triggered, as reported by David. [1] BUG: kernel NULL pointer dereference, address:
0000000000000008 Workqueue: kblockd blk_mq_timeout_work RIP: 0010:null_timeout_rq+0x4e/0x91 Call Trace: ? null_timeout_rq+0x4e/0x91 blk_mq_handle_expired+0x31/0x4b bt_iter+0x68/0x84 ? bt_tags_iter+0x81/0x81
__sbitmap_for_each_set.constprop.0+0xb0/0xf2 ? __blk_mq_complete_request_remote+0xf/0xf bt_for_each+0x46/0x64 ? __blk_mq_complete_request_remote+0xf/0xf ? percpu_ref_get_many+0xc/0x2a blk_mq_queue_tag_busy_iter+0x14d/0x18e blk_mq_timeout_work+0x95/0x127 process_one_work+0x185/0x263 worker_thread+0x1b5/0x227 This is indeed a race problem between null_timeout_rq() and null_poll().
null_poll() null_timeout_rq() spin_lock(&nq->poll_lock) list_splice_init(&nq->poll_list, &list) spin_unlock(&nq->poll_lock) while (!list_empty(&list)) req = list_first_entry() list_del_init() ...
blk_mq_add_to_batch() // req->rq_next = NULL spin_lock(&nq->poll_lock) // rq->queuelist->next == NULL list_del_init(&rq->queuelist) spin_unlock(&nq->poll_lock) Fix these problems by setting requests state to MQ_RQ_COMPLETE under nq->poll_lock protection, in which null_timeout_rq() can safely detect this race and early return. Note this patch just fix the kernel panic when request timeout happen. [1] https://lore.kernel.org/all/3893581.1691785261@warthog.procyon.org.uk/ (CVE-2023-53531)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53531
https://ubuntu.com/security/CVE-2023-53531

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53531

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269363 - Linux Distros Unpatched Vulnerability : CVE-2023-53535
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: bcmgenet: Add a check for oversized packets Occasionnaly we may get oversized packets from the hardware which exceed the nomimal 2KiB buffer size we allocate SKBs with. Add an early check which drops the packet to avoid invoking skb_over_panic() and move on to processing the next packet. (CVE-2023-53535)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53535
https://ubuntu.com/security/CVE-2023-53535

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53535

Plugin Information
Published: 2025/10/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269418 - Linux Distros Unpatched Vulnerability : CVE-2023-53540
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: cfg80211: reject auth/assoc to AP with our address If the AP uses our own address as its MLD address or BSSID, then clearly something's wrong. Reject such connections so we don't try and fail later.
(CVE-2023-53540)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53540
https://security-tracker.debian.org/tracker/CVE-2023-53540
https://ubuntu.com/security/CVE-2023-53540

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53540

Plugin Information
Published: 2025/10/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269368 - Linux Distros Unpatched Vulnerability : CVE-2023-53543
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops. That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773. This patch adds the missing nla_policy for vdpa max vqp attr to avoid such bugs.
(CVE-2023-53543)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53543
https://ubuntu.com/security/CVE-2023-53543

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53543

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269364 - Linux Distros Unpatched Vulnerability : CVE-2023-53557
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: fprobe: Release rethook after the ftrace_ops is unregistered While running bpf selftests it's possible to get following fault: general protection fault, probably for non-canonical address \ 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC NOPTI ... Call Trace: <TASK> fprobe_handler+0xc1/0x270 ? __pfx_bpf_testmod_init+0x10/0x10 ? __pfx_bpf_testmod_init+0x10/0x10 ? bpf_fentry_test1+0x5/0x10 ? bpf_fentry_test1+0x5/0x10 ? bpf_testmod_init+0x22/0x80 ? do_one_initcall+0x63/0x2e0 ? rcu_is_watching+0xd/0x40 ? kmalloc_trace+0xaf/0xc0 ? do_init_module+0x60/0x250 ? __do_sys_finit_module+0xac/0x120 ? do_syscall_64+0x37/0x90 ? entry_SYSCALL_64_after_hwframe+0x72/0xdc </TASK> In unregister_fprobe function we can't release fp->rethook while it's possible there are some of its users still running on another cpu.
Moving rethook_free call after fp->ops is unregistered with unregister_ftrace_function call.
(CVE-2023-53557)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53557
https://ubuntu.com/security/CVE-2023-53557

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53557

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269392 - Linux Distros Unpatched Vulnerability : CVE-2023-53567
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- spi: qup: Don't skip cleanup in remove's error path Returning early in a platform driver's remove callback is wrong. In this case the dma resources are not released in the error path. this is never retried later and so this is a permanent leak. To fix this, only skip hardware disabling if waking the device fails.
(CVE-2023-53567)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53567
https://ubuntu.com/security/CVE-2023-53567

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53567

Plugin Information
Published: 2025/10/08, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269379 - Linux Distros Unpatched Vulnerability : CVE-2023-53571
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/i915: Make intel_get_crtc_new_encoder() less oopsy The point of the WARN was to print something, not oops straight up. Currently that is precisely what happens if we can't find the connector for the crtc in the atomic state. Get the dev pointer from the atomic state instead of the potentially NULL encoder to avoid that.
(cherry picked from commit 3b6692357f70498f617ea1b31a0378070a0acf1c) (CVE-2023-53571)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53571
https://ubuntu.com/security/CVE-2023-53571

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53571

Plugin Information
Published: 2025/10/08, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269416 - Linux Distros Unpatched Vulnerability : CVE-2023-53574
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: rtw88: delete timer and free skb queue when unloading Fix possible crash and memory leak on driver unload by deleting TX purge timer and freeing C2H queue in 'rtw_core_deinit()', shrink critical section in the latter by freeing COEX queue out of TX report lock scope. (CVE-2023-53574)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53574
https://security-tracker.debian.org/tracker/CVE-2023-53574
https://ubuntu.com/security/CVE-2023-53574

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53574

Plugin Information
Published: 2025/10/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269395 - Linux Distros Unpatched Vulnerability : CVE-2023-53589
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: iwlwifi: mvm: don't trust firmware n_channels If the firmware sends us a corrupted MCC response with n_channels much larger than the command response can be, we might copy far too much (uninitialized) memory and even crash if the n_channels is large enough to make it run out of the one page allocated for the FW response. Fix that by checking the lengths. Doing a < comparison would be sufficient, but the firmware should be doing it correctly, so check more strictly. (CVE-2023-53589)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53589
https://ubuntu.com/security/CVE-2023-53589

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53589

Plugin Information
Published: 2025/10/08, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269393 - Linux Distros Unpatched Vulnerability : CVE-2023-53593
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cifs: Release folio lock on fscache read hit. Under the current code, when cifs_readpage_worker is called, the call contract is that the callee should unlock the page. This is documented in the read_folio section of Documentation/filesystems/vfs.rst as: > The filesystem should unlock the folio once the read has completed, > whether it was successful or not. Without this change, when fscache is in use and cache hit occurs during a read, the page lock is leaked, producing the following stack on subsequent reads (via mmap) to the page: $ cat /proc/3890/task/12864/stack [<0>] folio_wait_bit_common+0x124/0x350 [<0>] filemap_read_folio+0xad/0xf0 [<0>] filemap_fault+0x8b1/0xab0 [<0>] __do_fault+0x39/0x150 [<0>] do_fault+0x25c/0x3e0 [<0>] __handle_mm_fault+0x6ca/0xc70 [<0>] handle_mm_fault+0xe9/0x350 [<0>] do_user_addr_fault+0x225/0x6c0 [<0>] exc_page_fault+0x84/0x1b0 [<0>] asm_exc_page_fault+0x27/0x30 This requires a reboot to resolve; it is a deadlock. Note however that the call to cifs_readpage_from_fscache does mark the page clean, but does not free the folio lock. This happens in __cifs_readpage_from_fscache on success. Releasing the lock at that point however is not appropriate as cifs_readahead also calls cifs_readpage_from_fscache and *does* unconditionally release the lock after its return. This change therefore effectively makes cifs_readpage_worker work like cifs_readahead. (CVE-2023-53593)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53593
https://ubuntu.com/security/CVE-2023-53593

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53593

Plugin Information
Published: 2025/10/08, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269387 - Linux Distros Unpatched Vulnerability : CVE-2023-53600
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tunnels: fix kasan splat when generating ipv4 pmtu error If we try to emit an icmp error in response to a nonliner skb, we get BUG:
KASAN: slab-out-of-bounds in ip_compute_csum+0x134/0x220 Read of size 4 at addr ffff88811c50db00 by task iperf3/1691 CPU: 2 PID: 1691 Comm: iperf3 Not tainted 6.5.0-rc3+ #309 [..] kasan_report+0x105/0x140 ip_compute_csum+0x134/0x220 iptunnel_pmtud_build_icmp+0x554/0x1020 skb_tunnel_check_pmtu+0x513/0xb80 vxlan_xmit_one+0x139e/0x2ef0 vxlan_xmit+0x1867/0x2760 dev_hard_start_xmit+0x1ee/0x4f0 br_dev_queue_push_xmit+0x4d1/0x660 [..] ip_compute_csum() cannot deal with nonlinear skbs, so avoid it.
After this change, splat is gone and iperf3 is no longer stuck. (CVE-2023-53600)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53600
https://ubuntu.com/security/CVE-2023-53600

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53600

Plugin Information
Published: 2025/10/08, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269383 - Linux Distros Unpatched Vulnerability : CVE-2023-53601
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bonding: do not assume skb mac_header is set Drivers must not assume in their ndo_start_xmit() that skbs have their mac_header set. skb->data is all what is needed. bonding seems to be one of the last offender as caught by syzbot: WARNING: CPU: 1 PID:
12155 at include/linux/skbuff.h:2907 skb_mac_offset include/linux/skbuff.h:2913 [inline] WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_xmit_hash drivers/net/bonding/bond_main.c:4170 [inline] WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5149 [inline] WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_3ad_xor_xmit drivers/net/bonding/bond_main.c:5186 [inline] WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 __bond_start_xmit drivers/net/bonding/bond_main.c:5442 [inline] WARNING: CPU:
1 PID: 12155 at include/linux/skbuff.h:2907 bond_start_xmit+0x14ab/0x19d0 drivers/net/bonding/bond_main.c:5470 Modules linked in: CPU: 1 PID: 12155 Comm: syz-executor.3 Not tainted 6.1.30-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 RIP: 0010:skb_mac_header include/linux/skbuff.h:2907 [inline] RIP: 0010:skb_mac_offset include/linux/skbuff.h:2913 [inline] RIP: 0010:bond_xmit_hash drivers/net/bonding/bond_main.c:4170 [inline] RIP: 0010:bond_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5149 [inline] RIP:
0010:bond_3ad_xor_xmit drivers/net/bonding/bond_main.c:5186 [inline] RIP: 0010:__bond_start_xmit drivers/net/bonding/bond_main.c:5442 [inline] RIP: 0010:bond_start_xmit+0x14ab/0x19d0 drivers/net/bonding/bond_main.c:5470 Code: 8b 7c 24 30 e8 76 dd 1a 01 48 85 c0 74 0d 48 89 c3 e8 29 67 2e fe e9 15 ef ff ff e8 1f 67 2e fe e9 10 ef ff ff e8 15 67 2e fe <0f> 0b e9 45 f8 ff ff e8 09 67 2e fe e9 dc fa ff ff e8 ff 66 2e fe RSP: 0018:ffffc90002fff6e0 EFLAGS: 00010283 RAX: ffffffff835874db RBX:
000000000000ffff RCX: 0000000000040000 RDX: ffffc90004dcf000 RSI: 00000000000000b5 RDI: 00000000000000b6 RBP: ffffc90002fff8b8 R08: ffffffff83586d16 R09: ffffffff83586584 R10: 0000000000000007 R11:
ffff8881599fc780 R12: ffff88811b6a7b7e R13: 1ffff110236d4f6f R14: ffff88811b6a7ac0 R15: 1ffff110236d4f76 FS: 00007f2e9eb47700(0000) GS:ffff8881f6b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2e421000 CR3: 000000010e6d4000 CR4: 00000000003526e0 DR0:
0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> [<ffffffff8471a49f>] netdev_start_xmit include/linux/netdevice.h:4925 [inline] [<ffffffff8471a49f>] __dev_direct_xmit+0x4ef/0x850 net/core/dev.c:4380 [<ffffffff851d845b>] dev_direct_xmit include/linux/netdevice.h:3043 [inline] [<ffffffff851d845b>] packet_direct_xmit+0x18b/0x300 net/packet/af_packet.c:284 [<ffffffff851c7472>] packet_snd net/packet/af_packet.c:3112 [inline] [<ffffffff851c7472>] packet_sendmsg+0x4a22/0x64d0 net/packet/af_packet.c:3143 [<ffffffff8467a4b2>] sock_sendmsg_nosec net/socket.c:716 [inline] [<ffffffff8467a4b2>] sock_sendmsg net/socket.c:736 [inline] [<ffffffff8467a4b2>] __sys_sendto+0x472/0x5f0 net/socket.c:2139 [<ffffffff8467a715>] __do_sys_sendto net/socket.c:2151 [inline] [<ffffffff8467a715>]
__se_sys_sendto net/socket.c:2147 [inline] [<ffffffff8467a715>] __x64_sys_sendto+0xe5/0x100 net/socket.c:2147 [<ffffffff8553071f>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<ffffffff8553071f>] do_syscall_64+0x2f/0x50 arch/x86/entry/common.c:80 [<ffffffff85600087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd (CVE-2023-53601)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53601
https://ubuntu.com/security/CVE-2023-53601

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53601

Plugin Information
Published: 2025/10/08, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269433 - Linux Distros Unpatched Vulnerability : CVE-2023-53603
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: qla2xxx: Avoid fcport pointer dereference Klocwork reported warning of NULL pointer may be dereferenced. The routine exits when sa_ctl is NULL and fcport is allocated after the exit call thus causing NULL fcport pointer to dereference at the time of exit. To avoid fcport pointer dereference, exit the routine when sa_ctl is NULL. (CVE-2023-53603)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53603
https://ubuntu.com/security/CVE-2023-53603

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53603

Plugin Information
Published: 2025/10/08, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269353 - Linux Distros Unpatched Vulnerability : CVE-2023-53604
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path Otherwise the journal_io_cache will leak if dm_register_target() fails. (CVE-2023-53604)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53604
https://ubuntu.com/security/CVE-2023-53604

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53604

Plugin Information
Published: 2025/10/08, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
270239 - Linux Distros Unpatched Vulnerability : CVE-2023-53621
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: memcontrol: ensure memcg acquired by id is properly set up In the eviction recency check, we attempt to retrieve the memcg to which the folio belonged when it was evicted, by the memcg id stored in the shadow entry. However, there is a chance that the retrieved memcg is not the original memcg that has been killed, but a new one which happens to have the same id. This is a somewhat unfortunate, but acceptable and rare inaccuracy in the heuristics.
However, if we retrieve this new memcg between its allocation and when it is properly attached to the memcg hierarchy, we could run into the following NULL pointer exception during the memcg hierarchy traversal done in mem_cgroup_get_nr_swap_pages(): [ 155757.793456] BUG: kernel NULL pointer dereference, address: 00000000000000c0 [ 155757.807568] #PF: supervisor read access in kernel mode [ 155757.818024] #PF: error_code(0x0000) - not-present page [ 155757.828482] PGD 401f77067 P4D 401f77067 PUD 401f76067 PMD 0 [ 155757.839985] Oops: 0000 [#1] SMP [ 155757.887870] RIP: 0010:mem_cgroup_get_nr_swap_pages+0x3d/0xb0 [ 155757.899377] Code: 29 19 4a 02 48 39 f9 74 63 48 8b 97 c0 00 00 00 48 8b b7 58 02 00 00 48 2b b7 c0 01 00 00 48 39 f0 48 0f 4d c6 48 39 d1 74 42 <48> 8b b2 c0 00 00 00 48 8b ba 58 02 00 00 48 2b ba c0 01 00 00 48 [ 155757.937125] RSP: 0018:ffffc9002ecdfbc8 EFLAGS: 00010286 [ 155757.947755] RAX: 00000000003a3b1c RBX: 000007ffffffffff RCX: ffff888280183000 [ 155757.962202] RDX: 0000000000000000 RSI: 0007ffffffffffff RDI: ffff888bbc2d1000 [ 155757.976648] RBP: 0000000000000001 R08: 000000000000000b R09: ffff888ad9cedba0 [ 155757.991094] R10: ffffea0039c07900 R11: 0000000000000010 R12: ffff888b23a7b000 [ 155758.005540] R13:
0000000000000000 R14: ffff888bbc2d1000 R15: 000007ffffc71354 [ 155758.019991] FS: 00007f6234c68640(0000) GS:ffff88903f9c0000(0000) knlGS:0000000000000000 [ 155758.036356] CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 [ 155758.048023] CR2: 00000000000000c0 CR3: 0000000a83eb8004 CR4: 00000000007706e0 [ 155758.062473] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 155758.076924] DR3:
0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 155758.091376] PKRU: 55555554 [ 155758.096957] Call Trace: [ 155758.102016] <TASK> [ 155758.106502] ? __die+0x78/0xc0 [ 155758.112793] ? page_fault_oops+0x286/0x380 [ 155758.121175] ? exc_page_fault+0x5d/0x110 [ 155758.129209] ? asm_exc_page_fault+0x22/0x30 [ 155758.137763] ? mem_cgroup_get_nr_swap_pages+0x3d/0xb0 [ 155758.148060] workingset_test_recent+0xda/0x1b0 [ 155758.157133] workingset_refault+0xca/0x1e0 [ 155758.165508] filemap_add_folio+0x4d/0x70 [ 155758.173538] page_cache_ra_unbounded+0xed/0x190 [ 155758.182919] page_cache_sync_ra+0xd6/0x1e0 [ 155758.191738] filemap_read+0x68d/0xdf0 [ 155758.199495] ? mlx5e_napi_poll+0x123/0x940 [ 155758.207981] ? __napi_schedule+0x55/0x90 [ 155758.216095]
__x64_sys_pread64+0x1d6/0x2c0 [ 155758.224601] do_syscall_64+0x3d/0x80 [ 155758.232058] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 155758.242473] RIP: 0033:0x7f62c29153b5 [ 155758.249938] Code:
e8 48 89 75 f0 89 7d f8 48 89 4d e0 e8 b4 e6 f7 ff 41 89 c0 4c 8b 55 e0 48 8b 55 e8 48 8b 75 f0 8b 7d f8 b8 11 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 45 f8 e8 e7 e6 f7 ff 48 8b [ 155758.288005] RSP: 002b:00007f6234c5ffd0 EFLAGS: 00000293 ORIG_RAX: 0000000000000011 [ 155758.303474] RAX:
ffffffffffffffda RBX: 00007f628c4e70c0 RCX: 00007f62c29153b5 [ 155758.318075] RDX: 000000000003c041 RSI:
00007f61d2986000 RDI: 0000000000000076 [ 155758.332678] RBP: 00007f6234c5fff0 R08: 0000000000000000 R09:
0000000064d5230c [ 155758.347452] R10: 000000000027d450 R11: 0000000000000293 R12: 000000000003c041 [ 155758.362044] R13: 00007f61d2986000 R14: 00007f629e11b060 R15: 000000000027d450 [ 155758.376661] </TASK>
This patch fixes the issue by moving the memcg's id publication from the alloc stage to ---truncated--- (CVE-2023-53621)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53621
https://ubuntu.com/security/CVE-2023-53621

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53621

Plugin Information
Published: 2025/10/14, Modified: 2025/12/23
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
270177 - Linux Distros Unpatched Vulnerability : CVE-2023-53622
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- gfs2: Fix possible data races in gfs2_show_options() Some fields such as gt_logd_secs of the struct gfs2_tune are accessed without holding the lock gt_spin in gfs2_show_options(): val = sdp->sd_tune.gt_logd_secs; if (val != 30) seq_printf(s, ,commit=%d, val); And thus can cause data races when gfs2_show_options() and other functions such as gfs2_reconfigure() are concurrently executed:
spin_lock(>->gt_spin); gt->gt_logd_secs = newargs->ar_commit; To fix these possible data races, the lock sdp->sd_tune.gt_spin is acquired before accessing the fields of gfs2_tune and released after these accesses. Further changes by Andreas: - Don't hold the spin lock over the seq_printf operations.
(CVE-2023-53622)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53622
https://ubuntu.com/security/CVE-2023-53622

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53622

Plugin Information
Published: 2025/10/13, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
270199 - Linux Distros Unpatched Vulnerability : CVE-2023-53627
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list When freeing slots in function slot_complete_v3_hw(), it is possible that sas_dev.list is being traversed elsewhere, and it may trigger a NULL pointer exception, such as follows: ==>cq thread ==>scsi_eh_6 ==>scsi_error_handler() ==>sas_eh_handle_sas_errors() ==>sas_scsi_find_task() ==>lldd_abort_task() ==>slot_complete_v3_hw() ==>hisi_sas_abort_task() ==>hisi_sas_slot_task_free() ==>dereg_device_v3_hw() ==>list_del_init() ==>list_for_each_entry_safe() [ 7165.434918] sas: Enter sas_scsi_recover_host busy: 32 failed: 32 [ 7165.434926] sas: trying to find task 0x00000000769b5ba5 [ 7165.434927] sas: sas_scsi_find_task: aborting task 0x00000000769b5ba5 [ 7165.434940] hisi_sas_v3_hw 0000:b4:02.0: slot complete: task(00000000769b5ba5) aborted [ 7165.434964] hisi_sas_v3_hw 0000:b4:02.0: slot complete: task(00000000c9f7aa07) ignored [ 7165.434965] hisi_sas_v3_hw 0000:b4:02.0: slot complete: task(00000000e2a1cf01) ignored [ 7165.434968] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 7165.434972] hisi_sas_v3_hw 0000:b4:02.0: slot complete: task(0000000022d52d93) ignored [ 7165.434975] hisi_sas_v3_hw 0000:b4:02.0: slot complete: task(0000000066a7516c) ignored [ 7165.434976] Mem abort info: [ 7165.434982] ESR = 0x96000004 [ 7165.434991] Exception class = DABT (current EL), IL = 32 bits [ 7165.434992] SET = 0, FnV = 0 [ 7165.434993] EA = 0, S1PTW = 0 [ 7165.434994] Data abort info: [ 7165.434994] ISV = 0, ISS = 0x00000004 [ 7165.434995] CM = 0, WnR = 0 [ 7165.434997] user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000f29543f2 [ 7165.434998] [0000000000000000] pgd=0000000000000000 [ 7165.435003] Internal error:
Oops: 96000004 [#1] SMP [ 7165.439863] Process scsi_eh_6 (pid: 4109, stack limit = 0x00000000c43818d5) [ 7165.468862] pstate: 00c00009 (nzcv daif +PAN +UAO) [ 7165.473637] pc : dereg_device_v3_hw+0x68/0xa8 [hisi_sas_v3_hw] [ 7165.479443] lr : dereg_device_v3_hw+0x2c/0xa8 [hisi_sas_v3_hw] [ 7165.485247] sp :
ffff00001d623bc0 [ 7165.488546] x29: ffff00001d623bc0 x28: ffffa027d03b9508 [ 7165.493835] x27:
ffff80278ed50af0 x26: ffffa027dd31e0a8 [ 7165.499123] x25: ffffa027d9b27f88 x24: ffffa027d9b209f8 [ 7165.504411] x23: ffffa027c45b0d60 x22: ffff80278ec07c00 [ 7165.509700] x21: 0000000000000008 x20:
ffffa027d9b209f8 [ 7165.514988] x19: ffffa027d9b27f88 x18: ffffffffffffffff [ 7165.520276] x17:
0000000000000000 x16: 0000000000000000 [ 7165.525564] x15: ffff0000091d9708 x14: ffff0000093b7dc8 [ 7165.530852] x13: ffff0000093b7a23 x12: 6e7265746e692067 [ 7165.536140] x11: 0000000000000000 x10:
0000000000000bb0 [ 7165.541429] x9 : ffff00001d6238f0 x8 : ffffa027d877af00 [ 7165.546718] x7 :
ffffa027d6329600 x6 : ffff7e809f58ca00 [ 7165.552006] x5 : 0000000000001f8a x4 : 000000000000088e [ 7165.557295] x3 : ffffa027d9b27fa8 x2 : 0000000000000000 [ 7165.562583] x1 : 0000000000000000 x0 :
000000003000188e [ 7165.567872] Call trace: [ 7165.570309] dereg_device_v3_hw+0x68/0xa8 [hisi_sas_v3_hw] [ 7165.575775] hisi_sas_abort_task+0x248/0x358 [hisi_sas_main] [ 7165.581415] sas_eh_handle_sas_errors+0x258/0x8e0 [libsas] [ 7165.586876] sas_scsi_recover_host+0x134/0x458 [libsas] [ 7165.592082] scsi_error_handler+0xb4/0x488 [ 7165.596163] kthread+0x134/0x138 [ 7165.599380] ret_from_fork+0x10/0x18 [ 7165.602940] Code: d5033e9f b9000040 aa0103e2 eb03003f (f9400021) [ 7165.609004] kernel fault(0x1) notification starting on CPU 75 [ 7165.700728] ---[ end trace fc042cbbea224efc ]--- [ 7165.705326] Kernel panic - not syncing: Fatal exception To fix the issue, grab sas_dev lock when traversing the members of sas_dev.list in dereg_device_v3_hw() and hisi_sas_release_tasks() to avoid concurrency of adding and deleting member. When ---truncated--- (CVE-2023-53627)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53627
https://security-tracker.debian.org/tracker/CVE-2023-53627
https://ubuntu.com/security/CVE-2023-53627

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.0 (CVSS2#AV:L/AC:H/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53627

Plugin Information
Published: 2025/10/13, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
270165 - Linux Distros Unpatched Vulnerability : CVE-2023-53638
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: octeon_ep: cancel queued works in probe error path If it fails to get the devices's MAC address, octep_probe exits while leaving the delayed work intr_poll_task queued. When the work later runs, it's a use after free. Move the cancelation of intr_poll_task from octep_remove into octep_device_cleanup. This does not change anything in the octep_remove flow, but octep_device_cleanup is called also in the octep_probe error path, where the cancelation is needed. Note that the cancelation of ctrl_mbox_task has to follow intr_poll_task's, because the ctrl_mbox_task may be queued by intr_poll_task. (CVE-2023-53638)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53638
https://ubuntu.com/security/CVE-2023-53638

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53638

Plugin Information
Published: 2025/10/13, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
270152 - Linux Distros Unpatched Vulnerability : CVE-2023-53648
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer smatch error: sound/pci/ac97/ac97_codec.c:2354 snd_ac97_mixer() error: we previously assumed 'rac97' could be null (see line 2072) remove redundant assignment, return error if rac97 is NULL. (CVE-2023-53648)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53648
https://ubuntu.com/security/CVE-2023-53648

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53648

Plugin Information
Published: 2025/10/13, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269285 - Linux Distros Unpatched Vulnerability : CVE-2023-53667
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize Currently in cdc_ncm_check_tx_max(), if dwNtbOutMaxSize is lower than the calculated min value, but greater than zero, the logic sets tx_max to dwNtbOutMaxSize. This is then used to allocate a new SKB in cdc_ncm_fill_tx_frame() where all the data is handled. For small values of dwNtbOutMaxSize the memory allocated during alloc_skb(dwNtbOutMaxSize, GFP_ATOMIC) will have the same size, due to how size is aligned at alloc time: size = SKB_DATA_ALIGN(size); size += SKB_DATA_ALIGN(sizeof(struct skb_shared_info)); Thus we hit the same bug that we tried to squash with commit 2be6d4d16a084 (net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero) Low values of dwNtbOutMaxSize do not cause an issue presently because at alloc_skb() time more memory (512b) is allocated than required for the SKB headers alone (320b), leaving some space (512b - 320b = 192b) for CDC data (172b). However, if more elements (for example 3 x u64 = [24b]) were added to one of the SKB header structs, say 'struct skb_shared_info', increasing its original size (320b [320b aligned]) to something larger (344b [384b aligned]), then suddenly the CDC data (172b) no longer fits in the spare SKB data area (512b - 384b = 128b). Consequently the SKB bounds checking semantics fails and panics:
skbuff: skb_over_panic: text:ffffffff831f755b len:184 put:172 head:ffff88811f1c6c00 data:ffff88811f1c6c00 tail:0xb8 end:0x80 dev:<NULL> ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:113! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 57 Comm: kworker/0:2 Not tainted 5.15.106-syzkaller-00249-g19c0ed55a470 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 Workqueue: mld mld_ifc_work RIP: 0010:skb_panic net/core/skbuff.c:113 [inline] RIP: 0010:skb_over_panic+0x14c/0x150 net/core/skbuff.c:118 [snip] Call Trace: <TASK>
skb_put+0x151/0x210 net/core/skbuff.c:2047 skb_put_zero include/linux/skbuff.h:2422 [inline] cdc_ncm_ndp16 drivers/net/usb/cdc_ncm.c:1131 [inline] cdc_ncm_fill_tx_frame+0x11ab/0x3da0 drivers/net/usb/cdc_ncm.c:1308 cdc_ncm_tx_fixup+0xa3/0x100 Deal with too low values of dwNtbOutMaxSize, clamp it in the range [USB_CDC_NCM_NTB_MIN_OUT_SIZE, CDC_NCM_NTB_MAX_SIZE_TX]. We ensure enough data space is allocated to handle CDC data by making sure dwNtbOutMaxSize is not smaller than USB_CDC_NCM_NTB_MIN_OUT_SIZE.
(CVE-2023-53667)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53667
https://ubuntu.com/security/CVE-2023-53667

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53667

Plugin Information
Published: 2025/10/08, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
270187 - Linux Distros Unpatched Vulnerability : CVE-2023-53680
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL OPDESC() simply indexes into nfsd4_ops[] by the op's operation number, without range checking that value. It assumes callers are careful to avoid calling it with an out-of-bounds opnum value. nfsd4_decode_compound() is not so careful, and can invoke OPDESC() with opnum set to OP_ILLEGAL, which is 10044 -- well beyond the end of nfsd4_ops[]. (CVE-2023-53680)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53680
https://ubuntu.com/security/CVE-2023-53680

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53680

Plugin Information
Published: 2025/10/13, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
270193 - Linux Distros Unpatched Vulnerability : CVE-2023-53682
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- hwmon: (xgene) Fix ioremap and memremap leak Smatch reports: drivers/hwmon/xgene-hwmon.c:757 xgene_hwmon_probe() warn: 'ctx->pcc_comm_addr' from ioremap() not released on line: 757. This is because in drivers/hwmon/xgene-hwmon.c:701 xgene_hwmon_probe(), ioremap and memremap is not released, which may cause a leak. To fix this, ioremap and memremap is modified to devm_ioremap and devm_memremap. [groeck:
Fixed formatting and subject] (CVE-2023-53682)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53682
https://security-tracker.debian.org/tracker/CVE-2023-53682
https://ubuntu.com/security/CVE-2023-53682

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53682

Plugin Information
Published: 2025/10/13, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269271 - Linux Distros Unpatched Vulnerability : CVE-2023-53685
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tun: Fix memory leak for detached NAPI queue. syzkaller reported [0] memory leaks of sk and skb related to the TUN device with no repro, but we can reproduce it easily with: struct ifreq ifr = {} int fd_tun, fd_tmp; char buf[4] = {}; fd_tun = openat(AT_FDCWD, /dev/net/tun, O_WRONLY, 0); ifr.ifr_flags = IFF_TUN | IFF_NAPI | IFF_MULTI_QUEUE; ioctl(fd_tun, TUNSETIFF, &ifr); ifr.ifr_flags = IFF_DETACH_QUEUE;
ioctl(fd_tun, TUNSETQUEUE, &ifr); fd_tmp = socket(AF_PACKET, SOCK_PACKET, 0); ifr.ifr_flags = IFF_UP;
ioctl(fd_tmp, SIOCSIFFLAGS, &ifr); write(fd_tun, buf, sizeof(buf)); close(fd_tun); If we enable NAPI and multi-queue on a TUN device, we can put skb into tfile->sk.sk_write_queue after the queue is detached. We should prevent it by checking tfile->detached before queuing skb. Note this must be done under tfile->sk.sk_write_queue.lock because write() and ioctl(IFF_DETACH_QUEUE) can run concurrently. Otherwise, there would be a small race window: write() ioctl(IFF_DETACH_QUEUE) `- tun_get_user `- __tun_detach |- if (tfile->detached) |- tun_disable_queue | `-> false | `- tfile->detached = tun | `- tun_queue_purge |- spin_lock_bh(&queue->lock) `- __skb_queue_tail(queue, skb) Another solution is to call tun_queue_purge() when closing and reattaching the detached queue, but it could paper over another problems. Also, we do the same kind of test for IFF_NAPI_FRAGS. [0]: unreferenced object 0xffff88801edbc800 (size 2048): comm syz- executor.1, pid 33269, jiffies 4295743834 (age 18.756s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ backtrace: [<000000008c16ea3d>] __do_kmalloc_node mm/slab_common.c:965 [inline] [<000000008c16ea3d>] __kmalloc+0x4a/0x130 mm/slab_common.c:979 [<000000003addde56>] kmalloc include/linux/slab.h:563 [inline] [<000000003addde56>] sk_prot_alloc+0xef/0x1b0 net/core/sock.c:2035 [<000000003e20621f>] sk_alloc+0x36/0x2f0 net/core/sock.c:2088 [<0000000028e43843>] tun_chr_open+0x3d/0x190 drivers/net/tun.c:3438 [<000000001b0f1f28>] misc_open+0x1a6/0x1f0 drivers/char/misc.c:165 [<000000004376f706>] chrdev_open+0x111/0x300 fs/char_dev.c:414 [<00000000614d379f>] do_dentry_open+0x2f9/0x750 fs/open.c:920 [<000000008eb24774>] do_open fs/namei.c:3636 [inline] [<000000008eb24774>] path_openat+0x143f/0x1a30 fs/namei.c:3791 [<00000000955077b5>] do_filp_open+0xce/0x1c0 fs/namei.c:3818 [<00000000b78973b0>] do_sys_openat2+0xf0/0x260 fs/open.c:1356 [<00000000057be699>] do_sys_open fs/open.c:1372 [inline] [<00000000057be699>] __do_sys_openat fs/open.c:1388 [inline] [<00000000057be699>] __se_sys_openat fs/open.c:1383 [inline] [<00000000057be699>]
__x64_sys_openat+0x83/0xf0 fs/open.c:1383 [<00000000a7d2182d>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<00000000a7d2182d>] do_syscall_64+0x3c/0x90 arch/x86/entry/common.c:80 [<000000004cc4e8c4>] entry_SYSCALL_64_after_hwframe+0x72/0xdc unreferenced object 0xffff88802f671700 (size 240): comm syz- executor.1, pid 33269, jiffies 4295743854 (age 18.736s) hex dump (first 32 bytes): 68 c9 db 1e 80 88 ff ff 68 c9 db 1e 80 88 ff ff h.......h....... 00 c0 7b 2f 80 88 ff ff 00 c8 db 1e 80 88 ff ff ..{/............ backtrace: [<00000000e9d9fdb6>] __alloc_skb+0x223/0x250 net/core/skbuff.c:644 [<000000002c3e4e0b>] alloc_skb include/linux/skbuff.h:1288 [inline] [<000000002c3e4e0b>] alloc_skb_with_frags+0x6f/0x350 net/core/skbuff.c:6378 [<00000000825f98d7>] sock_alloc_send_pskb+0x3ac/0x3e0 net/core/sock.c:2729 [<00000000e9eb3df3>] tun_alloc_skb drivers/net/tun.c:1529 [inline] [< ---truncated--- (CVE-2023-53685)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53685
https://security-tracker.debian.org/tracker/CVE-2023-53685
https://ubuntu.com/security/CVE-2023-53685

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53685

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271606 - Linux Distros Unpatched Vulnerability : CVE-2023-53702
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- s390/crypto: use vector instructions only if available for ChaCha20 Commit 349d03ffd5f6 (crypto: s390 - add crypto library interface for ChaCha20) added a library interface to the s390 specific ChaCha20 implementation. However no check was added to verify if the required facilities are installed before branching into the assembler code. If compiled into the kernel, this will lead to the following crash, if vector instructions are not available: data exception: 0007 ilc:3 [#1] SMP Modules linked in: CPU: 0 PID:
1 Comm: swapper/0 Not tainted 6.3.0-rc7+ #11 Hardware name: IBM 3931 A01 704 (KVM/Linux) Krnl PSW :
0704e00180000000 000000001857277a (chacha20_vx+0x32/0x818) R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3 Krnl GPRS: 0000037f0000000a ffffffffffffff60 000000008184b000 0000000019f5c8e6 0000000000000109 0000037fffb13c58 0000037fffb13c78 0000000019bb1780 0000037fffb13c58 0000000019f5c8e6 000000008184b000 0000000000000109 00000000802d8000 0000000000000109 0000000018571ebc 0000037fffb13718 Krnl Code: 000000001857276a: c07000b1f80b larl %r7,0000000019bb1780 0000000018572770: a708000a lhi %r0,10 #0000000018572774: e78950000c36 vlm %v24,%v25,0(%r5),0 >000000001857277a: e7a060000806 vl %v26,0(%r6),0 0000000018572780: e7bf70004c36 vlm %v27,%v31,0(%r7),4 0000000018572786: e70b00000456 vlr %v0,%v27 000000001857278c: e71800000456 vlr %v1,%v24 0000000018572792: e74b00000456 vlr %v4,%v27 Call Trace:
[<000000001857277a>] chacha20_vx+0x32/0x818 Last Breaking-Event-Address: [<0000000018571eb6>] chacha20_crypt_s390.constprop.0+0x6e/0xd8 ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing:
Attempted to kill init! exitcode=0x0000000b Fix this by adding a missing MACHINE_HAS_VX check.
[agordeev@linux.ibm.com: remove duplicates in commit message] (CVE-2023-53702)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53702
https://ubuntu.com/security/CVE-2023-53702

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53702

Plugin Information
Published: 2025/10/27, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271592 - Linux Distros Unpatched Vulnerability : CVE-2023-53704
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe() Replace of_iomap() and kzalloc() with devm_of_iomap() and devm_kzalloc() which can automatically release the related memory when the device or driver is removed or unloaded to avoid potential memory leak. In this case, iounmap(anatop_base) in line 427,433 are removed as manual release is not required. Besides, referring to clk-imx8mq.c, check the return code of of_clk_add_hw_provider, if it returns negtive, print error info and unregister hws, which makes the program more robust. (CVE-2023-53704)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53704
https://ubuntu.com/security/CVE-2023-53704

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53704

Plugin Information
Published: 2025/10/27, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271590 - Linux Distros Unpatched Vulnerability : CVE-2023-53709
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ring-buffer: Handle race between rb_move_tail and rb_check_pages It seems a data race between ring_buffer writing and integrity check. That is, RB_FLAG of head_page is been updating, while at same time RB_FLAG was cleared when doing integrity check rb_check_pages(): rb_check_pages() rb_handle_head_page(): --------
-------- rb_head_page_deactivate() rb_head_page_set_normal() rb_head_page_activate() We do intergrity test of the list to check if the list is corrupted and it is still worth doing it. So, let's refactor rb_check_pages() such that we no longer clear and set flag during the list sanity checking. [1] and [2] are the test to reproduce and the crash report respectively. 1: ``` read_trace.sh while true; do # the trace file is closed after read head -1 /sys/kernel/tracing/trace > /dev/null done ``` ``` repro.sh sysctl -w kernel.panic_on_warn=1 # function tracer will writing enough data into ring_buffer echo function > /sys/kernel/tracing/current_tracer ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ``` 2: ------------[ cut here ]------------ WARNING: CPU: 9 PID: 62 at kernel/trace/ring_buffer.c:2653 rb_move_tail+0x450/0x470 Modules linked in: CPU: 9 PID: 62 Comm: ksoftirqd/9 Tainted: G W 6.2.0-rc6+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP:
0010:rb_move_tail+0x450/0x470 Code: ff ff 4c 89 c8 f0 4d 0f b1 02 48 89 c2 48 83 e2 fc 49 39 d0 75 24 83 e0 03 83 f8 02 0f 84 e1 fb ff ff 48 8b 57 10 f0 ff 42 08 <0f> 0b 83 f8 02 0f 84 ce fb ff ff e9 db RSP:
0018:ffffb5564089bd00 EFLAGS: 00000203 RAX: 0000000000000000 RBX: ffff9db385a2bf81 RCX: ffffb5564089bd18 RDX: ffff9db281110100 RSI: 0000000000000fe4 RDI: ffff9db380145400 RBP: ffff9db385a2bf80 R08:
ffff9db385a2bfc0 R09: ffff9db385a2bfc2 R10: ffff9db385a6c000 R11: ffff9db385a2bf80 R12: 0000000000000000 R13: 00000000000003e8 R14: ffff9db281110100 R15: ffffffffbb006108 FS: 0000000000000000(0000) GS:ffff9db3bdcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
00005602323024c8 CR3: 0000000022e0c000 CR4: 00000000000006e0 Call Trace: <TASK>
ring_buffer_lock_reserve+0x136/0x360 ? __do_softirq+0x287/0x2df ? __pfx_rcu_softirq_qs+0x10/0x10 trace_function+0x21/0x110 ? __pfx_rcu_softirq_qs+0x10/0x10 ? __do_softirq+0x287/0x2df function_trace_call+0xf6/0x120 0xffffffffc038f097 ? rcu_softirq_qs+0x5/0x140 rcu_softirq_qs+0x5/0x140
__do_softirq+0x287/0x2df run_ksoftirqd+0x2a/0x30 smpboot_thread_fn+0x188/0x220 ?
__pfx_smpboot_thread_fn+0x10/0x10 kthread+0xe7/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 </TASK> ---[ end trace 0000000000000000 ]--- [ crash report and test reproducer credit goes to Zheng Yejian] (CVE-2023-53709)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53709
https://ubuntu.com/security/CVE-2023-53709

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53709

Plugin Information
Published: 2025/10/27, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271609 - Linux Distros Unpatched Vulnerability : CVE-2023-53712
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ARM: 9317/1: kexec: Make smp stop calls asynchronous If a panic is triggered by a hrtimer interrupt all online cpus will be notified and set offline. But as highlighted by commit 19dbdcb8039c (smp: Warn on function calls from softirq context) this call should not be made synchronous with disabled interrupts:
softdog: Initiating panic Kernel panic - not syncing: Software Watchdog Timer expired WARNING: CPU: 1 PID:
0 at kernel/smp.c:753 smp_call_function_many_cond unwind_backtrace: show_stack dump_stack_lvl __warn warn_slowpath_fmt smp_call_function_many_cond smp_call_function crash_smp_send_stop.part.0 machine_crash_shutdown __crash_kexec panic softdog_fire __hrtimer_run_queues hrtimer_interrupt Make the smp call for machine_crash_nonpanic_core() asynchronous. (CVE-2023-53712)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53712
https://security-tracker.debian.org/tracker/CVE-2023-53712
https://ubuntu.com/security/CVE-2023-53712

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53712

Plugin Information
Published: 2025/10/27, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271619 - Linux Distros Unpatched Vulnerability : CVE-2023-53718
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ring-buffer: Do not swap cpu_buffer during resize process When ring_buffer_swap_cpu was called during resize process, the cpu buffer was swapped in the middle, resulting in incorrect state. Continuing to run in the wrong state will result in oops. This issue can be easily reproduced using the following two scripts: /tmp # cat test1.sh //#! /bin/sh for i in `seq 0 100000` do echo 2000 >
/sys/kernel/debug/tracing/buffer_size_kb sleep 0.5 echo 5000 > /sys/kernel/debug/tracing/buffer_size_kb sleep 0.5 done /tmp # cat test2.sh //#! /bin/sh for i in `seq 0 100000` do echo irqsoff >
/sys/kernel/debug/tracing/current_tracer sleep 1 echo nop > /sys/kernel/debug/tracing/current_tracer sleep 1 done /tmp # ./test1.sh & /tmp # ./test2.sh & A typical oops log is as follows, sometimes with other different oops logs. [ 231.711293] WARNING: CPU: 0 PID: 9 at kernel/trace/ring_buffer.c:2026 rb_update_pages+0x378/0x3f8 [ 231.713375] Modules linked in: [ 231.714735] CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.5.0-rc1-00276-g20edcec23f92 #15 [ 231.716750] Hardware name: linux,dummy-virt (DT) [ 231.718152] Workqueue: events update_pages_handler [ 231.719714] pstate: 60000005 (nZCv daif -PAN -UAO
-TCO -DIT -SSBS BTYPE=--) [ 231.721171] pc : rb_update_pages+0x378/0x3f8 [ 231.722212] lr :
rb_update_pages+0x25c/0x3f8 [ 231.723248] sp : ffff800082b9bd50 [ 231.724169] x29: ffff800082b9bd50 x28:
ffff8000825f7000 x27: 0000000000000000 [ 231.726102] x26: 0000000000000001 x25: fffffffffffff010 x24:
0000000000000ff0 [ 231.728122] x23: ffff0000c3a0b600 x22: ffff0000c3a0b5c0 x21: fffffffffffffe0a [ 231.730203] x20: ffff0000c3a0b600 x19: ffff0000c0102400 x18: 0000000000000000 [ 231.732329] x17:
0000000000000000 x16: 0000000000000000 x15: 0000ffffe7aa8510 [ 231.734212] x14: 0000000000000000 x13:
0000000000000000 x12: 0000000000000002 [ 231.736291] x11: ffff8000826998a8 x10: ffff800082b9baf0 x9 :
ffff800081137558 [ 231.738195] x8 : fffffc00030e82c8 x7 : 0000000000000000 x6 : 0000000000000001 [ 231.740192] x5 : ffff0000ffbafe00 x4 : 0000000000000000 x3 : 0000000000000000 [ 231.742118] x2 :
00000000000006aa x1 : 0000000000000001 x0 : ffff0000c0007208 [ 231.744196] Call trace: [ 231.744892] rb_update_pages+0x378/0x3f8 [ 231.745893] update_pages_handler+0x1c/0x38 [ 231.746893] process_one_work+0x1f0/0x468 [ 231.747852] worker_thread+0x54/0x410 [ 231.748737] kthread+0x124/0x138 [ 231.749549] ret_from_fork+0x10/0x20 [ 231.750434] ---[ end trace 0000000000000000 ]--- [ 233.720486] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 233.721696] Mem abort info: [ 233.721935] ESR = 0x0000000096000004 [ 233.722283] EC = 0x25: DABT (current EL), IL = 32 bits [ 233.722596] SET = 0, FnV = 0 [ 233.722805] EA = 0, S1PTW = 0 [ 233.723026] FSC = 0x04: level 0 translation fault [ 233.723458] Data abort info: [ 233.723734] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 233.724176] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 233.724589] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 233.725075] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000104943000 [ 233.725592] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 233.726231] Internal error: Oops:
0000000096000004 [#1] PREEMPT SMP [ 233.726720] Modules linked in: [ 233.727007] CPU: 0 PID: 9 Comm:
kworker/0:1 Tainted: G W 6.5.0-rc1-00276-g20edcec23f92 #15 [ 233.727777] Hardware name: linux,dummy-virt (DT) [ 233.728225] Workqueue: events update_pages_handler [ 233.728655] pstate: 200000c5 (nzCv daIF -PAN
-UAO -TCO -DIT -SSBS BTYPE=--) [ 233.729054] pc : rb_update_pages+0x1a8/0x3f8 [ 233.729334] lr :
rb_update_pages+0x154/0x3f8 [ 233.729592] sp : ffff800082b9bd50 [ 233.729792] x29: ffff800082b9bd50 x28:
ffff8000825f7000 x27: 00000000 ---truncated--- (CVE-2023-53718)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53718
https://ubuntu.com/security/CVE-2023-53718

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53718

Plugin Information
Published: 2025/10/27, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271570 - Linux Distros Unpatched Vulnerability : CVE-2023-53720
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Release the label when replacing existing ct entry Cited commit doesn't release the label mapping when replacing existing ct entry which leads to following memleak report: unreferenced object 0xffff8881854cf280 (size 96): comm kworker/u48:74, pid 23093, jiffies 4296664564 (age 175.944s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000002722d368>] __kmalloc+0x4b/0x1c0 [<00000000cc44e18f>] mapping_add+0x6e8/0xc90 [mlx5_core] [<000000003ad942a7>] mlx5_get_label_mapping+0x66/0xe0 [mlx5_core] [<00000000266308ac>] mlx5_tc_ct_entry_create_mod_hdr+0x1c4/0xf50 [mlx5_core] [<000000009a768b4f>] mlx5_tc_ct_entry_add_rule+0x16f/0xaf0 [mlx5_core] [<00000000a178f3e5>] mlx5_tc_ct_block_flow_offload_add+0x10cb/0x1f90 [mlx5_core] [<000000007b46c496>] mlx5_tc_ct_block_flow_offload+0x14a/0x630 [mlx5_core] [<00000000a9a18ac5>] nf_flow_offload_tuple+0x1a3/0x390 [nf_flow_table] [<00000000d0881951>] flow_offload_work_handler+0x257/0xd30 [nf_flow_table] [<000000009e4935a4>] process_one_work+0x7c2/0x13e0 [<00000000f5cd36a7>] worker_thread+0x59d/0xec0 [<00000000baed1daf>] kthread+0x28f/0x330 [<0000000063d282a4>] ret_from_fork+0x1f/0x30 Fix the issue by correctly releasing the label mapping.
(CVE-2023-53720)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53720
https://ubuntu.com/security/CVE-2023-53720

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53720

Plugin Information
Published: 2025/10/27, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271580 - Linux Distros Unpatched Vulnerability : CVE-2023-53721
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath12k: Fix a NULL pointer dereference in ath12k_mac_op_hw_scan() In ath12k_mac_op_hw_scan(), the return value of kzalloc() is directly used in memcpy(), which may lead to a NULL pointer dereference on failure of kzalloc(). Fix this bug by adding a check of arg.extraie.ptr. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4 (CVE-2023-53721)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53721
https://ubuntu.com/security/CVE-2023-53721

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53721

Plugin Information
Published: 2025/10/27, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271617 - Linux Distros Unpatched Vulnerability : CVE-2023-53728
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- posix-timers: Ensure timer ID search-loop limit is valid posix_timer_add() tries to allocate a posix timer ID by starting from the cached ID which was stored by the last successful allocation. This is done in a loop searching the ID space for a free slot one by one. The loop has to terminate when the search wrapped around to the starting point. But that's racy vs. establishing the starting point. That is read out lockless, which leads to the following problem: CPU0 CPU1 posix_timer_add() start = sig->posix_timer_id;
lock(hash_lock); ... posix_timer_add() if (++sig->posix_timer_id < 0) start = sig->posix_timer_id;
sig->posix_timer_id = 0; So CPU1 can observe a negative start value, i.e. -1, and the loop break never happens because the condition can never be true: if (sig->posix_timer_id == start) break; While this is unlikely to ever turn into an endless loop as the ID space is huge (INT_MAX), the racy read of the start value caught the attention of KCSAN and Dmitry unearthed that incorrectness. Rewrite it so that all id operations are under the hash lock. (CVE-2023-53728)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53728
https://ubuntu.com/security/CVE-2023-53728

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53728

Plugin Information
Published: 2025/10/27, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271593 - Linux Distros Unpatched Vulnerability : CVE-2023-53729
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: soc: qcom: qmi_encdec: Restrict string length in decode The QMI TLV value for strings in a lot of qmi element info structures account for null terminated strings with MAX_LEN + 1. If a string is actually MAX_LEN + 1 length, this will cause an out of bounds access when the NULL character is appended in decoding. (CVE-2023-53729)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53729
https://ubuntu.com/security/CVE-2023-53729

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53729

Plugin Information
Published: 2025/10/27, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271622 - Linux Distros Unpatched Vulnerability : CVE-2023-53730
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost adjust_inuse_and_calc_cost() use spin_lock_irq() and IRQ will be enabled when unlock. DEADLOCK might happen if we have held other locks and disabled IRQ before invoking it. Fix it by using spin_lock_irqsave() instead, which can keep IRQ state consistent with before when unlock.
================================ WARNING: inconsistent lock state 5.10.0-02758-g8e5f91fd772f #26 Not tainted -------------------------------- inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.
kworker/2:3/388 [HC0[0]:SC0[0]:HE0:SE1] takes: ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at:
spin_lock_irq ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: bfq_bio_merge+0x141/0x390 {IN-HARDIRQ-W} state was registered at: __lock_acquire+0x3d7/0x1070 lock_acquire+0x197/0x4a0 __raw_spin_lock_irqsave
_raw_spin_lock_irqsave+0x3b/0x60 bfq_idle_slice_timer_body bfq_idle_slice_timer+0x53/0x1d0
__run_hrtimer+0x477/0xa70 __hrtimer_run_queues+0x1c6/0x2d0 hrtimer_interrupt+0x302/0x9e0 local_apic_timer_interrupt __sysvec_apic_timer_interrupt+0xfd/0x420 run_sysvec_on_irqstack_cond sysvec_apic_timer_interrupt+0x46/0xa0 asm_sysvec_apic_timer_interrupt+0x12/0x20 irq event stamp: 837522 hardirqs last enabled at (837521): [<ffffffff84b9419d>] __raw_spin_unlock_irqrestore hardirqs last enabled at (837521): [<ffffffff84b9419d>] _raw_spin_unlock_irqrestore+0x3d/0x40 hardirqs last disabled at (837522): [<ffffffff84b93fa3>] __raw_spin_lock_irq hardirqs last disabled at (837522):
[<ffffffff84b93fa3>] _raw_spin_lock_irq+0x43/0x50 softirqs last enabled at (835852): [<ffffffff84e00558>]
__do_softirq+0x558/0x8ec softirqs last disabled at (835845): [<ffffffff84c010ff>] asm_call_irq_on_stack+0xf/0x20 other info that might help us debug this: Possible unsafe locking scenario:
CPU0 ---- lock(&bfqd->lock); <Interrupt> lock(&bfqd->lock); *** DEADLOCK *** 3 locks held by kworker/2:3/388: #0: ffff888107af0f38 ((wq_completion)kthrotld){+.+.}-{0:0}, at:
process_one_work+0x742/0x13f0 #1: ffff8881176bfdd8 ((work_completion)(&td->dispatch_work)){+.+.}-{0:0}, at: process_one_work+0x777/0x13f0 #2: ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: spin_lock_irq #2:
ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: bfq_bio_merge+0x141/0x390 stack backtrace: CPU: 2 PID: 388 Comm: kworker/2:3 Not tainted 5.10.0-02758-g8e5f91fd772f #26 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Workqueue: kthrotld blk_throtl_dispatch_work_fn Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x107/0x167 print_usage_bug valid_state mark_lock_irq.cold+0x32/0x3a mark_lock+0x693/0xbc0 mark_held_locks+0x9e/0xe0
__trace_hardirqs_on_caller lockdep_hardirqs_on_prepare.part.0+0x151/0x360 trace_hardirqs_on+0x5b/0x180
__raw_spin_unlock_irq _raw_spin_unlock_irq+0x24/0x40 spin_unlock_irq adjust_inuse_and_calc_cost+0x4fb/0x970 ioc_rqos_merge+0x277/0x740 __rq_qos_merge+0x62/0xb0 rq_qos_merge bio_attempt_back_merge+0x12c/0x4a0 blk_mq_sched_try_merge+0x1b6/0x4d0 bfq_bio_merge+0x24a/0x390
__blk_mq_sched_bio_merge+0xa6/0x460 blk_mq_sched_bio_merge blk_mq_submit_bio+0x2e7/0x1ee0
__submit_bio_noacct_mq+0x175/0x3b0 submit_bio_noacct+0x1fb/0x270 blk_throtl_dispatch_work_fn+0x1ef/0x2b0 process_one_work+0x83e/0x13f0 process_scheduled_works worker_thread+0x7e3/0xd80 kthread+0x353/0x470 ret_from_fork+0x1f/0x30 (CVE-2023-53730)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53730
https://ubuntu.com/security/CVE-2023-53730

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53730

Plugin Information
Published: 2025/10/27, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271579 - Linux Distros Unpatched Vulnerability : CVE-2023-53731
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netlink: fix potential deadlock in netlink_set_err() syzbot reported a possible deadlock in netlink_set_err() [1] A similar issue was fixed in commit 1d482e666b8e (netlink: disable IRQs for netlink_lock_table()) in netlink_lock_table() This patch adds IRQ safety to netlink_set_err() and
__netlink_diag_dump() which were not covered by cited commit. [1] WARNING: possible irq lock inversion dependency detected 6.4.0-rc6-syzkaller-00240-g4e9f0ec38852 #0 Not tainted syz-executor.2/23011 just changed the state of lock: ffffffff8e1a7a58 (nl_table_lock){.+.?}-{2:2}, at: netlink_set_err+0x2e/0x3a0 net/netlink/af_netlink.c:1612 but this lock was taken by another, SOFTIRQ-safe lock in the past:
(&local->queue_stop_reason_lock){..-.}-{2:2} and interrupts could create inverse lock ordering between them. other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ----
---- lock(nl_table_lock); local_irq_disable(); lock(&local->queue_stop_reason_lock); lock(nl_table_lock);
<Interrupt> lock(&local->queue_stop_reason_lock); *** DEADLOCK *** (CVE-2023-53731)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53731
https://ubuntu.com/security/CVE-2023-53731

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53731

Plugin Information
Published: 2025/10/27, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271713 - Linux Distros Unpatched Vulnerability : CVE-2023-53733
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode When u32_replace_hw_knode fails, we need to undo the tcf_bind_filter operation done at u32_set_parms. (CVE-2023-53733)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53733
https://security-tracker.debian.org/tracker/CVE-2023-53733
https://ubuntu.com/security/CVE-2023-53733

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53733

Plugin Information
Published: 2025/10/27, Modified: 2025/10/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277669 - Linux Distros Unpatched Vulnerability : CVE-2023-53753
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/amd/display: fix mapping to non-allocated address [Why] There is an issue mapping non-allocated location of memory. It would allocate gpio registers from an array out of bounds. [How] Patch correct numbers of bounds for using. (CVE-2023-53753)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53753
https://security-tracker.debian.org/tracker/CVE-2023-53753
https://ubuntu.com/security/CVE-2023-53753

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53753

Plugin Information
Published: 2025/12/08, Modified: 2025/12/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277771 - Linux Distros Unpatched Vulnerability : CVE-2023-53754
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() When if_type equals zero and pci_resource_start(pdev, PCI_64BIT_BAR4) returns false, drbl_regs_memmap_p is not remapped. This passes a NULL pointer to iounmap(), which can trigger a WARN() on certain arches. When if_type equals six and pci_resource_start(pdev, PCI_64BIT_BAR4) returns true, drbl_regs_memmap_p may has been remapped and ctrl_regs_memmap_p is not remapped. This is a resource leak and passes a NULL pointer to iounmap(). To fix these issues, we need to add null checks before iounmap(), and change some goto labels. (CVE-2023-53754)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53754
https://ubuntu.com/security/CVE-2023-53754

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53754

Plugin Information
Published: 2025/12/08, Modified: 2025/12/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277887 - Linux Distros Unpatched Vulnerability : CVE-2023-53756
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- KVM: VMX: Fix crash due to uninitialized current_vmcs KVM enables 'Enlightened VMCS' and 'Enlightened MSR Bitmap' when running as a nested hypervisor on top of Hyper-V. When MSR bitmap is updated, evmcs_touch_msr_bitmap function uses current_vmcs per-cpu variable to mark that the msr bitmap was changed. vmx_vcpu_create() modifies the msr bitmap via vmx_disable_intercept_for_msr ->
vmx_msr_bitmap_l01_changed which in the end calls this function. The function checks for current_vmcs if it is null but the check is insufficient because current_vmcs is not initialized. Because of this, the code might incorrectly write to the structure pointed by current_vmcs value left by another task.
Preemption is not disabled, the current task can be preempted and moved to another CPU while current_vmcs is accessed multiple times from evmcs_touch_msr_bitmap() which leads to crash. The manipulation of MSR bitmaps by callers happens only for vmcs01 so the solution is to use vmx->vmcs01.vmcs instead of current_vmcs. BUG: kernel NULL pointer dereference, address: 0000000000000338 PGD 4e1775067 P4D 0 Oops:
0002 [#1] PREEMPT SMP NOPTI ... RIP: 0010:vmx_msr_bitmap_l01_changed+0x39/0x50 [kvm_intel] ... Call Trace:
vmx_disable_intercept_for_msr+0x36/0x260 [kvm_intel] vmx_vcpu_create+0xe6/0x540 [kvm_intel] kvm_arch_vcpu_create+0x1d1/0x2e0 [kvm] kvm_vm_ioctl_create_vcpu+0x178/0x430 [kvm] kvm_vm_ioctl+0x53f/0x790 [kvm] __x64_sys_ioctl+0x8a/0xc0 do_syscall_64+0x5c/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd (CVE-2023-53756)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53756
https://ubuntu.com/security/CVE-2023-53756

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53756

Plugin Information
Published: 2025/12/09, Modified: 2025/12/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277779 - Linux Distros Unpatched Vulnerability : CVE-2023-53760
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: ufs: core: mcq: Fix &hwq->cq_lock deadlock issue When ufshcd_err_handler() is executed, CQ event interrupt can enter waiting for the same lock. This can happen in ufshcd_handle_mcq_cq_events() and also in ufs_mtk_mcq_intr(). The following warning message will be generated when &hwq->cq_lock is used in IRQ context with IRQ enabled. Use ufshcd_mcq_poll_cqe_lock() with spin_lock_irqsave instead of spin_lock to resolve the deadlock issue. [name:lockdep&]WARNING: inconsistent lock state [name:lockdep&]-------------------------------- [name:lockdep&]inconsistent {IN-HARDIRQ-W} -> {HARDIRQ- ON-W} usage. [name:lockdep&]kworker/u16:4/260 [HC0[0]:SC0[0]:HE1:SE1] takes: ffffff8028444600 (&hwq->cq_lock){?.-.}-{2:2}, at: ufshcd_mcq_poll_cqe_lock+0x30/0xe0 [name:lockdep&]{IN-HARDIRQ-W} state was registered at: lock_acquire+0x17c/0x33c _raw_spin_lock+0x5c/0x7c ufshcd_mcq_poll_cqe_lock+0x30/0xe0 ufs_mtk_mcq_intr+0x60/0x1bc [ufs_mediatek_mod] __handle_irq_event_percpu+0x140/0x3ec handle_irq_event+0x50/0xd8 handle_fasteoi_irq+0x148/0x2b0 generic_handle_domain_irq+0x4c/0x6c gic_handle_irq+0x58/0x134 call_on_irq_stack+0x40/0x74 do_interrupt_handler+0x84/0xe4 el1_interrupt+0x3c/0x78 <snip> Possible unsafe locking scenario: CPU0 ---- lock(&hwq->cq_lock);
<Interrupt> lock(&hwq->cq_lock); *** DEADLOCK *** 2 locks held by kworker/u16:4/260: [name:lockdep&] stack backtrace: CPU: 7 PID: 260 Comm: kworker/u16:4 Tainted: G S W OE 6.1.17-mainline-android14-2-g277223301adb #1 Workqueue: ufs_eh_wq_0 ufshcd_err_handler Call trace: dump_backtrace+0x10c/0x160 show_stack+0x20/0x30 dump_stack_lvl+0x98/0xd8 dump_stack+0x20/0x60 print_usage_bug+0x584/0x76c mark_lock_irq+0x488/0x510 mark_lock+0x1ec/0x25c __lock_acquire+0x4d8/0xffc lock_acquire+0x17c/0x33c _raw_spin_lock+0x5c/0x7c ufshcd_mcq_poll_cqe_lock+0x30/0xe0 ufshcd_poll+0x68/0x1b0 ufshcd_transfer_req_compl+0x9c/0xc8 ufshcd_err_handler+0x3bc/0xea0 process_one_work+0x2f4/0x7e8 worker_thread+0x234/0x450 kthread+0x110/0x134 ret_from_fork+0x10/0x20 (CVE-2023-53760)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53760
https://ubuntu.com/security/CVE-2023-53760

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53760

Plugin Information
Published: 2025/12/08, Modified: 2025/12/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277646 - Linux Distros Unpatched Vulnerability : CVE-2023-53765
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dm cache: free background tracker's queued work in btracker_destroy Otherwise the kernel can BUG with: [ 2245.426978] ============================================================================= [ 2245.435155] BUG bt_work (Tainted: G B W ): Objects remaining in bt_work on __kmem_cache_shutdown() [ 2245.445233]
----------------------------------------------------------------------------- [ 2245.445233] [ 2245.454879] Slab 0x00000000b0ce2b30 objects=64 used=2 fp=0x000000000a3c6a4e flags=0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) [ 2245.467300] CPU: 7 PID: 10805 Comm: lvm Kdump: loaded Tainted: G B W 6.0.0-rc2 #19 [ 2245.476078] Hardware name: Dell Inc. PowerEdge R7525/0590KW, BIOS 2.5.6 10/06/2021 [ 2245.483646] Call Trace: [ 2245.486100] <TASK> [ 2245.488206] dump_stack_lvl+0x34/0x48 [ 2245.491878] slab_err+0x95/0xcd [ 2245.495028]
__kmem_cache_shutdown.cold+0x31/0x136 [ 2245.499821] kmem_cache_destroy+0x49/0x130 [ 2245.503928] btracker_destroy+0x12/0x20 [dm_cache] [ 2245.508728] smq_destroy+0x15/0x60 [dm_cache_smq] [ 2245.513435] dm_cache_policy_destroy+0x12/0x20 [dm_cache] [ 2245.518834] destroy+0xc0/0x110 [dm_cache] [ 2245.522933] dm_table_destroy+0x5c/0x120 [dm_mod] [ 2245.527649] __dm_destroy+0x10e/0x1c0 [dm_mod] [ 2245.532102] dev_remove+0x117/0x190 [dm_mod] [ 2245.536384] ctl_ioctl+0x1a2/0x290 [dm_mod] [ 2245.540579] dm_ctl_ioctl+0xa/0x20 [dm_mod] [ 2245.544773] __x64_sys_ioctl+0x8a/0xc0 [ 2245.548524] do_syscall_64+0x5c/0x90 [ 2245.552104] ? syscall_exit_to_user_mode+0x12/0x30 [ 2245.556897] ? do_syscall_64+0x69/0x90 [ 2245.560648] ? do_syscall_64+0x69/0x90 [ 2245.564394] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 2245.569447] RIP: 0033:0x7fe52583ec6b ... [ 2245.646771]
------------[ cut here ]------------ [ 2245.651395] kmem_cache_destroy bt_work: Slab cache still has objects when called from btracker_destroy+0x12/0x20 [dm_cache] [ 2245.651408] WARNING: CPU: 7 PID: 10805 at mm/slab_common.c:478 kmem_cache_destroy+0x128/0x130 Found using: lvm2-testsuite --only cache-single- split.sh Ben bisected and found that commit 0495e337b703 (mm/slab_common: Deleting kobject in kmem_cache_destroy() without holding slab_mutex/cpu_hotplug_lock) first exposed dm-cache's incomplete cleanup of its background tracker work objects. (CVE-2023-53765)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53765
https://security-tracker.debian.org/tracker/CVE-2023-53765
https://ubuntu.com/security/CVE-2023-53765

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53765

Plugin Information
Published: 2025/12/08, Modified: 2025/12/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277916 - Linux Distros Unpatched Vulnerability : CVE-2023-53781
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smc: Fix use-after-free in tcp_write_timer_handler(). With Eric's ref tracker, syzbot finally found a repro for use-after-free in tcp_write_timer_handler() by kernel TCP sockets. [0] If SMC creates a kernel socket in __smc_create(), the kernel socket is supposed to be freed in smc_clcsock_release() by calling sock_release() when we close() the parent SMC socket. However, at the end of smc_clcsock_release(), the kernel socket's sk_state might not be TCP_CLOSE. This means that we have not called inet_csk_destroy_sock() in __tcp_close() and have not stopped the TCP timers. The kernel socket's TCP timers can be fired later, so we need to hold a refcnt for net as we do for MPTCP subflows in mptcp_subflow_create_socket(). [0]: leaked reference. sk_alloc (./include/net/net_namespace.h:335 net/core/sock.c:2108) inet_create (net/ipv4/af_inet.c:319 net/ipv4/af_inet.c:244) __sock_create (net/socket.c:1546) smc_create (net/smc/af_smc.c:3269 net/smc/af_smc.c:3284) __sock_create (net/socket.c:1546) __sys_socket (net/socket.c:1634 net/socket.c:1618 net/socket.c:1661) __x64_sys_socket (net/socket.c:1672) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) ================================================================== BUG: KASAN: slab-use-after-free in tcp_write_timer_handler (net/ipv4/tcp_timer.c:378 net/ipv4/tcp_timer.c:624 net/ipv4/tcp_timer.c:594) Read of size 1 at addr ffff888052b65e0d by task syzrepro/18091 CPU: 0 PID: 18091 Comm: syzrepro Tainted: G W 6.3.0-rc4-01174-gb5d54eb5899a #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.amzn2022.0.1 04/01/2014 Call Trace: <IRQ> dump_stack_lvl (lib/dump_stack.c:107) print_report (mm/kasan/report.c:320 mm/kasan/report.c:430) kasan_report (mm/kasan/report.c:538) tcp_write_timer_handler (net/ipv4/tcp_timer.c:378 net/ipv4/tcp_timer.c:624 net/ipv4/tcp_timer.c:594) tcp_write_timer (./include/linux/spinlock.h:390 net/ipv4/tcp_timer.c:643) call_timer_fn (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/timer.h:127 kernel/time/timer.c:1701) __run_timers.part.0 (kernel/time/timer.c:1752 kernel/time/timer.c:2022) run_timer_softirq (kernel/time/timer.c:2037) __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:572) __irq_exit_rcu (kernel/softirq.c:445 kernel/softirq.c:650) irq_exit_rcu (kernel/softirq.c:664) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1107 (discriminator 14)) </IRQ> (CVE-2023-53781)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53781
https://security-tracker.debian.org/tracker/CVE-2023-53781
https://ubuntu.com/security/CVE-2023-53781

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53781

Plugin Information
Published: 2025/12/09, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278106 - Linux Distros Unpatched Vulnerability : CVE-2023-53783
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- blk-iocost: fix divide by 0 error in calc_lcoefs() echo max of u64 to cost.model can cause divide by 0 error. # echo 8:0 rbps=18446744073709551615 > /sys/fs/cgroup/io.cost.model divide error: 0000 [#1] PREEMPT SMP RIP: 0010:calc_lcoefs+0x4c/0xc0 Call Trace: <TASK> ioc_refresh_params+0x2b3/0x4f0 ioc_cost_model_write+0x3cb/0x4c0 ? _copy_from_iter+0x6d/0x6c0 ? kernfs_fop_write_iter+0xfc/0x270 cgroup_file_write+0xa0/0x200 kernfs_fop_write_iter+0x17d/0x270 vfs_write+0x414/0x620 ksys_write+0x73/0x160
__x64_sys_write+0x1e/0x30 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd calc_lcoefs() uses the input value of cost.model in DIV_ROUND_UP_ULL, overflow would happen if bps plus IOC_PAGE_SIZE is greater than ULLONG_MAX, it can cause divide by 0 error. Fix the problem by setting basecost (CVE-2023-53783)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53783
https://ubuntu.com/security/CVE-2023-53783

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53783

Plugin Information
Published: 2025/12/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277888 - Linux Distros Unpatched Vulnerability : CVE-2023-53785
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mt76: mt7921: don't assume adequate headroom for SDIO headers mt7921_usb_sdio_tx_prepare_skb() calls mt7921_usb_sdio_write_txwi() and mt7921_skb_add_usb_sdio_hdr(), both of which blindly assume that adequate headroom will be available in the passed skb. This assumption typically is satisfied when the skb was allocated in the net core for transmission via the mt7921 netdev (although even that is only an optimization and is not strictly guaranteed), but the assumption is sometimes not satisfied when the skb originated in the receive path of another netdev and was passed through to the mt7921, such as by the bridge layer. Blindly prepending bytes to an skb is always wrong. This commit introduces a call to skb_cow_head() before the call to mt7921_usb_sdio_write_txwi() in mt7921_usb_sdio_tx_prepare_skb() to ensure that at least MT_SDIO_TXD_SIZE + MT_SDIO_HDR_SIZE bytes can be pushed onto the skb. Without this fix, I can trivially cause kernel panics by bridging an MT7921AU-based USB 802.11ax interface with an Ethernet interface on an Intel Atom-based x86 system using its onboard RTL8169 PCI Ethernet adapter and also on an ARM-based Raspberry Pi 1 using its onboard SMSC9512 USB Ethernet adapter. Note that the panics do not occur in every system configuration, as they occur only if the receiving netdev leaves less headroom in its received skbs than the mt7921 needs for its SDIO headers. Here is an example stack trace of this panic on Raspberry Pi OS Lite 2023-02-21 running kernel 6.1.24+ [1]: skb_panic from skb_push+0x44/0x48 skb_push from mt7921_usb_sdio_tx_prepare_skb+0xd4/0x190 [mt7921_common] mt7921_usb_sdio_tx_prepare_skb [mt7921_common] from mt76u_tx_queue_skb+0x94/0x1d0 [mt76_usb] mt76u_tx_queue_skb [mt76_usb] from __mt76_tx_queue_skb+0x4c/0xc8 [mt76] __mt76_tx_queue_skb [mt76] from mt76_txq_schedule.part.0+0x13c/0x398 [mt76] mt76_txq_schedule.part.0 [mt76] from mt76_txq_schedule_all+0x24/0x30 [mt76] mt76_txq_schedule_all [mt76] from mt7921_tx_worker+0x58/0xf4 [mt7921_common] mt7921_tx_worker [mt7921_common] from __mt76_worker_fn+0x9c/0xec [mt76] __mt76_worker_fn [mt76] from kthread+0xbc/0xe0 kthread from ret_from_fork+0x14/0x34 After this fix, bridging the mt7921 interface works fine on both of my previously problematic systems. [1] https://github.com/raspberrypi/firmware/tree/5c276f55a4b21345cd4d6200a504ee991851ff7a (CVE-2023-53785)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53785
https://ubuntu.com/security/CVE-2023-53785

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53785

Plugin Information
Published: 2025/12/09, Modified: 2025/12/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278058 - Linux Distros Unpatched Vulnerability : CVE-2023-53788
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() tuning_ctl_set() might have buffer overrun at (X) if it didn't break from loop by matching (A). static int tuning_ctl_set(...) { for (i = 0; i <
TUNING_CTLS_COUNT; i++) (A) if (nid == ca0132_tuning_ctls[i].nid) break; snd_hda_power_up(...); (X) dspio_set_param(..., ca0132_tuning_ctls[i].mid, ...); snd_hda_power_down(...); ^ return 1; } We will get below error by cppcheck sound/pci/hda/patch_ca0132.c:4229:2: note: After for loop, i has value 12 for (i = 0; i < TUNING_CTLS_COUNT; i++) ^ sound/pci/hda/patch_ca0132.c:4234:43: note: Array index out of bounds dspio_set_param(codec, ca0132_tuning_ctls[i].mid, 0x20, ^ This patch cares non match case.
(CVE-2023-53788)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53788
https://ubuntu.com/security/CVE-2023-53788

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53788

Plugin Information
Published: 2025/12/10, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278108 - Linux Distros Unpatched Vulnerability : CVE-2023-53790
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Zeroing allocated object from slab in bpf memory allocator Currently the freed element in bpf memory allocator may be immediately reused, for htab map the reuse will reinitialize special fields in map value (e.g., bpf_spin_lock), but lookup procedure may still access these special fields, and it may lead to hard-lockup as shown below: NMI backtrace for cpu 16 CPU: 16 PID: 2574 Comm: htab.bin Tainted: G L 6.1.0+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), RIP: 0010:queued_spin_lock_slowpath+0x283/0x2c0 ...... Call Trace: <TASK> copy_map_value_locked+0xb7/0x170 bpf_map_copy_value+0x113/0x3c0
__sys_bpf+0x1c67/0x2780 __x64_sys_bpf+0x1c/0x20 do_syscall_64+0x30/0x60 entry_SYSCALL_64_after_hwframe+0x46/0xb0 ...... </TASK> For htab map, just like the preallocated case, these is no need to initialize these special fields in map value again once these fields have been initialized. For preallocated htab map, these fields are initialized through __GFP_ZERO in bpf_map_area_alloc(), so do the similar thing for non-preallocated htab in bpf memory allocator. And there is no need to use __GFP_ZERO for per-cpu bpf memory allocator, because __alloc_percpu_gfp() does it implicitly. (CVE-2023-53790)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53790
https://ubuntu.com/security/CVE-2023-53790

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53790

Plugin Information
Published: 2025/12/10, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278056 - Linux Distros Unpatched Vulnerability : CVE-2023-53793
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- perf tool x86: Fix perf_env memory leak Found by leak sanitizer: ``` ==1632594==ERROR: LeakSanitizer:
detected memory leaks Direct leak of 21 byte(s) in 1 object(s) allocated from: #0 0x7f2953a7077b in
__interceptor_strdup ../../../../src/libsanitizer/asan/asan_interceptors.cpp:439 #1 0x556701d6fbbf in perf_env__read_cpuid util/env.c:369 #2 0x556701d70589 in perf_env__cpuid util/env.c:465 #3 0x55670204bba2 in x86__is_amd_cpu arch/x86/util/env.c:14 #4 0x5567020487a2 in arch__post_evsel_config arch/x86/util/evsel.c:83 #5 0x556701d8f78b in evsel__config util/evsel.c:1366 #6 0x556701ef5872 in evlist__config util/record.c:108 #7 0x556701cd6bcd in test__PERF_RECORD tests/perf-record.c:112 #8 0x556701cacd07 in run_test tests/builtin-test.c:236 #9 0x556701cacfac in test_and_print tests/builtin- test.c:265 #10 0x556701cadddb in __cmd_test tests/builtin-test.c:402 #11 0x556701caf2aa in cmd_test tests/builtin-test.c:559 #12 0x556701d3b557 in run_builtin tools/perf/perf.c:323 #13 0x556701d3bac8 in handle_internal_command tools/perf/perf.c:377 #14 0x556701d3be90 in run_argv tools/perf/perf.c:421 #15 0x556701d3c3f8 in main tools/perf/perf.c:537 #16 0x7f2952a46189 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 SUMMARY: AddressSanitizer: 21 byte(s) leaked in 1 allocation(s).
``` (CVE-2023-53793)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53793
https://ubuntu.com/security/CVE-2023-53793

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53793

Plugin Information
Published: 2025/12/10, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278095 - Linux Distros Unpatched Vulnerability : CVE-2023-53798
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ethtool: Fix uninitialized number of lanes It is not possible to set the number of lanes when setting link modes using the legacy IOCTL ethtool interface. Since 'struct ethtool_link_ksettings' is not initialized in this path, drivers receive an uninitialized number of lanes in 'struct ethtool_link_ksettings::lanes'.
When this information is later queried from drivers, it results in the ethtool code making decisions based on uninitialized memory, leading to the following KMSAN splat [1]. In practice, this most likely only happens with the tun driver that simply returns whatever it got in the set operation. As far as I can tell, this uninitialized memory is not leaked to user space thanks to the 'ethtool_ops->cap_link_lanes_supported' check in linkmodes_prepare_data(). Fix by initializing the structure in the IOCTL path. Did not find any more call sites that pass an uninitialized structure when calling 'ethtool_ops::set_link_ksettings()'. [1] BUG: KMSAN: uninit-value in ethnl_update_linkmodes net/ethtool/linkmodes.c:273 [inline] BUG: KMSAN: uninit-value in ethnl_set_linkmodes+0x190b/0x19d0 net/ethtool/linkmodes.c:333 ethnl_update_linkmodes net/ethtool/linkmodes.c:273 [inline] ethnl_set_linkmodes+0x190b/0x19d0 net/ethtool/linkmodes.c:333 ethnl_default_set_doit+0x88d/0xde0 net/ethtool/netlink.c:640 genl_family_rcv_msg_doit net/netlink/genetlink.c:968 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline] genl_rcv_msg+0x141a/0x14c0 net/netlink/genetlink.c:1065 netlink_rcv_skb+0x3f8/0x750 net/netlink/af_netlink.c:2577 genl_rcv+0x40/0x60 net/netlink/genetlink.c:1076 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0xf41/0x1270 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x127d/0x1430 net/netlink/af_netlink.c:1942 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] ____sys_sendmsg+0xa24/0xe40 net/socket.c:2501 ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2555
__sys_sendmsg net/socket.c:2584 [inline] __do_sys_sendmsg net/socket.c:2593 [inline] __se_sys_sendmsg net/socket.c:2591 [inline] __x64_sys_sendmsg+0x36b/0x540 net/socket.c:2591 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was stored to memory at: tun_get_link_ksettings+0x37/0x60 drivers/net/tun.c:3544 __ethtool_get_link_ksettings+0x17b/0x260 net/ethtool/ioctl.c:441 ethnl_set_linkmodes+0xee/0x19d0 net/ethtool/linkmodes.c:327 ethnl_default_set_doit+0x88d/0xde0 net/ethtool/netlink.c:640 genl_family_rcv_msg_doit net/netlink/genetlink.c:968 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline] genl_rcv_msg+0x141a/0x14c0 net/netlink/genetlink.c:1065 netlink_rcv_skb+0x3f8/0x750 net/netlink/af_netlink.c:2577 genl_rcv+0x40/0x60 net/netlink/genetlink.c:1076 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0xf41/0x1270 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x127d/0x1430 net/netlink/af_netlink.c:1942 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] ____sys_sendmsg+0xa24/0xe40 net/socket.c:2501 ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2555
__sys_sendmsg net/socket.c:2584 [inline] __do_sys_sendmsg net/socket.c:2593 [inline] __se_sys_sendmsg net/socket.c:2591 [inline] __x64_sys_sendmsg+0x36b/0x540 net/socket.c:2591 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was stored to memory at: tun_set_link_ksettings+0x37/0x60 drivers/net/tun.c:3553 ethtool_set_link_ksettings+0x600/0x690 net/ethtool/ioctl.c:609 __dev_ethtool net/ethtool/ioctl.c:3024 [inline] dev_ethtool+0x1db9/0x2a70 net/ethtool/ioctl.c:3078 dev_ioctl+0xb07/0x1270 net/core/dev_ioctl.c:524 sock_do_ioctl+0x295/0x540 net/socket.c:1213 sock_i
---truncated--- (CVE-2023-53798)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53798
https://ubuntu.com/security/CVE-2023-53798

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)
CVSS v3.0 Temporal Score
5.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.2 (CVSS2#AV:L/AC:L/Au:S/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53798

Plugin Information
Published: 2025/12/10, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277912 - Linux Distros Unpatched Vulnerability : CVE-2023-53806
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/amd/display: populate subvp cmd info only for the top pipe [Why] System restart observed while changing the display resolution to 8k with extended mode. Sytem restart was caused by a page fault. [How] When the driver populates subvp info it did it for both the pipes using vblank which caused an outof bounds array access causing the page fault. added checks to allow the top pipe only to fix this issue.
(CVE-2023-53806)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53806
https://security-tracker.debian.org/tracker/CVE-2023-53806
https://ubuntu.com/security/CVE-2023-53806

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53806

Plugin Information
Published: 2025/12/09, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278100 - Linux Distros Unpatched Vulnerability : CVE-2023-53809
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register() When a file descriptor of pppol2tp socket is passed as file descriptor of UDP socket, a recursive deadlock occurs in l2tp_tunnel_register().
This situation is reproduced by the following program: int main(void) { int sock; struct sockaddr_pppol2tp addr; sock = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP); if (sock < 0) { perror(socket); return 1; } addr.sa_family = AF_PPPOX; addr.sa_protocol = PX_PROTO_OL2TP; addr.pppol2tp.pid = 0; addr.pppol2tp.fd = sock; addr.pppol2tp.addr.sin_family = PF_INET; addr.pppol2tp.addr.sin_port = htons(0);
addr.pppol2tp.addr.sin_addr.s_addr = inet_addr(192.168.0.1); addr.pppol2tp.s_tunnel = 1;
addr.pppol2tp.s_session = 0; addr.pppol2tp.d_tunnel = 0; addr.pppol2tp.d_session = 0; if (connect(sock, (const struct sockaddr *)&addr, sizeof(addr)) < 0) { perror(connect); return 1; } return 0; } This program causes the following lockdep warning: ============================================ WARNING:
possible recursive locking detected 6.2.0-rc5-00205-gc96618275234 #56 Not tainted
-------------------------------------------- repro/8607 is trying to acquire lock: ffff8880213c8130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: l2tp_tunnel_register+0x2b7/0x11c0 but task is already holding lock:
ffff8880213c8130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: pppol2tp_connect+0xa82/0x1a30 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(sk_lock-AF_PPPOX); lock(sk_lock- AF_PPPOX); *** DEADLOCK *** May be due to missing lock nesting notation 1 lock held by repro/8607: #0:
ffff8880213c8130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: pppol2tp_connect+0xa82/0x1a30 stack backtrace: CPU: 0 PID: 8607 Comm: repro Not tainted 6.2.0-rc5-00205-gc96618275234 #56 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x100/0x178
__lock_acquire.cold+0x119/0x3b9 ? lockdep_hardirqs_on_prepare+0x410/0x410 lock_acquire+0x1e0/0x610 ? l2tp_tunnel_register+0x2b7/0x11c0 ? lock_downgrade+0x710/0x710 ? __fget_files+0x283/0x3e0 lock_sock_nested+0x3a/0xf0 ? l2tp_tunnel_register+0x2b7/0x11c0 l2tp_tunnel_register+0x2b7/0x11c0 ? sprintf+0xc4/0x100 ? l2tp_tunnel_del_work+0x6b0/0x6b0 ? debug_object_deactivate+0x320/0x320 ? lockdep_init_map_type+0x16d/0x7a0 ? lockdep_init_map_type+0x16d/0x7a0 ? l2tp_tunnel_create+0x2bf/0x4b0 ? l2tp_tunnel_create+0x3c6/0x4b0 pppol2tp_connect+0x14e1/0x1a30 ? pppol2tp_put_sk+0xd0/0xd0 ? aa_sk_perm+0x2b7/0xa80 ? aa_af_perm+0x260/0x260 ? bpf_lsm_socket_connect+0x9/0x10 ? pppol2tp_put_sk+0xd0/0xd0 __sys_connect_file+0x14f/0x190 __sys_connect+0x133/0x160 ?
__sys_connect_file+0x190/0x190 ? lockdep_hardirqs_on+0x7d/0x100 ? ktime_get_coarse_real_ts64+0x1b7/0x200 ? ktime_get_coarse_real_ts64+0x147/0x200 ? __audit_syscall_entry+0x396/0x500 __x64_sys_connect+0x72/0xb0 do_syscall_64+0x38/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd This patch fixes the issue by getting/creating the tunnel before locking the pppol2tp socket. (CVE-2023-53809)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53809
https://ubuntu.com/security/CVE-2023-53809

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53809

Plugin Information
Published: 2025/12/10, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278107 - Linux Distros Unpatched Vulnerability : CVE-2023-53811
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA/irdma: Cap MSIX used to online CPUs + 1 The irdma driver can use a maximum number of msix vectors equal to num_online_cpus() + 1 and the kernel warning stack below is shown if that number is exceeded. The kernel throws a warning as the driver tries to update the affinity hint with a CPU mask greater than the max CPU IDs. Fix this by capping the MSIX vectors to num_online_cpus() + 1. WARNING: CPU: 7 PID: 23655 at include/linux/cpumask.h:106 irdma_cfg_ceq_vector+0x34c/0x3f0 [irdma] RIP:
0010:irdma_cfg_ceq_vector+0x34c/0x3f0 [irdma] Call Trace: irdma_rt_init_hw+0xa62/0x1290 [irdma] ? irdma_alloc_local_mac_entry+0x1a0/0x1a0 [irdma] ? __is_kernel_percpu_address+0x63/0x310 ? rcu_read_lock_held_common+0xe/0xb0 ? irdma_lan_unregister_qset+0x280/0x280 [irdma] ? irdma_request_reset+0x80/0x80 [irdma] ? ice_get_qos_params+0x84/0x390 [ice] irdma_probe+0xa40/0xfc0 [irdma] ? rcu_read_lock_bh_held+0xd0/0xd0 ? irdma_remove+0x140/0x140 [irdma] ? rcu_read_lock_sched_held+0x62/0xe0 ? down_write+0x187/0x3d0 ? auxiliary_match_id+0xf0/0x1a0 ? irdma_remove+0x140/0x140 [irdma] auxiliary_bus_probe+0xa6/0x100 __driver_probe_device+0x4a4/0xd50 ?
__device_attach_driver+0x2c0/0x2c0 driver_probe_device+0x4a/0x110 __driver_attach+0x1aa/0x350 bus_for_each_dev+0x11d/0x1b0 ? subsys_dev_iter_init+0xe0/0xe0 bus_add_driver+0x3b1/0x610 driver_register+0x18e/0x410 ? 0xffffffffc0b88000 irdma_init_module+0x50/0xaa [irdma] do_one_initcall+0x103/0x5f0 ? perf_trace_initcall_level+0x420/0x420 ? do_init_module+0x4e/0x700 ?
__kasan_kmalloc+0x7d/0xa0 ? kmem_cache_alloc_trace+0x188/0x2b0 ? kasan_unpoison+0x21/0x50 do_init_module+0x1d1/0x700 load_module+0x3867/0x5260 ? layout_and_allocate+0x3990/0x3990 ? rcu_read_lock_held_common+0xe/0xb0 ? rcu_read_lock_sched_held+0x62/0xe0 ? rcu_read_lock_bh_held+0xd0/0xd0 ? __vmalloc_node_range+0x46b/0x890 ? lock_release+0x5c8/0xba0 ? alloc_vm_area+0x120/0x120 ? selinux_kernel_module_from_file+0x2a5/0x300 ? __inode_security_revalidate+0xf0/0xf0 ?
__do_sys_init_module+0x1db/0x260 __do_sys_init_module+0x1db/0x260 ? load_module+0x5260/0x5260 ? do_syscall_64+0x22/0x450 do_syscall_64+0xa5/0x450 entry_SYSCALL_64_after_hwframe+0x66/0xdb (CVE-2023-53811)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53811
https://ubuntu.com/security/CVE-2023-53811

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53811

Plugin Information
Published: 2025/12/10, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278062 - Linux Distros Unpatched Vulnerability : CVE-2023-53814
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- PCI: Fix dropping valid root bus resources with .end = zero On r8a7791/koelsch: kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak) # cat /sys/kernel/debug/kmemleak unreferenced object 0xc3a34e00 (size 64): comm swapper/0, pid 1, jiffies 4294937460 (age 199.080s) hex dump (first 32 bytes): b4 5d 81 f0 b4 5d 81 f0 c0 b0 a2 c3 00 00 00 00 .]...].......... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<fe3aa979>] __kmalloc+0xf0/0x140 [<34bd6bc0>] resource_list_create_entry+0x18/0x38 [<767046bc>] pci_add_resource_offset+0x20/0x68 [<b3f3edf2>] devm_of_pci_get_host_bridge_resources.constprop.0+0xb0/0x390 When coalescing two resources for a contiguous aperture, the second resource is enlarged to cover the full contiguous range, while the first resource is marked invalid. This invalidation is done by clearing the flags, start, and end members. When adding the initial resources to the bus later, invalid resources are skipped. Unfortunately, the check for an invalid resource considers only the end member, causing false positives. E.g. on r8a7791/koelsch, root bus resource 0 (bus 00) is skipped, and no longer registered with pci_bus_insert_busn_res() (causing the memory leak), nor printed: pci-rcar-gen2 ee090000.pci: host bridge /soc/pci@ee090000 ranges: pci-rcar-gen2 ee090000.pci: MEM 0x00ee080000..0x00ee08ffff -> 0x00ee080000 pci-rcar-gen2 ee090000.pci: PCI: revision 11 pci-rcar-gen2 ee090000.pci: PCI host bridge to bus 0000:00 -pci_bus 0000:00: root bus resource [bus 00] pci_bus 0000:00: root bus resource [mem 0xee080000-0xee08ffff] Fix this by only skipping resources where all of the flags, start, and end members are zero. (CVE-2023-53814)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53814
https://ubuntu.com/security/CVE-2023-53814

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53814

Plugin Information
Published: 2025/12/10, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277874 - Linux Distros Unpatched Vulnerability : CVE-2023-53822
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath11k: Ignore frags from uninitialized peer in dp. When max virtual ap interfaces are configured in all the bands with ACS and hostapd restart is done every 60s, a crash is observed at random times. In this certain scenario, a fragmented packet is received for self peer, for which rx_tid and rx_frags are not initialized in datapath. While handling this fragment, crash is observed as the rx_frag list is uninitialised and when we walk in ath11k_dp_rx_h_sort_frags, skb null leads to exception. To address this, before processing received fragments we check dp_setup_done flag is set to ensure that peer has completed its dp peer setup for fragment queue, else ignore processing the fragments. Call trace:
ath11k_dp_process_rx_err+0x550/0x1084 [ath11k] ath11k_dp_service_srng+0x70/0x370 [ath11k] 0xffffffc009693a04 __napi_poll+0x30/0xa4 net_rx_action+0x118/0x270 __do_softirq+0x10c/0x244 irq_exit+0x64/0xb4 __handle_domain_irq+0x88/0xac gic_handle_irq+0x74/0xbc el1_irq+0xf0/0x1c0 arch_cpu_idle+0x10/0x18 do_idle+0x104/0x248 cpu_startup_entry+0x20/0x64 rest_init+0xd0/0xdc arch_call_rest_init+0xc/0x14 start_kernel+0x480/0x4b8 Code: f9400281 f94066a2 91405021 b94a0023 (f9406401) Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 (CVE-2023-53822)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53822
https://security-tracker.debian.org/tracker/CVE-2023-53822
https://ubuntu.com/security/CVE-2023-53822

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53822

Plugin Information
Published: 2025/12/09, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277950 - Linux Distros Unpatched Vulnerability : CVE-2023-53824
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netlink: annotate lockless accesses to nlk->max_recvmsg_len syzbot reported a data-race in data-race in netlink_recvmsg() [1] Indeed, netlink_recvmsg() can be run concurrently, and netlink_dump() also needs protection. [1] BUG: KCSAN: data-race in netlink_recvmsg / netlink_recvmsg read to 0xffff888141840b38 of 8 bytes by task 23057 on cpu 0: netlink_recvmsg+0xea/0x730 net/netlink/af_netlink.c:1988 sock_recvmsg_nosec net/socket.c:1017 [inline] sock_recvmsg net/socket.c:1038 [inline] __sys_recvfrom+0x1ee/0x2e0 net/socket.c:2194 __do_sys_recvfrom net/socket.c:2212 [inline] __se_sys_recvfrom net/socket.c:2208 [inline] __x64_sys_recvfrom+0x78/0x90 net/socket.c:2208 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd write to 0xffff888141840b38 of 8 bytes by task 23037 on cpu 1: netlink_recvmsg+0x114/0x730 net/netlink/af_netlink.c:1989 sock_recvmsg_nosec net/socket.c:1017 [inline] sock_recvmsg net/socket.c:1038 [inline] ____sys_recvmsg+0x156/0x310 net/socket.c:2720 ___sys_recvmsg net/socket.c:2762 [inline] do_recvmmsg+0x2e5/0x710 net/socket.c:2856 __sys_recvmmsg net/socket.c:2935 [inline] __do_sys_recvmmsg net/socket.c:2958 [inline] __se_sys_recvmmsg net/socket.c:2951 [inline] __x64_sys_recvmmsg+0xe2/0x160 net/socket.c:2951 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x0000000000000000 ->
0x0000000000001000 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 23037 Comm: syz-executor.2 Not tainted 6.3.0-rc4-syzkaller-00195-g5a57b48fdfcb #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 (CVE-2023-53824)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53824
https://ubuntu.com/security/CVE-2023-53824

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53824

Plugin Information
Published: 2025/12/09, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278063 - Linux Distros Unpatched Vulnerability : CVE-2023-53830
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- platform/x86: think-lmi: Fix memory leak when showing current settings When retriving a item string with tlmi_setting(), the result has to be freed using kfree(). In current_value_show() however, malformed item strings are not freed, causing a memory leak. Fix this by eliminating the early return responsible for this. (CVE-2023-53830)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53830
https://ubuntu.com/security/CVE-2023-53830

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53830

Plugin Information
Published: 2025/12/10, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279977 - Linux Distros Unpatched Vulnerability : CVE-2023-53987
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ping: Fix potentail NULL deref for /proc/net/icmp. After commit dbca1596bbb0 (ping: convert to RCU lookups, get rid of rwlock), we use RCU for ping sockets, but we should use spinlock for /proc/net/icmp to avoid a potential NULL deref mentioned in the previous patch. Let's go back to using spinlock there.
Note we can convert ping sockets to use hlist instead of hlist_nulls because we do not use SLAB_TYPESAFE_BY_RCU for ping sockets. (CVE-2023-53987)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53987
https://ubuntu.com/security/CVE-2023-53987

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53987

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279721 - Linux Distros Unpatched Vulnerability : CVE-2023-53992
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: cfg80211: ocb: don't leave if not joined If there's no OCB state, don't ask the driver/mac80211 to leave, since that's just confusing. Since set/clear the chandef state, that's a simple check.
(CVE-2023-53992)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53992
https://security-tracker.debian.org/tracker/CVE-2023-53992
https://ubuntu.com/security/CVE-2023-53992

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53992

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279974 - Linux Distros Unpatched Vulnerability : CVE-2023-53993
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- PCI/DOE: Fix memory leak with CONFIG_DEBUG_OBJECTS=y After a pci_doe_task completes, its work_struct needs to be destroyed to avoid a memory leak with CONFIG_DEBUG_OBJECTS=y. (CVE-2023-53993)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53993
https://ubuntu.com/security/CVE-2023-53993

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53993

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279941 - Linux Distros Unpatched Vulnerability : CVE-2023-53995
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: ipv4: fix one memleak in __inet_del_ifa() I got the below warning when do fuzzing test:
unregister_netdevice: waiting for bond0 to become free. Usage count = 2 It can be repoduced via: ip link add bond0 type bond sysctl -w net.ipv4.conf.bond0.promote_secondaries=1 ip addr add 4.117.174.103/0 scope 0x40 dev bond0 ip addr add 192.168.100.111/255.255.255.254 scope 0 dev bond0 ip addr add 0.0.0.4/0 scope 0x40 secondary dev bond0 ip addr del 4.117.174.103/0 scope 0x40 dev bond0 ip link delete bond0 type bond In this reproduction test case, an incorrect 'last_prim' is found in __inet_del_ifa(), as a result, the secondary address(0.0.0.4/0 scope 0x40) is lost. The memory of the secondary address is leaked and the reference of in_device and net_device is leaked. Fix this problem: Look for 'last_prim' starting at location of the deleted IP and inserting the promoted IP into the location of 'last_prim'.
(CVE-2023-53995)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53995
https://ubuntu.com/security/CVE-2023-53995

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53995

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279961 - Linux Distros Unpatched Vulnerability : CVE-2023-53996
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- x86/sev: Make enc_dec_hypercall() accept a size instead of npages enc_dec_hypercall() accepted a page count instead of a size, which forced its callers to round up. As a result, non-page aligned vaddrs caused pages to be spuriously marked as decrypted via the encryption status hypercall, which in turn caused consistent corruption of pages during live migration. Live migration requires accurate encryption status information to avoid migrating pages from the wrong perspective. (CVE-2023-53996)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53996
https://ubuntu.com/security/CVE-2023-53996

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53996

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279973 - Linux Distros Unpatched Vulnerability : CVE-2023-53998
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- hwrng: virtio - Fix race on data_avail and actual data The virtio rng device kicks off a new entropy request whenever the data available reaches zero. When a new request occurs at the end of a read operation, that is, when the result of that request is only needed by the next reader, then there is a race between the writing of the new data and the next reader. This is because there is no synchronisation whatsoever between the writer and the reader. Fix this by writing data_avail with smp_store_release and reading it with smp_load_acquire when we first enter read. The subsequent reads are safe because they're either protected by the first load acquire, or by the completion mechanism. Also remove the redundant zeroing of data_idx in random_recv_done (data_idx must already be zero at this point) and data_avail in request_entropy (ditto). (CVE-2023-53998)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53998
https://ubuntu.com/security/CVE-2023-53998

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53998

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279730 - Linux Distros Unpatched Vulnerability : CVE-2023-53999
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mlx5e: TC, Fix internal port memory leak The flow rule can be splited, and the extra post_act rules are added to post_act table. It's possible to trigger memleak when the rule forwards packets from internal port and over tunnel, in the case that, for example, CT 'new' state offload is allowed. As int_port object is assigned to the flow attribute of post_act rule, and its refcnt is incremented by mlx5e_tc_int_port_get(), but mlx5e_tc_int_port_put() is not called, the refcnt is never decremented, then int_port is never freed. The kmemleak reports the following error: unreferenced object 0xffff888128204b80 (size 64): comm handler20, pid 50121, jiffies 4296973009 (age 642.932s) hex dump (first 32 bytes): 01 00 00 00 19 00 00 00 03 f0 00 00 04 00 00 00 ................ 98 77 67 41 81 88 ff ff 98 77 67 41 81 88 ff ff .wgA.....wgA.... backtrace: [<00000000e992680d>] kmalloc_trace+0x27/0x120 [<000000009e945a98>] mlx5e_tc_int_port_get+0x3f3/0xe20 [mlx5_core] [<0000000035a537f0>] mlx5e_tc_add_fdb_flow+0x473/0xcf0 [mlx5_core] [<0000000070c2cec6>] __mlx5e_add_fdb_flow+0x7cf/0xe90 [mlx5_core] [<000000005cc84048>] mlx5e_configure_flower+0xd40/0x4c40 [mlx5_core] [<000000004f8a2031>] mlx5e_rep_indr_offload.isra.0+0x10e/0x1c0 [mlx5_core] [<000000007df797dc>] mlx5e_rep_indr_setup_tc_cb+0x90/0x130 [mlx5_core] [<0000000016c15cc3>] tc_setup_cb_add+0x1cf/0x410 [<00000000a63305b4>] fl_hw_replace_filter+0x38f/0x670 [cls_flower] [<000000008bc9e77c>] fl_change+0x1fd5/0x4430 [cls_flower] [<00000000e7f766e4>] tc_new_tfilter+0x867/0x2010 [<00000000e101c0ef>] rtnetlink_rcv_msg+0x6fc/0x9f0 [<00000000e1111d44>] netlink_rcv_skb+0x12c/0x360 [<0000000082dd6c8b>] netlink_unicast+0x438/0x710 [<00000000fc568f70>] netlink_sendmsg+0x794/0xc50 [<0000000016e92590>] sock_sendmsg+0xc5/0x190 So fix this by moving int_port cleanup code to the flow attribute free helper, which is used by all the attribute free cases. (CVE-2023-53999)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53999
https://security-tracker.debian.org/tracker/CVE-2023-53999
https://ubuntu.com/security/CVE-2023-53999

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53999

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279958 - Linux Distros Unpatched Vulnerability : CVE-2023-54004
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). syzbot reported [0] a null-ptr-deref in sk_get_rmem0() while using IPPROTO_UDPLITE (0x88): 14:25:52 executing program 1: r0 = socket$inet6(0xa, 0x80002, 0x88) We had a similar report [1] for probably sk_memory_allocated_add() in
__sk_mem_raise_allocated(), and commit c915fe13cbaa (udplite: fix NULL pointer dereference) fixed it by setting .memory_allocated for udplite_prot and udplitev6_prot. To fix the variant, we need to set either .sysctl_wmem_offset or .sysctl_rmem. Now UDP and UDPLITE share the same value for .memory_allocated, so we use the same .sysctl_wmem_offset for UDP and UDPLITE. [0]: general protection fault, probably for non- canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 PID: 6829 Comm: syz-executor.1 Not tainted 6.4.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023 RIP: 0010:sk_get_rmem0 include/net/sock.h:2907 [inline] RIP:
0010:__sk_mem_raise_allocated+0x806/0x17a0 net/core/sock.c:3006 Code: c1 ea 03 80 3c 02 00 0f 85 23 0f 00 00 48 8b 44 24 08 48 8b 98 38 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 da 48 c1 ea 03 <0f> b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 0f 8d 6f 0a 00 00 8b RSP: 0018:ffffc90005d7f450 EFLAGS: 00010246 RAX:
dffffc0000000000 RBX: 0000000000000000 RCX: ffffc90004d92000 RDX: 0000000000000000 RSI: ffffffff88066482 RDI: ffffffff8e2ccbb8 RBP: ffff8880173f7000 R08: 0000000000000005 R09: 0000000000000000 R10:
0000000000000000 R11: 0000000000000000 R12: 0000000000030000 R13: 0000000000000001 R14: 0000000000000340 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880b9800000(0063) knlGS:00000000f7f1cb40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 000000002e82f000 CR3: 0000000034ff0000 CR4: 00000000003506f0 Call Trace: <TASK> __sk_mem_schedule+0x6c/0xe0 net/core/sock.c:3077 udp_rmem_schedule net/ipv4/udp.c:1539 [inline] __udp_enqueue_schedule_skb+0x776/0xb30 net/ipv4/udp.c:1581 __udpv6_queue_rcv_skb net/ipv6/udp.c:666 [inline] udpv6_queue_rcv_one_skb+0xc39/0x16c0 net/ipv6/udp.c:775 udpv6_queue_rcv_skb+0x194/0xa10 net/ipv6/udp.c:793 __udp6_lib_mcast_deliver net/ipv6/udp.c:906 [inline]
__udp6_lib_rcv+0x1bda/0x2bd0 net/ipv6/udp.c:1013 ip6_protocol_deliver_rcu+0x2e7/0x1250 net/ipv6/ip6_input.c:437 ip6_input_finish+0x150/0x2f0 net/ipv6/ip6_input.c:482 NF_HOOK include/linux/netfilter.h:303 [inline] NF_HOOK include/linux/netfilter.h:297 [inline] ip6_input+0xa0/0xd0 net/ipv6/ip6_input.c:491 ip6_mc_input+0x40b/0xf50 net/ipv6/ip6_input.c:585 dst_input include/net/dst.h:468 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline] NF_HOOK include/linux/netfilter.h:303 [inline] NF_HOOK include/linux/netfilter.h:297 [inline] ipv6_rcv+0x250/0x380 net/ipv6/ip6_input.c:309
__netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5491 __netif_receive_skb+0x1f/0x1c0 net/core/dev.c:5605 netif_receive_skb_internal net/core/dev.c:5691 [inline] netif_receive_skb+0x133/0x7a0 net/core/dev.c:5750 tun_rx_batched+0x4b3/0x7a0 drivers/net/tun.c:1553 tun_get_user+0x2452/0x39c0 drivers/net/tun.c:1989 tun_chr_write_iter+0xdf/0x200 drivers/net/tun.c:2035 call_write_iter include/linux/fs.h:1868 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x945/0xd50 fs/read_write.c:584 ksys_write+0x12b/0x250 fs/read_write.c:637 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203 entry_SYSENTER_compat_after_hwframe+0x70/0x82 RIP: 0023:0xf7f21579 Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 ---truncated--- (CVE-2023-54004)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54004
https://ubuntu.com/security/CVE-2023-54004

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54004

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279965 - Linux Distros Unpatched Vulnerability : CVE-2023-54007
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vmci_host: fix a race condition in vmci_host_poll() causing GPF During fuzzing, a general protection fault is observed in vmci_host_poll(). general protection fault, probably for non-canonical address 0xdffffc0000000019: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x00000000000000c8-0x00000000000000cf] RIP: 0010:__lock_acquire+0xf3/0x5e00 kernel/locking/lockdep.c:4926 <- omitting registers -> Call Trace: <TASK> lock_acquire+0x1a4/0x4a0 kernel/locking/lockdep.c:5672
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xb3/0x100 kernel/locking/spinlock.c:162 add_wait_queue+0x3d/0x260 kernel/sched/wait.c:22 poll_wait include/linux/poll.h:49 [inline] vmci_host_poll+0xf8/0x2b0 drivers/misc/vmw_vmci/vmci_host.c:174 vfs_poll include/linux/poll.h:88 [inline] do_pollfd fs/select.c:873 [inline] do_poll fs/select.c:921 [inline] do_sys_poll+0xc7c/0x1aa0 fs/select.c:1015 __do_sys_ppoll fs/select.c:1121 [inline]
__se_sys_ppoll+0x2cc/0x330 fs/select.c:1101 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4e/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Example thread interleaving that causes the general protection fault is as follows: CPU1 (vmci_host_poll) CPU2 (vmci_host_do_init_context) ----- ----- // Read uninitialized context context = vmci_host_dev->context; // Initialize context vmci_host_dev->context = vmci_ctx_create(); vmci_host_dev->ct_type = VMCIOBJ_CONTEXT;
if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) { // Dereferencing the wrong pointer poll_wait(..., &context->host_context); } In this scenario, vmci_host_poll() reads vmci_host_dev->context first, and then reads vmci_host_dev->ct_type to check that vmci_host_dev->context is initialized. However, since these two reads are not atomically executed, there is a chance of a race condition as described above. To fix this race condition, read vmci_host_dev->context after checking the value of vmci_host_dev->ct_type so that vmci_host_poll() always reads an initialized context. (CVE-2023-54007)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54007
https://ubuntu.com/security/CVE-2023-54007

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54007

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279970 - Linux Distros Unpatched Vulnerability : CVE-2023-54008
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- virtio_vdpa: build affinity masks conditionally We try to build affinity mask via create_affinity_masks() unconditionally which may lead several issues: - the affinity mask is not used for parent without affinity support (only VDUSE support the affinity now) - the logic of create_affinity_masks() might not work for devices other than block. For example it's not rare in the networking device where the number of queues could exceed the number of CPUs. Such case breaks the current affinity logic which is based on group_cpus_evenly() who assumes the number of CPUs are not less than the number of groups. This can trigger a warning[1]: if (ret >= 0) WARN_ON(nr_present + nr_others < numgrps); Fixing this by only build the affinity masks only when - Driver passes affinity descriptor, driver like virtio-blk can make sure to limit the number of queues when it exceeds the number of CPUs - Parent support affinity setting config ops This help to avoid the warning. More optimizations could be done on top. [1] [ 682.146655] WARNING: CPU: 6 PID: 1550 at lib/group_cpus.c:400 group_cpus_evenly+0x1aa/0x1c0 [ 682.146668] CPU: 6 PID: 1550 Comm: vdpa Not tainted 6.5.0-rc5jason+ #79 [ 682.146671] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [ 682.146673] RIP:
0010:group_cpus_evenly+0x1aa/0x1c0 [ 682.146676] Code: 4c 89 e0 5b 5d 41 5c 41 5d 41 5e c3 cc cc cc cc e8 1b c4 74 ff 48 89 ef e8 13 ac 98 ff 4c 89 e7 45 31 e4 e8 08 ac 98 ff eb c2 <0f> 0b eb b6 e8 fd 05 c3 00 45 31 e4 eb e5 cc cc cc cc cc cc cc cc [ 682.146679] RSP: 0018:ffffc9000215f498 EFLAGS: 00010293 [ 682.146682] RAX: 000000000001f1e0 RBX: 0000000000000041 RCX: 0000000000000000 [ 682.146684] RDX:
ffff888109922058 RSI: 0000000000000041 RDI: 0000000000000030 [ 682.146686] RBP: ffff888109922058 R08:
ffffc9000215f498 R09: ffffc9000215f4a0 [ 682.146687] R10: 00000000000198d0 R11: 0000000000000030 R12:
ffff888107e02800 [ 682.146689] R13: 0000000000000030 R14: 0000000000000030 R15: 0000000000000041 [ 682.146692] FS: 00007fef52315740(0000) GS:ffff888237380000(0000) knlGS:0000000000000000 [ 682.146695] CS:
0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 682.146696] CR2: 00007fef52509000 CR3: 0000000110dbc004 CR4: 0000000000370ee0 [ 682.146698] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 682.146700] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 682.146701] Call Trace: [ 682.146703] <TASK> [ 682.146705] ? __warn+0x7b/0x130 [ 682.146709] ? group_cpus_evenly+0x1aa/0x1c0 [ 682.146712] ? report_bug+0x1c8/0x1e0 [ 682.146717] ? handle_bug+0x3c/0x70 [ 682.146721] ? exc_invalid_op+0x14/0x70 [ 682.146723] ? asm_exc_invalid_op+0x16/0x20 [ 682.146727] ? group_cpus_evenly+0x1aa/0x1c0 [ 682.146729] ? group_cpus_evenly+0x15c/0x1c0 [ 682.146731] create_affinity_masks+0xaf/0x1a0 [ 682.146735] virtio_vdpa_find_vqs+0x83/0x1d0 [ 682.146738] ?
__pfx_default_calc_sets+0x10/0x10 [ 682.146742] virtnet_find_vqs+0x1f0/0x370 [ 682.146747] virtnet_probe+0x501/0xcd0 [ 682.146749] ? vp_modern_get_status+0x12/0x20 [ 682.146751] ? get_cap_addr.isra.0+0x10/0xc0 [ 682.146754] virtio_dev_probe+0x1af/0x260 [ 682.146759] really_probe+0x1a5/0x410 (CVE-2023-54008)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54008
https://ubuntu.com/security/CVE-2023-54008

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54008

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279960 - Linux Distros Unpatched Vulnerability : CVE-2023-54010
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects ACPICA commit 0d5f467d6a0ba852ea3aad68663cbcbd43300fd4 ACPI_ALLOCATE_ZEROED may fails, object_info might be null and will cause null pointer dereference later. (CVE-2023-54010)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54010
https://ubuntu.com/security/CVE-2023-54010

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54010

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279843 - Linux Distros Unpatched Vulnerability : CVE-2023-54013
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- interconnect: Fix locking for runpm vs reclaim For cases where icc_bw_set() can be called in callbaths that could deadlock against shrinker/reclaim, such as runpm resume, we need to decouple the icc locking.
Introduce a new icc_bw_lock for cases where we need to serialize bw aggregation and update to decouple that from paths that require memory allocation such as node/link creation/ destruction. Fixes this lockdep splat: ====================================================== WARNING: possible circular locking dependency detected 6.2.0-rc8-debug+ #554 Not tainted
------------------------------------------------------ ring0/132 is trying to acquire lock:
ffffff80871916d0 (&gmu->lock){+.+.}-{3:3}, at: a6xx_pm_resume+0xf0/0x234 but task is already holding lock:
ffffffdb5aee57e8 (dma_fence_map){++++}-{0:0}, at: msm_job_run+0x68/0x150 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #4 (dma_fence_map){++++}-{0:0}:
__dma_fence_might_wait+0x74/0xc0 dma_resv_lockdep+0x1f4/0x2f4 do_one_initcall+0x104/0x2bc kernel_init_freeable+0x344/0x34c kernel_init+0x30/0x134 ret_from_fork+0x10/0x20 -> #3 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}: fs_reclaim_acquire+0x80/0xa8 slab_pre_alloc_hook.constprop.0+0x40/0x25c __kmem_cache_alloc_node+0x60/0x1cc __kmalloc+0xd8/0x100 topology_parse_cpu_capacity+0x8c/0x178 get_cpu_for_node+0x88/0xc4 parse_cluster+0x1b0/0x28c parse_cluster+0x8c/0x28c init_cpu_topology+0x168/0x188 smp_prepare_cpus+0x24/0xf8 kernel_init_freeable+0x18c/0x34c kernel_init+0x30/0x134 ret_from_fork+0x10/0x20 -> #2 (fs_reclaim){+.+.}-{0:0}: __fs_reclaim_acquire+0x3c/0x48 fs_reclaim_acquire+0x54/0xa8 slab_pre_alloc_hook.constprop.0+0x40/0x25c __kmem_cache_alloc_node+0x60/0x1cc __kmalloc+0xd8/0x100 kzalloc.constprop.0+0x14/0x20 icc_node_create_nolock+0x4c/0xc4 icc_node_create+0x38/0x58 qcom_icc_rpmh_probe+0x1b8/0x248 platform_probe+0x70/0xc4 really_probe+0x158/0x290
__driver_probe_device+0xc8/0xe0 driver_probe_device+0x44/0x100 __driver_attach+0xf8/0x108 bus_for_each_dev+0x78/0xc4 driver_attach+0x2c/0x38 bus_add_driver+0xd0/0x1d8 driver_register+0xbc/0xf8
__platform_driver_register+0x30/0x3c qnoc_driver_init+0x24/0x30 do_one_initcall+0x104/0x2bc kernel_init_freeable+0x344/0x34c kernel_init+0x30/0x134 ret_from_fork+0x10/0x20 -> #1 (icc_lock){+.+.}-{3:3}: __mutex_lock+0xcc/0x3c8 mutex_lock_nested+0x30/0x44 icc_set_bw+0x88/0x2b4
_set_opp_bw+0x8c/0xd8 _set_opp+0x19c/0x300 dev_pm_opp_set_opp+0x84/0x94 a6xx_gmu_resume+0x18c/0x804 a6xx_pm_resume+0xf8/0x234 adreno_runtime_resume+0x2c/0x38 pm_generic_runtime_resume+0x30/0x44
__rpm_callback+0x15c/0x174 rpm_callback+0x78/0x7c rpm_resume+0x318/0x524 __pm_runtime_resume+0x78/0xbc adreno_load_gpu+0xc4/0x17c msm_open+0x50/0x120 drm_file_alloc+0x17c/0x228 drm_open_helper+0x74/0x118 drm_open+0xa0/0x144 drm_stub_open+0xd4/0xe4 chrdev_open+0x1b8/0x1e4 do_dentry_open+0x2f8/0x38c vfs_open+0x34/0x40 path_openat+0x64c/0x7b4 do_filp_open+0x54/0xc4 do_sys_openat2+0x9c/0x100 do_sys_open+0x50/0x7c __arm64_sys_openat+0x28/0x34 invoke_syscall+0x8c/0x128 el0_svc_common.constprop.0+0xa0/0x11c do_el0_ ---truncated--- (CVE-2023-54013)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54013
https://security-tracker.debian.org/tracker/CVE-2023-54013
https://ubuntu.com/security/CVE-2023-54013

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54013

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279955 - Linux Distros Unpatched Vulnerability : CVE-2023-54014
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() Klocwork reported warning of rport maybe NULL and will be dereferenced. rport returned by call to fc_bsg_to_rport() could be NULL and dereferenced.
Check valid rport returned by fc_bsg_to_rport(). (CVE-2023-54014)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54014
https://ubuntu.com/security/CVE-2023-54014

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54014

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279959 - Linux Distros Unpatched Vulnerability : CVE-2023-54015
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device In case devcom allocation is failed, mlx5 is always freeing the priv. However, this priv might have been allocated by a different thread, and freeing it might lead to use-after-free bugs. Fix it by freeing the priv only in case it was allocated by the running thread. (CVE-2023-54015)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54015
https://ubuntu.com/security/CVE-2023-54015

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54015

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279735 - Linux Distros Unpatched Vulnerability : CVE-2023-54016
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath12k: Fix memory leak in rx_desc and tx_desc Currently when ath12k_dp_cc_desc_init() is called we allocate memory to rx_descs and tx_descs. In ath12k_dp_cc_cleanup(), during descriptor cleanup rx_descs and tx_descs memory is not freed. This is cause of memory leak. These allocated memory should be freed in ath12k_dp_cc_cleanup. In ath12k_dp_cc_desc_init(), we can save base address of rx_descs and tx_descs. In ath12k_dp_cc_cleanup(), we can free rx_descs and tx_descs memory using their base address. Tested-on:
QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 (CVE-2023-54016)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54016
https://security-tracker.debian.org/tracker/CVE-2023-54016
https://ubuntu.com/security/CVE-2023-54016

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54016

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279850 - Linux Distros Unpatched Vulnerability : CVE-2023-54019
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sched/psi: use kernfs polling functions for PSI trigger polling Destroying psi trigger in cgroup_file_release causes UAF issues when a cgroup is removed from under a polling process. This is happening because cgroup removal causes a call to cgroup_file_release while the actual file is still alive. Destroying the trigger at this point would also destroy its waitqueue head and if there is still a polling process on that file accessing the waitqueue, it will step on the freed pointer: do_select vfs_poll do_rmdir cgroup_rmdir kernfs_drain_open_files cgroup_file_release cgroup_pressure_release psi_trigger_destroy wake_up_pollfree(&t->event_wait) // vfs_poll is unblocked synchronize_rcu kfree(t) poll_freewait -> UAF access to the trigger's waitqueue head Patch [1] fixed this issue for epoll() case using wake_up_pollfree(), however the same issue exists for synchronous poll() case. The root cause of this issue is that the lifecycles of the psi trigger's waitqueue and of the file associated with the trigger are different. Fix this by using kernfs_generic_poll function when polling on cgroup-specific psi triggers. It internally uses kernfs_open_node->poll waitqueue head with its lifecycle tied to the file's lifecycle. This also renders the fix in [1] obsolete, so revert it. [1] commit c2dbe32d5db5 (sched/psi:
Fix use-after-free in ep_remove_wait_queue()) (CVE-2023-54019)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54019
https://security-tracker.debian.org/tracker/CVE-2023-54019
https://ubuntu.com/security/CVE-2023-54019

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54019

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279936 - Linux Distros Unpatched Vulnerability : CVE-2023-54021
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: set goal start correctly in ext4_mb_normalize_request We need to set ac_g_ex to notify the goal start used in ext4_mb_find_by_goal. Set ac_g_ex instead of ac_f_ex in ext4_mb_normalize_request. Besides we should assure goal start is in range [first_data_block, blocks_count) as ext4_mb_initialize_context does. [ Added a check to make sure size is less than ar->pright; otherwise we could end up passing an underflowed value of ar->pright - size to ext4_get_group_no_and_offset(), which will trigger a BUG_ON later on. - TYT ] (CVE-2023-54021)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54021
https://ubuntu.com/security/CVE-2023-54021

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54021

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279967 - Linux Distros Unpatched Vulnerability : CVE-2023-54022
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: usb-audio: Fix potential memory leaks at error path for UMP open The allocation and initialization errors at alloc_midi_urbs() that is called at MIDI 2.0 / UMP device are supposed to be handled at the caller side by invoking free_midi_urbs(). However, free_midi_urbs() loops only for ep->num_urbs entries, and since ep->num_entries wasn't updated yet at the allocation / init error in alloc_midi_urbs(), this entry won't be released. The intention of free_midi_urbs() is to release the whole elements, so change the loop size to NUM_URBS to scan over all elements for fixing the missed releases. Also, the call of free_midi_urbs() is missing at snd_usb_midi_v2_open(). Although it'll be released later at reopen/close or disconnection, it's better to release immediately at the error path. (CVE-2023-54022)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54022
https://ubuntu.com/security/CVE-2023-54022

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54022

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279968 - Linux Distros Unpatched Vulnerability : CVE-2023-54024
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- KVM: Destroy target device if coalesced MMIO unregistration fails Destroy and free the target coalesced MMIO device if unregistering said device fails. As clearly noted in the code, kvm_io_bus_unregister_dev() does not destroy the target device. BUG: memory leak unreferenced object 0xffff888112a54880 (size 64):
comm syz-executor.2, pid 5258, jiffies 4297861402 (age 14.129s) hex dump (first 32 bytes): 38 c7 67 15 00 c9 ff ff 38 c7 67 15 00 c9 ff ff 8.g.....8.g..... e0 c7 e1 83 ff ff ff ff 00 30 67 15 00 c9 ff ff .........0g..... backtrace: [<0000000006995a8a>] kmalloc include/linux/slab.h:556 [inline] [<0000000006995a8a>] kzalloc include/linux/slab.h:690 [inline] [<0000000006995a8a>] kvm_vm_ioctl_register_coalesced_mmio+0x8e/0x3d0 arch/x86/kvm/../../../virt/kvm/coalesced_mmio.c:150 [<00000000022550c2>] kvm_vm_ioctl+0x47d/0x1600 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3323 [<000000008a75102f>] vfs_ioctl fs/ioctl.c:46 [inline] [<000000008a75102f>] file_ioctl fs/ioctl.c:509 [inline] [<000000008a75102f>] do_vfs_ioctl+0xbab/0x1160 fs/ioctl.c:696 [<0000000080e3f669>] ksys_ioctl+0x76/0xa0 fs/ioctl.c:713 [<0000000059ef4888>] __do_sys_ioctl fs/ioctl.c:720 [inline] [<0000000059ef4888>] __se_sys_ioctl fs/ioctl.c:718 [inline] [<0000000059ef4888>] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:718 [<000000006444fa05>] do_syscall_64+0x9f/0x4e0 arch/x86/entry/common.c:290 [<000000009a4ed50b>] entry_SYSCALL_64_after_hwframe+0x49/0xbe BUG: leak checking failed (CVE-2023-54024)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54024
https://ubuntu.com/security/CVE-2023-54024

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54024

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279964 - Linux Distros Unpatched Vulnerability : CVE-2023-54026
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- opp: Fix use-after-free in lazy_opp_tables after probe deferral When dev_pm_opp_of_find_icc_paths() in
_allocate_opp_table() returns -EPROBE_DEFER, the opp_table is freed again, to wait until all the interconnect paths are available. However, if the OPP table is using required-opps then it may already have been added to the global lazy_opp_tables list. The error path does not remove the opp_table from the list again. This can cause crashes later when the provider of the required-opps is added, since we will iterate over OPP tables that have already been freed. E.g.: Unable to handle kernel NULL pointer dereference when read CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.4.0-rc3 PC is at _of_add_opp_table_v2 (include/linux/of.h:949 drivers/opp/of.c:98 drivers/opp/of.c:344 drivers/opp/of.c:404 drivers/opp/of.c:1032) -> lazy_link_required_opp_table() Fix this by calling _of_clear_opp_table() to remove the opp_table from the list and clear other allocated resources. While at it, also add the missing mutex_destroy() calls in the error path. (CVE-2023-54026)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54026
https://ubuntu.com/security/CVE-2023-54026

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54026

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279729 - Linux Distros Unpatched Vulnerability : CVE-2023-54028
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA/rxe: Fix the error trying to register non-static key in rxe_cleanup_task In the function rxe_create_qp(), rxe_qp_from_init() is called to initialize qp, internally things like rxe_init_task are not setup until rxe_qp_init_req(). If an error occurred before this point then the unwind will call rxe_cleanup() and eventually to rxe_qp_do_cleanup()/rxe_cleanup_task() which will oops when trying to access the uninitialized spinlock. If rxe_init_task is not executed, rxe_cleanup_task will not be called.
(CVE-2023-54028)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54028
https://security-tracker.debian.org/tracker/CVE-2023-54028
https://ubuntu.com/security/CVE-2023-54028

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54028

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279786 - Linux Distros Unpatched Vulnerability : CVE-2023-54029
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: iwlwifi: fix iwl_mvm_max_amsdu_size() for MLO For MLO, we cannot use vif->bss_conf.chandef.chan->band, since that will lead to a NULL-ptr dereference as bss_conf isn't used.
However, in case of real MLO, we also need to take both LMACs into account if they exist, since the station might be active on both LMACs at the same time. (CVE-2023-54029)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54029
https://security-tracker.debian.org/tracker/CVE-2023-54029
https://ubuntu.com/security/CVE-2023-54029

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54029

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279934 - Linux Distros Unpatched Vulnerability : CVE-2023-54031
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops. That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773. This patch adds the missing nla_policy for vdpa queue index attr to avoid such bugs. (CVE-2023-54031)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54031
https://ubuntu.com/security/CVE-2023-54031

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54031

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279914 - Linux Distros Unpatched Vulnerability : CVE-2023-54033
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps The LRU and LRU_PERCPU maps allocate a new element on update before locking the target hash table bucket. Right after that the maps try to lock the bucket. If this fails, then maps return -EBUSY to the caller without releasing the allocated element. This makes the element untracked: it doesn't belong to either of free lists, and it doesn't belong to the hash table, so can't be re-used; this eventually leads to the permanent -ENOMEM on LRU map updates, which is unexpected. Fix this by returning the element to the local free list if bucket locking fails.
(CVE-2023-54033)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54033
https://ubuntu.com/security/CVE-2023-54033

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54033

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279956 - Linux Distros Unpatched Vulnerability : CVE-2023-54034
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- iommufd: Make sure to zero vfio_iommu_type1_info before copying to user Missed a zero initialization here.
Most of the struct is filled with a copy_from_user(), however minsz for that copy is smaller than the actual struct by 8 bytes, thus we don't fill the padding. (CVE-2023-54034)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54034
https://ubuntu.com/security/CVE-2023-54034

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54034

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279943 - Linux Distros Unpatched Vulnerability : CVE-2023-54036
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU The wifi + bluetooth combo chip RTL8723BU can leak memory (especially?) when it's connected to a bluetooth audio device. The busy bluetooth traffic generates lots of C2H (card to host) messages, which are not freed correctly. To fix this, move the dev_kfree_skb() call in rtl8xxxu_c2hcmd_callback() inside the loop where skb_dequeue() is called. The RTL8192EU leaks memory because the C2H messages are added to the queue and left there forever. (This was fine in the past because it probably wasn't sending any C2H messages until commit e542e66b7c2e (wifi:
rtl8xxxu: gen2: Turn on the rate control). Since that commit it sends a C2H message when the TX rate changes.) To fix this, delete the check for rf_paths > 1 and the goto. Let the function process the C2H messages from RTL8192EU like the ones from the other chips. Theoretically the RTL8188FU could also leak like RTL8723BU, but it most likely doesn't send C2H messages frequently enough. This change was tested with RTL8723BU by Erhard F. I tested it with RTL8188FU and RTL8192EU. (CVE-2023-54036)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54036
https://ubuntu.com/security/CVE-2023-54036

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.7 (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54036

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279976 - Linux Distros Unpatched Vulnerability : CVE-2023-54037
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ice: prevent NULL pointer deref during reload Calling ethtool during reload can lead to call trace, because VSI isn't configured for some time, but netdev is alive. To fix it add rtnl lock for VSI deconfig and config. Set ::num_q_vectors to 0 after freeing and add a check for ::tx/rx_rings in ring related ethtool ops. Add proper unroll of filters in ice_start_eth(). Reproduction: $watch -n 0.1 -d 'ethtool -g enp24s0f0np0' $devlink dev reload pci/0000:18:00.0 action driver_reinit Call trace before fix:
[66303.926205] BUG: kernel NULL pointer dereference, address: 0000000000000000 [66303.926259] #PF:
supervisor read access in kernel mode [66303.926286] #PF: error_code(0x0000) - not-present page [66303.926311] PGD 0 P4D 0 [66303.926332] Oops: 0000 [#1] PREEMPT SMP PTI [66303.926358] CPU: 4 PID:
933821 Comm: ethtool Kdump: loaded Tainted: G OE 6.4.0-rc5+ #1 [66303.926400] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.00.01.0014.070920180847 07/09/2018 [66303.926446] RIP:
0010:ice_get_ringparam+0x22/0x50 [ice] [66303.926649] Code: 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 48 8b 87 c0 09 00 00 c7 46 04 e0 1f 00 00 c7 46 10 e0 1f 00 00 48 8b 50 20 <48> 8b 12 0f b7 52 3a 89 56 14 48 8b 40 28 48 8b 00 0f b7 40 58 48 [66303.926722] RSP: 0018:ffffad40472f39c8 EFLAGS: 00010246 [66303.926749] RAX: ffff98a8ada05828 RBX: ffff98a8c46dd060 RCX: ffffad40472f3b48 [66303.926781] RDX:
0000000000000000 RSI: ffff98a8c46dd068 RDI: ffff98a8b23c4000 [66303.926811] RBP: ffffad40472f3b48 R08:
00000000000337b0 R09: 0000000000000000 [66303.926843] R10: 0000000000000001 R11: 0000000000000100 R12:
ffff98a8b23c4000 [66303.926874] R13: ffff98a8c46dd060 R14: 000000000000000f R15: ffffad40472f3a50 [66303.926906] FS: 00007f6397966740(0000) GS:ffff98b390900000(0000) knlGS:0000000000000000 [66303.926941] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [66303.926967] CR2: 0000000000000000 CR3:
000000011ac20002 CR4: 00000000007706e0 [66303.926999] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000 [66303.927029] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [66303.927060] PKRU: 55555554 [66303.927075] Call Trace: [66303.927094] <TASK> [66303.927111] ?
__die+0x23/0x70 [66303.927140] ? page_fault_oops+0x171/0x4e0 [66303.927176] ? exc_page_fault+0x7f/0x180 [66303.927209] ? asm_exc_page_fault+0x26/0x30 [66303.927244] ? ice_get_ringparam+0x22/0x50 [ice] [66303.927433] rings_prepare_data+0x62/0x80 [66303.927469] ethnl_default_doit+0xe2/0x350 [66303.927501] genl_family_rcv_msg_doit.isra.0+0xe3/0x140 [66303.927538] genl_rcv_msg+0x1b1/0x2c0 [66303.927561] ?
__pfx_ethnl_default_doit+0x10/0x10 [66303.927590] ? __pfx_genl_rcv_msg+0x10/0x10 [66303.927615] netlink_rcv_skb+0x58/0x110 [66303.927644] genl_rcv+0x28/0x40 [66303.927665] netlink_unicast+0x19e/0x290 [66303.927691] netlink_sendmsg+0x254/0x4d0 [66303.927717] sock_sendmsg+0x93/0xa0 [66303.927743]
__sys_sendto+0x126/0x170 [66303.927780] __x64_sys_sendto+0x24/0x30 [66303.928593] do_syscall_64+0x5d/0x90 [66303.929370] ? __count_memcg_events+0x60/0xa0 [66303.930146] ? count_memcg_events.constprop.0+0x1a/0x30 [66303.930920] ? handle_mm_fault+0x9e/0x350 [66303.931688] ? do_user_addr_fault+0x258/0x740 [66303.932452] ? exc_page_fault+0x7f/0x180 [66303.933193] entry_SYSCALL_64_after_hwframe+0x72/0xdc (CVE-2023-54037)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54037
https://ubuntu.com/security/CVE-2023-54037

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54037

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279980 - Linux Distros Unpatched Vulnerability : CVE-2023-54038
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: hci_conn: return ERR_PTR instead of NULL when there is no link hci_connect_sco currently returns NULL when there is no link (i.e. when hci_conn_link() returns NULL). sco_connect() expects an ERR_PTR in case of any error (see line 266 in sco.c). Thus, hcon set as NULL passes through to sco_conn_add(), which tries to get hcon->hdev, resulting in dereferencing a NULL pointer as reported by syzkaller. The same issue exists for iso_connect_cis() calling hci_connect_cis(). Thus, make hci_connect_sco() and hci_connect_cis() return ERR_PTR instead of NULL. (CVE-2023-54038)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54038
https://ubuntu.com/security/CVE-2023-54038

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54038

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279915 - Linux Distros Unpatched Vulnerability : CVE-2023-54040
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ice: fix wrong fallback logic for FDIR When adding a FDIR filter, if ice_vc_fdir_set_irq_ctx returns failure, the inserted fdir entry will not be removed and if ice_vc_fdir_write_fltr returns failure, the fdir context info for irq handler will not be cleared which may lead to inconsistent or memory leak issue.
This patch refines failure cases to resolve this issue. (CVE-2023-54040)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54040
https://ubuntu.com/security/CVE-2023-54040

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54040

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279926 - Linux Distros Unpatched Vulnerability : CVE-2023-54041
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- io_uring: fix memory leak when removing provided buffers When removing provided buffers, io_buffer structs are not being disposed of, leading to a memory leak. They can't be freed individually, because they are allocated in page-sized groups. They need to be added to some free list instead, such as io_buffers_cache.
All callers already hold the lock protecting it, apart from when destroying buffers, so had to extend the lock there. (CVE-2023-54041)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54041
https://ubuntu.com/security/CVE-2023-54041

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54041

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279891 - Linux Distros Unpatched Vulnerability : CVE-2023-54045
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- audit: fix possible soft lockup in __audit_inode_child() Tracefs or debugfs maybe cause hundreds to thousands of PATH records, too many PATH records maybe cause soft lockup. For example: 1. CONFIG_KASAN=y && CONFIG_PREEMPTION=n 2. auditctl -a exit,always -S open -k key 3. sysctl -w kernel.watchdog_thresh=5 4.
mkdir /sys/kernel/debug/tracing/instances/test There may be a soft lockup as follows: watchdog: BUG: soft lockup - CPU#45 stuck for 7s! [mkdir:15498] Kernel panic - not syncing: softlockup: hung tasks Call trace:
dump_backtrace+0x0/0x30c show_stack+0x20/0x30 dump_stack+0x11c/0x174 panic+0x27c/0x494 watchdog_timer_fn+0x2bc/0x390 __run_hrtimer+0x148/0x4fc __hrtimer_run_queues+0x154/0x210 hrtimer_interrupt+0x2c4/0x760 arch_timer_handler_phys+0x48/0x60 handle_percpu_devid_irq+0xe0/0x340
__handle_domain_irq+0xbc/0x130 gic_handle_irq+0x78/0x460 el1_irq+0xb8/0x140
__audit_inode_child+0x240/0x7bc tracefs_create_file+0x1b8/0x2a0 trace_create_file+0x18/0x50 event_create_dir+0x204/0x30c __trace_add_new_event+0xac/0x100 event_trace_add_tracer+0xa0/0x130 trace_array_create_dir+0x60/0x140 trace_array_create+0x1e0/0x370 instance_mkdir+0x90/0xd0 tracefs_syscall_mkdir+0x68/0xa0 vfs_mkdir+0x21c/0x34c do_mkdirat+0x1b4/0x1d4 __arm64_sys_mkdirat+0x4c/0x60 el0_svc_common.constprop.0+0xa8/0x240 do_el0_svc+0x8c/0xc0 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Therefore, we add cond_resched() to __audit_inode_child() to fix it. (CVE-2023-54045)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54045
https://ubuntu.com/security/CVE-2023-54045

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54045

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279831 - Linux Distros Unpatched Vulnerability : CVE-2023-54048
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA/bnxt_re: Prevent handling any completions after qp destroy HW may generate completions that indicates QP is destroyed. Driver should not be scheduling any more completion handlers for this QP, after the QP is destroyed. Since CQs are active during the QP destroy, driver may still schedule completion handlers. This can cause a race where the destroy_cq and poll_cq running simultaneously. Snippet of kernel panic while doing bnxt_re driver load unload in loop. This indicates a poll after the CQ is freed. [77786.481636] Call Trace: [77786.481640] <TASK> [77786.481644] bnxt_re_poll_cq+0x14a/0x620 [bnxt_re] [77786.481658] ? kvm_clock_read+0x14/0x30 [77786.481693] __ib_process_cq+0x57/0x190 [ib_core] [77786.481728] ib_cq_poll_work+0x26/0x80 [ib_core] [77786.481761] process_one_work+0x1e5/0x3f0 [77786.481768] worker_thread+0x50/0x3a0 [77786.481785] ? __pfx_worker_thread+0x10/0x10 [77786.481790] kthread+0xe2/0x110 [77786.481794] ? __pfx_kthread+0x10/0x10 [77786.481797] ret_from_fork+0x2c/0x50 To avoid this, complete all completion handlers before returning the destroy QP. If free_cq is called soon after destroy_qp, IB stack will cancel the CQ work before invoking the destroy_cq verb and this will prevent any race mentioned. (CVE-2023-54048)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54048
https://security-tracker.debian.org/tracker/CVE-2023-54048
https://ubuntu.com/security/CVE-2023-54048

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.1
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54048

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279969 - Linux Distros Unpatched Vulnerability : CVE-2023-54051
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: do not allow gso_size to be set to GSO_BY_FRAGS One missing check in virtio_net_hdr_to_skb() allowed syzbot to crash kernels again [1] Do not allow gso_size to be set to GSO_BY_FRAGS (0xffff), because this magic value is used by the kernel. [1] general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 0 PID: 5039 Comm: syz-executor401 Not tainted 6.5.0-rc5-next-20230809-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 RIP: 0010:skb_segment+0x1a52/0x3ef0 net/core/skbuff.c:4500 Code: 00 00 00 e9 ab eb ff ff e8 6b 96 5d f9 48 8b 84 24 00 01 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e ea 21 00 00 48 8b 84 24 00 01 RSP: 0018:ffffc90003d3f1c8 EFLAGS:
00010202 RAX: dffffc0000000000 RBX: 000000000001fffe RCX: 0000000000000000 RDX: 000000000000000e RSI:
ffffffff882a3115 RDI: 0000000000000070 RBP: ffffc90003d3f378 R08: 0000000000000005 R09: 000000000000ffff R10: 000000000000ffff R11: 5ee4a93e456187d6 R12: 000000000001ffc6 R13: dffffc0000000000 R14:
0000000000000008 R15: 000000000000ffff FS: 00005555563f2380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020020000 CR3:
000000001626d000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK>
udp6_ufo_fragment+0x9d2/0xd50 net/ipv6/udp_offload.c:109 ipv6_gso_segment+0x5c4/0x17b0 net/ipv6/ip6_offload.c:120 skb_mac_gso_segment+0x292/0x610 net/core/gso.c:53 __skb_gso_segment+0x339/0x710 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x3a5/0xf10 net/core/dev.c:3625 __dev_queue_xmit+0x8f0/0x3d60 net/core/dev.c:4329 dev_queue_xmit include/linux/netdevice.h:3082 [inline] packet_xmit+0x257/0x380 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x24c7/0x5570 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:727 [inline] sock_sendmsg+0xd9/0x180 net/socket.c:750
____sys_sendmsg+0x6ac/0x940 net/socket.c:2496 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2550
__sys_sendmsg+0x117/0x1e0 net/socket.c:2579 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP:
0033:0x7ff27cdb34d9 (CVE-2023-54051)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54051
https://ubuntu.com/security/CVE-2023-54051

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54051

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279888 - Linux Distros Unpatched Vulnerability : CVE-2023-54052
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: mt76: mt7921: fix skb leak by txs missing in AMSDU txs may be dropped if the frame is aggregated in AMSDU. When the problem shows up, some SKBs would be hold in driver to cause network stopped temporarily.
Even if the problem can be recovered by txs timeout handling, mt7921 still need to disable txs in AMSDU to avoid this issue. (CVE-2023-54052)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54052
https://ubuntu.com/security/CVE-2023-54052

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54052

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279938 - Linux Distros Unpatched Vulnerability : CVE-2023-54058
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- firmware: arm_ffa: Check if ffa_driver remove is present before executing Currently ffa_drv->remove() is called unconditionally from ffa_device_remove(). Since the driver registration doesn't check for it and allows it to be registered without .remove callback, we need to check for the presence of it before executing it from ffa_device_remove() to above a NULL pointer dereference like the one below: | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 | Mem abort info: | ESR = 0x0000000086000004 | EC = 0x21: IABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x04: level 0 translation fault | user pgtable: 4k pages, 48-bit VAs, pgdp=0000000881cc8000 | [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 | Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP | CPU: 3 PID: 130 Comm: rmmod Not tainted 6.3.0-rc7 #6 | Hardware name: FVP Base RevC (DT) | pstate: 63402809 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=-c) | pc : 0x0 | lr :
ffa_device_remove+0x20/0x2c | Call trace: | 0x0 | device_release_driver_internal+0x16c/0x260 | driver_detach+0x90/0xd0 | bus_remove_driver+0xdc/0x11c | driver_unregister+0x30/0x54 | ffa_driver_unregister+0x14/0x20 | cleanup_module+0x18/0xeec | __arm64_sys_delete_module+0x234/0x378 | invoke_syscall+0x40/0x108 | el0_svc_common+0xb4/0xf0 | do_el0_svc+0x30/0xa4 | el0_svc+0x2c/0x7c | el0t_64_sync_handler+0x84/0xf0 | el0t_64_sync+0x190/0x194 (CVE-2023-54058)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54058
https://ubuntu.com/security/CVE-2023-54058

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54058

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279942 - Linux Distros Unpatched Vulnerability : CVE-2023-54060
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- iommufd: Set end correctly when doing batch carry Even though the test suite covers this it somehow became obscured that this wasn't working. The test iommufd_ioas.mock_domain.access_domain_destory would blow up rarely. end should be set to 1 because this just pushed an item, the carry, to the pfns list. Sometimes the test would blow up with: BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF:
supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP CPU: 5 PID: 584 Comm: iommufd Not tainted 6.5.0-rc1-dirty #1236 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP:
0010:batch_unpin+0xa2/0x100 [iommufd] Code: 17 48 81 fe ff ff 07 00 77 70 48 8b 15 b7 be 97 e2 48 85 d2 74 14 48 8b 14 fa 48 85 d2 74 0b 40 0f b6 f6 48 c1 e6 04 48 01 f2 <48> 8b 3a 48 c1 e0 06 89 ca 48 89 de 48 83 e7 f0 48 01 c7 e8 96 dc RSP: 0018:ffffc90001677a58 EFLAGS: 00010246 RAX: 00007f7e2646f000 RBX:
0000000000000000 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 00000000fefc4c8d RDI: 0000000000fefc4c RBP: ffffc90001677a80 R08: 0000000000000048 R09: 0000000000000200 R10: 0000000000030b98 R11:
ffffffff81f3bb40 R12: 0000000000000001 R13: ffff888101f75800 R14: ffffc90001677ad0 R15: 00000000000001fe FS: 00007f9323679740(0000) GS:ffff8881ba540000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000105ede003 CR4: 00000000003706a0 DR0:
0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? show_regs+0x5c/0x70 ? __die+0x1f/0x60 ? page_fault_oops+0x15d/0x440 ? lock_release+0xbc/0x240 ? exc_page_fault+0x4a4/0x970 ? asm_exc_page_fault+0x27/0x30 ? batch_unpin+0xa2/0x100 [iommufd] ? batch_unpin+0xba/0x100 [iommufd]
__iopt_area_unfill_domain+0x198/0x430 [iommufd] ? __mutex_lock+0x8c/0xb80 ? __mutex_lock+0x6aa/0xb80 ? xa_erase+0x28/0x30 ? iopt_table_remove_domain+0x162/0x320 [iommufd] ? lock_release+0xbc/0x240 iopt_area_unfill_domain+0xd/0x10 [iommufd] iopt_table_remove_domain+0x195/0x320 [iommufd] iommufd_hw_pagetable_destroy+0xb3/0x110 [iommufd] iommufd_object_destroy_user+0x8e/0xf0 [iommufd] iommufd_device_detach+0xc5/0x140 [iommufd] iommufd_selftest_destroy+0x1f/0x70 [iommufd] iommufd_object_destroy_user+0x8e/0xf0 [iommufd] iommufd_destroy+0x3a/0x50 [iommufd] iommufd_fops_ioctl+0xfb/0x170 [iommufd] __x64_sys_ioctl+0x40d/0x9a0 do_syscall_64+0x3c/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 (CVE-2023-54060)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54060
https://ubuntu.com/security/CVE-2023-54060

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54060

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279950 - Linux Distros Unpatched Vulnerability : CVE-2023-54064
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipmi:ssif: Fix a memory leak when scanning for an adapter The adapter scan ssif_info_find() sets info->adapter_name if the adapter info came from SMBIOS, as it's not set in that case. However, this function can be called more than once, and it will leak the adapter name if it had already been set. So check for NULL before setting it. (CVE-2023-54064)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54064
https://ubuntu.com/security/CVE-2023-54064

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54064

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279924 - Linux Distros Unpatched Vulnerability : CVE-2023-54066
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer In gl861_i2c_master_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach gl861_i2c_master_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a (media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()) (CVE-2023-54066)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54066
https://ubuntu.com/security/CVE-2023-54066

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54066

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279877 - Linux Distros Unpatched Vulnerability : CVE-2023-54070
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- igb: clean up in all error paths when enabling SR-IOV After commit 50f303496d92 (igb: Enable SR-IOV after reinit), removing the igb module could hang or crash (depending on the machine) when the module has been loaded with the max_vfs parameter set to some value != 0. In case of one test machine with a dual port 82580, this hang occurred: [ 232.480687] igb 0000:41:00.1: removed PHC on enp65s0f1 [ 233.093257] igb 0000:41:00.1: IOV Disabled [ 233.329969] pcieport 0000:40:01.0: AER: Multiple Uncorrected (Non-Fatal) err0 [ 233.340302] igb 0000:41:00.0: PCIe Bus Error: severity=Uncorrected (Non-Fata) [ 233.352248] igb 0000:41:00.0: device [8086:1516] error status/mask=00100000 [ 233.361088] igb 0000:41:00.0: [20] UnsupReq (First) [ 233.368183] igb 0000:41:00.0: AER: TLP Header: 40000001 0000040f cdbfc00c c [ 233.376846] igb 0000:41:00.1: PCIe Bus Error: severity=Uncorrected (Non-Fata) [ 233.388779] igb 0000:41:00.1: device [8086:1516] error status/mask=00100000 [ 233.397629] igb 0000:41:00.1: [20] UnsupReq (First) [ 233.404736] igb 0000:41:00.1: AER: TLP Header: 40000001 0000040f cdbfc00c c [ 233.538214] pci 0000:41:00.1: AER: can't recover (no error_detected callback) [ 233.538401] igb 0000:41:00.0: removed PHC on enp65s0f0 [ 233.546197] pcieport 0000:40:01.0: AER: device recovery failed [ 234.157244] igb 0000:41:00.0: IOV Disabled [ 371.619705] INFO: task irq/35-aerdrv:257 blocked for more than 122 seconds. [ 371.627489] Not tainted 6.4.0-dirty #2 [ 371.632257] echo 0 > /proc/sys/kernel/hung_task_timeout_secs disables this. [ 371.641000] task:irq/35-aerdrv state:D stack:0 pid:257 ppid:2 f0 [ 371.650330] Call Trace: [ 371.653061] <TASK> [ 371.655407] __schedule+0x20e/0x660 [ 371.659313] schedule+0x5a/0xd0 [ 371.662824] schedule_preempt_disabled+0x11/0x20 [ 371.667983] __mutex_lock.constprop.0+0x372/0x6c0 [ 371.673237] ?
__pfx_aer_root_reset+0x10/0x10 [ 371.678105] report_error_detected+0x25/0x1c0 [ 371.682974] ?
__pfx_report_normal_detected+0x10/0x10 [ 371.688618] pci_walk_bus+0x72/0x90 [ 371.692519] pcie_do_recovery+0xb2/0x330 [ 371.696899] aer_process_err_devices+0x117/0x170 [ 371.702055] aer_isr+0x1c0/0x1e0 [ 371.705661] ? __set_cpus_allowed_ptr+0x54/0xa0 [ 371.710723] ?
__pfx_irq_thread_fn+0x10/0x10 [ 371.715496] irq_thread_fn+0x20/0x60 [ 371.719491] irq_thread+0xe6/0x1b0 [ 371.723291] ? __pfx_irq_thread_dtor+0x10/0x10 [ 371.728255] ? __pfx_irq_thread+0x10/0x10 [ 371.732731] kthread+0xe2/0x110 [ 371.736243] ? __pfx_kthread+0x10/0x10 [ 371.740430] ret_from_fork+0x2c/0x50 [ 371.744428] </TASK> The reproducer was a simple script: #!/bin/sh for i in `seq 1 5`; do modprobe -rv igb modprobe -v igb max_vfs=1 sleep 1 modprobe -rv igb done It turned out that this could only be reproduce on 82580 (quad and dual-port), but not on 82576, i350 and i210. Further debugging showed that igb_enable_sriov()'s call to pci_enable_sriov() is failing, because dev->is_physfn is 0 on 82580. Prior to commit 50f303496d92 (igb: Enable SR-IOV after reinit), igb_enable_sriov() jumped into the err_out cleanup branch. After this commit it only returned the error code. So the cleanup didn't take place, and the incorrect VF setup in the igb_adapter structure fooled the igb driver into assuming that VFs have been set up where no VF actually existed. Fix this problem by cleaning up again if pci_enable_sriov() fails.
(CVE-2023-54070)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54070
https://ubuntu.com/security/CVE-2023-54070

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54070

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279879 - Linux Distros Unpatched Vulnerability : CVE-2023-54071
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: rtw88: use work to update rate to avoid RCU warning The ieee80211_ops::sta_rc_update must be atomic, because ieee80211_chan_bw_change() holds rcu_read lock while calling drv_sta_rc_update(), so create a work to do original things. Voluntary context switch within RCU read-side critical section! WARNING: CPU: 0 PID: 4621 at kernel/rcu/tree_plugin.h:318 rcu_note_context_switch+0x571/0x5d0 CPU: 0 PID: 4621 Comm:
kworker/u16:2 Tainted: G W OE Workqueue: phy3 ieee80211_chswitch_work [mac80211] RIP:
0010:rcu_note_context_switch+0x571/0x5d0 Call Trace: <TASK> __schedule+0xb0/0x1460 ?
__mod_timer+0x116/0x360 schedule+0x5a/0xc0 schedule_timeout+0x87/0x150 ? trace_raw_output_tick_stop+0x60/0x60 wait_for_completion_timeout+0x7b/0x140 usb_start_wait_urb+0x82/0x160 [usbcore usb_control_msg+0xe3/0x140 [usbcore rtw_usb_read+0x88/0xe0 [rtw_usb rtw_usb_read8+0xf/0x10 [rtw_usb rtw_fw_send_h2c_command+0xa0/0x170 [rtw_core rtw_fw_send_ra_info+0xc9/0xf0 [rtw_core drv_sta_rc_update+0x7c/0x160 [mac80211 ieee80211_chan_bw_change+0xfb/0x110 [mac80211 ieee80211_change_chanctx+0x38/0x130 [mac80211 ieee80211_vif_use_reserved_switch+0x34e/0x900 [mac80211 ieee80211_link_use_reserved_context+0x88/0xe0 [mac80211 ieee80211_chswitch_work+0x95/0x170 [mac80211 process_one_work+0x201/0x410 worker_thread+0x4a/0x3b0 ? process_one_work+0x410/0x410 kthread+0xe1/0x110 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 </TASK> (CVE-2023-54071)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54071
https://ubuntu.com/security/CVE-2023-54071

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54071

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279922 - Linux Distros Unpatched Vulnerability : CVE-2023-54072
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: pcm: Fix potential data race at PCM memory allocation helpers The PCM memory allocation helpers have a sanity check against too many buffer allocations. However, the check is performed without a proper lock and the allocation isn't serialized; this allows user to allocate more memories than predefined max size.
Practically seen, this isn't really a big problem, as it's more or less some soft limit as a sanity check, and it's not possible to allocate unlimitedly. But it's still better to address this for more consistent behavior. The patch covers the size check in do_alloc_pages() with the card->memory_mutex, and increases the allocated size there for preventing the further overflow. When the actual allocation fails, the size is decreased accordingly. (CVE-2023-54072)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54072
https://ubuntu.com/security/CVE-2023-54072

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54072

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279797 - Linux Distros Unpatched Vulnerability : CVE-2023-54081
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xen: speed up grant-table reclaim When a grant entry is still in use by the remote domain, Linux must put it on a deferred list. Normally, this list is very short, because the PV network and block protocols expect the backend to unmap the grant first. However, Qubes OS's GUI protocol is subject to the constraints of the X Window System, and as such winds up with the frontend unmapping the window first. As a result, the list can grow very large, resulting in a massive memory leak and eventual VM freeze. To partially solve this problem, make the number of entries that the VM will attempt to free at each iteration tunable. The default is still 10, but it can be overridden via a module parameter. This is Cc:
stable because (when combined with appropriate userspace changes) it fixes a severe performance and stability problem for Qubes OS users. (CVE-2023-54081)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54081
https://security-tracker.debian.org/tracker/CVE-2023-54081
https://ubuntu.com/security/CVE-2023-54081

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54081

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279779 - Linux Distros Unpatched Vulnerability : CVE-2023-54085
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mptcp: fix NULL pointer dereference on fastopen early fallback In case of early fallback to TCP, subflow_syn_recv_sock() deletes the subflow context before returning the newly allocated sock to the caller. The fastopen path does not cope with the above unconditionally dereferencing the subflow context.
(CVE-2023-54085)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54085
https://ubuntu.com/security/CVE-2023-54085

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54085

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279782 - Linux Distros Unpatched Vulnerability : CVE-2023-54086
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Add preempt_count_{sub,add} into btf id deny list The recursion check in __bpf_prog_enter* and
__bpf_prog_exit* leave preempt_count_{sub,add} unprotected. When attaching trampoline to them we get panic as follows, [ 867.843050] BUG: TASK stack guard page was hit at 0000000009d325cf (stack is 0000000046a46a15..00000000537e7b28) [ 867.843064] stack guard page: 0000 [#1] PREEMPT SMP NOPTI [ 867.843067] CPU: 8 PID: 11009 Comm: trace Kdump: loaded Not tainted 6.2.0+ #4 [ 867.843100] Call Trace: [ 867.843101] <TASK> [ 867.843104] asm_exc_int3+0x3a/0x40 [ 867.843108] RIP: 0010:preempt_count_sub+0x1/0xa0 [ 867.843135] __bpf_prog_enter_recur+0x17/0x90 [ 867.843148] bpf_trampoline_6442468108_0+0x2e/0x1000 [ 867.843154] ? preempt_count_sub+0x1/0xa0 [ 867.843157] preempt_count_sub+0x5/0xa0 [ 867.843159] ? migrate_enable+0xac/0xf0 [ 867.843164] __bpf_prog_exit_recur+0x2d/0x40 [ 867.843168] bpf_trampoline_6442468108_0+0x55/0x1000 ... [ 867.843788] preempt_count_sub+0x5/0xa0 [ 867.843793] ? migrate_enable+0xac/0xf0 [ 867.843829] __bpf_prog_exit_recur+0x2d/0x40 [ 867.843837] BUG: IRQ stack guard page was hit at 0000000099bd8228 (stack is 00000000b23e2bc4..000000006d95af35) [ 867.843841] BUG: IRQ stack guard page was hit at 000000005ae07924 (stack is 00000000ffd69623..0000000014eb594c) [ 867.843843] BUG: IRQ stack guard page was hit at 00000000028320f0 (stack is 00000000034b6438..0000000078d1bcec) [ 867.843842] bpf_trampoline_6442468108_0+0x55/0x1000 ... That is because in __bpf_prog_exit_recur, the preempt_count_{sub,add} are called after prog->active is decreased. Fixing this by adding these two functions into btf ids deny list. (CVE-2023-54086)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54086
https://security-tracker.debian.org/tracker/CVE-2023-54086
https://ubuntu.com/security/CVE-2023-54086

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54086

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279837 - Linux Distros Unpatched Vulnerability : CVE-2023-54087
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ubi: Fix possible null-ptr-deref in ubi_free_volume() It willl cause null-ptr-deref in the following case:
uif_init() ubi_add_volume() cdev_add() -> if it fails, call kill_volumes() device_register() kill_volumes() -> if ubi_add_volume() fails call this function ubi_free_volume() cdev_del() device_unregister() -> trying to delete a not added device, it causes null-ptr-deref So in ubi_free_volume(), it delete devices whether they are added or not, it will causes null-ptr-deref. Handle the error case whlie calling ubi_add_volume() to fix this problem. If add volume fails, set the corresponding vol to null, so it can not be accessed in kill_volumes() and release the resource in ubi_add_volume() error path. (CVE-2023-54087)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54087
https://ubuntu.com/security/CVE-2023-54087

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54087

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279860 - Linux Distros Unpatched Vulnerability : CVE-2023-54090
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ixgbe: Fix panic during XDP_TX with > 64 CPUs Commit 4fe815850bdc (ixgbe: let the xdpdrv work with more than 64 cpus) adds support to allow XDP programs to run on systems with more than 64 CPUs by locking the XDP TX rings and indexing them using cpu % 64 (IXGBE_MAX_XDP_QS). Upon trying this out patch on a system with more than 64 cores, the kernel paniced with an array-index-out-of-bounds at the return in ixgbe_determine_xdp_ring in ixgbe.h, which means ixgbe_determine_xdp_q_idx was just returning the cpu instead of cpu % IXGBE_MAX_XDP_QS. An example splat:
========================================================================== UBSAN: array-index-out-of- bounds in /var/lib/dkms/ixgbe/5.18.6+focal-1/build/src/ixgbe.h:1147:26 index 65 is out of range for type 'ixgbe_ring *[64]' ========================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000058 #PF: supervisor read access in kernel mode #PF:
error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI CPU: 65 PID: 408 Comm:
ksoftirqd/65 Tainted: G IOE 5.15.0-48-generic #54~20.04.1-Ubuntu Hardware name: Dell Inc. PowerEdge R640/0W23H8, BIOS 2.5.4 01/13/2020 RIP: 0010:ixgbe_xmit_xdp_ring+0x1b/0x1c0 [ixgbe] Code: 3b 52 d4 cf e9 42 f2 ff ff 66 0f 1f 44 00 00 0f 1f 44 00 00 55 b9 00 00 00 00 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 08 <44> 0f b7 47 58 0f b7 47 5a 0f b7 57 54 44 0f b7 76 08 66 41 39 c0 RSP: 0018:ffffbc3fcd88fcb0 EFLAGS: 00010282 RAX: ffff92a253260980 RBX: ffffbc3fe68b00a0 RCX: 0000000000000000 RDX: ffff928b5f659000 RSI: ffff928b5f659000 RDI: 0000000000000000 RBP: ffffbc3fcd88fce0 R08: ffff92b9dfc20580 R09:
0000000000000001 R10: 3d3d3d3d3d3d3d3d R11: 3d3d3d3d3d3d3d3d R12: 0000000000000000 R13: ffff928b2f0fa8c0 R14: ffff928b9be20050 R15: 000000000000003c FS: 0000000000000000(0000) GS:ffff92b9dfc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000058 CR3:
000000011dd6a002 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK>
ixgbe_poll+0x103e/0x1280 [ixgbe] ? sched_clock_cpu+0x12/0xe0 __napi_poll+0x30/0x160 net_rx_action+0x11c/0x270 __do_softirq+0xda/0x2ee run_ksoftirqd+0x2f/0x50 smpboot_thread_fn+0xb7/0x150 ? sort_range+0x30/0x30 kthread+0x127/0x150 ? set_kthread_struct+0x50/0x50 ret_from_fork+0x1f/0x30 </TASK> I think this is how it happens: Upon loading the first XDP program on a system with more than 64 CPUs, ixgbe_xdp_locking_key is incremented in ixgbe_xdp_setup. However, immediately after this, the rings are reconfigured by ixgbe_setup_tc. ixgbe_setup_tc calls ixgbe_clear_interrupt_scheme which calls ixgbe_free_q_vectors which calls ixgbe_free_q_vector in a loop. ixgbe_free_q_vector decrements ixgbe_xdp_locking_key once per call if it is non-zero. Commenting out the decrement in ixgbe_free_q_vector stopped my system from panicing. I suspect to make the original patch work, I would need to load an XDP program and then replace it in order to get ixgbe_xdp_locking_key back above 0 since ixgbe_setup_tc is only called when transitioning between XDP and non-XDP ring configurations, while ixgbe_xdp_locking_key is incremented every time ixgbe_xdp_setup is called. Also, ixgbe_setup_tc can be called via ethtool --set- channels, so this becomes another path to decrement ixgbe_xdp_locking_key to 0 on systems with more than 64 CPUs. Since ixgbe_xdp_locking_key only protects the XDP_TX path and is tied to the number of CPUs present, there is no reason to disable it upon unloading an XDP program. To avoid confusion, I have moved enabling ixgbe_xdp_locking_key into ixgbe_sw_init, which is part of the probe path. (CVE-2023-54090)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54090
https://ubuntu.com/security/CVE-2023-54090

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54090

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279835 - Linux Distros Unpatched Vulnerability : CVE-2023-54091
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/client: Fix memory leak in drm_client_target_cloned dmt_mode is allocated and never freed in this function. It was found with the ast driver, but most drivers using generic fbdev setup are probably affected. This fixes the following kmemleak report: backtrace: [<00000000b391296d>] drm_mode_duplicate+0x45/0x220 [drm] [<00000000e45bb5b3>] drm_client_target_cloned.constprop.0+0x27b/0x480 [drm] [<00000000ed2d3a37>] drm_client_modeset_probe+0x6bd/0xf50 [drm] [<0000000010e5cc9d>]
__drm_fb_helper_initial_config_and_unlock+0xb4/0x2c0 [drm_kms_helper] [<00000000909f82ca>] drm_fbdev_client_hotplug+0x2bc/0x4d0 [drm_kms_helper] [<00000000063a69aa>] drm_client_register+0x169/0x240 [drm] [<00000000a8c61525>] ast_pci_probe+0x142/0x190 [ast] [<00000000987f19bb>] local_pci_probe+0xdc/0x180 [<000000004fca231b>] work_for_cpu_fn+0x4e/0xa0 [<0000000000b85301>] process_one_work+0x8b7/0x1540 [<000000003375b17c>] worker_thread+0x70a/0xed0 [<00000000b0d43cd9>] kthread+0x29f/0x340 [<000000008d770833>] ret_from_fork+0x1f/0x30 unreferenced object 0xff11000333089a00 (size 128):
(CVE-2023-54091)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54091
https://ubuntu.com/security/CVE-2023-54091

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54091

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279855 - Linux Distros Unpatched Vulnerability : CVE-2023-54092
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- KVM: s390: pv: fix index value of replaced ASCE The index field of the struct page corresponding to a guest ASCE should be 0. When replacing the ASCE in s390_replace_asce(), the index of the new ASCE should also be set to 0. Having the wrong index might lead to the wrong addresses being passed around when notifying pte invalidations, and eventually to validity intercepts (VM crash) if the prefix gets unmapped and the notifier gets called with the wrong address. (CVE-2023-54092)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54092
https://ubuntu.com/security/CVE-2023-54092

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54092

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279868 - Linux Distros Unpatched Vulnerability : CVE-2023-54093
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- media: anysee: fix null-ptr-deref in anysee_master_xfer In anysee_master_xfer, msg is controlled by user.
When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach anysee_master_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a (media:
dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()) [hverkuil: add spaces around +] (CVE-2023-54093)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54093
https://ubuntu.com/security/CVE-2023-54093

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54093

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279838 - Linux Distros Unpatched Vulnerability : CVE-2023-54094
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: prevent skb corruption on frag list segmentation Ian reported several skb corruptions triggered by rx-gro-list, collecting different oops alike: [ 62.624003] BUG: kernel NULL pointer dereference, address:
00000000000000c0 [ 62.631083] #PF: supervisor read access in kernel mode [ 62.636312] #PF:
error_code(0x0000) - not-present page [ 62.641541] PGD 0 P4D 0 [ 62.644174] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 62.648629] CPU: 1 PID: 913 Comm: napi/eno2-79 Not tainted 6.4.0 #364 [ 62.655162] Hardware name:
Supermicro Super Server/A2SDi-12C-HLN4F, BIOS 1.7a 10/13/2022 [ 62.663344] RIP: 0010:__udp_gso_segment (./include/linux/skbuff.h:2858 ./include/linux/udp.h:23 net/ipv4/udp_offload.c:228 net/ipv4/udp_offload.c:261 net/ipv4/udp_offload.c:277) [ 62.687193] RSP: 0018:ffffbd3a83b4f868 EFLAGS:
00010246 [ 62.692515] RAX: 00000000000000ce RBX: 0000000000000000 RCX: 0000000000000000 [ 62.699743] RDX:
ffffa124def8a000 RSI: 0000000000000079 RDI: ffffa125952a14d4 [ 62.706970] RBP: ffffa124def8a000 R08:
0000000000000022 R09: 00002000001558c9 [ 62.714199] R10: 0000000000000000 R11: 00000000be554639 R12:
00000000000000e2 [ 62.721426] R13: ffffa125952a1400 R14: ffffa125952a1400 R15: 00002000001558c9 [ 62.728654] FS: 0000000000000000(0000) GS:ffffa127efa40000(0000) knlGS:0000000000000000 [ 62.736852] CS:
0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 62.742702] CR2: 00000000000000c0 CR3: 00000001034b0000 CR4:
00000000003526e0 [ 62.749948] Call Trace: [ 62.752498] <TASK> [ 62.779267] inet_gso_segment (net/ipv4/af_inet.c:1398) [ 62.787605] skb_mac_gso_segment (net/core/gro.c:141) [ 62.791906]
__skb_gso_segment (net/core/dev.c:3403 (discriminator 2)) [ 62.800492] validate_xmit_skb (./include/linux/netdevice.h:4862 net/core/dev.c:3659) [ 62.804695] validate_xmit_skb_list (net/core/dev.c:3710) [ 62.809158] sch_direct_xmit (net/sched/sch_generic.c:330) [ 62.813198]
__dev_queue_xmit (net/core/dev.c:3805 net/core/dev.c:4210) net/netfilter/core.c:626) [ 62.821093] br_dev_queue_push_xmit (net/bridge/br_forward.c:55) [ 62.825652] maybe_deliver (net/bridge/br_forward.c:193) [ 62.829420] br_flood (net/bridge/br_forward.c:233) [ 62.832758] br_handle_frame_finish (net/bridge/br_input.c:215) [ 62.837403] br_handle_frame (net/bridge/br_input.c:298 net/bridge/br_input.c:416) [ 62.851417] __netif_receive_skb_core.constprop.0 (net/core/dev.c:5387) [ 62.866114] __netif_receive_skb_list_core (net/core/dev.c:5570) [ 62.871367] netif_receive_skb_list_internal (net/core/dev.c:5638 net/core/dev.c:5727) [ 62.876795] napi_complete_done (./include/linux/list.h:37 ./include/net/gro.h:434 ./include/net/gro.h:429 net/core/dev.c:6067) [ 62.881004] ixgbe_poll (drivers/net/ethernet/intel/ixgbe/ixgbe_main.c:3191) [ 62.893534] __napi_poll (net/core/dev.c:6498) [ 62.897133] napi_threaded_poll (./include/linux/netpoll.h:89 net/core/dev.c:6640) [ 62.905276] kthread (kernel/kthread.c:379) [ 62.913435] ret_from_fork (arch/x86/entry/entry_64.S:314) [ 62.917119] </TASK> In the critical scenario, rx-gro-list GRO-ed packets are fed, via a bridge, both to the local input path and to an egress device (tun). The segmentation of such packets unsafely writes to the cloned skbs with shared heads. This change addresses the issue by uncloning as needed the to-be-segmented skbs. (CVE-2023-54094)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54094
https://ubuntu.com/security/CVE-2023-54094

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54094

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279848 - Linux Distros Unpatched Vulnerability : CVE-2023-54098
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/i915/gvt: fix gvt debugfs destroy When gvt debug fs is destroyed, need to have a sane check if drm minor's debugfs root is still available or not, otherwise in case like device remove through unbinding, drm minor's debugfs directory has already been removed, then intel_gvt_debugfs_clean() would act upon dangling pointer like below oops. i915 0000:00:02.0: Direct firmware load for i915/gvt/vid_0x8086_did_0x1926_rid_0x0a.golden_hw_state failed with error -2 i915 0000:00:02.0: MDEV:
Registered Console: switching to colour dummy device 80x25 i915 0000:00:02.0: MDEV: Unregistering BUG:
kernel NULL pointer dereference, address: 00000000000000a0 PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP PTI CPU: 2 PID: 2486 Comm: gfx-unbind.sh Tainted: G I 6.1.0-rc8+ #15 Hardware name: Dell Inc. XPS 13 9350/0JXC1H, BIOS 1.13.0 02/10/2020 RIP: 0010:down_write+0x1f/0x90 Code: 1d ff ff 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 53 48 89 fb e8 62 c0 ff ff bf 01 00 00 00 e8 28 5e 31 ff 31 c0 ba 01 00 00 00 <f0> 48 0f b1 13 75 33 65 48 8b 04 25 c0 bd 01 00 48 89 43 08 bf 01 RSP: 0018:ffff9eb3036ffcc8 EFLAGS: 00010246 RAX:
0000000000000000 RBX: 00000000000000a0 RCX: ffffff8100000000 RDX: 0000000000000001 RSI: 0000000000000064 RDI: ffffffffa48787a8 RBP: ffff9eb3036ffd30 R08: ffffeb1fc45a0608 R09: ffffeb1fc45a05c0 R10:
0000000000000002 R11: 0000000000000000 R12: 0000000000000000 R13: ffff91acc33fa328 R14: ffff91acc033f080 R15: ffff91acced533e0 FS: 00007f6947bba740(0000) GS:ffff91ae36d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000000a0 CR3: 00000001133a2002 CR4: 00000000003706e0 Call Trace: <TASK> simple_recursive_removal+0x9f/0x2a0 ? start_creating.part.0+0x120/0x120 ?
_raw_spin_lock+0x13/0x40 debugfs_remove+0x40/0x60 intel_gvt_debugfs_clean+0x15/0x30 [kvmgt] intel_gvt_clean_device+0x49/0xe0 [kvmgt] intel_gvt_driver_remove+0x2f/0xb0 i915_driver_remove+0xa4/0xf0 i915_pci_remove+0x1a/0x30 pci_device_remove+0x33/0xa0 device_release_driver_internal+0x1b2/0x230 unbind_store+0xe0/0x110 kernfs_fop_write_iter+0x11b/0x1f0 vfs_write+0x203/0x3d0 ksys_write+0x63/0xe0 do_syscall_64+0x37/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f6947cb5190 Code: 40 00 48 8b 15 71 9c 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d 51 24 0e 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89 RSP: 002b:00007ffcbac45a28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000000000d RCX:
00007f6947cb5190 RDX: 000000000000000d RSI: 0000555e35c866a0 RDI: 0000000000000001 RBP: 0000555e35c866a0 R08: 0000000000000002 R09: 0000555e358cb97c R10: 0000000000000000 R11: 0000000000000202 R12:
0000000000000001 R13: 000000000000000d R14: 0000000000000000 R15: 0000555e358cb8e0 </TASK> Modules linked in: kvmgt CR2: 00000000000000a0 ---[ end trace 0000000000000000 ]--- (CVE-2023-54098)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54098
https://ubuntu.com/security/CVE-2023-54098

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54098

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279833 - Linux Distros Unpatched Vulnerability : CVE-2023-54106
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mlx5: fix potential memory leak in mlx5e_init_rep_rx The memory pointed to by the priv->rx_res pointer is not freed in the error path of mlx5e_init_rep_rx, which can lead to a memory leak. Fix by freeing the memory in the error path, thereby making the error path identical to mlx5e_cleanup_rep_rx().
(CVE-2023-54106)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54106
https://ubuntu.com/security/CVE-2023-54106

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54106

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279823 - Linux Distros Unpatched Vulnerability : CVE-2023-54107
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- blk-cgroup: dropping parent refcount after pd_free_fn() is done Some cgroup policies will access parent pd through child pd even after pd_offline_fn() is done. If pd_free_fn() for parent is called before child, then UAF can be triggered. Hence it's better to guarantee the order of pd_free_fn(). Currently refcount of parent blkg is dropped in __blkg_release(), which is before pd_free_fn() is called in blkg_free_work_fn() while blkg_free_work_fn() is called asynchronously. This patch make sure pd_free_fn() called from removing cgroup is ordered by delaying dropping parent refcount after calling pd_free_fn() for child. BTW, pd_free_fn() will also be called from blkcg_deactivate_policy() from deleting device, and following patches will guarantee the order. (CVE-2023-54107)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54107
https://security-tracker.debian.org/tracker/CVE-2023-54107
https://ubuntu.com/security/CVE-2023-54107

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54107

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279866 - Linux Distros Unpatched Vulnerability : CVE-2023-54108
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests The following message and call trace was seen with debug kernels: DMA-API: qla2xxx 0000:41:00.0: device driver failed to check map error [device address=0x00000002a3ff38d8] [size=1024 bytes] [mapped as single] WARNING: CPU: 0 PID: 2930 at kernel/dma/debug.c:1017 check_unmap+0xf42/0x1990 Call Trace: debug_dma_unmap_page+0xc9/0x100 qla_nvme_ls_unmap+0x141/0x210 [qla2xxx] Remove DMA mapping from the driver altogether, as it is already done by FC layer. This prevents the warning. (CVE-2023-54108)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54108
https://ubuntu.com/security/CVE-2023-54108

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54108

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279883 - Linux Distros Unpatched Vulnerability : CVE-2023-54117
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- s390/dcssblk: fix kernel crash with list_add corruption Commit fb08a1908cb1 (dax: simplify the dax_device <-> gendisk association) introduced new logic for gendisk association, requiring drivers to explicitly call dax_add_host() and dax_remove_host(). For dcssblk driver, some dax_remove_host() calls were missing, e.g. in device remove path. The commit also broke error handling for out_dax case in device add path, resulting in an extra put_device() w/o the previous get_device() in that case. This lead to stale xarray entries after device add / remove cycles. In the case when a previously used struct gendisk pointer (xarray index) would be used again, because blk_alloc_disk() happened to return such a pointer, the xa_insert() in dax_add_host() would fail and go to out_dax, doing the extra put_device() in the error path. In combination with an already flawed error handling in dcssblk (device_register() cleanup), which needs to be addressed in a separate patch, this resulted in a missing device_del() / klist_del(), and eventually in the kernel crash with list_add corruption on a subsequent device_add() / klist_add(). Fix this by adding the missing dax_remove_host() calls, and also move the put_device() in the error path to restore the previous logic. (CVE-2023-54117)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54117
https://ubuntu.com/security/CVE-2023-54117

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54117

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279898 - Linux Distros Unpatched Vulnerability : CVE-2023-54119
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- inotify: Avoid reporting event with invalid wd When inotify_freeing_mark() races with inotify_handle_inode_event() it can happen that inotify_handle_inode_event() sees that i_mark->wd got already reset to -1 and reports this value to userspace which can confuse the inotify listener. Avoid the problem by validating that wd is sensible (and pretend the mark got removed before the event got generated otherwise). (CVE-2023-54119)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54119
https://ubuntu.com/security/CVE-2023-54119

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54119

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279886 - Linux Distros Unpatched Vulnerability : CVE-2023-54128
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fs: drop peer group ids under namespace lock When cleaning up peer group ids in the failure path we need to make sure to hold on to the namespace lock. Otherwise another thread might just turn the mount from a shared into a non-shared mount concurrently. (CVE-2023-54128)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54128
https://ubuntu.com/security/CVE-2023-54128

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54128

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279849 - Linux Distros Unpatched Vulnerability : CVE-2023-54129
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- octeontx2-af: Add validation for lmac type Upon physical link change, firmware reports to the kernel about the change along with the details like speed, lmac_type_id, etc. Kernel derives lmac_type based on lmac_type_id received from firmware. In a few scenarios, firmware returns an invalid lmac_type_id, which is resulting in below kernel panic. This patch adds the missing validation of the lmac_type_id field.
Internal error: Oops: 96000005 [#1] PREEMPT SMP [ 35.321595] Modules linked in: [ 35.328982] CPU: 0 PID:
31 Comm: kworker/0:1 Not tainted 5.4.210-g2e3169d8e1bc-dirty #17 [ 35.337014] Hardware name: Marvell CN103XX board (DT) [ 35.344297] Workqueue: events work_for_cpu_fn [ 35.352730] pstate: 40400089 (nZcv daIf +PAN -UAO) [ 35.360267] pc : strncpy+0x10/0x30 [ 35.366595] lr : cgx_link_change_handler+0x90/0x180 (CVE-2023-54129)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54129
https://security-tracker.debian.org/tracker/CVE-2023-54129
https://ubuntu.com/security/CVE-2023-54129

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54129

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279774 - Linux Distros Unpatched Vulnerability : CVE-2023-54134
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- autofs: fix memory leak of waitqueues in autofs_catatonic_mode Syzkaller reports a memory leak: BUG:
memory leak unreferenced object 0xffff88810b279e00 (size 96): comm syz-executor399, pid 3631, jiffies 4294964921 (age 23.870s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 08 9e 27 0b 81 88 ff ff ..........'..... 08 9e 27 0b 81 88 ff ff 00 00 00 00 00 00 00 00 ..'............. backtrace:
[<ffffffff814cfc90>] kmalloc_trace+0x20/0x90 mm/slab_common.c:1046 [<ffffffff81bb75ca>] kmalloc include/linux/slab.h:576 [inline] [<ffffffff81bb75ca>] autofs_wait+0x3fa/0x9a0 fs/autofs/waitq.c:378 [<ffffffff81bb88a7>] autofs_do_expire_multi+0xa7/0x3e0 fs/autofs/expire.c:593 [<ffffffff81bb8c33>] autofs_expire_multi+0x53/0x80 fs/autofs/expire.c:619 [<ffffffff81bb6972>] autofs_root_ioctl_unlocked+0x322/0x3b0 fs/autofs/root.c:897 [<ffffffff81bb6a95>] autofs_root_ioctl+0x25/0x30 fs/autofs/root.c:910 [<ffffffff81602a9c>] vfs_ioctl fs/ioctl.c:51 [inline] [<ffffffff81602a9c>] __do_sys_ioctl fs/ioctl.c:870 [inline] [<ffffffff81602a9c>] __se_sys_ioctl fs/ioctl.c:856 [inline] [<ffffffff81602a9c>] __x64_sys_ioctl+0xfc/0x140 fs/ioctl.c:856 [<ffffffff84608225>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<ffffffff84608225>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [<ffffffff84800087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd autofs_wait_queue structs should be freed if their wait_ctr becomes zero. Otherwise they will be lost. In this case an AUTOFS_IOC_EXPIRE_MULTI ioctl is done, then a new waitqueue struct is allocated in autofs_wait(), its initial wait_ctr equals 2. After that wait_event_killable() is interrupted (it returns -ERESTARTSYS), so that 'wq->name.name == NULL' condition may be not satisfied. Actually, this condition can be satisfied when autofs_wait_release() or autofs_catatonic_mode() is called and, what is also important, wait_ctr is decremented in those places.
Upon the exit of autofs_wait(), wait_ctr is decremented to 1. Then the unmounting process begins: kill_sb calls autofs_catatonic_mode(), which should have freed the waitqueues, but it only decrements its usage counter to zero which is not a correct behaviour. edit:imk This description is of course not correct. The umount performed as a result of an expire is a umount of a mount that has been automounted, it's not the autofs mount itself. They happen independently, usually after everything mounted within the autofs file system has been expired away. If everything hasn't been expired away the automount daemon can still exit leaving mounts in place. But expires done in both cases will result in a notification that calls autofs_wait_release() with a result status. The problem case is the summary execution of of the automount daemon. In this case any waiting processes won't be woken up until either they are terminated or the mount is umounted. end edit: imk So in catatonic mode we should free waitqueues which counter becomes zero.
edit: imk Initially I was concerned that the calling of autofs_wait_release() and autofs_catatonic_mode() was not mutually exclusive but that can't be the case (obviously) because the queue entry (or entries) is removed from the list when either of these two functions are called. Consequently the wait entry will be freed by only one of these functions or by the woken process in autofs_wait() depending on the order of the calls. end edit: imk (CVE-2023-54134)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54134
https://ubuntu.com/security/CVE-2023-54134

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54134

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279722 - Linux Distros Unpatched Vulnerability : CVE-2023-54144
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/amdkfd: Fix kernel warning during topology setup This patch fixes the following kernel warning seen during driver load by correctly initializing the p2plink attr before creating the sysfs file: [ +0.002865]
------------[ cut here ]------------ [ +0.002327] kobject: '(null)' (0000000056260cfb): is not initialized, yet kobject_put() is being called. [ +0.004780] WARNING: CPU: 32 PID: 1006 at lib/kobject.c:718 kobject_put+0xaa/0x1c0 [ +0.001361] Call Trace: [ +0.001234] <TASK> [ +0.001067] kfd_remove_sysfs_node_entry+0x24a/0x2d0 [amdgpu] [ +0.003147] kfd_topology_update_sysfs+0x3d/0x750 [amdgpu] [ +0.002890] kfd_topology_add_device+0xbd7/0xc70 [amdgpu] [ +0.002844] ? lock_release+0x13c/0x2e0 [ +0.001936] ? smu_cmn_send_smc_msg_with_param+0x1e8/0x2d0 [amdgpu] [ +0.003313] ? amdgpu_dpm_get_mclk+0x54/0x60 [amdgpu] [ +0.002703] kgd2kfd_device_init.cold+0x39f/0x4ed [amdgpu] [ +0.002930] amdgpu_amdkfd_device_init+0x13d/0x1f0 [amdgpu] [ +0.002944] amdgpu_device_init.cold+0x1464/0x17b4 [amdgpu] [ +0.002970] ? pci_bus_read_config_word+0x43/0x80 [ +0.002380] amdgpu_driver_load_kms+0x15/0x100 [amdgpu] [ +0.002744] amdgpu_pci_probe+0x147/0x370 [amdgpu] [ +0.002522] local_pci_probe+0x40/0x80 [ +0.001896] work_for_cpu_fn+0x10/0x20 [ +0.001892] process_one_work+0x26e/0x5a0 [ +0.002029] worker_thread+0x1fd/0x3e0 [ +0.001890] ? process_one_work+0x5a0/0x5a0 [ +0.002115] kthread+0xea/0x110 [ +0.001618] ? kthread_complete_and_exit+0x20/0x20 [ +0.002422] ret_from_fork+0x1f/0x30 [ +0.001808] </TASK> [ +0.001103] irq event stamp: 59837 [ +0.001718] hardirqs last enabled at (59849): [<ffffffffb30fab12>]
__up_console_sem+0x52/0x60 [ +0.004414] hardirqs last disabled at (59860): [<ffffffffb30faaf7>]
__up_console_sem+0x37/0x60 [ +0.004414] softirqs last enabled at (59654): [<ffffffffb307d9c7>] irq_exit_rcu+0xd7/0x130 [ +0.004205] softirqs last disabled at (59649): [<ffffffffb307d9c7>] irq_exit_rcu+0xd7/0x130 [ +0.004203] ---[ end trace 0000000000000000 ]--- (CVE-2023-54144)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54144
https://ubuntu.com/security/CVE-2023-54144

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54144

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279726 - Linux Distros Unpatched Vulnerability : CVE-2023-54150
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/amd: Fix an out of bounds error in BIOS parser The array is hardcoded to 8 in atomfirmware.h, but firmware provides a bigger one sometimes. Deferencing the larger array causes an out of bounds error.
commit 4fc1ba4aa589 (drm/amd/display: fix array index out of bound error in bios parser) fixed some of this, but there are two other cases not covered by it. Fix those as well. (CVE-2023-54150)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54150
https://ubuntu.com/security/CVE-2023-54150

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54150

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279760 - Linux Distros Unpatched Vulnerability : CVE-2023-54152
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- can: j1939: prevent deadlock by moving j1939_sk_errqueue() This commit addresses a deadlock situation that can occur in certain scenarios, such as when running data TP/ETP transfer and subscribing to the error queue while receiving a net down event. The deadlock involves locks in the following order: 3 j1939_session_list_lock -> active_session_list_lock j1939_session_activate ...
j1939_sk_queue_activate_next -> sk_session_queue_lock ... j1939_xtp_rx_eoma_one 2 j1939_sk_queue_drop_all
-> sk_session_queue_lock ... j1939_sk_netdev_event_netdown -> j1939_socks_lock j1939_netdev_notify 1 j1939_sk_errqueue -> j1939_socks_lock __j1939_session_cancel -> active_session_list_lock j1939_tp_rxtimer CPU0 CPU1 ---- ---- lock(&priv->active_session_list_lock); lock(&jsk->sk_session_queue_lock);
lock(&priv->active_session_list_lock); lock(&priv->j1939_socks_lock); The solution implemented in this commit is to move the j1939_sk_errqueue() call out of the active_session_list_lock context, thus preventing the deadlock situation. (CVE-2023-54152)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54152
https://ubuntu.com/security/CVE-2023-54152

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54152

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279770 - Linux Distros Unpatched Vulnerability : CVE-2023-54153
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: turn quotas off if mount failed after enabling quotas Yi found during a review of the patch ext4:
don't BUG on inconsistent journal feature that when ext4_mark_recovery_complete() returns an error value, the error handling path does not turn off the enabled quotas, which triggers the following kmemleak:
================================================================ unreferenced object 0xffff8cf68678e7c0 (size 64): comm mount, pid 746, jiffies 4294871231 (age 11.540s) hex dump (first 32 bytes): 00 90 ef 82 f6 8c ff ff 00 00 00 00 41 01 00 00 ............A... c7 00 00 00 bd 00 00 00 0a 00 00 00 48 00 00 00 ............H... backtrace: [<00000000c561ef24>] __kmem_cache_alloc_node+0x4d4/0x880 [<00000000d4e621d7>] kmalloc_trace+0x39/0x140 [<00000000837eee74>] v2_read_file_info+0x18a/0x3a0 [<0000000088f6c877>] dquot_load_quota_sb+0x2ed/0x770 [<00000000340a4782>] dquot_load_quota_inode+0xc6/0x1c0 [<0000000089a18bd5>] ext4_enable_quotas+0x17e/0x3a0 [ext4] [<000000003a0268fa>]
__ext4_fill_super+0x3448/0x3910 [ext4] [<00000000b0f2a8a8>] ext4_fill_super+0x13d/0x340 [ext4] [<000000004a9489c4>] get_tree_bdev+0x1dc/0x370 [<000000006e723bf1>] ext4_get_tree+0x1d/0x30 [ext4] [<00000000c7cb663d>] vfs_get_tree+0x31/0x160 [<00000000320e1bed>] do_new_mount+0x1d5/0x480 [<00000000c074654c>] path_mount+0x22e/0xbe0 [<0000000003e97a8e>] do_mount+0x95/0xc0 [<000000002f3d3736>]
__x64_sys_mount+0xc4/0x160 [<0000000027d2140c>] do_syscall_64+0x3f/0x90 ================================================================ To solve this problem, we add a failed_mount10 tag, and call ext4_quota_off_umount() in this tag to release the enabled qoutas.
(CVE-2023-54153)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54153
https://security-tracker.debian.org/tracker/CVE-2023-54153
https://ubuntu.com/security/CVE-2023-54153

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54153

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279807 - Linux Distros Unpatched Vulnerability : CVE-2023-54154
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: target: core: Fix target_cmd_counter leak The target_cmd_counter struct allocated via target_alloc_cmd_counter() is never freed, resulting in leaks across various transport types, e.g.:
unreferenced object 0xffff88801f920120 (size 96): comm sh, pid 102, jiffies 4294892535 (age 713.412s) hex dump (first 32 bytes): 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 38 01 92 1f 80 88 ff ff ........8....... backtrace: [<00000000e58a6252>] kmalloc_trace+0x11/0x20 [<0000000043af4b2f>] target_alloc_cmd_counter+0x17/0x90 [target_core_mod] [<000000007da2dfa7>] target_setup_session+0x2d/0x140 [target_core_mod] [<0000000068feef86>] tcm_loop_tpg_nexus_store+0x19b/0x350 [tcm_loop] [<000000006a80e021>] configfs_write_iter+0xb1/0x120 [<00000000e9f4d860>] vfs_write+0x2e4/0x3c0 [<000000008143433b>] ksys_write+0x80/0xb0 [<00000000a7df29b2>] do_syscall_64+0x42/0x90 [<0000000053f45fb8>] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Free the structure alongside the corresponding iscsit_conn / se_sess parent. (CVE-2023-54154)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54154
https://ubuntu.com/security/CVE-2023-54154

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54154

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279728 - Linux Distros Unpatched Vulnerability : CVE-2023-54155
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail() Syzkaller reported the following issue: ======================================= Too BIG xdp->frame_sz = 131072 WARNING: CPU: 0 PID: 5020 at net/core/filter.c:4121 ____bpf_xdp_adjust_tail net/core/filter.c:4121 [inline] WARNING: CPU: 0 PID: 5020 at net/core/filter.c:4121 bpf_xdp_adjust_tail+0x466/0xa10 net/core/filter.c:4103 ... Call Trace: <TASK>
bpf_prog_4add87e5301a4105+0x1a/0x1c __bpf_prog_run include/linux/filter.h:600 [inline] bpf_prog_run_xdp include/linux/filter.h:775 [inline] bpf_prog_run_generic_xdp+0x57e/0x11e0 net/core/dev.c:4721 netif_receive_generic_xdp net/core/dev.c:4807 [inline] do_xdp_generic+0x35c/0x770 net/core/dev.c:4866 tun_get_user+0x2340/0x3ca0 drivers/net/tun.c:1919 tun_chr_write_iter+0xe8/0x210 drivers/net/tun.c:2043 call_write_iter include/linux/fs.h:1871 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x650/0xe40 fs/read_write.c:584 ksys_write+0x12f/0x250 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd xdp->frame_sz > PAGE_SIZE check was introduced in commit c8741e2bfe87 (xdp: Allow bpf_xdp_adjust_tail() to grow packet size). But Jesper Dangaard Brouer <jbrouer@redhat.com> noted that after introducing the xdp_init_buff() which all XDP driver use - it's safe to remove this check. The original intend was to catch cases where XDP drivers have not been updated to use xdp.frame_sz, but that is not longer a concern (since xdp_init_buff). Running the initial syzkaller repro it was discovered that the contiguous physical memory allocation is used for both xdp paths in tun_get_user(), e.g. tun_build_skb() and tun_alloc_skb(). It was also stated by Jesper Dangaard Brouer <jbrouer@redhat.com> that XDP can work on higher order pages, as long as this is contiguous physical memory (e.g. a page). (CVE-2023-54155)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54155
https://ubuntu.com/security/CVE-2023-54155

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54155

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279892 - Linux Distros Unpatched Vulnerability : CVE-2023-54156
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sfc: fix crash when reading stats while NIC is resetting efx_net_stats() (.ndo_get_stats64) can be called during an ethtool selftest, during which time nic_data->mc_stats is NULL as the NIC has been fini'd. In this case do not attempt to fetch the latest stats from the hardware, else we will crash on a NULL dereference: BUG: kernel NULL pointer dereference, address: 0000000000000038 RIP efx_nic_update_stats abridged calltrace: efx_ef10_update_stats_pf efx_net_stats dev_get_stats dev_seq_printf_stats Skipping the read is safe, we will simply give out stale stats. To ensure that the free in efx_ef10_fini_nic() does not race against efx_ef10_update_stats_pf(), which could cause a TOCTTOU bug, take the efx->stats_lock in fini_nic (it is already held across update_stats). (CVE-2023-54156)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54156
https://ubuntu.com/security/CVE-2023-54156

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54156

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279820 - Linux Distros Unpatched Vulnerability : CVE-2023-54160
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- firmware: arm_sdei: Fix sleep from invalid context BUG Running a preempt-rt (v6.2-rc3-rt1) based kernel on an Ampere Altra triggers: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46 in_atomic(): 0, irqs_disabled(): 128, non_block: 0, pid: 24, name: cpuhp/0 preempt_count: 0, expected: 0 RCU nest depth: 0, expected: 0 3 locks held by cpuhp/0/24: #0:
ffffda30217c70d0 (cpu_hotplug_lock){++++}-{0:0}, at: cpuhp_thread_fun+0x5c/0x248 #1: ffffda30217c7120 (cpuhp_state-up){+.+.}-{0:0}, at: cpuhp_thread_fun+0x5c/0x248 #2: ffffda3021c711f0 (sdei_list_lock){....}-{3:3}, at: sdei_cpuhp_up+0x3c/0x130 irq event stamp: 36 hardirqs last enabled at (35): [<ffffda301e85b7bc>] finish_task_switch+0xb4/0x2b0 hardirqs last disabled at (36):
[<ffffda301e812fec>] cpuhp_thread_fun+0x21c/0x248 softirqs last enabled at (0): [<ffffda301e80b184>] copy_process+0x63c/0x1ac0 softirqs last disabled at (0): [<0000000000000000>] 0x0 CPU: 0 PID: 24 Comm:
cpuhp/0 Not tainted 5.19.0-rc3-rt5-[...] Hardware name: WIWYNN Mt.Jade Server [...] Call trace:
dump_backtrace+0x114/0x120 show_stack+0x20/0x70 dump_stack_lvl+0x9c/0xd8 dump_stack+0x18/0x34
__might_resched+0x188/0x228 rt_spin_lock+0x70/0x120 sdei_cpuhp_up+0x3c/0x130 cpuhp_invoke_callback+0x250/0xf08 cpuhp_thread_fun+0x120/0x248 smpboot_thread_fn+0x280/0x320 kthread+0x130/0x140 ret_from_fork+0x10/0x20 sdei_cpuhp_up() is called in the STARTING hotplug section, which runs with interrupts disabled. Use a CPUHP_AP_ONLINE_DYN entry instead to execute the cpuhp cb later, with preemption enabled. SDEI originally got its own cpuhp slot to allow interacting with perf. It got superseded by pNMI and this early slot is not relevant anymore. [1] Some SDEI calls (e.g.
SDEI_1_0_FN_SDEI_PE_MASK) take actions on the calling CPU. It is checked that preemption is disabled for them. _ONLINE cpuhp cb are executed in the 'per CPU hotplug thread'. Preemption is enabled in those threads, but their cpumask is limited to 1 CPU. Move 'WARN_ON_ONCE(preemptible())' statements so that SDEI cpuhp cb don't trigger them. Also add a check for the SDEI_1_0_FN_SDEI_PRIVATE_RESET SDEI call which acts on the calling CPU. [1]: https://lore.kernel.org/all/5813b8c5-ae3e-87fd-fccc-94c9cd08816d@arm.com/ (CVE-2023-54160)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54160
https://ubuntu.com/security/CVE-2023-54160

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.1
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54160

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280807 - Linux Distros Unpatched Vulnerability : CVE-2023-54168
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Prevent shift wrapping in set_user_sq_size() The ucmd->log_sq_bb_count variable is controlled by the user so this shift can wrap.
Fix it by using check_shl_overflow() in the same way that it was done in commit 515f60004ed9 (RDMA/hns:
Prevent undefined behavior in hns_roce_set_user_sq_size()). (CVE-2023-54168)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54168

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
5.2
EPSS Score
0.0002
References

CVE | CVE-2023-54168

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281543 - Linux Distros Unpatched Vulnerability : CVE-2023-54170
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: keys: Fix linking a duplicate key to a keyring's assoc_array When making a DNS query inside the kernel using dns_query(), the request code can in rare cases end up creating a duplicate index key in the assoc_array of the destination keyring. It is eventually found by a BUG_ON() check in the assoc_array implementation and results in a crash. Example report: [2158499.700025] kernel BUG at ../lib/assoc_array.c:652! [2158499.700039] invalid opcode: 0000 [#1] SMP PTI [2158499.700065] CPU: 3 PID: 31985 Comm: kworker/3:1 Kdump: loaded Not tainted 5.3.18-150300.59.90-default #1 SLE15-SP3 [2158499.700096] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 [2158499.700351] Workqueue: cifsiod cifs_resolve_server [cifs] [2158499.700380] RIP: 0010:assoc_array_insert+0x85f/0xa40 [2158499.700401] Code: ff 74 2b 48 8b 3b 49 8b 45 18 4c 89 e6 48 83 e7 fe e8 95 ec 74 00 3b 45 88 7d db 85 c0 79 d4 0f 0b 0f 0b 0f 0b e8 41 f2 be ff <0f> 0b 0f 0b 81 7d 88 ff ff ff 7f 4c 89 eb 4c 8b ad 58 ff ff ff 0f [2158499.700448] RSP: 0018:ffffc0bd6187faf0 EFLAGS: 00010282 [2158499.700470] RAX: ffff9f1ea7da2fe8 RBX:
ffff9f1ea7da2fc1 RCX: 0000000000000005 [2158499.700492] RDX: 0000000000000000 RSI: 0000000000000005 RDI:
0000000000000000 [2158499.700515] RBP: ffffc0bd6187fbb0 R08: ffff9f185faf1100 R09: 0000000000000000 [2158499.700538] R10: ffff9f1ea7da2cc0 R11: 000000005ed8cec8 R12: ffffc0bd6187fc28 [2158499.700561] R13:
ffff9f15feb8d000 R14: ffff9f1ea7da2fc0 R15: ffff9f168dc0d740 [2158499.700585] FS: 0000000000000000(0000) GS:ffff9f185fac0000(0000) knlGS:0000000000000000 [2158499.700610] CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 [2158499.700630] CR2: 00007fdd94fca238 CR3: 0000000809d8c006 CR4: 00000000003706e0 [2158499.700702] Call Trace: [2158499.700741] ? key_alloc+0x447/0x4b0 [2158499.700768] ?
__key_link_begin+0x43/0xa0 [2158499.700790] __key_link_begin+0x43/0xa0 [2158499.700814] request_key_and_link+0x2c7/0x730 [2158499.700847] ? dns_resolver_read+0x20/0x20 [dns_resolver] [2158499.700873] ? key_default_cmp+0x20/0x20 [2158499.700898] request_key_tag+0x43/0xa0 [2158499.700926] dns_query+0x114/0x2ca [dns_resolver] [2158499.701127] dns_resolve_server_name_to_ip+0x194/0x310 [cifs] [2158499.701164] ? scnprintf+0x49/0x90 [2158499.701190] ? __switch_to_asm+0x40/0x70 [2158499.701211] ?
__switch_to_asm+0x34/0x70 [2158499.701405] reconn_set_ipaddr_from_hostname+0x81/0x2a0 [cifs] [2158499.701603] cifs_resolve_server+0x4b/0xd0 [cifs] [2158499.701632] process_one_work+0x1f8/0x3e0 [2158499.701658] worker_thread+0x2d/0x3f0 [2158499.701682] ? process_one_work+0x3e0/0x3e0 [2158499.701703] kthread+0x10d/0x130 [2158499.701723] ? kthread_park+0xb0/0xb0 [2158499.701746] ret_from_fork+0x1f/0x40 The situation occurs as follows: * Some kernel facility invokes dns_query() to resolve a hostname, for example, abcdef. The function registers its global DNS resolver cache as current->cred.thread_keyring and passes the query to request_key_net() -> request_key_tag() -> request_key_and_link(). * Function request_key_and_link() creates a keyring_search_context object. Its match_data.cmp method gets set via a call to type->match_preparse() (resolves to dns_resolver_match_preparse()) to dns_resolver_cmp(). * Function request_key_and_link() continues and invokes search_process_keyrings_rcu() which returns that a given key was not found. The control is then passed to request_key_and_link() -> construct_alloc_key(). * Concurrently to that, a second task similarly makes a DNS query for abcdef. and its result gets inserted into the DNS resolver cache. * Back on the first task, function construct_alloc_key() first runs
__key_link_begin() to determine an assoc_array_edit operation to insert a new key. Index keys in the array are compared exactly as-is, using keyring_compare_object(). The operation ---truncated--- (CVE-2023-54170)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54170

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.4
EPSS Score
0.0002
References

CVE | CVE-2023-54170

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280758 - Linux Distros Unpatched Vulnerability : CVE-2023-54171
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tracing: Fix memory leak of iter->temp when reading trace_pipe kmemleak reports: unreferenced object 0xffff88814d14e200 (size 256): comm cat, pid 336, jiffies 4294871818 (age 779.490s) hex dump (first 32 bytes): 04 00 01 03 00 00 00 00 08 00 00 00 00 00 00 00 ................ 0c d8 c8 9b ff ff ff ff 04 5a ca 9b ff ff ff ff .........Z...... backtrace:
[<ffffffff9bdff18f>] __kmalloc+0x4f/0x140 [<ffffffff9bc9238b>] trace_find_next_entry+0xbb/0x1d0 [<ffffffff9bc9caef>] trace_print_lat_context+0xaf/0x4e0 [<ffffffff9bc94490>] print_trace_line+0x3e0/0x950 [<ffffffff9bc95499>] tracing_read_pipe+0x2d9/0x5a0 [<ffffffff9bf03a43>] vfs_read+0x143/0x520 [<ffffffff9bf04c2d>] ksys_read+0xbd/0x160 [<ffffffff9d0f0edf>] do_syscall_64+0x3f/0x90 [<ffffffff9d2000aa>] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 when reading file 'trace_pipe', 'iter->temp'
is allocated or relocated in trace_find_next_entry() but not freed before 'trace_pipe' is closed. To fix it, free 'iter->temp' in tracing_release_pipe(). (CVE-2023-54171)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54171

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54171

Plugin Information
Published: 2025/12/30, Modified: 2025/12/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280727 - Linux Distros Unpatched Vulnerability : CVE-2023-54172
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- x86/hyperv: Disable IBT when hypercall page lacks ENDBR instruction On hardware that supports Indirect Branch Tracking (IBT), Hyper-V VMs with ConfigVersion 9.3 or later support IBT in the guest. However, current versions of Hyper-V have a bug in that there's not an ENDBR64 instruction at the beginning of the hypercall page. Since hypercalls are made with an indirect call to the hypercall page, all hypercall attempts fail with an exception and Linux panics. A Hyper-V fix is in progress to add ENDBR64. But guard against the Linux panic by clearing X86_FEATURE_IBT if the hypercall page doesn't start with ENDBR. The VM will boot and run without IBT. If future Linux 32-bit kernels were to support IBT, additional hypercall page hackery would be needed to make IBT work for such kernels in a Hyper-V VM. (CVE-2023-54172)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54172
https://security-tracker.debian.org/tracker/CVE-2023-54172

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54172

Plugin Information
Published: 2025/12/30, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281520 - Linux Distros Unpatched Vulnerability : CVE-2023-54173
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpf_event_output We received report [1] of kernel crash, which is caused by using nesting protection without disabled preemption. The bpf_event_output can be called by programs executed by bpf_prog_run_array_cg function that disabled migration but keeps preemption enabled. This can cause task to be preempted by another one inside the nesting protection and lead eventually to two tasks using same perf_sample_data buffer and cause crashes like: BUG: kernel NULL pointer dereference, address:
0000000000000001 #PF: supervisor instruction fetch in kernel mode #PF: error_code(0x0010) - not-present page ... ? perf_output_sample+0x12a/0x9a0 ? finish_task_switch.isra.0+0x81/0x280 ? perf_event_output+0x66/0xa0 ? bpf_event_output+0x13a/0x190 ? bpf_event_output_data+0x22/0x40 ? bpf_prog_dfc84bbde731b257_cil_sock4_connect+0x40a/0xacb ? xa_load+0x87/0xe0 ?
__cgroup_bpf_run_filter_sock_addr+0xc1/0x1a0 ? release_sock+0x3e/0x90 ? sk_setsockopt+0x1a1/0x12f0 ? udp_pre_connect+0x36/0x50 ? inet_dgram_connect+0x93/0xa0 ? __sys_connect+0xb4/0xe0 ? udp_setsockopt+0x27/0x40 ? __pfx_udp_push_pending_frames+0x10/0x10 ? __sys_setsockopt+0xdf/0x1a0 ?
__x64_sys_connect+0xf/0x20 ? do_syscall_64+0x3a/0x90 ? entry_SYSCALL_64_after_hwframe+0x72/0xdc Fixing this by disabling preemption in bpf_event_output. [1] https://github.com/cilium/cilium/issues/26756 (CVE-2023-54173)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54173

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.4
EPSS Score
0.0002
References

CVE | CVE-2023-54173

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280801 - Linux Distros Unpatched Vulnerability : CVE-2023-54174
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: vfio: Fix NULL pointer dereference caused by uninitialized group->iommufd group->iommufd is not initialized for the iommufd_ctx_put() [20018.331541] BUG: kernel NULL pointer dereference, address: 0000000000000000 [20018.377508] RIP:
0010:iommufd_ctx_put+0x5/0x10 [iommufd] ... [20018.476483] Call Trace: [20018.479214] <TASK>
[20018.481555] vfio_group_fops_unl_ioctl+0x506/0x690 [vfio] [20018.487586] __x64_sys_ioctl+0x6a/0xb0 [20018.491773] ? trace_hardirqs_on+0xc5/0xe0 [20018.496347] do_syscall_64+0x67/0x90 [20018.500340] entry_SYSCALL_64_after_hwframe+0x4b/0xb5 (CVE-2023-54174)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54174

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54174

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280711 - Linux Distros Unpatched Vulnerability : CVE-2023-54181
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Fix issue in verifying allow_ptr_leaks After we converted the capabilities of our networking-bpf program from cap_sys_admin to cap_net_admin+cap_bpf, our networking-bpf program failed to start. Because it failed the bpf verifier, and the error log is R3 pointer comparison prohibited. A simple reproducer as follows, SEC(cls-ingress) int ingress(struct __sk_buff *skb) { struct iphdr *iph = (void
*)(long)skb->data + sizeof(struct ethhdr); if ((long)(iph + 1) > (long)skb->data_end) return TC_ACT_STOLEN; return TC_ACT_OK; } Per discussion with Yonghong and Alexei [1], comparison of two packet pointers is not a pointer leak. This patch fixes it. Our local kernel is 6.1.y and we expect this fix to be backported to 6.1.y, so stable is CCed. [1].
https://lore.kernel.org/bpf/CAADnVQ+Nmspr7Si+pxWn8zkE7hX-7s93ugwC+94aXSy4uQ9vBg@mail.gmail.com/ (CVE-2023-54181)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54181
https://security-tracker.debian.org/tracker/CVE-2023-54181

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54181

Plugin Information
Published: 2025/12/30, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281482 - Linux Distros Unpatched Vulnerability : CVE-2023-54184
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsit: Free cmds before session free Commands from recovery entries are freed after session has been closed. That leads to use- after-free at command free or NPE with such call trace: Time2Retain timer expired for SID: 1, cleaning up iSCSI session. BUG: kernel NULL pointer dereference, address: 0000000000000140 RIP:
0010:sbitmap_queue_clear+0x3a/0xa0 Call Trace: target_release_cmd_kref+0xd1/0x1f0 [target_core_mod] transport_generic_free_cmd+0xd1/0x180 [target_core_mod] iscsit_free_cmd+0x53/0xd0 [iscsi_target_mod] iscsit_free_connection_recovery_entries+0x29d/0x320 [iscsi_target_mod] iscsit_close_session+0x13a/0x140 [iscsi_target_mod] iscsit_check_post_dataout+0x440/0x440 [iscsi_target_mod] call_timer_fn+0x24/0x140 Move cleanup of recovery enrties to before session freeing. (CVE-2023-54184)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54184

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
6.7
EPSS Score
0.0002
References

CVE | CVE-2023-54184

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281481 - Linux Distros Unpatched Vulnerability : CVE-2023-54191
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix memory leak in mt7996_mcu_exit Always purge mcu skb queues in mt7996_mcu_exit routine even if mt7996_firmware_state fails. (CVE-2023-54191)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54191

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54191

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280775 - Linux Distros Unpatched Vulnerability : CVE-2023-54193
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: remove block_cb from driver_list before freeing Error handler of tcf_block_bind() frees the whole bo->cb_list on error.
However, by that time the flow_block_cb instances are already in the driver list because driver ndo_setup_tc() callback is called before that up the call chain in tcf_block_offload_cmd(). This leaves dangling pointers to freed objects in the list and causes use-after-free[0]. Fix it by also removing flow_block_cb instances from driver_list before deallocating them. [0]: [ 279.868433] ================================================================== [ 279.869964] BUG: KASAN: slab-use- after-free in flow_block_cb_setup_simple+0x631/0x7c0 [ 279.871527] Read of size 8 at addr ffff888147e2bf20 by task tc/2963 [ 279.873151] CPU: 6 PID: 2963 Comm: tc Not tainted 6.3.0-rc6+ #4 [ 279.874273] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 279.876295] Call Trace: [ 279.876882] <TASK> [ 279.877413] dump_stack_lvl+0x33/0x50 [ 279.878198] print_report+0xc2/0x610 [ 279.878987] ? flow_block_cb_setup_simple+0x631/0x7c0 [ 279.879994] kasan_report+0xae/0xe0 [ 279.880750] ? flow_block_cb_setup_simple+0x631/0x7c0 [ 279.881744] ? mlx5e_tc_reoffload_flows_work+0x240/0x240 [mlx5_core] [ 279.883047] flow_block_cb_setup_simple+0x631/0x7c0 [ 279.884027] tcf_block_offload_cmd.isra.0+0x189/0x2d0 [ 279.885037] ? tcf_block_setup+0x6b0/0x6b0 [ 279.885901] ? mutex_lock+0x7d/0xd0 [ 279.886669] ? __mutex_unlock_slowpath.constprop.0+0x2d0/0x2d0 [ 279.887844] ? ingress_init+0x1c0/0x1c0 [sch_ingress] [ 279.888846] tcf_block_get_ext+0x61c/0x1200 [ 279.889711] ingress_init+0x112/0x1c0 [sch_ingress] [ 279.890682] ? clsact_init+0x2b0/0x2b0 [sch_ingress] [ 279.891701] qdisc_create+0x401/0xea0 [ 279.892485] ? qdisc_tree_reduce_backlog+0x470/0x470 [ 279.893473] tc_modify_qdisc+0x6f7/0x16d0 [ 279.894344] ? tc_get_qdisc+0xac0/0xac0 [ 279.895213] ? mutex_lock+0x7d/0xd0 [ 279.896005] ? __mutex_lock_slowpath+0x10/0x10 [ 279.896910] rtnetlink_rcv_msg+0x5fe/0x9d0 [ 279.897770] ? rtnl_calcit.isra.0+0x2b0/0x2b0 [ 279.898672] ? __sys_sendmsg+0xb5/0x140 [ 279.899494] ? do_syscall_64+0x3d/0x90 [ 279.900302] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 279.901337] ? kasan_save_stack+0x2e/0x40 [ 279.902177] ? kasan_save_stack+0x1e/0x40 [ 279.903058] ? kasan_set_track+0x21/0x30 [ 279.903913] ? kasan_save_free_info+0x2a/0x40 [ 279.904836] ?
____kasan_slab_free+0x11a/0x1b0 [ 279.905741] ? kmem_cache_free+0x179/0x400 [ 279.906599] netlink_rcv_skb+0x12c/0x360 [ 279.907450] ? rtnl_calcit.isra.0+0x2b0/0x2b0 [ 279.908360] ? netlink_ack+0x1550/0x1550 [ 279.909192] ? rhashtable_walk_peek+0x170/0x170 [ 279.910135] ? kmem_cache_alloc_node+0x1af/0x390 [ 279.911086] ? _copy_from_iter+0x3d6/0xc70 [ 279.912031] netlink_unicast+0x553/0x790 [ 279.912864] ? netlink_attachskb+0x6a0/0x6a0 [ 279.913763] ? netlink_recvmsg+0x416/0xb50 [ 279.914627] netlink_sendmsg+0x7a1/0xcb0 [ 279.915473] ? netlink_unicast+0x790/0x790 [ 279.916334] ? iovec_from_user.part.0+0x4d/0x220 [ 279.917293] ? netlink_unicast+0x790/0x790 [ 279.918159] sock_sendmsg+0xc5/0x190 [ 279.918938]
____sys_sendmsg+0x535/0x6b0 [ 279.919813] ? import_iovec+0x7/0x10 [ 279.920601] ? kernel_sendmsg+0x30/0x30 [ 279.921423] ? __copy_msghdr+0x3c0/0x3c0 [ 279.922254] ? import_iovec+0x7/0x10 [ 279.923041]
___sys_sendmsg+0xeb/0x170 [ 279.923854] ? copy_msghdr_from_user+0x110/0x110 [ 279.924797] ?
___sys_recvmsg+0xd9/0x130 [ 279.925630] ? __perf_event_task_sched_in+0x183/0x470 [ 279.926656] ?
___sys_sendmsg+0x170/0x170 [ 279.927529] ? ctx_sched_in+0x530/0x530 [ 279.928369] ? update_curr+0x283/0x4f0 [ 279.929185] ? perf_event_update_userpage+0x570/0x570 [ 279.930201] ?
__fget_light+0x57/0x520 [ 279.931023] ? __switch_to+0x53d/0xe70 [ 27 ---truncated--- (CVE-2023-54193)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54193

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
6.6
EPSS Score
0.0002
References

CVE | CVE-2023-54193

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280805 - Linux Distros Unpatched Vulnerability : CVE-2023-54194
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree The call stack shown below is a scenario in the Linux 4.19 kernel.
Allocating memory failed where exfat fs use kmalloc_array due to system memory fragmentation, while the u-disk was inserted without recognition. Devices such as u-disk using the exfat file system are pluggable and may be insert into the system at any time. However, long-term running systems cannot guarantee the continuity of physical memory. Therefore, it's necessary to address this issue. Binder:2632_6: page allocation failure: order:4, mode:0x6040c0(GFP_KERNEL|__GFP_COMP), nodemask=(null) Call trace:
[242178.097582] dump_backtrace+0x0/0x4 [242178.097589] dump_stack+0xf4/0x134 [242178.097598] warn_alloc+0xd8/0x144 [242178.097603] __alloc_pages_nodemask+0x1364/0x1384 [242178.097608] kmalloc_order+0x2c/0x510 [242178.097612] kmalloc_order_trace+0x40/0x16c [242178.097618]
__kmalloc+0x360/0x408 [242178.097624] load_alloc_bitmap+0x160/0x284 [242178.097628] exfat_fill_super+0xa3c/0xe7c [242178.097635] mount_bdev+0x2e8/0x3a0 [242178.097638] exfat_fs_mount+0x40/0x50 [242178.097643] mount_fs+0x138/0x2e8 [242178.097649] vfs_kern_mount+0x90/0x270 [242178.097655] do_mount+0x798/0x173c [242178.097659] ksys_mount+0x114/0x1ac [242178.097665]
__arm64_sys_mount+0x24/0x34 [242178.097671] el0_svc_common+0xb8/0x1b8 [242178.097676] el0_svc_handler+0x74/0x90 [242178.097681] el0_svc+0x8/0x340 By analyzing the exfat code,we found that continuous physical memory is not required here,so kvmalloc_array is used can solve this problem.
(CVE-2023-54194)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54194

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.4
EPSS Score
0.0002
References

CVE | CVE-2023-54194

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281512 - Linux Distros Unpatched Vulnerability : CVE-2023-54197
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: Revert Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work This reverts commit 1e9ac114c4428fdb7ff4635b45d4f46017e8916f. This patch introduces a possible null-ptr-def problem. Revert it. And the fixed bug by this patch have resolved by commit 73f7b171b7c0 (Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition). (CVE-2023-54197)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54197

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
6.7
EPSS Score
0.0003
References

CVE | CVE-2023-54197

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280708 - Linux Distros Unpatched Vulnerability : CVE-2023-54202
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/i915: fix race condition UAF in i915_perf_add_config_ioctl Userspace can guess the id value and try to race oa_config object creation with config remove, resulting in a use-after-free if we dereference the object after unlocking the metrics_lock. For that reason, unlocking the metrics_lock must be done after we are done dereferencing the object. [tursulin: Manually added stable tag.] (cherry picked from commit 49f6f6483b652108bcb73accd0204a464b922395) (CVE-2023-54202)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54202
https://security-tracker.debian.org/tracker/CVE-2023-54202

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54202

Plugin Information
Published: 2025/12/30, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281549 - Linux Distros Unpatched Vulnerability : CVE-2023-54209
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: block: fix blktrace debugfs entries leakage Commit 99d055b4fd4b (block: remove per-disk debugfs files in blk_unregister_queue) moves blk_trace_shutdown() from blk_release_queue() to blk_unregister_queue(), this is safe if blktrace is created through sysfs, however, there is a regression in corner case. blktrace can still be enabled after del_gendisk() through ioctl if the disk is opened before del_gendisk(), and if blktrace is not shutdown through ioctl before closing the disk, debugfs entries will be leaked. Fix this problem by shutdown blktrace in disk_release(), this is safe because blk_trace_remove() is reentrant. (CVE-2023-54209)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54209

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54209

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280744 - Linux Distros Unpatched Vulnerability : CVE-2023-54210
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Avoid use-after- free in dbg for hci_remove_adv_monitor() KASAN reports that there's a use-after-free in hci_remove_adv_monitor(). Trawling through the disassembly, you can see that the complaint is from the access in bt_dev_dbg() under the HCI_ADV_MONITOR_EXT_MSFT case. The problem case happens because msft_remove_monitor() can end up freeing the monitor structure. Specifically: hci_remove_adv_monitor() ->
msft_remove_monitor() -> msft_remove_monitor_sync() -> msft_le_cancel_monitor_advertisement_cb() ->
hci_free_adv_monitor() Let's fix the problem by just stashing the relevant data when it's still valid.
(CVE-2023-54210)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54210

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
6.7
EPSS Score
0.0002
References

CVE | CVE-2023-54210

Plugin Information
Published: 2025/12/30, Modified: 2025/12/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280738 - Linux Distros Unpatched Vulnerability : CVE-2023-54211
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tracing: Fix warning in trace_buffered_event_disable() Warning happened in trace_buffered_event_disable() at WARN_ON_ONCE(!trace_buffered_event_ref) Call Trace: ? __warn+0xa5/0x1b0 ? trace_buffered_event_disable+0x189/0x1b0 __ftrace_event_enable_disable+0x19e/0x3e0 free_probe_data+0x3b/0xa0 unregister_ftrace_function_probe_func+0x6b8/0x800 event_enable_func+0x2f0/0x3d0 ftrace_process_regex.isra.0+0x12d/0x1b0 ftrace_filter_write+0xe6/0x140 vfs_write+0x1c9/0x6f0 [...] The cause of the warning is in __ftrace_event_enable_disable(), trace_buffered_event_enable() was called once while trace_buffered_event_disable() was called twice. Reproduction script show as below, for analysis, see the comments: ``` #!/bin/bash cd /sys/kernel/tracing/ # 1. Register a 'disable_event' command, then: # 1) SOFT_DISABLED_BIT was set; # 2) trace_buffered_event_enable() was called first time; echo 'cmdline_proc_show:disable_event:initcall:initcall_finish' > \ set_ftrace_filter # 2. Enable the event registered, then: # 1) SOFT_DISABLED_BIT was cleared; # 2) trace_buffered_event_disable() was called first time; echo 1 > events/initcall/initcall_finish/enable # 3. Try to call into cmdline_proc_show(), then SOFT_DISABLED_BIT was # set again!!! cat /proc/cmdline # 4. Unregister the 'disable_event' command, then:
# 1) SOFT_DISABLED_BIT was cleared again; # 2) trace_buffered_event_disable() was called second time!!! echo '!cmdline_proc_show:disable_event:initcall:initcall_finish' > \ set_ftrace_filter ``` To fix it, IIUC, we can change to call trace_buffered_event_enable() at fist time soft-mode enabled, and call trace_buffered_event_disable() at last time soft-mode disabled. (CVE-2023-54211)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54211

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.4
EPSS Score
0.0002
References

CVE | CVE-2023-54211

Plugin Information
Published: 2025/12/30, Modified: 2025/12/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281506 - Linux Distros Unpatched Vulnerability : CVE-2023-54213
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: USB: sisusbvga: Add endpoint checks The syzbot fuzzer was able to provoke a WARNING from the sisusbvga driver: ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 26 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Modules linked in: CPU:
1 PID: 26 Comm: kworker/1:1 Not tainted 6.2.0-rc5-syzkaller-00199-g5af6ce704936 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Workqueue: usb_hub_wq hub_event RIP:
0010:usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Code: 7c 24 18 e8 6c 50 80 fb 48 8b 7c 24 18 e8 62 1a 01 ff 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 60 b1 fa 8a e8 84 b0 be 03 <0f> 0b e9 58 f8 ff ff e8 3e 50 80 fb 48 81 c5 c0 05 00 00 e9 84 f7 RSP: 0018:ffffc90000a1ed18 EFLAGS: 00010282 RAX:
0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: ffff888012783a80 RSI: ffffffff816680ec RDI: fffff52000143d95 RBP: ffff888079020000 R08: 0000000000000005 R09: 0000000000000000 R10:
0000000080000000 R11: 0000000000000000 R12: 0000000000000003 R13: ffff888017d33370 R14: 0000000000000003 R15: ffff888021213600 FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005592753a60b0 CR3: 0000000022899000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6:
00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> sisusb_bulkout_msg drivers/usb/misc/sisusbvga/sisusbvga.c:224 [inline] sisusb_send_bulk_msg.constprop.0+0x904/0x1230 drivers/usb/misc/sisusbvga/sisusbvga.c:379 sisusb_send_bridge_packet drivers/usb/misc/sisusbvga/sisusbvga.c:567 [inline] sisusb_do_init_gfxdevice drivers/usb/misc/sisusbvga/sisusbvga.c:2077 [inline] sisusb_init_gfxdevice+0x87b/0x4000 drivers/usb/misc/sisusbvga/sisusbvga.c:2177 sisusb_probe+0x9cd/0xbe2 drivers/usb/misc/sisusbvga/sisusbvga.c:2869 ... The problem was caused by the fact that the driver does not check whether the endpoints it uses are actually present and have the appropriate types. This can be fixed by adding a simple check of the endpoints. (CVE-2023-54213)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54213

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.4
EPSS Score
0.0002
References

CVE | CVE-2023-54213

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280789 - Linux Distros Unpatched Vulnerability : CVE-2023-54215
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: virtio-vdpa: Fix cpumask memory leak in virtio_vdpa_find_vqs() Free the cpumask allocated by create_affinity_masks() before returning from the function. (CVE-2023-54215)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54215

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54215

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281553 - Linux Distros Unpatched Vulnerability : CVE-2023-54218
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). KCSAN found a data race in sock_recv_cmsgs() where the read access to sk->sk_stamp needs READ_ONCE(). BUG: KCSAN: data-race in packet_recvmsg / packet_recvmsg write (marked) to 0xffff88803c81f258 of 8 bytes by task 19171 on cpu 0: sock_write_timestamp include/net/sock.h:2670 [inline] sock_recv_cmsgs include/net/sock.h:2722 [inline] packet_recvmsg+0xb97/0xd00 net/packet/af_packet.c:3489 sock_recvmsg_nosec net/socket.c:1019 [inline] sock_recvmsg+0x11a/0x130 net/socket.c:1040 sock_read_iter+0x176/0x220 net/socket.c:1118 call_read_iter include/linux/fs.h:1845 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x5e0/0x630 fs/read_write.c:470 ksys_read+0x163/0x1a0 fs/read_write.c:613 __do_sys_read fs/read_write.c:623 [inline] __se_sys_read fs/read_write.c:621 [inline] __x64_sys_read+0x41/0x50 fs/read_write.c:621 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc read to 0xffff88803c81f258 of 8 bytes by task 19183 on cpu 1:
sock_recv_cmsgs include/net/sock.h:2721 [inline] packet_recvmsg+0xb64/0xd00 net/packet/af_packet.c:3489 sock_recvmsg_nosec net/socket.c:1019 [inline] sock_recvmsg+0x11a/0x130 net/socket.c:1040 sock_read_iter+0x176/0x220 net/socket.c:1118 call_read_iter include/linux/fs.h:1845 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x5e0/0x630 fs/read_write.c:470 ksys_read+0x163/0x1a0 fs/read_write.c:613 __do_sys_read fs/read_write.c:623 [inline] __se_sys_read fs/read_write.c:621 [inline]
__x64_sys_read+0x41/0x50 fs/read_write.c:621 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc value changed:
0xffffffffc4653600 -> 0x0000000000000000 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 19183 Comm: syz-executor.5 Not tainted 6.3.0-rc7-02330-gca6270c12e20 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 (CVE-2023-54218)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54218

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.4
EPSS Score
0.0002
References

CVE | CVE-2023-54218

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281530 - Linux Distros Unpatched Vulnerability : CVE-2023-54220
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: serial: 8250: Fix oops for port->pm on uart_change_pm() Unloading a hardware specific 8250 driver can produce error Unable to handle kernel paging request at virtual address about ten seconds after unloading the driver. This happens on uart_hangup() calling uart_change_pm(). Turns out commit 04e82793f068 (serial: 8250: Reinit port->pm on port specific driver unbind) was only a partial fix. If the hardware specific driver has initialized port->pm function, we need to clear port->pm too. Just reinitializing port->ops does not do this.
Otherwise serial8250_pm() will call port->pm() instead of serial8250_do_pm(). (CVE-2023-54220)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54220

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.4
EPSS Score
0.0002
References

CVE | CVE-2023-54220

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281544 - Linux Distros Unpatched Vulnerability : CVE-2023-54221
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: clk: imx93: fix memory leak and missing unwind goto in imx93_clocks_probe In function probe(), it returns directly without unregistered hws when error occurs. Fix this by adding 'goto unregister_hws;' on line 295 and line 310. Use devm_kzalloc() instead of kzalloc() to automatically free the memory using devm_kfree() when error occurs.
Replace of_iomap() with devm_of_iomap() to automatically handle the unused ioremap region and delete 'iounmap(anatop_base);' in unregister_hws. (CVE-2023-54221)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54221

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54221

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281486 - Linux Distros Unpatched Vulnerability : CVE-2023-54222
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: hte: tegra-194: Fix off by one in tegra_hte_map_to_line_id() The map_sz is the number of elements in the m array so the > comparison needs to be changed to >= to prevent an out of bounds read. (CVE-2023-54222)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54222

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
5.2
EPSS Score
0.0002
References

CVE | CVE-2023-54222

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281510 - Linux Distros Unpatched Vulnerability : CVE-2023-54223
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix invalid buffer access for legacy rq The below crash can be encountered when using xdpsock in rx mode for legacy rq: the buffer gets released in the XDP_REDIRECT path, and then once again in the driver. This fix sets the flag to avoid releasing on the driver side. XSK handling of buffers for legacy rq was relying on the caller to set the skip release flag. But the referenced fix started using fragment counts for pages instead of the skip flag. Crash log: general protection fault, probably for non-canonical address 0xffff8881217e3a: 0000 [#1] SMP CPU: 0 PID: 14 Comm: ksoftirqd/0 Not tainted 6.5.0-rc1+ #31 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP:
0010:bpf_prog_03b13f331978c78c+0xf/0x28 Code: ... RSP: 0018:ffff88810082fc98 EFLAGS: 00010246 RAX:
0000000000000000 RBX: ffff888138404901 RCX: c0ffffc900027cbc RDX: ffffffffa000b514 RSI: 00ffff8881217e32 RDI: ffff888138404901 RBP: ffff88810082fc98 R08: 0000000000091100 R09: 0000000000000006 R10:
0000000000000800 R11: 0000000000000800 R12: ffffc9000027a000 R13: ffff8881217e2dc0 R14: ffff8881217e2910 R15: ffff8881217e2f00 FS: 0000000000000000(0000) GS:ffff88852c800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000564cb2e2cde0 CR3: 000000010e603004 CR4: 0000000000370eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6:
00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? die_addr+0x32/0x80 ? exc_general_protection+0x192/0x390 ? asm_exc_general_protection+0x22/0x30 ? 0xffffffffa000b514 ? bpf_prog_03b13f331978c78c+0xf/0x28 mlx5e_xdp_handle+0x48/0x670 [mlx5_core] ? dev_gro_receive+0x3b5/0x6e0 mlx5e_xsk_skb_from_cqe_linear+0x6e/0x90 [mlx5_core] mlx5e_handle_rx_cqe+0x55/0x100 [mlx5_core] mlx5e_poll_rx_cq+0x87/0x6e0 [mlx5_core] mlx5e_napi_poll+0x45e/0x6b0 [mlx5_core] __napi_poll+0x25/0x1a0 net_rx_action+0x28a/0x300 __do_softirq+0xcd/0x279 ? sort_range+0x20/0x20 run_ksoftirqd+0x1a/0x20 smpboot_thread_fn+0xa2/0x130 kthread+0xc9/0xf0 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 </TASK> Modules linked in: mlx5_ib mlx5_core rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter overlay zram zsmalloc fuse [last unloaded: mlx5_core] ---[ end trace 0000000000000000 ]--- (CVE-2023-54223)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54223

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
5.2
EPSS Score
0.0002
References

CVE | CVE-2023-54223

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280722 - Linux Distros Unpatched Vulnerability : CVE-2023-54233
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ASoC: SOF: avoid a NULL dereference with unsupported widgets If an IPC4 topology contains an unsupported widget, its .module_info field won't be set, then sof_ipc4_route_setup() will cause a kernel Oops trying to dereference it. Add a check for such cases. (CVE-2023-54233)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54233
https://security-tracker.debian.org/tracker/CVE-2023-54233

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54233

Plugin Information
Published: 2025/12/30, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280735 - Linux Distros Unpatched Vulnerability : CVE-2023-54235
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: PCI/DOE: Fix destroy_work_on_stack() race The following debug object splat was observed in testing: ODEBUG: free active (active state 0) object: 0000000097d23782 object type: work_struct hint: doe_statemachine_work+0x0/0x510 WARNING: CPU: 1 PID: 71 at lib/debugobjects.c:514 debug_print_object+0x7d/0xb0 ... Workqueue: pci 0000:36:00.0 DOE [1 doe_statemachine_work RIP: 0010:debug_print_object+0x7d/0xb0 ... Call Trace: ? debug_print_object+0x7d/0xb0 ? __pfx_doe_statemachine_work+0x10/0x10 debug_object_free.part.0+0x11b/0x150 doe_statemachine_work+0x45e/0x510 process_one_work+0x1d4/0x3c0 This occurs because destroy_work_on_stack() was called after signaling the completion in the calling thread. This creates a race between destroy_work_on_stack() and the task->work struct going out of scope in pci_doe(). Signal the work complete after destroying the work struct. This is safe because signal_task_complete() is the final thing the work item does and the workqueue code is careful not to access the work struct after. (CVE-2023-54235)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54235

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
6.7
EPSS Score
0.0002
References

CVE | CVE-2023-54235

Plugin Information
Published: 2025/12/30, Modified: 2025/12/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280806 - Linux Distros Unpatched Vulnerability : CVE-2023-54236
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/net_failover: fix txq exceeding warning The failover txq is inited as 16 queues. when a packet is transmitted from the failover device firstly, the failover device will select the queue which is returned from the primary device if the primary device is UP and running. If the primary device txq is bigger than the default 16, it can lead to the following warning: eth0 selects TX queue 18, but real number of TX queues is 16 The warning backtrace is: [ 32.146376] CPU: 18 PID: 9134 Comm: chronyd Tainted: G E 6.2.8-1.el7.centos.x86_64 #1 [ 32.147175] Hardware name: Red Hat KVM, BIOS 1.10.2-3.el7_4.1 04/01/2014 [ 32.147730] Call Trace: [ 32.147971] <TASK>
[ 32.148183] dump_stack_lvl+0x48/0x70 [ 32.148514] dump_stack+0x10/0x20 [ 32.148820] netdev_core_pick_tx+0xb1/0xe0 [ 32.149180] __dev_queue_xmit+0x529/0xcf0 [ 32.149533] ?
__check_object_size.part.0+0x21c/0x2c0 [ 32.149967] ip_finish_output2+0x278/0x560 [ 32.150327]
__ip_finish_output+0x1fe/0x2f0 [ 32.150690] ip_finish_output+0x2a/0xd0 [ 32.151032] ip_output+0x7a/0x110 [ 32.151337] ? __pfx_ip_finish_output+0x10/0x10 [ 32.151733] ip_local_out+0x5e/0x70 [ 32.152054] ip_send_skb+0x19/0x50 [ 32.152366] udp_send_skb.isra.0+0x163/0x3a0 [ 32.152736] udp_sendmsg+0xba8/0xec0 [ 32.153060] ? __folio_memcg_unlock+0x25/0x60 [ 32.153445] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 32.153854] ? sock_has_perm+0x85/0xa0 [ 32.154190] inet_sendmsg+0x6d/0x80 [ 32.154508] ? inet_sendmsg+0x6d/0x80 [ 32.154838] sock_sendmsg+0x62/0x70 [ 32.155152] ____sys_sendmsg+0x134/0x290 [ 32.155499]
___sys_sendmsg+0x81/0xc0 [ 32.155828] ? _get_random_bytes.part.0+0x79/0x1a0 [ 32.156240] ? ip4_datagram_release_cb+0x5f/0x1e0 [ 32.156649] ? get_random_u16+0x69/0xf0 [ 32.156989] ?
__fget_light+0xcf/0x110 [ 32.157326] __sys_sendmmsg+0xc4/0x210 [ 32.157657] ? __sys_connect+0xb7/0xe0 [ 32.157995] ? __audit_syscall_entry+0xce/0x140 [ 32.158388] ? syscall_trace_enter.isra.0+0x12c/0x1a0 [ 32.158820] __x64_sys_sendmmsg+0x24/0x30 [ 32.159171] do_syscall_64+0x38/0x90 [ 32.159493] entry_SYSCALL_64_after_hwframe+0x72/0xdc Fix that by reducing txq number as the non-existent primary-dev does. (CVE-2023-54236)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54236

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.8
EPSS Score
0.0002
References

CVE | CVE-2023-54236

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280728 - Linux Distros Unpatched Vulnerability : CVE-2023-54237
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link() There is a certain chance to trigger the following panic: PID: 5900 TASK: ffff88c1c8af4100 CPU: 1 COMMAND: kworker/1:48 #0 [ffff9456c1cc79a0] machine_kexec at ffffffff870665b7 #1 [ffff9456c1cc79f0] __crash_kexec at ffffffff871b4c7a #2 [ffff9456c1cc7ab0] crash_kexec at ffffffff871b5b60 #3 [ffff9456c1cc7ac0] oops_end at ffffffff87026ce7 #4 [ffff9456c1cc7ae0] page_fault_oops at ffffffff87075715 #5 [ffff9456c1cc7b58] exc_page_fault at ffffffff87ad0654 #6 [ffff9456c1cc7b80] asm_exc_page_fault at ffffffff87c00b62 [exception RIP: ib_alloc_mr+19] RIP: ffffffffc0c9cce3 RSP: ffff9456c1cc7c38 RFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000004 RDX: 0000000000000010 RSI: 0000000000000000 RDI:
0000000000000000 RBP: ffff88c1ea281d00 R8: 000000020a34ffff R9: ffff88c1350bbb20 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000010 R14: ffff88c1ab040a50 R15:
ffff88c1ea281d00 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #7 [ffff9456c1cc7c60] smc_ib_get_memory_region at ffffffffc0aff6df [smc] #8 [ffff9456c1cc7c88] smcr_buf_map_link at ffffffffc0b0278c [smc] #9 [ffff9456c1cc7ce0] __smc_buf_create at ffffffffc0b03586 [smc] The reason here is that when the server tries to create a second link, smc_llc_srv_add_link() has no protection and may add a new link to link group. This breaks the security environment protected by llc_conf_mutex. (CVE-2023-54237)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54237
https://security-tracker.debian.org/tracker/CVE-2023-54237

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54237

Plugin Information
Published: 2025/12/30, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280707 - Linux Distros Unpatched Vulnerability : CVE-2023-54242
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- block, bfq: Fix division by zero error on zero wsum When the weighted sum is zero the calculation of limit causes a division by zero error. Fix this by continuing to the next level. This was discovered by running as root: stress-ng --ioprio 0 Fixes divison by error oops: [ 521.450556] divide error: 0000 [#1] SMP NOPTI [ 521.450766] CPU: 2 PID: 2684464 Comm: stress-ng-iopri Not tainted 6.2.1-1280.native #1 [ 521.451117] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014 [ 521.451627] RIP: 0010:bfqq_request_over_limit+0x207/0x400 [ 521.451875] Code: 01 48 8d 0c c8 74 0b 48 8b 82 98 00 00 00 48 8d 0c c8 8b 85 34 ff ff ff 48 89 ca 41 0f af 41 50 48 d1 ea 48 98 48 01 d0 31 d2 <48> f7 f1 41 39 41 48 89 85 34 ff ff ff 0f 8c 7b 01 00 00 49 8b 44 [ 521.452699] RSP:
0018:ffffb1af84eb3948 EFLAGS: 00010046 [ 521.452938] RAX: 000000000000003c RBX: 0000000000000000 RCX:
0000000000000000 [ 521.453262] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffb1af84eb3978 [ 521.453584] RBP: ffffb1af84eb3a30 R08: 0000000000000001 R09: ffff8f88ab8a4ba0 [ 521.453905] R10:
0000000000000000 R11: 0000000000000001 R12: ffff8f88ab8a4b18 [ 521.454224] R13: ffff8f8699093000 R14:
0000000000000001 R15: ffffb1af84eb3970 [ 521.454549] FS: 00005640b6b0b580(0000) GS:ffff8f88b3880000(0000) knlGS:0000000000000000 [ 521.454912] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 521.455170] CR2:
00007ffcbcae4e38 CR3: 00000002e46de001 CR4: 0000000000770ee0 [ 521.455491] PKRU: 55555554 [ 521.455619] Call Trace: [ 521.455736] <TASK> [ 521.455837] ? bfq_request_merge+0x3a/0xc0 [ 521.456027] ? elv_merge+0x115/0x140 [ 521.456191] bfq_limit_depth+0xc8/0x240 [ 521.456366]
__blk_mq_alloc_requests+0x21a/0x2c0 [ 521.456577] blk_mq_submit_bio+0x23c/0x6c0 [ 521.456766]
__submit_bio+0xb8/0x140 [ 521.457236] submit_bio_noacct_nocheck+0x212/0x300 [ 521.457748] submit_bio_noacct+0x1a6/0x580 [ 521.458220] submit_bio+0x43/0x80 [ 521.458660] ext4_io_submit+0x23/0x80 [ 521.459116] ext4_do_writepages+0x40a/0xd00 [ 521.459596] ext4_writepages+0x65/0x100 [ 521.460050] do_writepages+0xb7/0x1c0 [ 521.460492] __filemap_fdatawrite_range+0xa6/0x100 [ 521.460979] file_write_and_wait_range+0xbf/0x140 [ 521.461452] ext4_sync_file+0x105/0x340 [ 521.461882]
__x64_sys_fsync+0x67/0x100 [ 521.462305] ? syscall_exit_to_user_mode+0x2c/0x1c0 [ 521.462768] do_syscall_64+0x3b/0xc0 [ 521.463165] entry_SYSCALL_64_after_hwframe+0x5a/0xc4 [ 521.463621] RIP:
0033:0x5640b6c56590 [ 521.464006] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 80 3d 71 70 0e 00 00 74 17 b8 4a 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 48 c3 0f 1f 80 00 00 00 00 48 83 ec 18 89 7c (CVE-2023-54242)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54242
https://security-tracker.debian.org/tracker/CVE-2023-54242

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54242

Plugin Information
Published: 2025/12/30, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281515 - Linux Distros Unpatched Vulnerability : CVE-2023-54243
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: fix table blob use-after-free We are not allowed to return an error at this point. Looking at the code it looks like ret is always 0 at this point, but its not. t = find_table_lock(net, repl->name, &ret, &ebt_mutex); ... this can return a valid table, with ret != 0. This bug causes update of table->private with the new blob, but then frees the blob right away in the caller. Syzbot report: BUG: KASAN: vmalloc-out-of-bounds in
__ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168 Read of size 4 at addr ffffc90005425000 by task kworker/u4:4/74 Workqueue: netns cleanup_net Call Trace: kasan_report+0xbf/0x1f0 mm/kasan/report.c:517 __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168 ebt_unregister_table+0x35/0x40 net/bridge/netfilter/ebtables.c:1372 ops_exit_list+0xb0/0x170 net/core/net_namespace.c:169 cleanup_net+0x4ee/0xb10 net/core/net_namespace.c:613 ... ip(6)tables appears to be ok (ret should be 0 at this point) but make this more obvious. (CVE-2023-54243)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54243

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
6.0
EPSS Score
0.0002
References

CVE | CVE-2023-54243

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281471 - Linux Distros Unpatched Vulnerability : CVE-2023-54244
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ACPI: EC: Fix oops when removing custom query handlers When removing custom query handlers, the handler might still be used inside the EC query workqueue, causing a kernel oops if the module holding the callback function was already unloaded.
Fix this by flushing the EC query workqueue when removing custom query handlers. Tested on a Acer Travelmate 4002WLMi (CVE-2023-54244)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54244

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.4
EPSS Score
0.0002
References

CVE | CVE-2023-54244

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280768 - Linux Distros Unpatched Vulnerability : CVE-2023-54246
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to _idle() The rcuscale.holdoff module parameter can be used to delay the start of rcu_scale_writer() kthread. However, the hung-task timeout will trigger when the timeout specified by rcuscale.holdoff is greater than hung_task_timeout_secs: runqemu kvm nographic slirp qemuparams=-smp 4 -m 2048M bootparams=rcuscale.shutdown=0 rcuscale.holdoff=300 [ 247.071753] INFO:
task rcu_scale_write:59 blocked for more than 122 seconds. [ 247.072529] Not tainted 6.4.0-rc1-00134-gb9ed6de8d4ff #7 [ 247.073400] echo 0 > /proc/sys/kernel/hung_task_timeout_secs disables this message. [ 247.074331] task:rcu_scale_write state:D stack:30144 pid:59 ppid:2 flags:0x00004000 [ 247.075346] Call Trace: [ 247.075660] <TASK> [ 247.075965] __schedule+0x635/0x1280 [ 247.076448] ?
__pfx___schedule+0x10/0x10 [ 247.076967] ? schedule_timeout+0x2dc/0x4d0 [ 247.077471] ?
__pfx_lock_release+0x10/0x10 [ 247.078018] ? enqueue_timer+0xe2/0x220 [ 247.078522] schedule+0x84/0x120 [ 247.078957] schedule_timeout+0x2e1/0x4d0 [ 247.079447] ? __pfx_schedule_timeout+0x10/0x10 [ 247.080032] ?
__pfx_rcu_scale_writer+0x10/0x10 [ 247.080591] ? __pfx_process_timeout+0x10/0x10 [ 247.081163] ?
__pfx_sched_set_fifo_low+0x10/0x10 [ 247.081760] ? __pfx_rcu_scale_writer+0x10/0x10 [ 247.082287] rcu_scale_writer+0x6b1/0x7f0 [ 247.082773] ? mark_held_locks+0x29/0xa0 [ 247.083252] ?
__pfx_rcu_scale_writer+0x10/0x10 [ 247.083865] ? __pfx_rcu_scale_writer+0x10/0x10 [ 247.084412] kthread+0x179/0x1c0 [ 247.084759] ? __pfx_kthread+0x10/0x10 [ 247.085098] ret_from_fork+0x2c/0x50 [ 247.085433] </TASK> This commit therefore replaces schedule_timeout_uninterruptible() with schedule_timeout_idle(). (CVE-2023-54246)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54246

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
7.3
EPSS Score
0.0002
References

CVE | CVE-2023-54246

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280705 - Linux Distros Unpatched Vulnerability : CVE-2023-54247
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Silence a warning in btf_type_id_size() syzbot reported a warning in [1] with the following stacktrace: WARNING: CPU: 0 PID: 5005 at kernel/bpf/btf.c:1988 btf_type_id_size+0x2d9/0x9d0 kernel/bpf/btf.c:1988 ... RIP: 0010:btf_type_id_size+0x2d9/0x9d0 kernel/bpf/btf.c:1988 ... Call Trace:
<TASK> map_check_btf kernel/bpf/syscall.c:1024 [inline] map_create+0x1157/0x1860 kernel/bpf/syscall.c:1198
__sys_bpf+0x127f/0x5420 kernel/bpf/syscall.c:5040 __do_sys_bpf kernel/bpf/syscall.c:5162 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5160 [inline] __x64_sys_bpf+0x79/0xc0 kernel/bpf/syscall.c:5160 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd With the following btf [1] DECL_TAG 'a' type_id=4 component_idx=-1 [2] PTR '(anon)' type_id=0 [3] TYPE_TAG 'a' type_id=2 [4] VAR 'a' type_id=3, linkage=static and when the bpf_attr.btf_key_type_id = 1 (DECL_TAG), the following WARN_ON_ONCE in btf_type_id_size() is triggered: if (WARN_ON_ONCE(!btf_type_is_modifier(size_type) &&
!btf_type_is_var(size_type))) return NULL; Note that 'return NULL' is the correct behavior as we don't want a DECL_TAG type to be used as a btf_{key,value}_type_id even for the case like 'DECL_TAG -> STRUCT'.
So there is no correctness issue here, we just want to silence warning. To silence the warning, I added DECL_TAG as one of kinds in btf_type_nosize() which will cause btf_type_id_size() returning NULL earlier without the warning. [1] https://lore.kernel.org/bpf/000000000000e0df8d05fc75ba86@google.com/ (CVE-2023-54247)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54247
https://security-tracker.debian.org/tracker/CVE-2023-54247

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54247

Plugin Information
Published: 2025/12/30, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280703 - Linux Distros Unpatched Vulnerability : CVE-2023-54251
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX. syzkaller found zero division error [0] in div_s64_rem() called from get_cycle_time_elapsed(), where sched->cycle_time is the divisor. We have tests in parse_taprio_schedule() so that cycle_time will never be 0, and actually cycle_time is not 0 in get_cycle_time_elapsed(). The problem is that the types of divisor are different; cycle_time is s64, but the argument of div_s64_rem() is s32. syzkaller fed this input and 0x100000000 is cast to s32 to be 0.
@TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME={0xc, 0x8, 0x100000000} We use s64 for cycle_time to cast it to ktime_t, so let's keep it and set max for cycle_time. While at it, we prevent overflow in setup_txtime() and add another test in parse_taprio_schedule() to check if cycle_time overflows. Also, we add a new tdc test case for this issue. [0]: divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 1 PID: 103 Comm: kworker/1:3 Not tainted 6.5.0-rc1-00330-g60cc1f7d0605 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: ipv6_addrconf addrconf_dad_work RIP:
0010:div_s64_rem include/linux/math64.h:42 [inline] RIP: 0010:get_cycle_time_elapsed net/sched/sch_taprio.c:223 [inline] RIP: 0010:find_entry_to_transmit+0x252/0x7e0 net/sched/sch_taprio.c:344 Code: 3c 02 00 0f 85 5e 05 00 00 48 8b 4c 24 08 4d 8b bd 40 01 00 00 48 8b 7c 24 48 48 89 c8 4c 29 f8 48 63 f7 48 99 48 89 74 24 70 <48> f7 fe 48 29 d1 48 8d 04 0f 49 89 cc 48 89 44 24 20 49 8d 85 10 RSP: 0018:ffffc90000acf260 EFLAGS: 00010206 RAX: 177450e0347560cf RBX: 0000000000000000 RCX: 177450e0347560cf RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000100000000 RBP:
0000000000000056 R08: 0000000000000000 R09: ffffed10020a0934 R10: ffff8880105049a7 R11: ffff88806cf3a520 R12: ffff888010504800 R13: ffff88800c00d800 R14: ffff8880105049a0 R15: 0000000000000000 FS:
0000000000000000(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 CR2: 00007f0edf84f0e8 CR3: 000000000d73c002 CR4: 0000000000770ee0 PKRU: 55555554 Call Trace: <TASK> get_packet_txtime net/sched/sch_taprio.c:508 [inline] taprio_enqueue_one+0x900/0xff0 net/sched/sch_taprio.c:577 taprio_enqueue+0x378/0xae0 net/sched/sch_taprio.c:658 dev_qdisc_enqueue+0x46/0x170 net/core/dev.c:3732 __dev_xmit_skb net/core/dev.c:3821 [inline]
__dev_queue_xmit+0x1b2f/0x3000 net/core/dev.c:4169 dev_queue_xmit include/linux/netdevice.h:3088 [inline] neigh_resolve_output net/core/neighbour.c:1552 [inline] neigh_resolve_output+0x4a7/0x780 net/core/neighbour.c:1532 neigh_output include/net/neighbour.h:544 [inline] ip6_finish_output2+0x924/0x17d0 net/ipv6/ip6_output.c:135 __ip6_finish_output+0x620/0xaa0 net/ipv6/ip6_output.c:196 ip6_finish_output net/ipv6/ip6_output.c:207 [inline] NF_HOOK_COND include/linux/netfilter.h:292 [inline] ip6_output+0x206/0x410 net/ipv6/ip6_output.c:228 dst_output include/net/dst.h:458 [inline] NF_HOOK.constprop.0+0xea/0x260 include/linux/netfilter.h:303 ndisc_send_skb+0x872/0xe80 net/ipv6/ndisc.c:508 ndisc_send_ns+0xb5/0x130 net/ipv6/ndisc.c:666 addrconf_dad_work+0xc14/0x13f0 net/ipv6/addrconf.c:4175 process_one_work+0x92c/0x13a0 kernel/workqueue.c:2597 worker_thread+0x60f/0x1240 kernel/workqueue.c:2748 kthread+0x2fe/0x3f0 kernel/kthread.c:389 ret_from_fork+0x2c/0x50 arch/x86/entry/entry_64.S:308 </TASK> Modules linked in:
(CVE-2023-54251)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54251
https://security-tracker.debian.org/tracker/CVE-2023-54251

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54251

Plugin Information
Published: 2025/12/30, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281550 - Linux Distros Unpatched Vulnerability : CVE-2023-54254
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Don't leak a resource on eviction error On eviction errors other than -EMULTIHOP we were leaking a resource. Fix. v2: - Avoid yet another goto (Andi Shyti) (CVE-2023-54254)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54254

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54254

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281480 - Linux Distros Unpatched Vulnerability : CVE-2023-54258
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential oops in cifs_oplock_break With deferred close we can have closes that race with lease breaks, and so with the current checks for whether to send the lease response, oplock_response(), this can mean that an unmount (kill_sb) can occur just before we were checking if the tcon->ses is valid. See below: [Fri Aug 4 04:12:50 2023] RIP: 0010:cifs_oplock_break+0x1f7/0x5b0 [cifs] [Fri Aug 4 04:12:50 2023] Code: 7d a8 48 8b 7d c0 c0 e9 02 48 89 45 b8 41 89 cf e8 3e f5 ff ff 4c 89 f7 41 83 e7 01 e8 82 b3 03 f2 49 8b 45 50 48 85 c0 74 5e <48> 83 78 60 00 74 57 45 84 ff 75 52 48 8b 43 98 48 83 eb 68 48 39 [Fri Aug 4 04:12:50 2023] RSP:
0018:ffffb30607ddbdf8 EFLAGS: 00010206 [Fri Aug 4 04:12:50 2023] RAX: 632d223d32612022 RBX:
ffff97136944b1e0 RCX: 0000000080100009 [Fri Aug 4 04:12:50 2023] RDX: 0000000000000001 RSI:
0000000080100009 RDI: ffff97136944b188 [Fri Aug 4 04:12:50 2023] RBP: ffffb30607ddbe58 R08:
0000000000000001 R09: ffffffffc08e0900 [Fri Aug 4 04:12:50 2023] R10: 0000000000000001 R11:
000000000000000f R12: ffff97136944b138 [Fri Aug 4 04:12:50 2023] R13: ffff97149147c000 R14:
ffff97136944b188 R15: 0000000000000000 [Fri Aug 4 04:12:50 2023] FS: 0000000000000000(0000) GS:ffff9714f7c00000(0000) knlGS:0000000000000000 [Fri Aug 4 04:12:50 2023] CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 [Fri Aug 4 04:12:50 2023] CR2: 00007fd8de9c7590 CR3: 000000011228e000 CR4:
0000000000350ef0 [Fri Aug 4 04:12:50 2023] Call Trace: [Fri Aug 4 04:12:50 2023] <TASK> [Fri Aug 4 04:12:50 2023] process_one_work+0x225/0x3d0 [Fri Aug 4 04:12:50 2023] worker_thread+0x4d/0x3e0 [Fri Aug 4 04:12:50 2023] ? process_one_work+0x3d0/0x3d0 [Fri Aug 4 04:12:50 2023] kthread+0x12a/0x150 [Fri Aug 4 04:12:50 2023] ? set_kthread_struct+0x50/0x50 [Fri Aug 4 04:12:50 2023] ret_from_fork+0x22/0x30 [Fri Aug 4 04:12:50 2023] </TASK> To fix this change the ordering of the checks before sending the oplock_response to first check if the openFileList is empty. (CVE-2023-54258)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54258

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
6.7
EPSS Score
0.0002
References

CVE | CVE-2023-54258

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280740 - Linux Distros Unpatched Vulnerability : CVE-2023-54260
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cifs: Fix lost destroy smbd connection when MR allocate failed If the MR allocate failed, the smb direct connection info is NULL, then smbd_destroy() will directly return, then the connection info will be leaked. Let's set the smb direct connection info to the server before call smbd_destroy(). (CVE-2023-54260)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54260

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54260

Plugin Information
Published: 2025/12/30, Modified: 2025/12/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280713 - Linux Distros Unpatched Vulnerability : CVE-2023-54261
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/amdkfd: Add missing gfx11 MQD manager callbacks mqd_stride function was introduced in commit 2f77b9a242a2 (drm/amdkfd: Update MQD management on multi XCC setup) but not assigned for gfx11. Fixes a NULL dereference in debugfs. (CVE-2023-54261)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54261
https://security-tracker.debian.org/tracker/CVE-2023-54261

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54261

Plugin Information
Published: 2025/12/30, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281556 - Linux Distros Unpatched Vulnerability : CVE-2023-54262
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Don't clone flow post action attributes second time The code already clones post action attributes in mlx5e_clone_flow_attr_for_post_act(). Creating another copy in mlx5e_tc_post_act_add() is a erroneous leftover from original implementation. Instead, assign handle->attribute to post_attr provided by the caller. Note that cloning the attribute second time is not just wasteful but also causes issues like second copy not being properly updated in neigh update code which leads to following use-after-free: Feb 21 09:02:00 c-237-177-40-045 kernel: BUG: KASAN: use-after-free in mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_report+0xbb/0x1a0 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_stack+0x1e/0x40 Feb 21 09:02:00 c-237-177-40-045 kernel:
kasan_set_track+0x21/0x30 Feb 21 09:02:00 c-237-177-40-045 kernel: __kasan_kmalloc+0x7a/0x90 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_stack+0x1e/0x40 Feb 21 09:02:00 c-237-177-40-045 kernel:
kasan_set_track+0x21/0x30 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_free_info+0x2a/0x40 Feb 21 09:02:00 c-237-177-40-045 kernel: ____kasan_slab_free+0x11a/0x1b0 Feb 21 09:02:00 c-237-177-40-045 kernel:
page dumped because: kasan: bad access detected Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0: mlx5_cmd_out_err:803:(pid 8833): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad resource state(0x9), syndrome (0xf2ff71), err(-22) Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0 enp8s0f0: Failed to add post action rule Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_core 0000:08:00.0: mlx5e_tc_encap_flows_add:190:(pid 8833): Failed to update flow post acts, -22 Feb 21 09:02:00 c-237-177-40-045 kernel: Call Trace: Feb 21 09:02:00 c-237-177-40-045 kernel: <TASK> Feb 21 09:02:00 c-237-177-40-045 kernel: dump_stack_lvl+0x57/0x7d Feb 21 09:02:00 c-237-177-40-045 kernel:
print_report+0x170/0x471 Feb 21 09:02:00 c-237-177-40-045 kernel: ? mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_report+0xbb/0x1a0 Feb 21 09:02:00 c-237-177-40-045 kernel: ? mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_cmd_set_fte+0x200d/0x24c0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: ?
__module_address.part.0+0x62/0x200 Feb 21 09:02:00 c-237-177-40-045 kernel: ? mlx5_cmd_stub_create_flow_table+0xd0/0xd0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: ?
__raw_spin_lock_init+0x3b/0x110 Feb 21 09:02:00 c-237-177-40-045 kernel: mlx5_cmd_create_fte+0x80/0xb0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel: add_rule_fg+0xe80/0x19c0 [mlx5_core] -- Feb 21 09:02:00 c-237-177-40-045 kernel: Allocated by task 13476: Feb 21 09:02:00 c-237-177-40-045 kernel:
kasan_save_stack+0x1e/0x40 Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_set_track+0x21/0x30 Feb 21 09:02:00 c-237-177-40-045 kernel: __kasan_kmalloc+0x7a/0x90 Feb 21 09:02:00 c-237-177-40-045 kernel:
mlx5_packet_reformat_alloc+0x7b/0x230 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel:
mlx5e_tc_tun_create_header_ipv4+0x977/0xf10 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel:
mlx5e_attach_encap+0x15b4/0x1e10 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel:
post_process_attr+0x305/0xa30 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel:
mlx5e_tc_add_fdb_flow+0x4c0/0xcf0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel:
__mlx5e_add_fdb_flow+0x7cf/0xe90 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel:
mlx5e_configure_flower+0xcaa/0x4b90 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel:
mlx5e_rep_setup_tc_cls_flower+0x99/0x1b0 [mlx5_core] Feb 21 09:02:00 c-237-177-40-045 kernel:
mlx5e_rep_setup_tc_cb+0x133/0x1e0 [mlx5_core] -- Feb 21 09:02:00 c-237-177-40-045 kernel: Freed by task 8833: Feb 21 09:02:00 c-237-177-40-045 kernel: kasan_save_s ---truncated--- (CVE-2023-54262)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54262

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
7.3
EPSS Score
0.0002
References

CVE | CVE-2023-54262

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280706 - Linux Distros Unpatched Vulnerability : CVE-2023-54263
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP Fixes OOPS on boards with ANX9805 DP encoders.
(CVE-2023-54263)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54263
https://security-tracker.debian.org/tracker/CVE-2023-54263

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54263

Plugin Information
Published: 2025/12/30, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280771 - Linux Distros Unpatched Vulnerability : CVE-2023-54267
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT lppaca_shared_proc() takes a pointer to the lppaca which is typically accessed through get_lppaca(). With DEBUG_PREEMPT enabled, this leads to checking if preemption is enabled, for example: BUG: using smp_processor_id() in preemptible [00000000] code: grep/10693 caller is lparcfg_data+0x408/0x19a0 CPU: 4 PID: 10693 Comm: grep Not tainted 6.5.0-rc3 #2 Call Trace:
dump_stack_lvl+0x154/0x200 (unreliable) check_preemption_disabled+0x214/0x220 lparcfg_data+0x408/0x19a0 ... This isn't actually a problem however, as it does not matter which lppaca is accessed, the shared proc state will be the same. vcpudispatch_stats_procfs_init() already works around this by disabling preemption, but the lparcfg code does not, erroring any time /proc/powerpc/lparcfg is accessed with DEBUG_PREEMPT enabled. Instead of disabling preemption on the caller side, rework lppaca_shared_proc() to not take a pointer and instead directly access the lppaca, bypassing any potential preemption checks.
[mpe: Rework to avoid needing a definition in paca.h and lppaca.h] (CVE-2023-54267)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54267

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
6.0
EPSS Score
0.0002
References

CVE | CVE-2023-54267

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281511 - Linux Distros Unpatched Vulnerability : CVE-2023-54268
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: debugobjects: Don't wake up kswapd from fill_pool() syzbot is reporting a lockdep warning in fill_pool() because the allocation from debugobjects is using GFP_ATOMIC, which is (__GFP_HIGH | __GFP_KSWAPD_RECLAIM) and therefore tries to wake up kswapd, which acquires kswapd_wait::lock. Since fill_pool() might be called with arbitrary locks held, fill_pool() should not assume that acquiring kswapd_wait::lock is safe. Use __GFP_HIGH instead and remove
__GFP_NORETRY as it is pointless for !__GFP_DIRECT_RECLAIM allocation. (CVE-2023-54268)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54268

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.4
EPSS Score
0.0002
References

CVE | CVE-2023-54268

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281507 - Linux Distros Unpatched Vulnerability : CVE-2023-54270
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: media: usb: siano: Fix use after free bugs caused by do_submit_urb There are UAF bugs caused by do_submit_urb(). One of the KASan reports is shown below: [ 36.403605] BUG: KASAN: use-after-free in worker_thread+0x4a2/0x890 [ 36.406105] Read of size 8 at addr ffff8880059600e8 by task kworker/0:2/49 [ 36.408316] [ 36.408867] CPU: 0 PID: 49 Comm:
kworker/0:2 Not tainted 6.2.0-rc3-15798-g5a41237ad1d4-dir8 [ 36.411696] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g15584 [ 36.416157] Workqueue: 0x0 (events) [ 36.417654] Call Trace: [ 36.418546] <TASK> [ 36.419320] dump_stack_lvl+0x96/0xd0 [ 36.420522] print_address_description+0x75/0x350 [ 36.421992] print_report+0x11b/0x250 [ 36.423174] ?
_raw_spin_lock_irqsave+0x87/0xd0 [ 36.424806] ? __virt_addr_valid+0xcf/0x170 [ 36.426069] ? worker_thread+0x4a2/0x890 [ 36.427355] kasan_report+0x131/0x160 [ 36.428556] ? worker_thread+0x4a2/0x890 [ 36.430053] worker_thread+0x4a2/0x890 [ 36.431297] ? worker_clr_flags+0x90/0x90 [ 36.432479] kthread+0x166/0x190 [ 36.433493] ? kthread_blkcg+0x50/0x50 [ 36.434669] ret_from_fork+0x22/0x30 [ 36.435923] </TASK> [ 36.436684] [ 36.437215] Allocated by task 24: [ 36.438289] kasan_set_track+0x50/0x80 [ 36.439436] __kasan_kmalloc+0x89/0xa0 [ 36.440566] smsusb_probe+0x374/0xc90 [ 36.441920] usb_probe_interface+0x2d1/0x4c0 [ 36.443253] really_probe+0x1d5/0x580 [ 36.444539]
__driver_probe_device+0xe3/0x130 [ 36.446085] driver_probe_device+0x49/0x220 [ 36.447423]
__device_attach_driver+0x19e/0x1b0 [ 36.448931] bus_for_each_drv+0xcb/0x110 [ 36.450217]
__device_attach+0x132/0x1f0 [ 36.451470] bus_probe_device+0x59/0xf0 [ 36.452563] device_add+0x4ec/0x7b0 [ 36.453830] usb_set_configuration+0xc63/0xe10 [ 36.455230] usb_generic_driver_probe+0x3b/0x80 [ 36.456166] printk: console [ttyGS0] disabled [ 36.456569] usb_probe_device+0x90/0x110 [ 36.459523] really_probe+0x1d5/0x580 [ 36.461027] __driver_probe_device+0xe3/0x130 [ 36.462465] driver_probe_device+0x49/0x220 [ 36.463847] __device_attach_driver+0x19e/0x1b0 [ 36.465229] bus_for_each_drv+0xcb/0x110 [ 36.466466] __device_attach+0x132/0x1f0 [ 36.467799] bus_probe_device+0x59/0xf0 [ 36.469010] device_add+0x4ec/0x7b0 [ 36.470125] usb_new_device+0x863/0xa00 [ 36.471374] hub_event+0x18c7/0x2220 [ 36.472746] process_one_work+0x34c/0x5b0 [ 36.474041] worker_thread+0x4b7/0x890 [ 36.475216] kthread+0x166/0x190 [ 36.476267] ret_from_fork+0x22/0x30 [ 36.477447] [ 36.478160] Freed by task 24: [ 36.479239] kasan_set_track+0x50/0x80 [ 36.480512] kasan_save_free_info+0x2b/0x40 [ 36.481808] ____kasan_slab_free+0x122/0x1a0 [ 36.483173]
__kmem_cache_free+0xc4/0x200 [ 36.484563] smsusb_term_device+0xcd/0xf0 [ 36.485896] smsusb_probe+0xc85/0xc90 [ 36.486976] usb_probe_interface+0x2d1/0x4c0 [ 36.488303] really_probe+0x1d5/0x580 [ 36.489498] __driver_probe_device+0xe3/0x130 [ 36.491140] driver_probe_device+0x49/0x220 [ 36.492475] __device_attach_driver+0x19e/0x1b0 [ 36.493988] bus_for_each_drv+0xcb/0x110 [ 36.495171] __device_attach+0x132/0x1f0 [ 36.496617] bus_probe_device+0x59/0xf0 [ 36.497875] device_add+0x4ec/0x7b0 [ 36.498972] usb_set_configuration+0xc63/0xe10 [ 36.500264] usb_generic_driver_probe+0x3b/0x80 [ 36.501740] usb_probe_device+0x90/0x110 [ 36.503084] really_probe+0x1d5/0x580 [ 36.504241]
__driver_probe_device+0xe3/0x130 [ 36.505548] driver_probe_device+0x49/0x220 [ 36.506766]
__device_attach_driver+0x19e/0x1b0 [ 36.508368] bus_for_each_drv+0xcb/0x110 [ 36.509646]
__device_attach+0x132/0x1f0 [ 36.510911] bus_probe_device+0x59/0xf0 [ 36.512103] device_add+0x4ec/0x7b0 [ 36.513215] usb_new_device+0x863/0xa00 [ 36.514736] hub_event+0x18c7/0x2220 [ 36.516130] process_one_work+
---truncated--- (CVE-2023-54270)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54270

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
5.5
EPSS Score
0.0002
References

CVE | CVE-2023-54270

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281465 - Linux Distros Unpatched Vulnerability : CVE-2023-54283
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf: Address KCSAN report on bpf_lru_list KCSAN reported a data-race when accessing node->ref. Although node->ref does not have to be accurate, take this chance to use a more common READ_ONCE() and WRITE_ONCE() pattern instead of data_race(). There is an existing bpf_lru_node_is_ref() and bpf_lru_node_set_ref(). This patch also adds bpf_lru_node_clear_ref() to do the WRITE_ONCE(node->ref, 0) also.
================================================================== BUG: KCSAN: data-race in
__bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem write to 0xffff888137038deb of 1 bytes by task 11240 on cpu 1: __bpf_lru_node_move kernel/bpf/bpf_lru_list.c:113 [inline] __bpf_lru_list_rotate_active kernel/bpf/bpf_lru_list.c:149 [inline] __bpf_lru_list_rotate+0x1bf/0x750 kernel/bpf/bpf_lru_list.c:240 bpf_lru_list_pop_free_to_local kernel/bpf/bpf_lru_list.c:329 [inline] bpf_common_lru_pop_free kernel/bpf/bpf_lru_list.c:447 [inline] bpf_lru_pop_free+0x638/0xe20 kernel/bpf/bpf_lru_list.c:499 prealloc_lru_pop kernel/bpf/hashtab.c:290 [inline] __htab_lru_percpu_map_update_elem+0xe7/0x820 kernel/bpf/hashtab.c:1316 bpf_percpu_hash_update+0x5e/0x90 kernel/bpf/hashtab.c:2313 bpf_map_update_value+0x2a9/0x370 kernel/bpf/syscall.c:200 generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1687 bpf_map_do_batch+0x2d9/0x3d0 kernel/bpf/syscall.c:4534 __sys_bpf+0x338/0x810
__do_sys_bpf kernel/bpf/syscall.c:5096 [inline] __se_sys_bpf kernel/bpf/syscall.c:5094 [inline]
__x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5094 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffff888137038deb of 1 bytes by task 11241 on cpu 0: bpf_lru_node_set_ref kernel/bpf/bpf_lru_list.h:70 [inline] __htab_lru_percpu_map_update_elem+0x2f1/0x820 kernel/bpf/hashtab.c:1332 bpf_percpu_hash_update+0x5e/0x90 kernel/bpf/hashtab.c:2313 bpf_map_update_value+0x2a9/0x370 kernel/bpf/syscall.c:200 generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1687 bpf_map_do_batch+0x2d9/0x3d0 kernel/bpf/syscall.c:4534 __sys_bpf+0x338/0x810 __do_sys_bpf kernel/bpf/syscall.c:5096 [inline] __se_sys_bpf kernel/bpf/syscall.c:5094 [inline] __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5094 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x01 -> 0x00 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 11241 Comm: syz-executor.3 Not tainted 6.3.0-rc7-syzkaller-00136-g6a66fdd29ea1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 ================================================================== (CVE-2023-54283)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54283

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54283

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280717 - Linux Distros Unpatched Vulnerability : CVE-2023-54287
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tty: serial: imx: disable Ageing Timer interrupt request irq There maybe pending USR interrupt before requesting irq, however uart_add_one_port has not executed, so there will be kernel panic: [ 0.795668] Unable to handle kernel NULL pointer dereference at virtual addre ss 0000000000000080 [ 0.802701] Mem abort info: [ 0.805367] ESR = 0x0000000096000004 [ 0.808950] EC = 0x25: DABT (current EL), IL = 32 bits [ 0.814033] SET = 0, FnV = 0 [ 0.816950] EA = 0, S1PTW = 0 [ 0.819950] FSC = 0x04: level 0 translation fault [ 0.824617] Data abort info: [ 0.827367] ISV = 0, ISS = 0x00000004 [ 0.831033] CM = 0, WnR = 0 [ 0.833866] [0000000000000080] user address but active_mm is swapper [ 0.839951] Internal error: Oops:
0000000096000004 [#1] PREEMPT SMP [ 0.845953] Modules linked in: [ 0.848869] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.1.1+g56321e101aca #1 [ 0.855617] Hardware name: Freescale i.MX8MP EVK (DT) [ 0.860452] pstate: 000000c5 (nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 0.867117] pc :
__imx_uart_rxint.constprop.0+0x11c/0x2c0 [ 0.872283] lr : imx_uart_int+0xf8/0x1ec The issue only happends in the inmate linux when Jailhouse hypervisor enabled. The test procedure is: while true; do jailhouse enable imx8mp.cell jailhouse cell linux xxxx sleep 10 jailhouse cell destroy 1 jailhouse disable sleep 5 done And during the upper test, press keys to the 2nd linux console. When `jailhouse cell destroy 1`, the 2nd linux has no chance to put the uart to a quiese state, so USR1/2 may has pending interrupts. Then when `jailhosue cell linux xx` to start 2nd linux again, the issue trigger. In order to disable irqs before requesting them, both UCR1 and UCR2 irqs should be disabled, so here fix that, disable the Ageing Timer interrupt in UCR2 as UCR1 does. (CVE-2023-54287)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54287
https://security-tracker.debian.org/tracker/CVE-2023-54287

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54287

Plugin Information
Published: 2025/12/30, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280798 - Linux Distros Unpatched Vulnerability : CVE-2023-54289
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Fix NULL dereference in error handling Smatch reported: drivers/scsi/qedf/qedf_main.c:3056 qedf_alloc_global_queues() warn:
missing unwind goto? At this point in the function, nothing has been allocated so we can return directly.
In particular the qedf->global_queues have not been allocated so calling qedf_free_global_queues() will lead to a NULL dereference when we check if (!gl[i]) and gl is NULL. (CVE-2023-54289)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54289

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54289

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281483 - Linux Distros Unpatched Vulnerability : CVE-2023-54291
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: vduse: fix NULL pointer dereference vduse_vdpa_set_vq_affinity callback can be called with NULL value as cpu_mask when deleting the vduse device. This patch resets virtqueue's IRQ affinity mask value to set all CPUs instead of dereferencing NULL cpu_mask. [ 4760.952149] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 4760.959110] #PF: supervisor read access in kernel mode [ 4760.964247] #PF: error_code(0x0000) - not- present page [ 4760.969385] PGD 0 P4D 0 [ 4760.971927] Oops: 0000 [#1] PREEMPT SMP PTI [ 4760.976112] CPU:
13 PID: 2346 Comm: vdpa Not tainted 6.4.0-rc6+ #4 [ 4760.982291] Hardware name: Dell Inc. PowerEdge R640/0W23H8, BIOS 2.8.1 06/26/2020 [ 4760.989769] RIP: 0010:memcpy_orig+0xc5/0x130 [ 4760.994049] Code: 16 f8 4c 89 07 4c 89 4f 08 4c 89 54 17 f0 4c 89 5c 17 f8 c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 fa 08 72 1b <4c> 8b 06 4c 8b 4c 16 f8 4c 89 07 4c 89 4c 17 f8 c3 cc cc cc cc 66 [ 4761.012793] RSP:
0018:ffffb1d565abb830 EFLAGS: 00010246 [ 4761.018020] RAX: ffff9f4bf6b27898 RBX: ffff9f4be23969c0 RCX:
ffff9f4bcadf6400 [ 4761.025152] RDX: 0000000000000008 RSI: 0000000000000000 RDI: ffff9f4bf6b27898 [ 4761.032286] RBP: 0000000000000000 R08: 0000000000000008 R09: 0000000000000000 [ 4761.039416] R10:
0000000000000000 R11: 0000000000000600 R12: 0000000000000000 [ 4761.046549] R13: 0000000000000000 R14:
0000000000000080 R15: ffffb1d565abbb10 [ 4761.053680] FS: 00007f64c2ec2740(0000) GS:ffff9f635f980000(0000) knlGS:0000000000000000 [ 4761.061765] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4761.067513] CR2:
0000000000000000 CR3: 0000001875270006 CR4: 00000000007706e0 [ 4761.074645] DR0: 0000000000000000 DR1:
0000000000000000 DR2: 0000000000000000 [ 4761.081775] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400 [ 4761.088909] PKRU: 55555554 [ 4761.091620] Call Trace: [ 4761.094074] <TASK> [ 4761.096180] ? __die+0x1f/0x70 [ 4761.099238] ? page_fault_oops+0x171/0x4f0 [ 4761.103340] ? exc_page_fault+0x7b/0x180 [ 4761.107265] ? asm_exc_page_fault+0x22/0x30 [ 4761.111460] ? memcpy_orig+0xc5/0x130 [ 4761.115126] vduse_vdpa_set_vq_affinity+0x3e/0x50 [vduse] [ 4761.120533] virtnet_clean_affinity.part.0+0x3d/0x90 [virtio_net] [ 4761.126635] remove_vq_common+0x1a4/0x250 [virtio_net] [ 4761.131781] virtnet_remove+0x5d/0x70 [virtio_net] [ 4761.136580] virtio_dev_remove+0x3a/0x90 [ 4761.140509] device_release_driver_internal+0x19b/0x200 [ 4761.145742] bus_remove_device+0xc2/0x130 [ 4761.149755] device_del+0x158/0x3e0 [ 4761.153245] ? kernfs_find_ns+0x35/0xc0 [ 4761.157086] device_unregister+0x13/0x60 [ 4761.161010] unregister_virtio_device+0x11/0x20 [ 4761.165543] device_release_driver_internal+0x19b/0x200 [ 4761.170770] bus_remove_device+0xc2/0x130 [ 4761.174782] device_del+0x158/0x3e0 [ 4761.178276] ?
__pfx_vdpa_name_match+0x10/0x10 [vdpa] [ 4761.183336] device_unregister+0x13/0x60 [ 4761.187260] vdpa_nl_cmd_dev_del_set_doit+0x63/0xe0 [vdpa] (CVE-2023-54291)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54291

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54291

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280791 - Linux Distros Unpatched Vulnerability : CVE-2023-54294
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix memleak of md thread In raid10_run(), if setup_conf() succeed and raid10_run() failed before setting 'mddev->thread', then in the error path 'conf->thread' is not freed. Fix the problem by setting 'mddev->thread' right after setup_conf(). (CVE-2023-54294)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54294

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.4
EPSS Score
0.0002
References

CVE | CVE-2023-54294

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280814 - Linux Distros Unpatched Vulnerability : CVE-2023-54295
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type spi_nor_set_erase_type() was used either to set or to mask out an erase type.
When we used it to mask out an erase type a shift-out-of-bounds was hit: UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24 shift exponent 4294967295 is too large for 32-bit type 'int' The setting of the size_{shift, mask} and of the opcode are unnecessary when the erase size is zero, as throughout the code just the erase size is considered to determine whether an erase type is supported or not. Setting the opcode to 0xFF was wrong too as nobody guarantees that 0xFF is an unused opcode. Thus when masking out an erase type, just set the erase size to zero. This will fix the shift-out-of-bounds.
[ta: refine changes, new commit message, fix compilation error] (CVE-2023-54295)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54295

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
6.0
EPSS Score
0.0002
References

CVE | CVE-2023-54295

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281523 - Linux Distros Unpatched Vulnerability : CVE-2023-54296
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration Fix a goof where KVM tries to grab source vCPUs from the destination VM when doing intrahost migration. Grabbing the wrong vCPU not only hoses the guest, it also crashes the host due to the VMSA pointer being left NULL. BUG: unable to handle page fault for address: ffffe38687000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops:
0000 [#1] SMP NOPTI CPU: 39 PID: 17143 Comm: sev_migrate_tes Tainted: GO 6.5.0-smp--fff2e47e6c3b-next #151 Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.28.0 07/10/2023 RIP:
0010:__free_pages+0x15/0xd0 RSP: 0018:ffff923fcf6e3c78 EFLAGS: 00010246 RAX: 0000000000000000 RBX:
ffffe38687000000 RCX: 0000000000000100 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffe38687000000 RBP: ffff923fcf6e3c88 R08: ffff923fcafb0000 R09: 0000000000000000 R10: 0000000000000000 R11:
ffffffff83619b90 R12: ffff923fa9540000 R13: 0000000000080007 R14: ffff923f6d35d000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff929d0d7c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffe38687000000 CR3: 0000005224c34005 CR4: 0000000000770ee0 PKRU: 55555554 Call Trace: <TASK> sev_free_vcpu+0xcb/0x110 [kvm_amd] svm_vcpu_free+0x75/0xf0 [kvm_amd] kvm_arch_vcpu_destroy+0x36/0x140 [kvm] kvm_destroy_vcpus+0x67/0x100 [kvm] kvm_arch_destroy_vm+0x161/0x1d0 [kvm] kvm_put_kvm+0x276/0x560 [kvm] kvm_vm_release+0x25/0x30 [kvm] __fput+0x106/0x280 ____fput+0x12/0x20 task_work_run+0x86/0xb0 do_exit+0x2e3/0x9c0 do_group_exit+0xb1/0xc0 __x64_sys_exit_group+0x1b/0x20 do_syscall_64+0x41/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> CR2: ffffe38687000000 (CVE-2023-54296)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54296

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
5.2
EPSS Score
0.0002
References

CVE | CVE-2023-54296

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281479 - Linux Distros Unpatched Vulnerability : CVE-2023-54298
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: thermal: intel: quark_dts: fix error pointer dereference If alloc_soc_dts() fails, then we can just return. Trying to free soc_dts will lead to an Oops. (CVE-2023-54298)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54298

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54298

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280749 - Linux Distros Unpatched Vulnerability : CVE-2023-54299
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: usb: typec: bus: verify partner exists in typec_altmode_attention Some usb hubs will negotiate DisplayPort Alt mode with the device but will then negotiate a data role swap after entering the alt mode. The data role swap causes the device to unregister all alt modes, however the usb hub will still send Attention messages even after failing to reregister the Alt Mode. type_altmode_attention currently does not verify whether or not a device's altmode partner exists, which results in a NULL pointer error when dereferencing the typec_altmode and typec_altmode_ops belonging to the altmode partner. Verify the presence of a device's altmode partner before sending the Attention message to the Alt Mode driver. (CVE-2023-54299)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54299

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.4
EPSS Score
0.0002
References

CVE | CVE-2023-54299

Plugin Information
Published: 2025/12/30, Modified: 2025/12/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280782 - Linux Distros Unpatched Vulnerability : CVE-2023-54302
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix data race on CQP completion stats CQP completion statistics is read lockesly in irdma_wait_event and irdma_check_cqp_progress while it can be updated in the completion thread irdma_sc_ccq_get_cqe_info on another CPU as KCSAN reports. Make completion statistics an atomic variable to reflect coherent updates to it. This will also avoid load/store tearing logic bug potentially possible by compiler optimizations.
[77346.170861] BUG: KCSAN: data-race in irdma_handle_cqp_op [irdma] / irdma_sc_ccq_get_cqe_info [irdma] [77346.171383] write to 0xffff8a3250b108e0 of 8 bytes by task 9544 on cpu 4: [77346.171483] irdma_sc_ccq_get_cqe_info+0x27a/0x370 [irdma] [77346.171658] irdma_cqp_ce_handler+0x164/0x270 [irdma] [77346.171835] cqp_compl_worker+0x1b/0x20 [irdma] [77346.172009] process_one_work+0x4d1/0xa40 [77346.172024] worker_thread+0x319/0x700 [77346.172037] kthread+0x180/0x1b0 [77346.172054] ret_from_fork+0x22/0x30 [77346.172136] read to 0xffff8a3250b108e0 of 8 bytes by task 9838 on cpu 2:
[77346.172234] irdma_handle_cqp_op+0xf4/0x4b0 [irdma] [77346.172413] irdma_cqp_aeq_cmd+0x75/0xa0 [irdma] [77346.172592] irdma_create_aeq+0x390/0x45a [irdma] [77346.172769] irdma_rt_init_hw.cold+0x212/0x85d [irdma] [77346.172944] irdma_probe+0x54f/0x620 [irdma] [77346.173122] auxiliary_bus_probe+0x66/0xa0 [77346.173137] really_probe+0x140/0x540 [77346.173154] __driver_probe_device+0xc7/0x220 [77346.173173] driver_probe_device+0x5f/0x140 [77346.173190] __driver_attach+0xf0/0x2c0 [77346.173208] bus_for_each_dev+0xa8/0xf0 [77346.173225] driver_attach+0x29/0x30 [77346.173240] bus_add_driver+0x29c/0x2f0 [77346.173255] driver_register+0x10f/0x1a0 [77346.173272]
__auxiliary_driver_register+0xbc/0x140 [77346.173287] irdma_init_module+0x55/0x1000 [irdma] [77346.173460] do_one_initcall+0x7d/0x410 [77346.173475] do_init_module+0x81/0x2c0 [77346.173491] load_module+0x1232/0x12c0 [77346.173506] __do_sys_finit_module+0x101/0x180 [77346.173522]
__x64_sys_finit_module+0x3c/0x50 [77346.173538] do_syscall_64+0x39/0x90 [77346.173553] entry_SYSCALL_64_after_hwframe+0x63/0xcd [77346.173634] value changed: 0x0000000000000094 ->
0x0000000000000095 (CVE-2023-54302)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54302

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
6.0
EPSS Score
0.0002
References

CVE | CVE-2023-54302

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281516 - Linux Distros Unpatched Vulnerability : CVE-2023-54303
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpf_perf_event_output The nesting protection in bpf_perf_event_output relies on disabled preemption, which is guaranteed for kprobes and tracepoints. However bpf_perf_event_output can be also called from uprobes context through bpf_prog_run_array_sleepable function which disables migration, but keeps preemption enabled. This can cause task to be preempted by another one inside the nesting protection and lead eventually to two tasks using same perf_sample_data buffer and cause crashes like: kernel tried to execute NX-protected page - exploit attempt? (uid: 0) BUG: unable to handle page fault for address:
ffffffff82be3eea ... Call Trace: ? __die+0x1f/0x70 ? page_fault_oops+0x176/0x4d0 ? exc_page_fault+0x132/0x230 ? asm_exc_page_fault+0x22/0x30 ? perf_output_sample+0x12b/0x910 ? perf_event_output+0xd0/0x1d0 ? bpf_perf_event_output+0x162/0x1d0 ? bpf_prog_c6271286d9a4c938_krava1+0x76/0x87 ? __uprobe_perf_func+0x12b/0x540 ? uprobe_dispatcher+0x2c4/0x430 ? uprobe_notify_resume+0x2da/0xce0 ? atomic_notifier_call_chain+0x7b/0x110 ? exit_to_user_mode_prepare+0x13e/0x290 ? irqentry_exit_to_user_mode+0x5/0x30 ? asm_exc_int3+0x35/0x40 Fixing this by disabling preemption in bpf_perf_event_output. (CVE-2023-54303)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54303

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
6.7
EPSS Score
0.0002
References

CVE | CVE-2023-54303

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280754 - Linux Distros Unpatched Vulnerability : CVE-2023-54306
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: tls: avoid hanging tasks on the tx_lock syzbot sent a hung task report and Eric explains that adversarial receiver may keep RWIN at 0 for a long time, so we are not guaranteed to make forward progress. Thread which took tx_lock and went to sleep may not release tx_lock for hours. Use interruptible sleep where possible and reschedule the work if it can't take the lock. Testing: existing selftest passes (CVE-2023-54306)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54306

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.4
EPSS Score
0.0002
References

CVE | CVE-2023-54306

Plugin Information
Published: 2025/12/30, Modified: 2025/12/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280776 - Linux Distros Unpatched Vulnerability : CVE-2023-54309
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation /dev/vtpmx is made visible before 'workqueue' is initialized, which can lead to a memory corruption in the worst case scenario. Address this by initializing 'workqueue' as the very first step of the driver initialization. (CVE-2023-54309)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54309

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
8.4
EPSS Score
0.0002
References

CVE | CVE-2023-54309

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280804 - Linux Distros Unpatched Vulnerability : CVE-2023-54312
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: samples/bpf: Fix buffer overflow in tcp_basertt Using sizeof(nv) or strlen(nv)+1 is correct. (CVE-2023-54312)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54312

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
7.4
EPSS Score
0.0003
References

CVE | CVE-2023-54312

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281484 - Linux Distros Unpatched Vulnerability : CVE-2023-54313
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ovl: fix null pointer dereference in ovl_get_acl_rcu() Following process: P1 P2 path_openat link_path_walk may_lookup inode_permission(rcu) ovl_permission acl_permission_check check_acl get_cached_acl_rcu ovl_get_inode_acl realinode = ovl_inode_real(ovl_inode) drop_cache __dentry_kill(ovl_dentry) iput(ovl_inode) ovl_destroy_inode(ovl_inode) dput(oi->__upperdentry) dentry_kill(upperdentry) dentry_unlink_inode upperdentry->d_inode = NULL ovl_inode_upper upperdentry = ovl_i_dentry_upper(ovl_inode) d_inode(upperdentry) // returns NULL IS_POSIXACL(realinode) // NULL pointer dereference , will trigger an null pointer dereference at realinode: [ 205.472797] BUG: kernel NULL pointer dereference, address:
0000000000000028 [ 205.476701] CPU: 2 PID: 2713 Comm: ls Not tainted 6.3.0-12064-g2edfa098e750-dirty #1216 [ 205.478754] RIP: 0010:do_ovl_get_acl+0x5d/0x300 [ 205.489584] Call Trace: [ 205.489812] <TASK> [ 205.490014] ovl_get_inode_acl+0x26/0x30 [ 205.490466] get_cached_acl_rcu+0x61/0xa0 [ 205.490908] generic_permission+0x1bf/0x4e0 [ 205.491447] ovl_permission+0x79/0x1b0 [ 205.491917] inode_permission+0x15e/0x2c0 [ 205.492425] link_path_walk+0x115/0x550 [ 205.493311] path_lookupat.isra.0+0xb2/0x200 [ 205.493803] filename_lookup+0xda/0x240 [ 205.495747] vfs_fstatat+0x7b/0xb0 Fetch a reproducer in [Link]. Use the helper ovl_i_path_realinode() to get realinode and then do non-nullptr checking. (CVE-2023-54313)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54313

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54313

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280797 - Linux Distros Unpatched Vulnerability : CVE-2023-54315
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv/sriov: perform null check on iov before dereferencing iov Currently pointer iov is being dereferenced before the null check of iov which can lead to null pointer dereference errors. Fix this by moving the iov null check before the dereferencing. Detected using cppcheck static analysis: linux/arch/powerpc/platforms/powernv/pci- sriov.c:597:12: warning: Either the condition '!iov' is redundant or there is possible null pointer dereference: iov. [nullPointerRedundantCheck] num_vfs = iov->num_vfs; ^ (CVE-2023-54315)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54315

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.4
EPSS Score
0.0002
References

CVE | CVE-2023-54315

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281525 - Linux Distros Unpatched Vulnerability : CVE-2023-54316
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: refscale: Fix uninitalized use of wait_queue_head_t Running the refscale test occasionally crashes the kernel with the following error: [ 8569.952896] BUG: unable to handle page fault for address: ffffffffffffffe8 [ 8569.952900] #PF: supervisor read access in kernel mode [ 8569.952902] #PF: error_code(0x0000) - not-present page [ 8569.952904] PGD c4b048067 P4D c4b049067 PUD c4b04b067 PMD 0 [ 8569.952910] Oops: 0000 [#1] PREEMPT_RT SMP NOPTI [ 8569.952916] Hardware name: Dell Inc. PowerEdge R750/0WMWCR, BIOS 1.2.4 05/28/2021 [ 8569.952917] RIP:
0010:prepare_to_wait_event+0x101/0x190 : [ 8569.952940] Call Trace: [ 8569.952941] <TASK> [ 8569.952944] ref_scale_reader+0x380/0x4a0 [refscale] [ 8569.952959] kthread+0x10e/0x130 [ 8569.952966] ret_from_fork+0x1f/0x30 [ 8569.952973] </TASK> The likely cause is that init_waitqueue_head() is called after the call to the torture_create_kthread() function that creates the ref_scale_reader kthread.
Although this init_waitqueue_head() call will very likely complete before this kthread is created and starts running, it is possible that the calling kthread will be delayed between the calls to torture_create_kthread() and init_waitqueue_head(). In this case, the new kthread will use the waitqueue head before it is properly initialized, which is not good for the kernel's health and well-being. The above crash happened here: static inline void __add_wait_queue(...) { : if (!(wq->flags &
WQ_FLAG_PRIORITY)) <=== Crash here The offset of flags from list_head entry in wait_queue_entry is -0x18.
If reader_tasks[i].wq.head.next is NULL as allocated reader_task structure is zero initialized, the instruction will try to access address 0xffffffffffffffe8, which is exactly the fault address listed above. This commit therefore invokes init_waitqueue_head() before creating the kthread. (CVE-2023-54316)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54316

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.4
EPSS Score
0.0002
References

CVE | CVE-2023-54316

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
281536 - Linux Distros Unpatched Vulnerability : CVE-2023-54317
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: dm flakey: don't corrupt the zero page When we need to zero some range on a block device, the function __blkdev_issue_zero_pages submits a write bio with the bio vector pointing to the zero page. If we use dm-flakey with corrupt bio writes option, it will corrupt the content of the zero page which results in crashes of various userspace programs. Glibc assumes that memory returned by mmap is zeroed and it uses it for calloc implementation; if the newly mapped memory is not zeroed, calloc will return non-zeroed memory. Fix this bug by testing if the page is equal to ZERO_PAGE(0) and avoiding the corruption in this case. (CVE-2023-54317)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54317

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.4
EPSS Score
0.0002
References

CVE | CVE-2023-54317

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280719 - Linux Distros Unpatched Vulnerability : CVE-2023-54320
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- platform/x86/amd: pmc: Fix memory leak in amd_pmc_stb_debugfs_open_v2() Function amd_pmc_stb_debugfs_open_v2() may be called when the STB debug mechanism enabled. When amd_pmc_send_cmd() fails, the 'buf' needs to be released. (CVE-2023-54320)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54320
https://security-tracker.debian.org/tracker/CVE-2023-54320

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54320

Plugin Information
Published: 2025/12/30, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280731 - Linux Distros Unpatched Vulnerability : CVE-2023-54321
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- driver core: fix potential null-ptr-deref in device_add() I got the following null-ptr-deref report while doing fault injection test: BUG: kernel NULL pointer dereference, address: 0000000000000058 CPU: 2 PID:
278 Comm: 37-i2c-ds2482 Tainted: G B W N 6.1.0-rc3+ RIP: 0010:klist_put+0x2d/0xd0 Call Trace: <TASK>
klist_remove+0xf1/0x1c0 device_release_driver_internal+0x196/0x210 bus_remove_device+0x1bd/0x240 device_add+0xd3d/0x1100 w1_add_master_device+0x476/0x490 [wire] ds2482_probe+0x303/0x3e0 [ds2482] This is how it happened: w1_alloc_dev() // The dev->driver is set to w1_master_driver. memcpy(&dev->dev, device, sizeof(struct device)); device_add() bus_add_device() dpm_sysfs_add() // It fails, calls bus_remove_device. // error path bus_remove_device() // The dev->driver is not null, but driver is not bound. __device_release_driver() klist_remove(&dev->p->knode_driver) <-- It causes null-ptr-deref. // normal path bus_probe_device() // It's not called yet. device_bind_driver() If dev->driver is set, in the error path after calling bus_add_device() in device_add(), bus_remove_device() is called, then the device will be detached from driver. But device_bind_driver() is not called yet, so it causes null-ptr-deref while access the 'knode_driver'. To fix this, set dev->driver to null in the error path before calling bus_remove_device(). (CVE-2023-54321)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54321
https://security-tracker.debian.org/tracker/CVE-2023-54321

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54321

Plugin Information
Published: 2025/12/30, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280780 - Linux Distros Unpatched Vulnerability : CVE-2023-54323
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cxl/pmem: Fix nvdimm registration races A loop of the form: while true; do modprobe cxl_pci; modprobe -r cxl_pci; done ...fails with the following crash signature: BUG: kernel NULL pointer dereference, address: 0000000000000040 [..] RIP:
0010:cxl_internal_send_cmd+0x5/0xb0 [cxl_core] [..] Call Trace: <TASK> cxl_pmem_ctl+0x121/0x240 [cxl_pmem] nvdimm_get_config_data+0xd6/0x1a0 [libnvdimm] nd_label_data_init+0x135/0x7e0 [libnvdimm] nvdimm_probe+0xd6/0x1c0 [libnvdimm] nvdimm_bus_probe+0x7a/0x1e0 [libnvdimm] really_probe+0xde/0x380
__driver_probe_device+0x78/0x170 driver_probe_device+0x1f/0x90 __device_attach_driver+0x85/0x110 bus_for_each_drv+0x7d/0xc0 __device_attach+0xb4/0x1e0 bus_probe_device+0x9f/0xc0 device_add+0x445/0x9c0 nd_async_device_register+0xe/0x40 [libnvdimm] async_run_entry_fn+0x30/0x130 ...namely that the bottom half of async nvdimm device registration runs after the CXL has already torn down the context that cxl_pmem_ctl() needs. Unlike the ACPI NFIT case that benefits from launching multiple nvdimm device registrations in parallel from those listed in the table, CXL is already marked PROBE_PREFER_ASYNCHRONOUS.
So provide for a synchronous registration path to preclude this scenario. (CVE-2023-54323)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54323

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.4
EPSS Score
0.0002
References

CVE | CVE-2023-54323

Plugin Information
Published: 2025/12/31, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226519 - Linux Distros Unpatched Vulnerability : CVE-2023-5441
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960.
(CVE-2023-5441)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-5441
https://security-tracker.debian.org/tracker/CVE-2023-5441

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.001
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-5441

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
250366 - Linux Distros Unpatched Vulnerability : CVE-2023-5616
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for openssh-server. This could unknowingly leave the local machine exposed to remote SSH access contrary to expectation of the user. (CVE-2023-5616)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-5616
https://security-tracker.debian.org/tracker/CVE-2023-5616
https://ubuntu.com/security/CVE-2023-5616

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
4.4 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.2
EPSS Score
0.0006
CVSS v2.0 Base Score
9.3 (CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.3 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-5616

Plugin Information
Published: 2025/08/18, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gnome-control-center
- gnome-control-center-filesystem
253259 - Linux Distros Unpatched Vulnerability : CVE-2023-5678
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. While DH_check() performs all the necessary checks (as of CVE-2023-3817), DH_check_pub_key() doesn't make any of these checks, and is therefore vulnerable for excessively large P and Q parameters. Likewise, while DH_generate_key() performs a check for an excessively large P, it doesn't check for an excessively large Q. An application that calls DH_generate_key() or DH_check_pub_key() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. DH_generate_key() and DH_check_pub_key() are also called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate(). Also vulnerable are the OpenSSL pkey command line application when using the -pubcheck option, as well as the OpenSSL genpkey command line application.
The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. (CVE-2023-5678)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-5678
https://ubuntu.com/security/CVE-2023-5678

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.0054
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-5678

Plugin Information
Published: 2025/08/21, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- compat-openssl11
253286 - Linux Distros Unpatched Vulnerability : CVE-2023-6129
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL for PowerPC CPUs restores the contents of vector registers in a different order than they are saved. Thus the contents of some of these vector registers are corrupted when returning to the caller. The vulnerable code is used only on newer PowerPC processors supporting the PowerISA 2.07 instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However unless the compiler uses the vector registers for storing pointers, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3. If this cipher is enabled on the server a malicious client can influence whether this AEAD cipher is used.
This implies that TLS server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue. (CVE-2023-6129)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-6129
https://ubuntu.com/security/CVE-2023-6129

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.0
EPSS Score
0.0191
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-6129

Plugin Information
Published: 2025/08/21, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
227410 - Linux Distros Unpatched Vulnerability : CVE-2023-6135
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Multiple NSS NIST curves were susceptible to a side-channel attack known as Minerva. This attack could potentially allow an attacker to recover the private key. This vulnerability affects Firefox < 121.
(CVE-2023-6135)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-6135
https://security-tracker.debian.org/tracker/CVE-2023-6135
https://ubuntu.com/security/CVE-2023-6135

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
3.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.0022
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-6135

Plugin Information
Published: 2025/03/05, Modified: 2025/10/08
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
225925 - Linux Distros Unpatched Vulnerability : CVE-2023-6277
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a craft input with size smaller than 379 KB.
(CVE-2023-6277)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-6277
https://security-tracker.debian.org/tracker/CVE-2023-6277

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0282
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-6277

Plugin Information
Published: 2025/03/05, Modified: 2025/09/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libtiff
- libtiff-devel
243793 - Linux Distros Unpatched Vulnerability : CVE-2023-7042
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A null pointer dereference vulnerability was found in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() in drivers/net/wireless/ath/ath10k/wmi-tlv.c in the Linux kernel. This issue could be exploited to trigger a denial of service. (CVE-2023-7042)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-7042
https://ubuntu.com/security/CVE-2023-7042

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-7042

Plugin Information
Published: 2025/08/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228139 - Linux Distros Unpatched Vulnerability : CVE-2023-7192
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of service (DoS) attack due to a refcount overflow. (CVE-2023-7192)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-7192
https://ubuntu.com/security/CVE-2023-7192

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.4 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-7192

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227975 - Linux Distros Unpatched Vulnerability : CVE-2023-7207
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regression in --no-absolute-filenames. Upstream has since provided a proper fix to --no-absolute-filenames. (CVE-2023-7207)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-7207
https://security-tracker.debian.org/tracker/CVE-2023-7207

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0047
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-7207

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- cpio
260356 - Linux Distros Unpatched Vulnerability : CVE-2023-7216
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A path traversal vulnerability was found in the CPIO utility. This issue could allow a remote unauthenticated attacker to trick a user into opening a specially crafted archive. During the extraction process, the archiver could follow symlinks outside of the intended directory, which allows files to be written in arbitrary directories through symlinks. (CVE-2023-7216)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-7216
https://ubuntu.com/security/CVE-2023-7216

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.2
EPSS Score
0.0039
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2023-7216

Plugin Information
Published: 2025/09/02, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- cpio
260203 - Linux Distros Unpatched Vulnerability : CVE-2024-0232
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service. (CVE-2024-0232)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-0232

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-0232

Plugin Information
Published: 2025/09/01, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- sqlite-libs
227872 - Linux Distros Unpatched Vulnerability : CVE-2024-0564
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in the Linux kernel's memory deduplication mechanism. The max page sharing of Kernel Samepage Merging (KSM), added in Linux kernel version 4.4.0-96.119, can create a side channel. When the attacker and the victim share the same host and the default setting of KSM is max page sharing=256, it is possible for the attacker to time the unmap to merge with the victim's page. The unmapping time depends on whether it merges with the victim's page and additional physical pages are created beyond the KSM's max page share. Through these operations, the attacker can leak the victim's page. (CVE-2024-0564)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-0564
https://security-tracker.debian.org/tracker/CVE-2024-0564
https://ubuntu.com/security/CVE-2024-0564

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0009
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2024-0564

Plugin Information
Published: 2025/03/05, Modified: 2025/12/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227880 - Linux Distros Unpatched Vulnerability : CVE-2024-0607
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval() function, where the code iterates through a loop and writes to the `dst` array. On each iteration, 8 bytes are written, but `dst` is an array of u32, so each element only has space for 4 bytes. That means every iteration overwrites part of the previous element corrupting this array of u32. This flaw allows a local user to cause a denial of service or potentially break NetFilter functionality. (CVE-2024-0607)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-0607
https://ubuntu.com/security/CVE-2024-0607

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.6 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
CVSS v3.0 Temporal Score
6.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.7
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-0607

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227499 - Linux Distros Unpatched Vulnerability : CVE-2024-0639
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel's SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system. (CVE-2024-0639)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-0639
https://ubuntu.com/security/CVE-2024-0639

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-0639

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227616 - Linux Distros Unpatched Vulnerability : CVE-2024-0727
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue. OpenSSL APIs that are vulnerable to this are:
PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass(). We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. (CVE-2024-0727)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-0727
https://ubuntu.com/security/CVE-2024-0727

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0016
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-0727

Plugin Information
Published: 2025/03/05, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- compat-openssl11
227652 - Linux Distros Unpatched Vulnerability : CVE-2024-10524
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host. (CVE-2024-10524)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-10524
https://security-tracker.debian.org/tracker/CVE-2024-10524
https://ubuntu.com/security/CVE-2024-10524

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.0
EPSS Score
0.0047
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-10524

Plugin Information
Published: 2025/03/05, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- wget
260250 - Linux Distros Unpatched Vulnerability : CVE-2024-10941
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A malicious website could have included an iframe with an malformed URI resulting in a non-exploitable browser crash. This vulnerability affects Firefox < 126. (CVE-2024-10941)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-10941

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0008
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-10941

Plugin Information
Published: 2025/09/02, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
248844 - Linux Distros Unpatched Vulnerability : CVE-2024-11701
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt.
This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox <
133 and Thunderbird < 133. (CVE-2024-11701)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-11701
https://ubuntu.com/security/CVE-2024-11701

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
4.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.0005
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-11701

Plugin Information
Published: 2025/08/12, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
249928 - Linux Distros Unpatched Vulnerability : CVE-2024-11706
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A null pointer dereference may have inadvertently occurred in `pk12util`, and specifically in the `SEC_ASN1DecodeItem_Util` function, when handling malformed or improperly formatted input files. This vulnerability affects Firefox < 133 and Thunderbird < 133. (CVE-2024-11706)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-11706
https://ubuntu.com/security/CVE-2024-11706

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-11706

Plugin Information
Published: 2025/08/15, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
245341 - Linux Distros Unpatched Vulnerability : CVE-2024-11708
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure. This vulnerability affects Firefox < 133 and Thunderbird < 133. (CVE-2024-11708)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-11708
https://ubuntu.com/security/CVE-2024-11708

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-11708

Plugin Information
Published: 2025/08/07, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
227598 - Linux Distros Unpatched Vulnerability : CVE-2024-12086
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client. (CVE-2024-12086)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-12086

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
6.1 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
5.2
EPSS Score
0.0006
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-12086

Plugin Information
Published: 2025/03/05, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- rsync
228225 - Linux Distros Unpatched Vulnerability : CVE-2024-13176
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low. The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue. (CVE-2024-13176)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-13176
https://ubuntu.com/security/CVE-2024-13176

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
4.1 (CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
3.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.2
EPSS Score
0.0006
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-13176

Plugin Information
Published: 2025/03/05, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- compat-openssl11
- openssl
- openssl-devel
- openssl-libs
- shim-x64
252700 - Linux Distros Unpatched Vulnerability : CVE-2024-13978
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.
(CVE-2024-13978)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-13978
https://security-tracker.debian.org/tracker/CVE-2024-13978
https://ubuntu.com/security/CVE-2024-13978

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v4.0 Base Score
2.0 (CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
5.0 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.7 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.7 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2024-13978

Plugin Information
Published: 2025/08/20, Modified: 2025/11/07
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libtiff
- libtiff-devel
227485 - Linux Distros Unpatched Vulnerability : CVE-2024-20994
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema).
Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-20994)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-20994
https://ubuntu.com/security/CVE-2024-20994

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0039
CVSS v2.0 Base Score
3.5 (CVSS2#AV:N/AC:M/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-20994

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
228151 - Linux Distros Unpatched Vulnerability : CVE-2024-20996
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-20996)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-20996
https://ubuntu.com/security/CVE-2024-20996

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0017
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-20996

Plugin Information
Published: 2025/03/05, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
228312 - Linux Distros Unpatched Vulnerability : CVE-2024-20998
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.
Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-20998)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-20998
https://ubuntu.com/security/CVE-2024-20998

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0018
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-20998

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
227675 - Linux Distros Unpatched Vulnerability : CVE-2024-21008
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.
Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21008)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21008
https://ubuntu.com/security/CVE-2024-21008

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
4.4 (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0027
CVSS v2.0 Base Score
3.5 (CVSS2#AV:N/AC:M/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21008

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
227533 - Linux Distros Unpatched Vulnerability : CVE-2024-21009
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.
Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21009)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21009
https://ubuntu.com/security/CVE-2024-21009

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0027
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21009

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
227834 - Linux Distros Unpatched Vulnerability : CVE-2024-21013
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.
Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21013)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21013
https://ubuntu.com/security/CVE-2024-21013

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
4.4 (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0027
CVSS v2.0 Base Score
3.5 (CVSS2#AV:N/AC:M/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21013

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
228284 - Linux Distros Unpatched Vulnerability : CVE-2024-21015
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.34 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. (CVE-2024-21015)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21015
https://ubuntu.com/security/CVE-2024-21015

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.2
EPSS Score
0.0027
CVSS v2.0 Base Score
5.5 (CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-21015

Plugin Information
Published: 2025/03/05, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
227937 - Linux Distros Unpatched Vulnerability : CVE-2024-21047
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21047)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21047
https://ubuntu.com/security/CVE-2024-21047

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0034
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21047

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
228084 - Linux Distros Unpatched Vulnerability : CVE-2024-21054
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.
Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21054)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21054
https://ubuntu.com/security/CVE-2024-21054

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0018
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21054

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
227491 - Linux Distros Unpatched Vulnerability : CVE-2024-21060
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Data Dictionary). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.
Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21060)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21060
https://ubuntu.com/security/CVE-2024-21060

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0018
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21060

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
227551 - Linux Distros Unpatched Vulnerability : CVE-2024-21062
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.
Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21062)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21062
https://ubuntu.com/security/CVE-2024-21062

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0034
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21062

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
227471 - Linux Distros Unpatched Vulnerability : CVE-2024-21069
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21069)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21069
https://ubuntu.com/security/CVE-2024-21069

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0034
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21069

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
227753 - Linux Distros Unpatched Vulnerability : CVE-2024-21087
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin).
Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21087)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21087
https://ubuntu.com/security/CVE-2024-21087

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0034
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21087

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
228206 - Linux Distros Unpatched Vulnerability : CVE-2024-21096
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. (CVE-2024-21096)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21096
https://ubuntu.com/security/CVE-2024-21096

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.2
EPSS Score
0.001
CVSS v2.0 Base Score
4.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21096

Plugin Information
Published: 2025/03/05, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
227590 - Linux Distros Unpatched Vulnerability : CVE-2024-21102
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.
Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21102)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21102
https://ubuntu.com/security/CVE-2024-21102

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.004
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21102

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
227905 - Linux Distros Unpatched Vulnerability : CVE-2024-21125
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21125)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21125
https://ubuntu.com/security/CVE-2024-21125

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0017
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21125

Plugin Information
Published: 2025/03/05, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
227960 - Linux Distros Unpatched Vulnerability : CVE-2024-21127
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21127)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21127
https://ubuntu.com/security/CVE-2024-21127

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0017
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21127

Plugin Information
Published: 2025/03/05, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
228043 - Linux Distros Unpatched Vulnerability : CVE-2024-21129
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21129)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21129
https://ubuntu.com/security/CVE-2024-21129

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0017
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21129

Plugin Information
Published: 2025/03/05, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
228253 - Linux Distros Unpatched Vulnerability : CVE-2024-21130
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.
Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21130)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21130
https://ubuntu.com/security/CVE-2024-21130

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0017
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21130

Plugin Information
Published: 2025/03/05, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
228256 - Linux Distros Unpatched Vulnerability : CVE-2024-21134
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection Handling).
Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. (CVE-2024-21134)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21134
https://ubuntu.com/security/CVE-2024-21134

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
4.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0022
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21134

Plugin Information
Published: 2025/03/05, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
227980 - Linux Distros Unpatched Vulnerability : CVE-2024-21135
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.
Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21135)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21135
https://ubuntu.com/security/CVE-2024-21135

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0017
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21135

Plugin Information
Published: 2025/03/05, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
227447 - Linux Distros Unpatched Vulnerability : CVE-2024-21142
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges).
Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21142)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21142
https://ubuntu.com/security/CVE-2024-21142

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0017
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21142

Plugin Information
Published: 2025/03/05, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
227758 - Linux Distros Unpatched Vulnerability : CVE-2024-21157
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21157)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21157
https://ubuntu.com/security/CVE-2024-21157

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0021
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21157

Plugin Information
Published: 2025/03/05, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
228003 - Linux Distros Unpatched Vulnerability : CVE-2024-21159
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21159)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21159
https://ubuntu.com/security/CVE-2024-21159

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0016
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21159

Plugin Information
Published: 2025/03/05, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
227786 - Linux Distros Unpatched Vulnerability : CVE-2024-21160
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21160)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21160
https://ubuntu.com/security/CVE-2024-21160

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0017
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21160

Plugin Information
Published: 2025/03/05, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
227897 - Linux Distros Unpatched Vulnerability : CVE-2024-21162
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.
Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21162)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21162
https://ubuntu.com/security/CVE-2024-21162

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0017
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21162

Plugin Information
Published: 2025/03/05, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
227711 - Linux Distros Unpatched Vulnerability : CVE-2024-21163
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.
Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. (CVE-2024-21163)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21163
https://ubuntu.com/security/CVE-2024-21163

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.2
EPSS Score
0.0017
CVSS v2.0 Base Score
5.5 (CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21163

Plugin Information
Published: 2025/03/05, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
227483 - Linux Distros Unpatched Vulnerability : CVE-2024-21165
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are 8.0.37 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21165)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21165
https://ubuntu.com/security/CVE-2024-21165

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0021
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21165

Plugin Information
Published: 2025/03/05, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
228267 - Linux Distros Unpatched Vulnerability : CVE-2024-21166
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21166)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21166
https://ubuntu.com/security/CVE-2024-21166

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.9 (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
5.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21166

Plugin Information
Published: 2025/03/05, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
227804 - Linux Distros Unpatched Vulnerability : CVE-2024-21171
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.
Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21171)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21171
https://ubuntu.com/security/CVE-2024-21171

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0025
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21171

Plugin Information
Published: 2025/03/05, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
227760 - Linux Distros Unpatched Vulnerability : CVE-2024-21173
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21173)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21173
https://ubuntu.com/security/CVE-2024-21173

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0017
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21173

Plugin Information
Published: 2025/03/05, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
227906 - Linux Distros Unpatched Vulnerability : CVE-2024-21177
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.
Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21177)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21177
https://ubuntu.com/security/CVE-2024-21177

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0023
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21177

Plugin Information
Published: 2025/03/05, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
227764 - Linux Distros Unpatched Vulnerability : CVE-2024-21179
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21179)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21179
https://ubuntu.com/security/CVE-2024-21179

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0012
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21179

Plugin Information
Published: 2025/03/05, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
227990 - Linux Distros Unpatched Vulnerability : CVE-2024-21185
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.38, 8.4.1 and 9.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21185)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21185
https://ubuntu.com/security/CVE-2024-21185

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0016
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21185

Plugin Information
Published: 2025/03/05, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
227685 - Linux Distros Unpatched Vulnerability : CVE-2024-21207
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.38 and prior, 8.4.1 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.
Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2024-21207)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21207
https://ubuntu.com/security/CVE-2024-21207

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.001
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21207

Plugin Information
Published: 2025/03/05, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
255435 - Linux Distros Unpatched Vulnerability : CVE-2024-21853
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Improper finite state machines (FSMs) in the hardware logic in some 4th and 5th Generation Intel(R) Xeon(R) Processors may allow an authorized user to potentially enable denial of service via local access.
(CVE-2024-21853)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21853
https://ubuntu.com/security/CVE-2024-21853

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-21853

Plugin Information
Published: 2025/08/26, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- microcode_ctl
227839 - Linux Distros Unpatched Vulnerability : CVE-2024-2193
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting speculative execution (related to Spectre V1) has been disclosed. An unauthenticated attacker can exploit this vulnerability to disclose arbitrary data from the CPU using race conditions to access the speculative executable code paths. (CVE-2024-2193)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-2193
https://security-tracker.debian.org/tracker/CVE-2024-2193
https://ubuntu.com/security/CVE-2024-2193

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.7 (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
5.4 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0231
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.2 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2024-2193

Plugin Information
Published: 2025/03/05, Modified: 2025/12/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228037 - Linux Distros Unpatched Vulnerability : CVE-2024-23196
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A race condition was found in the Linux kernel's sound/hda device driver in snd_hdac_regmap_sync() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue. (CVE-2024-23196)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-23196
https://ubuntu.com/security/CVE-2024-23196

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-23196

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228228 - Linux Distros Unpatched Vulnerability : CVE-2024-2397
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Due to a bug in packet data buffers management, the PPP printer in tcpdump can enter an infinite loop when reading a crafted DLT_PPP_SERIAL .pcap savefile. This problem does not affect any tcpdump release, but it affected the git master branch from 2023-06-05 to 2024-03-21. (CVE-2024-2397)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-2397

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.4 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.001
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-2397

Plugin Information
Published: 2025/03/05, Modified: 2025/09/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- tcpdump
228020 - Linux Distros Unpatched Vulnerability : CVE-2024-24855
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue. (CVE-2024-24855)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-24855
https://security-tracker.debian.org/tracker/CVE-2024-24855
https://ubuntu.com/security/CVE-2024-24855

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-24855

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227974 - Linux Distros Unpatched Vulnerability : CVE-2024-24968
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Improper finite state machines (FSMs) in hardware logic in some Intel(R) Processors may allow an privileged user to potentially enable a denial of service via local access. (CVE-2024-24968)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-24968
https://ubuntu.com/security/CVE-2024-24968

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.6 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0009
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-24968

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- microcode_ctl
257049 - Linux Distros Unpatched Vulnerability : CVE-2024-2511
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.
(CVE-2024-2511)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-2511
https://ubuntu.com/security/CVE-2024-2511

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0367
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-2511

Plugin Information
Published: 2025/08/27, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- compat-openssl11
227773 - Linux Distros Unpatched Vulnerability : CVE-2024-25260
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c. (CVE-2024-25260)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-25260
https://security-tracker.debian.org/tracker/CVE-2024-25260

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.0 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.6 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
2.2
EPSS Score
0.0006
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-25260

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- elfutils
- elfutils-default-yama-scope
- elfutils-devel
- elfutils-libelf
- elfutils-libelf-devel
- elfutils-libs
247354 - Linux Distros Unpatched Vulnerability : CVE-2024-25740
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A memory leak flaw was found in the UBI driver in drivers/mtd/ubi/attach.c in the Linux kernel through 6.7.4 for UBI_IOCATT, because kobj->name is not released. (CVE-2024-25740)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-25740
https://security-tracker.debian.org/tracker/CVE-2024-25740
https://ubuntu.com/security/CVE-2024-25740

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-25740

Plugin Information
Published: 2025/08/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228182 - Linux Distros Unpatched Vulnerability : CVE-2024-26595
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path When calling mlxsw_sp_acl_tcam_region_destroy() from an error path after failing to attach the region to an ACL group, we hit a NULL pointer dereference upon 'region->group->tcam' [1]. Fix by retrieving the 'tcam' pointer using mlxsw_sp_acl_to_tcam(). [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] RIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0 [...] Call Trace:
mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b (CVE-2024-26595)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26595
https://security-tracker.debian.org/tracker/CVE-2024-26595
https://ubuntu.com/security/CVE-2024-26595

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0009
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26595

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227911 - Linux Distros Unpatched Vulnerability : CVE-2024-26637
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: rely on mac80211 debugfs handling for vif mac80211 started to delete debugfs entries in certain cases, causing a ath11k to crash when it tried to delete the entries later. Fix this by relying on mac80211 to delete the entries when appropriate and adding them from the vif_add_debugfs handler. (CVE-2024-26637)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26637
https://ubuntu.com/security/CVE-2024-26637

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-26637

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227648 - Linux Distros Unpatched Vulnerability : CVE-2024-26647
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/amd/display: Fix late derefrence 'dsc' check in 'link_set_dsc_pps_packet()' In link_set_dsc_pps_packet(), 'struct display_stream_compressor *dsc' was dereferenced in a DC_LOGGER_INIT(dsc->ctx->logger); before the 'dsc' NULL pointer check. Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/link/link_dpms.c:905 link_set_dsc_pps_packet() warn: variable dereferenced before check 'dsc' (see line 903) (CVE-2024-26647)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26647
https://ubuntu.com/security/CVE-2024-26647

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26647

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228071 - Linux Distros Unpatched Vulnerability : CVE-2024-26648
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/amd/display: Fix variable deferencing before NULL check in edp_setup_replay() In edp_setup_replay(), 'struct dc *dc' & 'struct dmub_replay *replay' was dereferenced before the pointer 'link' & 'replay' NULL check. Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_edp_panel_control.c:947 edp_setup_replay() warn: variable dereferenced before check 'link' (see line 933) (CVE-2024-26648)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26648
https://ubuntu.com/security/CVE-2024-26648

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0007
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26648

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228287 - Linux Distros Unpatched Vulnerability : CVE-2024-26659
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xhci: handle isoc Babble and Buffer Overrun events properly xHCI 4.9 explicitly forbids assuming that the xHC has released its ownership of a multi-TRB TD when it reports an error on one of the early TRBs. Yet the driver makes such assumption and releases the TD, allowing the remaining TRBs to be freed or overwritten by new TDs. The xHC should also report completion of the final TRB due to its IOC flag being set by us, regardless of prior errors. This event cannot be recognized if the TD has already been freed earlier, resulting in Transfer event TRB DMA ptr not part of current TD error message. Fix this by reusing the logic for processing isoc Transaction Errors. This also handles hosts which fail to report the final completion. Fix transfer length reporting on Babble errors. They may be caused by device malfunction, no guarantee that the buffer has been filled. (CVE-2024-26659)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26659
https://ubuntu.com/security/CVE-2024-26659

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26659

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248335 - Linux Distros Unpatched Vulnerability : CVE-2024-26682
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: improve CSA/ECSA connection refusal As mentioned in the previous commit, we pretty quickly found that some APs have ECSA elements stuck in their probe response, so using that to not attempt to connect while CSA is happening we never connect to such an AP. Improve this situation by checking more carefully and ignoring the ECSA if cfg80211 has previously detected the ECSA element being stuck in the probe response. Additionally, allow connecting to an AP that's switching to a channel it's already using, unless it's using quiet mode. In this case, we may just have to adjust bandwidth later. If it's actually switching channels, it's better not to try to connect in the middle of that. (CVE-2024-26682)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26682
https://ubuntu.com/security/CVE-2024-26682

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-26682

Plugin Information
Published: 2025/08/11, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246172 - Linux Distros Unpatched Vulnerability : CVE-2024-26683
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: detect stuck ECSA element in probe resp We recently added some validation that we don't try to connect to an AP that is currently in a channel switch process, since that might want the channel to be quiet or we might not be able to connect in time to hear the switching in a beacon. This was in commit c09c4f31998b (wifi:
mac80211: don't connect to an AP while it's in a CSA process). However, we promptly got a report that this caused new connection failures, and it turns out that the AP that we now cannot connect to is permanently advertising an extended channel switch announcement, even with quiet. The AP in question was an Asus RT-AC53, with firmware 3.0.0.4.380_10760-g21a5898. As a first step, attempt to detect that we're dealing with such a situation, so mac80211 can use this later. (CVE-2024-26683)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26683
https://ubuntu.com/security/CVE-2024-26683

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-26683

Plugin Information
Published: 2025/08/08, Modified: 2025/09/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227896 - Linux Distros Unpatched Vulnerability : CVE-2024-26687
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xen/events: close evtchn after mapping cleanup shutdown_pirq and startup_pirq are not taking the irq_mapping_update_lock because they can't due to lock inversion. Both are called with the irq_desc->lock being taking. The lock order, however, is first irq_mapping_update_lock and then irq_desc->lock. This opens multiple races: - shutdown_pirq can be interrupted by a function that allocates an event channel:
CPU0 CPU1 shutdown_pirq { xen_evtchn_close(e) __startup_pirq { EVTCHNOP_bind_pirq -> returns just freed evtchn e set_evtchn_to_irq(e, irq) } xen_irq_info_cleanup() { set_evtchn_to_irq(e, -1) } } Assume here event channel e refers here to the same event channel number. After this race the evtchn_to_irq mapping for e is invalid (-1). - __startup_pirq races with __unbind_from_irq in a similar way. Because
__startup_pirq doesn't take irq_mapping_update_lock it can grab the evtchn that __unbind_from_irq is currently freeing and cleaning up. In this case even though the event channel is allocated, its mapping can be unset in evtchn_to_irq. The fix is to first cleanup the mappings and then close the event channel.
In this way, when an event channel gets allocated it's potential previous evtchn_to_irq mappings are guaranteed to be unset already. This is also the reverse order of the allocation where first the event channel is allocated and then the mappings are setup. On a 5.10 kernel prior to commit 3fcdaf3d7634 (xen/events: modify internal [un]bind interfaces), we hit a BUG like the following during probing of NVMe devices. The issue is that during nvme_setup_io_queues, pci_free_irq is called for every device which results in a call to shutdown_pirq. With many nvme devices it's therefore likely to hit this race during boot because there will be multiple calls to shutdown_pirq and startup_pirq are running potentially in parallel. ------------[ cut here ]------------ blkfront: xvda: barrier or flush: disabled; persistent grants: enabled; indirect descriptors: enabled; bounce buffer: enabled kernel BUG at drivers/xen/events/events_base.c:499! invalid opcode: 0000 [#1] SMP PTI CPU: 44 PID: 375 Comm:
kworker/u257:23 Not tainted 5.10.201-191.748.amzn2.x86_64 #1 Hardware name: Xen HVM domU, BIOS 4.11.amazon 08/24/2006 Workqueue: nvme-reset-wq nvme_reset_work RIP: 0010:bind_evtchn_to_cpu+0xdf/0xf0 Code: 5d 41 5e c3 cc cc cc cc 44 89 f7 e8 2b 55 ad ff 49 89 c5 48 85 c0 0f 84 64 ff ff ff 4c 8b 68 30 41 83 fe ff 0f 85 60 ff ff ff <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 0f 1f 44 00 00 RSP: 0000:ffffc9000d533b08 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000006 RDX: 0000000000000028 RSI: 00000000ffffffff RDI: 00000000ffffffff RBP: ffff888107419680 R08: 0000000000000000 R09:
ffffffff82d72b00 R10: 0000000000000000 R11: 0000000000000000 R12: 00000000000001ed R13: 0000000000000000 R14: 00000000ffffffff R15: 0000000000000002 FS: 0000000000000000(0000) GS:ffff88bc8b500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3:
0000000002610001 CR4: 00000000001706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? show_trace_log_lvl+0x1c1/0x2d9 ? show_trace_log_lvl+0x1c1/0x2d9 ? set_affinity_irq+0xdc/0x1c0 ?
__die_body.cold+0x8/0xd ? die+0x2b/0x50 ? do_trap+0x90/0x110 ? bind_evtchn_to_cpu+0xdf/0xf0 ? do_error_trap+0x65/0x80 ? bind_evtchn_to_cpu+0xdf/0xf0 ? exc_invalid_op+0x4e/0x70 ? bind_evtchn_to_cpu+0xdf/0xf0 ? asm_exc_invalid_op+0x12/0x20 ? bind_evtchn_to_cpu+0xdf/0x ---truncated--- (CVE-2024-26687)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26687
https://ubuntu.com/security/CVE-2024-26687

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26687

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228188 - Linux Distros Unpatched Vulnerability : CVE-2024-26695
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked The SEV platform device can be shutdown with a null psp_master, e.g., using DEBUG_TEST_DRIVER_REMOVE. Found using KASAN: [ 137.148210] ccp 0000:23:00.1:
enabling device (0000 -> 0002) [ 137.162647] ccp 0000:23:00.1: no command queues available [ 137.170598] ccp 0000:23:00.1: sev enabled [ 137.174645] ccp 0000:23:00.1: psp enabled [ 137.178890] general protection fault, probably for non-canonical address 0xdffffc000000001e: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN NOPTI [ 137.182693] KASAN: null-ptr-deref in range [0x00000000000000f0-0x00000000000000f7] [ 137.182693] CPU: 93 PID: 1 Comm: swapper/0 Not tainted 6.8.0-rc1+ #311 [ 137.182693] RIP:
0010:__sev_platform_shutdown_locked+0x51/0x180 [ 137.182693] Code: 08 80 3c 08 00 0f 85 0e 01 00 00 48 8b 1d 67 b6 01 08 48 b8 00 00 00 00 00 fc ff df 48 8d bb f0 00 00 00 48 89 f9 48 c1 e9 03 <80> 3c 01 00 0f 85 fe 00 00 00 48 8b 9b f0 00 00 00 48 85 db 74 2c [ 137.182693] RSP: 0018:ffffc900000cf9b0 EFLAGS: 00010216 [ 137.182693] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 000000000000001e [ 137.182693] RDX:
0000000000000000 RSI: 0000000000000008 RDI: 00000000000000f0 [ 137.182693] RBP: ffffc900000cf9c8 R08:
0000000000000000 R09: fffffbfff58f5a66 [ 137.182693] R10: ffffc900000cf9c8 R11: ffffffffac7ad32f R12:
ffff8881e5052c28 [ 137.182693] R13: ffff8881e5052c28 R14: ffff8881758e43e8 R15: ffffffffac64abf8 [ 137.182693] FS: 0000000000000000(0000) GS:ffff889de7000000(0000) knlGS:0000000000000000 [ 137.182693] CS:
0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 137.182693] CR2: 0000000000000000 CR3: 0000001cf7c7e000 CR4: 0000000000350ef0 [ 137.182693] Call Trace: [ 137.182693] <TASK> [ 137.182693] ? show_regs+0x6c/0x80 [ 137.182693] ? __die_body+0x24/0x70 [ 137.182693] ? die_addr+0x4b/0x80 [ 137.182693] ? exc_general_protection+0x126/0x230 [ 137.182693] ? asm_exc_general_protection+0x2b/0x30 [ 137.182693] ?
__sev_platform_shutdown_locked+0x51/0x180 [ 137.182693] sev_firmware_shutdown.isra.0+0x1e/0x80 [ 137.182693] sev_dev_destroy+0x49/0x100 [ 137.182693] psp_dev_destroy+0x47/0xb0 [ 137.182693] sp_destroy+0xbb/0x240 [ 137.182693] sp_pci_remove+0x45/0x60 [ 137.182693] pci_device_remove+0xaa/0x1d0 [ 137.182693] device_remove+0xc7/0x170 [ 137.182693] really_probe+0x374/0xbe0 [ 137.182693] ? srso_return_thunk+0x5/0x5f [ 137.182693] __driver_probe_device+0x199/0x460 [ 137.182693] driver_probe_device+0x4e/0xd0 [ 137.182693] __driver_attach+0x191/0x3d0 [ 137.182693] ?
__pfx___driver_attach+0x10/0x10 [ 137.182693] bus_for_each_dev+0x100/0x190 [ 137.182693] ?
__pfx_bus_for_each_dev+0x10/0x10 [ 137.182693] ? __kasan_check_read+0x15/0x20 [ 137.182693] ? srso_return_thunk+0x5/0x5f [ 137.182693] ? _raw_spin_unlock+0x27/0x50 [ 137.182693] driver_attach+0x41/0x60 [ 137.182693] bus_add_driver+0x2a8/0x580 [ 137.182693] driver_register+0x141/0x480 [ 137.182693] __pci_register_driver+0x1d6/0x2a0 [ 137.182693] ? srso_return_thunk+0x5/0x5f [ 137.182693] ? esrt_sysfs_init+0x1cd/0x5d0 [ 137.182693] ? __pfx_sp_mod_init+0x10/0x10 [ 137.182693] sp_pci_init+0x22/0x30 [ 137.182693] sp_mod_init+0x14/0x30 [ 137.182693] ? __pfx_sp_mod_init+0x10/0x10 [ 137.182693] do_one_initcall+0xd1/0x470 [ 137.182693] ? __pfx_do_one_initcall+0x10/0x10 [ 137.182693] ? parameq+0x80/0xf0 [ 137.182693] ? srso_return_thunk+0x5/0x5f [ 137.182693] ? __kmalloc+0x3b0/0x4e0 [ 137.182693] ? kernel_init_freeable+0x92d/0x1050 [ 137.182693] ? kasan_populate_vmalloc_pte+0x171/0x190 [ 137.182693] ? srso_return_thunk+0x5/0x5f [ 137.182693] kernel_init_freeable+0xa64/0x1050 [ 137.182693] ?
__pfx_kernel_init+0x10/0x10 [ 137.182693] kernel_init+0x24/0x160 [ 137.182693] ? __switch_to_asm+0x3e/0x70 [ 137.182693] ret_from_fork+0x40/0x80 [ 137.182693] ? __pfx_kernel_init+0x1 ---truncated--- (CVE-2024-26695)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26695
https://ubuntu.com/security/CVE-2024-26695

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0009
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26695

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227620 - Linux Distros Unpatched Vulnerability : CVE-2024-26698
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove In commit ac5047671758 (hv_netvsc: Disable NAPI before closing the VMBus channel), napi_disable was getting called for all channels, including all subchannels without confirming if they are enabled or not. This caused hv_netvsc getting hung at napi_disable, when netvsc_probe() has finished running but nvdev->subchan_work has not started yet. netvsc_subchan_work() ->
rndis_set_subchannel() has not created the sub-channels and because of that netvsc_sc_open() is not running. netvsc_remove() calls cancel_work_sync(&nvdev->subchan_work), for which netvsc_subchan_work did not run. netif_napi_add() sets the bit NAPI_STATE_SCHED because it ensures NAPI cannot be scheduled. Then netvsc_sc_open() -> napi_enable will clear the NAPIF_STATE_SCHED bit, so it can be scheduled.
napi_disable() does the opposite. Now during netvsc_device_remove(), when napi_disable is called for those subchannels, napi_disable gets stuck on infinite msleep. This fix addresses this problem by ensuring that napi_disable() is not getting called for non-enabled NAPI struct. But netif_napi_del() is still necessary for these non-enabled NAPI struct for cleanup purpose. Call trace: [ 654.559417] task:modprobe state:D stack: 0 pid: 2321 ppid: 1091 flags:0x00004002 [ 654.568030] Call Trace: [ 654.571221] <TASK> [ 654.573790] __schedule+0x2d6/0x960 [ 654.577733] schedule+0x69/0xf0 [ 654.581214] schedule_timeout+0x87/0x140 [ 654.585463] ? __bpf_trace_tick_stop+0x20/0x20 [ 654.590291] msleep+0x2d/0x40 [ 654.593625] napi_disable+0x2b/0x80 [ 654.597437] netvsc_device_remove+0x8a/0x1f0 [hv_netvsc] [ 654.603935] rndis_filter_device_remove+0x194/0x1c0 [hv_netvsc] [ 654.611101] ? do_wait_intr+0xb0/0xb0 [ 654.615753] netvsc_remove+0x7c/0x120 [hv_netvsc] [ 654.621675] vmbus_remove+0x27/0x40 [hv_vmbus] (CVE-2024-26698)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26698
https://ubuntu.com/security/CVE-2024-26698

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26698

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228299 - Linux Distros Unpatched Vulnerability : CVE-2024-26714
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- interconnect: qcom: sc8180x: Mark CO0 BCM keepalive The CO0 BCM needs to be up at all times, otherwise some hardware (like the UFS controller) loses its connection to the rest of the SoC, resulting in a hang of the platform, accompanied by a spectacular logspam. Mark it as keepalive to prevent such cases.
(CVE-2024-26714)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26714
https://ubuntu.com/security/CVE-2024-26714

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26714

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228196 - Linux Distros Unpatched Vulnerability : CVE-2024-26715
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: dwc3: gadget: Fix NULL pointer dereference in dwc3_gadget_suspend In current scenario if Plug-out and Plug-In performed continuously there could be a chance while checking for dwc->gadget_driver in dwc3_gadget_suspend, a NULL pointer dereference may occur. Call Stack: CPU1: CPU2: gadget_unbind_driver dwc3_suspend_common dwc3_gadget_stop dwc3_gadget_suspend dwc3_disconnect_gadget CPU1 basically clears the variable and CPU2 checks the variable. Consider CPU1 is running and right before gadget_driver is cleared and in parallel CPU2 executes dwc3_gadget_suspend where it finds dwc->gadget_driver which is not NULL and resumes execution and then CPU1 completes execution. CPU2 executes dwc3_disconnect_gadget where it checks dwc->gadget_driver is already NULL because of which the NULL pointer deference occur. (CVE-2024-26715)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26715
https://security-tracker.debian.org/tracker/CVE-2024-26715
https://ubuntu.com/security/CVE-2024-26715

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0008
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26715

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228248 - Linux Distros Unpatched Vulnerability : CVE-2024-26721
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/i915/dsc: Fix the macro that calculates DSCC_/DSCA_ PPS reg address Commit bd077259d0a9 (drm/i915/vdsc: Add function to read any PPS register) defines a new macro to calculate the DSC PPS register addresses with PPS number as an input.
This macro correctly calculates the addresses till PPS 11 since the addresses increment by 4. So in that case the following macro works correctly to give correct register address: _MMIO(_DSCA_PPS_0 + (pps) * 4) However after PPS 11, the register address for PPS 12 increments by 12 because of RC Buffer memory allocation in between. Because of this discontinuity in the address space, the macro calculates wrong addresses for PPS 12 - 16 resulting into incorrect DSC PPS parameter value read/writes causing DSC corruption. This fixes it by correcting this macro to add the offset of 12 for PPS >=12. v3: Add correct paranthesis for pps argument (Jani Nikula) (cherry picked from commit 6074be620c31dc2ae11af96a1a5ea95580976fb5) (CVE-2024-26721)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26721
https://ubuntu.com/security/CVE-2024-26721

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-26721

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245169 - Linux Distros Unpatched Vulnerability : CVE-2024-26751
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ARM: ep93xx: Add terminator to gpiod_lookup_table Without the terminator, if a con_id is passed to gpio_find() that does not exist in the lookup table the function will not stop looping correctly, and eventually cause an oops. (CVE-2024-26751)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26751
https://ubuntu.com/security/CVE-2024-26751

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26751

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227484 - Linux Distros Unpatched Vulnerability : CVE-2024-26760
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: scsi: target: pscsi: Fix bio_put() for error case As of commit 066ff571011d (block: turn bio_kmalloc into a simple kmalloc wrapper), a bio allocated by bio_kmalloc() must be freed by bio_uninit() and kfree(). That is not done properly for the error case, hitting WARN and NULL pointer dereference in bio_free(). (CVE-2024-26760)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26760
https://ubuntu.com/security/CVE-2024-26760

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0009
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-26760

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228251 - Linux Distros Unpatched Vulnerability : CVE-2024-26769
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nvmet-fc: avoid deadlock on delete association path When deleting an association the shutdown path is deadlocking because we try to flush the nvmet_wq nested. Avoid this by deadlock by deferring the put work into its own work item. (CVE-2024-26769)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26769
https://security-tracker.debian.org/tracker/CVE-2024-26769
https://ubuntu.com/security/CVE-2024-26769

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.4 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0009
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26769

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227708 - Linux Distros Unpatched Vulnerability : CVE-2024-26771
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dmaengine: ti: edma: Add some null pointer checks to the edma_probe devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity. (CVE-2024-26771)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26771
https://ubuntu.com/security/CVE-2024-26771

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0012
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26771

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227916 - Linux Distros Unpatched Vulnerability : CVE-2024-26775
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- aoe: avoid potential deadlock at set_capacity Move set_capacity() outside of the section procected by (&d->lock). To avoid possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- [1] lock(&bdev->bd_size_lock); local_irq_disable(); [2] lock(&d->lock); [3] lock(&bdev->bd_size_lock);
<Interrupt> [4] lock(&d->lock); *** DEADLOCK *** Where [1](&bdev->bd_size_lock) hold by zram_add()->set_capacity(). [2]lock(&d->lock) hold by aoeblk_gdalloc(). And aoeblk_gdalloc() is trying to acquire [3](&bdev->bd_size_lock) at set_capacity() call. In this situation an attempt to acquire [4]lock(&d->lock) from aoecmd_cfg_rsp() will lead to deadlock. So the simplest solution is breaking lock dependency [2](&d->lock) -> [3](&bdev->bd_size_lock) by moving set_capacity() outside. (CVE-2024-26775)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26775
https://security-tracker.debian.org/tracker/CVE-2024-26775
https://ubuntu.com/security/CVE-2024-26775

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26775

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228229 - Linux Distros Unpatched Vulnerability : CVE-2024-26776
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected Return IRQ_NONE from the interrupt handler when no interrupt was detected. Because an empty interrupt will cause a null pointer error: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Call trace:
complete+0x54/0x100 hisi_sfc_v3xx_isr+0x2c/0x40 [spi_hisi_sfc_v3xx] __handle_irq_event_percpu+0x64/0x1e0 handle_irq_event+0x7c/0x1cc (CVE-2024-26776)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26776
https://ubuntu.com/security/CVE-2024-26776

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0009
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26776

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227661 - Linux Distros Unpatched Vulnerability : CVE-2024-26779
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: mac80211: fix race condition on enabling fast-xmit fast-xmit must only be enabled after the sta has been uploaded to the driver, otherwise it could end up passing the not-yet-uploaded sta via drv_tx calls to the driver, leading to potential crashes because of uninitialized drv_priv data. Add a missing sta->uploaded check and re-check fast xmit after inserting a sta. (CVE-2024-26779)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26779
https://ubuntu.com/security/CVE-2024-26779

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26779

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243898 - Linux Distros Unpatched Vulnerability : CVE-2024-26816
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- x86, relocs: Ignore relocations in .notes section When building with CONFIG_XEN_PV=y, .text symbols are emitted into the .notes section so that Xen can find the startup_xen entry point. This information is used prior to booting the kernel, so relocations are not useful. In fact, performing relocations against the .notes section means that the KASLR base is exposed since /sys/kernel/notes is world-readable. To avoid leaking the KASLR base without breaking unprivileged tools that are expecting to read /sys/kernel/notes, skip performing relocations in the .notes section. The values readable in .notes are then identical to those found in System.map. (CVE-2024-26816)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26816
https://ubuntu.com/security/CVE-2024-26816

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0037
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26816

Plugin Information
Published: 2025/08/05, Modified: 2025/11/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248397 - Linux Distros Unpatched Vulnerability : CVE-2024-26818
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tools/rtla: Fix clang warning about mount_point var size clang is reporting this warning: $ make HOSTCC=clang CC=clang LLVM_IAS=1 [...] clang
-O -g -DVERSION=\6.8.0-rc3\ -flto=auto -fexceptions -fstack-protector-strong -fasynchronous-unwind- tables -fstack-clash-protection -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2
-Wp,-D_GLIBCXX_ASSERTIONS $(pkg-config --cflags libtracefs) -c -o src/utils.o src/utils.c src/utils.c:548:66: warning: 'fscanf' may overflow; destination buffer in argument 3 has size 1024, but the corresponding specifier may require size 1025 [-Wfortify-source] 548 | while (fscanf(fp, %*s % STR(MAX_PATH) s %99s %*s %*d %*d , mount_point, type) == 2) { | ^ Increase mount_point variable size to MAX_PATH+1 to avoid the overflow. (CVE-2024-26818)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26818
https://ubuntu.com/security/CVE-2024-26818

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0016
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-26818

Plugin Information
Published: 2025/08/11, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227558 - Linux Distros Unpatched Vulnerability : CVE-2024-26820
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed If hv_netvsc driver is unloaded and reloaded, the NET_DEVICE_REGISTER handler cannot perform VF register successfully as the register call is received before netvsc_probe is finished. This is because we register register_netdevice_notifier() very early( even before vmbus_driver_register()). To fix this, we try to register each such matching VF( if it is visible as a netdevice) at the end of netvsc_probe. (CVE-2024-26820)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26820
https://ubuntu.com/security/CVE-2024-26820

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0037
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-26820

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228230 - Linux Distros Unpatched Vulnerability : CVE-2024-26844
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- block: Fix WARNING in _copy_from_iter Syzkaller reports a warning in _copy_from_iter because an iov_iter is supposedly used in the wrong direction. The reason is that syzcaller managed to generate a request with a transfer direction of SG_DXFER_TO_FROM_DEV. This instructs the kernel to copy user buffers into the kernel, read into the copied buffers and then copy the data back to user space. Thus the iovec is used in both directions. Detect this situation in the block layer and construct a new iterator with the correct direction for the copy-in. (CVE-2024-26844)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26844
https://security-tracker.debian.org/tracker/CVE-2024-26844
https://ubuntu.com/security/CVE-2024-26844

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0018
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26844

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227876 - Linux Distros Unpatched Vulnerability : CVE-2024-26845
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: target: core: Add TMF to tmr_list handling An abort that is responded to by iSCSI itself is added to tmr_list but does not go to target core. A LUN_RESET that goes through tmr_list takes a refcounter on the abort and waits for completion. However, the abort will be never complete because it was not started in target core. Unable to locate ITT: 0x05000000 on CID: 0 Unable to locate RefTaskTag: 0x05000000 on CID: 0.
wait_for_tasks: Stopping tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop wait for tasks: tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop ... INFO: task kworker/0:2:49 blocked for more than 491 seconds. task:kworker/0:2 state:D stack: 0 pid: 49 ppid: 2 flags:0x00000800 Workqueue: events target_tmr_work [target_core_mod] Call Trace: __switch_to+0x2c4/0x470
_schedule+0x314/0x1730 schedule+0x64/0x130 schedule_timeout+0x168/0x430 wait_for_completion+0x140/0x270 target_put_cmd_and_wait+0x64/0xb0 [target_core_mod] core_tmr_lun_reset+0x30/0xa0 [target_core_mod] target_tmr_work+0xc8/0x1b0 [target_core_mod] process_one_work+0x2d4/0x5d0 worker_thread+0x78/0x6c0 To fix this, only add abort to tmr_list if it will be handled by target core. (CVE-2024-26845)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26845
https://ubuntu.com/security/CVE-2024-26845

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0037
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26845

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227593 - Linux Distros Unpatched Vulnerability : CVE-2024-26851
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfilter: nf_conntrack_h323: Add protection for bmp length out of range UBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts that are out of bounds for their data type. vmlinux get_bitmap(b=75) + 712 <net/netfilter/nf_conntrack_h323_asn1.c:0> vmlinux decode_seq(bs=0xFFFFFFD008037000, f=0xFFFFFFD008037018, level=134443100) + 1956 <net/netfilter/nf_conntrack_h323_asn1.c:592> vmlinux decode_choice(base=0xFFFFFFD0080370F0, level=23843636) + 1216 <net/netfilter/nf_conntrack_h323_asn1.c:814> vmlinux decode_seq(f=0xFFFFFFD0080371A8, level=134443500) + 812 <net/netfilter/nf_conntrack_h323_asn1.c:576>
vmlinux decode_choice(base=0xFFFFFFD008037280, level=0) + 1216 <net/netfilter/nf_conntrack_h323_asn1.c:814> vmlinux DecodeRasMessage() + 304 <net/netfilter/nf_conntrack_h323_asn1.c:833> vmlinux ras_help() + 684 <net/netfilter/nf_conntrack_h323_main.c:1728> vmlinux nf_confirm() + 188 <net/netfilter/nf_conntrack_proto.c:137> Due to abnormal data in skb->data, the extension bitmap length exceeds 32 when decoding ras message then uses the length to make a shift operation. It will change into negative after several loop. UBSAN load could detect a negative shift as an undefined behaviour and reports exception. So we add the protection to avoid the length exceeding 32. Or else it will return out of range error and stop decoding. (CVE-2024-26851)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26851
https://ubuntu.com/security/CVE-2024-26851

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0037
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26851

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228286 - Linux Distros Unpatched Vulnerability : CVE-2024-26859
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/bnx2x: Prevent access to a freed page in page_pool Fix race condition leading to system crash during EEH error handling During EEH error recovery, the bnx2x driver's transmit timeout logic could cause a race condition when handling reset tasks. The bnx2x_tx_timeout() schedules reset tasks via bnx2x_sp_rtnl_task(), which ultimately leads to bnx2x_nic_unload(). In bnx2x_nic_unload() SGEs are freed using bnx2x_free_rx_sge_range(). However, this could overlap with the EEH driver's attempt to reset the device using bnx2x_io_slot_reset(), which also tries to free SGEs. This race condition can result in system crashes due to accessing freed memory locations in bnx2x_free_rx_sge() 799 static inline void bnx2x_free_rx_sge(struct bnx2x *bp, 800 struct bnx2x_fastpath *fp, u16 index) 801 { 802 struct sw_rx_page
*sw_buf = &fp->rx_page_ring[index]; 803 struct page *page = sw_buf->page; .... where sw_buf was set to NULL after the call to dma_unmap_page() by the preceding thread. EEH: Beginning: 'slot_reset' PCI 0011:01:00.0#10000: EEH: Invoking bnx2x->slot_reset() bnx2x: [bnx2x_io_slot_reset:14228(eth1)]IO slot reset initializing... bnx2x 0011:01:00.0: enabling device (0140 -> 0142) bnx2x:
[bnx2x_io_slot_reset:14244(eth1)]IO slot reset --> driver unload Kernel attempted to read user page (0) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x00000000 Faulting instruction address: 0xc0080000025065fc Oops: Kernel access of bad area, sig: 11 [#1] ..... Call Trace:
[c000000003c67a20] [c00800000250658c] bnx2x_io_slot_reset+0x204/0x610 [bnx2x] (unreliable) [c000000003c67af0] [c0000000000518a8] eeh_report_reset+0xb8/0xf0 [c000000003c67b60] [c000000000052130] eeh_pe_report+0x180/0x550 [c000000003c67c70] [c00000000005318c] eeh_handle_normal_event+0x84c/0xa60 [c000000003c67d50] [c000000000053a84] eeh_event_handler+0xf4/0x170 [c000000003c67da0] [c000000000194c58] kthread+0x1c8/0x1d0 [c000000003c67e10] [c00000000000cf64] ret_from_kernel_thread+0x5c/0x64 To solve this issue, we need to verify page pool allocations before freeing. (CVE-2024-26859)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26859
https://ubuntu.com/security/CVE-2024-26859

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.1 (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
3.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26859

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228300 - Linux Distros Unpatched Vulnerability : CVE-2024-26891
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected For those endpoint devices connect to system via hotplug capable ports, users could request a hot reset to the device by flapping device's link through setting the slot's link control register, as pciehp_ist() DLLSC interrupt sequence response, pciehp will unload the device driver and then power it off. thus cause an IOMMU device-TLB invalidation (Intel VT-d spec, or ATS Invalidation in PCIe spec r6.1) request for non-existence target device to be sent and deadly loop to retry that request after ITE fault triggered in interrupt context. That would cause following continuous hard lockup warning and system hang [ 4211.433662] pcieport 0000:17:01.0: pciehp: Slot(108): Link Down [ 4211.433664] pcieport 0000:17:01.0: pciehp: Slot(108): Card not present [ 4223.822591] NMI watchdog:
Watchdog detected hard LOCKUP on cpu 144 [ 4223.822622] CPU: 144 PID: 1422 Comm: irq/57-pciehp Kdump:
loaded Tainted: G S OE kernel version xxxx [ 4223.822623] Hardware name: vendorname xxxx 666-106, BIOS 01.01.02.03.01 05/15/2023 [ 4223.822623] RIP: 0010:qi_submit_sync+0x2c0/0x490 [ 4223.822624] Code: 48 be 00 00 00 00 00 08 00 00 49 85 74 24 20 0f 95 c1 48 8b 57 10 83 c1 04 83 3c 1a 03 0f 84 a2 01 00 00 49 8b 04 24 8b 70 34 <40> f6 c6 1 0 74 17 49 8b 04 24 8b 80 80 00 00 00 89 c2 d3 fa 41 39 [ 4223.822624] RSP:
0018:ffffc4f074f0bbb8 EFLAGS: 00000093 [ 4223.822625] RAX: ffffc4f040059000 RBX: 0000000000000014 RCX:
0000000000000005 [ 4223.822625] RDX: ffff9f3841315800 RSI: 0000000000000000 RDI: ffff9f38401a8340 [ 4223.822625] RBP: ffff9f38401a8340 R08: ffffc4f074f0bc00 R09: 0000000000000000 [ 4223.822626] R10:
0000000000000010 R11: 0000000000000018 R12: ffff9f384005e200 [ 4223.822626] R13: 0000000000000004 R14:
0000000000000046 R15: 0000000000000004 [ 4223.822626] FS: 0000000000000000(0000) GS:ffffa237ae400000(0000) knlGS:0000000000000000 [ 4223.822627] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4223.822627] CR2:
00007ffe86515d80 CR3: 000002fd3000a001 CR4: 0000000000770ee0 [ 4223.822627] DR0: 0000000000000000 DR1:
0000000000000000 DR2: 0000000000000000 [ 4223.822628] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7:
0000000000000400 [ 4223.822628] PKRU: 55555554 [ 4223.822628] Call Trace: [ 4223.822628] qi_flush_dev_iotlb+0xb1/0xd0 [ 4223.822628] __dmar_remove_one_dev_info+0x224/0x250 [ 4223.822629] dmar_remove_one_dev_info+0x3e/0x50 [ 4223.822629] intel_iommu_release_device+0x1f/0x30 [ 4223.822629] iommu_release_device+0x33/0x60 [ 4223.822629] iommu_bus_notifier+0x7f/0x90 [ 4223.822630] blocking_notifier_call_chain+0x60/0x90 [ 4223.822630] device_del+0x2e5/0x420 [ 4223.822630] pci_remove_bus_device+0x70/0x110 [ 4223.822630] pciehp_unconfigure_device+0x7c/0x130 [ 4223.822631] pciehp_disable_slot+0x6b/0x100 [ 4223.822631] pciehp_handle_presence_or_link_change+0xd8/0x320 [ 4223.822631] pciehp_ist+0x176/0x180 [ 4223.822631] ? irq_finalize_oneshot.part.50+0x110/0x110 [ 4223.822632] irq_thread_fn+0x19/0x50 [ 4223.822632] irq_thread+0x104/0x190 [ 4223.822632] ? irq_forced_thread_fn+0x90/0x90 [ 4223.822632] ? irq_thread_check_affinity+0xe0/0xe0 [ 4223.822633] kthread+0x114/0x130 [ 4223.822633] ? __kthread_cancel_work+0x40/0x40 [ 4223.822633] ret_from_fork+0x1f/0x30 [ 4223.822633] Kernel panic - not syncing: Hard LOCKUP [ 4223.822634] CPU: 144 PID: 1422 Comm: irq/57-pciehp Kdump: loaded Tainted: G S OE kernel version xxxx [ 4223.822634] Hardware name: vendorname xxxx 666-106, BIOS 01.01.02.03.01 05/15/2023 [ 4223.822634] Call Trace: [ 4223.822634] <NMI> [ 4223.822635] dump_stack+0x6d/0x88 [ 4223.822635] panic+0x101/0x2d0 [ 4223.822635] ? ret_from_fork+0x11/0x30 [ 4223.822635] nmi_panic.cold.14+0xc/0xc [ 4223.822636] watchdog_overflow_callback.cold.8+0x6d/0x81 [ 4223.822636] __perf_event_overflow+0x4f/0xf0 [ 4223.822636] handle_pmi_common ---truncated--- (CVE-2024-26891)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26891
https://ubuntu.com/security/CVE-2024-26891

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26891

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227930 - Linux Distros Unpatched Vulnerability : CVE-2024-26902
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- perf: RISCV: Fix panic on pmu overflow handler (1 << idx) of int is not desired when setting bits in unsigned long overflowed_ctrs, use BIT() instead. This panic happens when running 'perf record -e branches' on sophgo sg2042. [ 273.311852] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000098 [ 273.320851] Oops [#1] [ 273.323179] Modules linked in: [ 273.326303] CPU: 0 PID: 1475 Comm: perf Not tainted 6.6.0-rc3+ #9 [ 273.332521] Hardware name: Sophgo Mango (DT) [ 273.336878] epc : riscv_pmu_ctr_get_width_mask+0x8/0x62 [ 273.342291] ra : pmu_sbi_ovf_handler+0x2e0/0x34e [ 273.347091] epc : ffffffff80aecd98 ra : ffffffff80aee056 sp : fffffff6e36928b0 [ 273.354454] gp :
ffffffff821f82d0 tp : ffffffd90c353200 t0 : 0000002ade4f9978 [ 273.361815] t1 : 0000000000504d55 t2 :
ffffffff8016cd8c s0 : fffffff6e3692a70 [ 273.369180] s1 : 0000000000000020 a0 : 0000000000000000 a1 :
00001a8e81800000 [ 273.376540] a2 : 0000003c00070198 a3 : 0000003c00db75a4 a4 : 0000000000000015 [ 273.383901] a5 : ffffffd7ff8804b0 a6 : 0000000000000015 a7 : 000000000000002a [ 273.391327] s2 :
000000000000ffff s3 : 0000000000000000 s4 : ffffffd7ff8803b0 [ 273.398773] s5 : 0000000000504d55 s6 :
ffffffd905069800 s7 : ffffffff821fe210 [ 273.406139] s8 : 000000007fffffff s9 : ffffffd7ff8803b0 s10:
ffffffd903f29098 [ 273.413660] s11: 0000000080000000 t3 : 0000000000000003 t4 : ffffffff8017a0ca [ 273.421022] t5 : ffffffff8023cfc2 t6 : ffffffd9040780e8 [ 273.426437] status: 0000000200000100 badaddr:
0000000000000098 cause: 000000000000000d [ 273.434512] [<ffffffff80aecd98>] riscv_pmu_ctr_get_width_mask+0x8/0x62 [ 273.441169] [<ffffffff80076bd8>] handle_percpu_devid_irq+0x98/0x1ee [ 273.447562] [<ffffffff80071158>] generic_handle_domain_irq+0x28/0x36 [ 273.454151] [<ffffffff8047a99a>] riscv_intc_irq+0x36/0x4e [ 273.459659] [<ffffffff80c944de>] handle_riscv_irq+0x4a/0x74 [ 273.465442] [<ffffffff80c94c48>] do_irq+0x62/0x92 [ 273.470360] Code: 0420 60a2 6402 5529 0141 8082 0013 0000 0013 0000 (6d5c) b783 [ 273.477921] ---[ end trace 0000000000000000 ]--- [ 273.482630] Kernel panic - not syncing: Fatal exception in interrupt (CVE-2024-26902)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26902
https://security-tracker.debian.org/tracker/CVE-2024-26902
https://ubuntu.com/security/CVE-2024-26902

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-26902

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227535 - Linux Distros Unpatched Vulnerability : CVE-2024-26918
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: PCI: Fix active state requirement in PME polling The commit noted in fixes added a bogus requirement that runtime PM managed devices need to be in the RPM_ACTIVE state for PME polling. In fact, only devices in low power states should be polled.
However there's still a requirement that the device config space must be accessible, which has implications for both the current state of the polled device and the parent bridge, when present. It's not sufficient to assume the bridge remains in D0 and cases have been observed where the bridge passes the D0 test, but the PM state indicates RPM_SUSPENDING and config space of the polled device becomes inaccessible during pci_pme_wakeup(). Therefore, since the bridge is already effectively required to be in the RPM_ACTIVE state, formalize this in the code and elevate the PM usage count to maintain the state while polling the subordinate device. This resolves a regression reported in the bugzilla below where a Thunderbolt/USB4 hierarchy fails to scan for an attached NVMe endpoint downstream of a bridge in a D3hot power state. (CVE-2024-26918)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26918
https://ubuntu.com/security/CVE-2024-26918

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.4 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0008
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-26918

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227754 - Linux Distros Unpatched Vulnerability : CVE-2024-26999
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- serial/pmac_zilog: Remove flawed mitigation for rx irq flood The mitigation was intended to stop the irq completely. That may be better than a hard lock-up but it turns out that you get a crash anyway if you're using pmac_zilog as a serial console: ttyPZ0: pmz: rx irq flood ! BUG: spinlock recursion on CPU#0, swapper/0 That's because the pr_err() call in pmz_receive_chars() results in pmz_console_write() attempting to lock a spinlock already locked in pmz_interrupt(). With CONFIG_DEBUG_SPINLOCK=y, this produces a fatal BUG splat. The spinlock in question is the one in struct uart_port. Even when it's not fatal, the serial port rx function ceases to work. Also, the iteration limit doesn't play nicely with QEMU, as can be seen in the bug report linked below. A web search for other reports of the error message pmz: rx irq flood didn't produce anything. So I don't think this code is needed any more. Remove it.
(CVE-2024-26999)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-26999
https://ubuntu.com/security/CVE-2024-26999

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-26999

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228298 - Linux Distros Unpatched Vulnerability : CVE-2024-27031
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: NFS: Fix nfs_netfs_issue_read() xarray locking for writeback interrupt The loop inside nfs_netfs_issue_read() currently does not disable interrupts while iterating through pages in the xarray to submit for NFS read. This is not safe though since after taking xa_lock, another page in the mapping could be processed for writeback inside an interrupt, and deadlock can occur. The fix is simple and clean if we use xa_for_each_range(), which handles the iteration with RCU while reducing code complexity. The problem is easily reproduced with the following test: mount -o vers=3,fsc 127.0.0.1:/export /mnt/nfs dd if=/dev/zero of=/mnt/nfs/file1.bin bs=4096 count=1 echo 3 > /proc/sys/vm/drop_caches dd if=/mnt/nfs/file1.bin of=/dev/null umount /mnt/nfs On the console with a lockdep-enabled kernel a message similar to the following will be seen:
================================ WARNING: inconsistent lock state 6.7.0-lockdbg+ #10 Not tainted
-------------------------------- inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. test5/1708 [HC0[0]:SC0[0]:HE1:SE1] takes: ffff888127baa598 (&xa->xa_lock#4){+.?.}-{3:3}, at:
nfs_netfs_issue_read+0x1b2/0x4b0 [nfs] {IN-SOFTIRQ-W} state was registered at: lock_acquire+0x144/0x380
_raw_spin_lock_irqsave+0x4e/0xa0 __folio_end_writeback+0x17e/0x5c0 folio_end_writeback+0x93/0x1b0 iomap_finish_ioend+0xeb/0x6a0 blk_update_request+0x204/0x7f0 blk_mq_end_request+0x30/0x1c0 blk_complete_reqs+0x7e/0xa0 __do_softirq+0x113/0x544 __irq_exit_rcu+0xfe/0x120 irq_exit_rcu+0xe/0x20 sysvec_call_function_single+0x6f/0x90 asm_sysvec_call_function_single+0x1a/0x20 pv_native_safe_halt+0xf/0x20 default_idle+0x9/0x20 default_idle_call+0x67/0xa0 do_idle+0x2b5/0x300 cpu_startup_entry+0x34/0x40 start_secondary+0x19d/0x1c0 secondary_startup_64_no_verify+0x18f/0x19b irq event stamp: 176891 hardirqs last enabled at (176891): [<ffffffffa67a0be4>]
_raw_spin_unlock_irqrestore+0x44/0x60 hardirqs last disabled at (176890): [<ffffffffa67a0899>]
_raw_spin_lock_irqsave+0x79/0xa0 softirqs last enabled at (176646): [<ffffffffa515d91e>]
__irq_exit_rcu+0xfe/0x120 softirqs last disabled at (176633): [<ffffffffa515d91e>]
__irq_exit_rcu+0xfe/0x120 other info that might help us debug this: Possible unsafe locking scenario: CPU0
---- lock(&xa->xa_lock#4); <Interrupt> lock(&xa->xa_lock#4); *** DEADLOCK *** 2 locks held by test5/1708:
#0: ffff888127baa498 (&sb->s_type->i_mutex_key#22){++++}-{4:4}, at: nfs_start_io_read+0x28/0x90 [nfs] #1:
ffff888127baa650 (mapping.invalidate_lock#3){.+.+}-{4:4}, at: page_cache_ra_unbounded+0xa4/0x280 stack backtrace: CPU: 6 PID: 1708 Comm: test5 Kdump: loaded Not tainted 6.7.0-lockdbg+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-1.fc39 04/01/2014 Call Trace: dump_stack_lvl+0x5b/0x90 mark_lock+0xb3f/0xd20 __lock_acquire+0x77b/0x3360 _raw_spin_lock+0x34/0x80 nfs_netfs_issue_read+0x1b2/0x4b0 [nfs] netfs_begin_read+0x77f/0x980 [netfs] nfs_netfs_readahead+0x45/0x60 [nfs] nfs_readahead+0x323/0x5a0 [nfs] read_pages+0xf3/0x5c0 page_cache_ra_unbounded+0x1c8/0x280 filemap_get_pages+0x38c/0xae0 filemap_read+0x206/0x5e0 nfs_file_read+0xb7/0x140 [nfs] vfs_read+0x2a9/0x460 ksys_read+0xb7/0x140 (CVE-2024-27031)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-27031
https://ubuntu.com/security/CVE-2024-27031

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-27031

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228130 - Linux Distros Unpatched Vulnerability : CVE-2024-27039
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: clk: hisilicon: hi3559a: Fix an erroneous devm_kfree() 'p_clk' is an array allocated just before the for loop for all clk that need to be registered. It is incremented at each loop iteration. If a clk_register() call fails, 'p_clk' may point to something different from what should be freed. The best we can do, is to avoid this wrong release of memory. (CVE-2024-27039)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-27039
https://ubuntu.com/security/CVE-2024-27039

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-27039

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227909 - Linux Distros Unpatched Vulnerability : CVE-2024-27056
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: iwlwifi: mvm: ensure offloading TID queue exists The resume code path assumes that the TX queue for the offloading TID has been configured. At resume time it then tries to sync the write pointer as it may have been updated by the firmware. In the unusual event that no packets have been send on TID 0, the queue will not have been allocated and this causes a crash. Fix this by ensuring the queue exist at suspend time. (CVE-2024-27056)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-27056
https://security-tracker.debian.org/tracker/CVE-2024-27056
https://ubuntu.com/security/CVE-2024-27056

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0014
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-27056

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248143 - Linux Distros Unpatched Vulnerability : CVE-2024-27059
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command The isd200 sub-driver in usb-storage uses the HEADS and SECTORS values in the ATA ID information to calculate cylinder and head values when creating a CDB for READ or WRITE commands. The calculation involves division and modulus operations, which will cause a crash if either of these values is 0. While this never happens with a genuine device, it could happen with a flawed or subversive emulation, as reported by the syzbot fuzzer. Protect against this possibility by refusing to bind to the device if either the ATA_ID_HEADS or ATA_ID_SECTORS value in the device's ID information is 0. This requires isd200_Initialization() to return a negative error code when initialization fails; currently it always returns 0 (even when there is an error). (CVE-2024-27059)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-27059
https://ubuntu.com/security/CVE-2024-27059

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0009
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-27059

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246830 - Linux Distros Unpatched Vulnerability : CVE-2024-27073
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- media: ttpci: fix two memleaks in budget_av_attach When saa7146_register_device and saa7146_vv_init fails, budget_av_attach should free the resources it allocates, like the error-handling of ttpci_budget_init does. Besides, there are two fixme comment refers to such deallocations. (CVE-2024-27073)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-27073
https://ubuntu.com/security/CVE-2024-27073

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0008
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-27073

Plugin Information
Published: 2025/08/09, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227717 - Linux Distros Unpatched Vulnerability : CVE-2024-27077
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity The entity->name (i.e. name) is allocated in v4l2_m2m_register_entity but isn't freed in its following error-handling paths. This patch adds such deallocation to prevent memleak of entity->name. (CVE-2024-27077)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-27077
https://ubuntu.com/security/CVE-2024-27077

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0008
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-27077

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246325 - Linux Distros Unpatched Vulnerability : CVE-2024-27413
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- efi/capsule-loader: fix incorrect allocation size gcc-14 notices that the allocation with sizeof(void) on 32-bit architectures is not enough for a 64-bit phys_addr_t: drivers/firmware/efi/capsule-loader.c: In function 'efi_capsule_open': drivers/firmware/efi/capsule-loader.c:295:24: error: allocation of insufficient size '4' for type 'phys_addr_t' {aka 'long long unsigned int'} with size '8' [-Werror=alloc- size] 295 | cap_info->phys = kzalloc(sizeof(void *), GFP_KERNEL); | ^ Use the correct type instead here.
(CVE-2024-27413)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-27413
https://ubuntu.com/security/CVE-2024-27413

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0037
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-27413

Plugin Information
Published: 2025/08/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227572 - Linux Distros Unpatched Vulnerability : CVE-2024-28180
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-28180
https://security-tracker.debian.org/tracker/CVE-2024-28180
https://ubuntu.com/security/CVE-2024-28180

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
2.2
EPSS Score
0.0087
References

CVE | CVE-2024-28180

Plugin Information
Published: 2025/03/05, Modified: 2025/10/08
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- jose
- libjose
227478 - Linux Distros Unpatched Vulnerability : CVE-2024-29040
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This issue has been patched in version 4.1.0. (CVE-2024-29040)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-29040
https://security-tracker.debian.org/tracker/CVE-2024-29040

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
3.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.6
EPSS Score
0.0007
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-29040

Plugin Information
Published: 2025/03/05, Modified: 2025/09/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- tpm2-tss
227863 - Linux Distros Unpatched Vulnerability : CVE-2024-29507
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters. (CVE-2024-29507)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-29507

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L)
CVSS v3.0 Temporal Score
4.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
2.5
EPSS Score
0.0019
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-29507

Plugin Information
Published: 2025/03/05, Modified: 2025/08/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- ghostscript
- ghostscript-tools-fonts
- ghostscript-tools-printing
- libgs
227679 - Linux Distros Unpatched Vulnerability : CVE-2024-3056
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in Podman. This issue may allow an attacker to create a specially crafted container that, when configured to share the same IPC with at least one other container, can create a large number of IPC resources in /dev/shm. The malicious container will continue to exhaust resources until it is out-of- memory (OOM) killed. While the malicious container's cgroup will be removed, the IPC resources it created are not. Those resources are tied to the IPC namespace that will not be removed until all containers using it are stopped, and one non-malicious container is holding the namespace open. The malicious container is restarted, either automatically or by attacker control, repeating the process and increasing the amount of memory consumed. With a container configured to restart always, such as `podman run --restart=always`, this can result in a memory-based denial of service of the system. (CVE-2024-3056)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-3056
https://ubuntu.com/security/CVE-2024-3056

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.8 (CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0036
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-3056

Plugin Information
Published: 2025/03/05, Modified: 2025/11/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
227469 - Linux Distros Unpatched Vulnerability : CVE-2024-31068
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Improper Finite State Machines (FSMs) in Hardware Logic for some Intel(R) Processors may allow privileged user to potentially enable denial of service via local access. (CVE-2024-31068)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-31068
https://ubuntu.com/security/CVE-2024-31068

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.6 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-31068

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- microcode_ctl
229247 - Linux Distros Unpatched Vulnerability : CVE-2024-35790
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group The DisplayPort driver's sysfs nodes may be present to the userspace before typec_altmode_set_drvdata() completes in dp_altmode_probe. This means that a sysfs read can trigger a NULL pointer error by deferencing dp->hpd in hpd_show or dp->lock in pin_assignment_show, as dev_get_drvdata() returns NULL in those cases. Remove manual sysfs node creation in favor of adding attribute group as default for devices bound to the driver. The ATTRIBUTE_GROUPS() macro is not used here otherwise the path to the sysfs nodes is no longer compliant with the ABI. (CVE-2024-35790)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-35790
https://ubuntu.com/security/CVE-2024-35790

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-35790

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228589 - Linux Distros Unpatched Vulnerability : CVE-2024-35803
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- x86/efistub: Call mixed mode boot services on the firmware's stack Normally, the EFI stub calls into the EFI boot services using the stack that was live when the stub was entered. According to the UEFI spec, this stack needs to be at least 128k in size - this might seem large but all asynchronous processing and event handling in EFI runs from the same stack and so quite a lot of space may be used in practice. In mixed mode, the situation is a bit different: the bootloader calls the 32-bit EFI stub entry point, which calls the decompressor's 32-bit entry point, where the boot stack is set up, using a fixed allocation of 16k. This stack is still in use when the EFI stub is started in 64-bit mode, and so all calls back into the EFI firmware will be using the decompressor's limited boot stack. Due to the placement of the boot stack right after the boot heap, any stack overruns have gone unnoticed. However, commit 5c4feadb0011983b (x86/decompressor: Move global symbol references to C code) moved the definition of the boot heap into C code, and now the boot stack is placed right at the base of BSS, where any overruns will corrupt the end of the .data section. While it would be possible to work around this by increasing the size of the boot stack, doing so would affect all x86 systems, and mixed mode systems are a tiny (and shrinking) fraction of the x86 installed base. So instead, record the firmware stack pointer value when entering from the 32-bit firmware, and switch to this stack every time a EFI boot service call is made. (CVE-2024-35803)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-35803
https://security-tracker.debian.org/tracker/CVE-2024-35803
https://ubuntu.com/security/CVE-2024-35803

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0019
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-35803

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228899 - Linux Distros Unpatched Vulnerability : CVE-2024-35834
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: xsk: recycle buffer in case Rx queue was full Add missing xsk_buff_free() call when __xsk_rcv_zc() failed to produce descriptor to XSK Rx queue. (CVE-2024-35834)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-35834
https://ubuntu.com/security/CVE-2024-35834

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0012
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-35834

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229047 - Linux Distros Unpatched Vulnerability : CVE-2024-35836
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: dpll: fix pin dump crash for rebound module When a kernel module is unbound but the pin resources were not entirely freed (other kernel module instance of the same PCI device have had kept the reference to that pin), and kernel module is again bound, the pin properties would not be updated (the properties are only assigned when memory for the pin is allocated), prop pointer still points to the kernel module memory of the kernel module which was deallocated on the unbind. If the pin dump is invoked in this state, the result is a kernel crash. Prevent the crash by storing persistent pin properties in dpll subsystem, copy the content from the kernel module when pin is allocated, instead of using memory of the kernel module. (CVE-2024-35836)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-35836
https://ubuntu.com/security/CVE-2024-35836

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0014
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-35836

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229371 - Linux Distros Unpatched Vulnerability : CVE-2024-35860
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: support deferring bpf_link dealloc to after RCU grace period BPF link for some program types is passed as a context which can be used by those BPF programs to look up additional information. E.g., for multi-kprobes and multi-uprobes, link is used to fetch BPF cookie values. Because of this runtime dependency, when bpf_link refcnt drops to zero there could still be active BPF programs running accessing link data. This patch adds generic support to defer bpf_link dealloc callback to after RCU GP, if requested. This is done by exposing two different deallocation callbacks, one synchronous and one deferred. If deferred one is provided, bpf_link_free() will schedule dealloc_deferred() callback to happen after RCU GP. BPF is using two flavors of RCU: classic non-sleepable one and RCU tasks trace one. The latter is used when sleepable BPF programs are used. bpf_link_free() accommodates that by checking underlying BPF program's sleepable flag, and goes either through normal RCU GP only for non-sleepable, or through RCU tasks trace GP *and* then normal RCU GP (taking into account rcu_trace_implies_rcu_gp() optimization), if BPF program is sleepable. We use this for multi-kprobe and multi-uprobe links, which dereference link during program run. We also preventively switch raw_tp link to use deferred dealloc callback, as upcoming changes in bpf-next tree expose raw_tp link data (specifically, cookie value) to BPF program at runtime as well. (CVE-2024-35860)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-35860
https://security-tracker.debian.org/tracker/CVE-2024-35860
https://ubuntu.com/security/CVE-2024-35860

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)
CVSS v3.0 Temporal Score
5.3 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0016
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-35860

Plugin Information
Published: 2025/03/05, Modified: 2025/09/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244170 - Linux Distros Unpatched Vulnerability : CVE-2024-35879
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: of: dynamic: Synchronize of_changeset_destroy() with the devlink removals In the following sequence: 1) of_platform_depopulate() 2) of_overlay_remove() During the step 1, devices are destroyed and devlinks are removed. During the step 2, OF nodes are destroyed but __of_changeset_entry_destroy() can raise warnings related to missing of_node_put(): ERROR: memory leak, expected refcount 1 instead of 2 ... Indeed, during the devlink removals performed at step 1, the removal itself releasing the device (and the attached of_node) is done by a job queued in a workqueue and so, it is done asynchronously with respect to function calls. When the warning is present, of_node_put() will be called but wrongly too late from the workqueue job. In order to be sure that any ongoing devlink removals are done before the of_node destruction, synchronize the of_changeset_destroy() with the devlink removals. (CVE-2024-35879)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-35879
https://ubuntu.com/security/CVE-2024-35879

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-35879

Plugin Information
Published: 2025/08/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229575 - Linux Distros Unpatched Vulnerability : CVE-2024-35901
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix Rx DMA datasize and skb_over_panic mana_get_rxbuf_cfg() aligns the RX buffer's DMA datasize to be multiple of 64. So a packet slightly bigger than mtu+14, say 1536, can be received and cause skb_over_panic. Sample dmesg: [ 5325.237162] skbuff: skb_over_panic: text:ffffffffc043277a len:1536 put:1536 head:ff1100018b517000 data:ff1100018b517100 tail:0x700 end:0x6ea dev:<NULL> [ 5325.243689] ------------[ cut here ]------------ [ 5325.245748] kernel BUG at net/core/skbuff.c:192! [ 5325.247838] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 5325.258374] RIP: 0010:skb_panic+0x4f/0x60 [ 5325.302941] Call Trace: [ 5325.304389] <IRQ> [ 5325.315794] ? skb_panic+0x4f/0x60 [ 5325.317457] ? asm_exc_invalid_op+0x1f/0x30 [ 5325.319490] ? skb_panic+0x4f/0x60 [ 5325.321161] skb_put+0x4e/0x50 [ 5325.322670] mana_poll+0x6fa/0xb50 [mana] [ 5325.324578] __napi_poll+0x33/0x1e0 [ 5325.326328] net_rx_action+0x12e/0x280 As discussed internally, this alignment is not necessary. To fix this bug, remove it from the code. So oversized packets will be marked as CQE_RX_TRUNCATED by NIC, and dropped. (CVE-2024-35901)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-35901
https://ubuntu.com/security/CVE-2024-35901

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0016
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-35901

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245143 - Linux Distros Unpatched Vulnerability : CVE-2024-35903
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: x86/bpf: Fix IP after emitting call depth accounting Adjust the IP passed to `emit_patch` so it calculates the correct offset for the CALL instruction if `x86_call_depth_emit_accounting` emits code. Otherwise we will skip some instructions and most likely crash. (CVE-2024-35903)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-35903
https://ubuntu.com/security/CVE-2024-35903

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-35903

Plugin Information
Published: 2025/08/07, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
252997 - Linux Distros Unpatched Vulnerability : CVE-2024-35917
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Fix bpf_plt pointer arithmetic Kui-Feng Lee reported a crash on s390x triggered by the dummy_st_ops/dummy_init_ptr_arg test [1]: [<0000000000000002>] 0x2 [<00000000009d5cde>] bpf_struct_ops_test_run+0x156/0x250 [<000000000033145a>] __sys_bpf+0xa1a/0xd00 [<00000000003319dc>] __s390x_sys_bpf+0x44/0x50 [<0000000000c4382c>] __do_syscall+0x244/0x300 [<0000000000c59a40>] system_call+0x70/0x98 This is caused by GCC moving memcpy() after assignments in bpf_jit_plt(), resulting in NULL pointers being written instead of the return and the target addresses. Looking at the GCC internals, the reordering is allowed because the alias analysis thinks that the memcpy() destination and the assignments' left-hand-sides are based on different objects: new_plt and bpf_plt_ret/bpf_plt_target respectively, and therefore they cannot alias.
This is in turn due to a violation of the C standard: When two pointers are subtracted, both shall point to elements of the same array object, or one past the last element of the array object ... From the C's perspective, bpf_plt_ret and bpf_plt are distinct objects and cannot be subtracted. In the practical terms, doing so confuses the GCC's alias analysis. The code was written this way in order to let the C side know a few offsets defined in the assembly. While nice, this is by no means necessary. Fix the noncompliance by hardcoding these offsets. [1] https://lore.kernel.org/bpf/c9923c1d-971d-4022-8dc8-1364e929d34c@gmail.com/ (CVE-2024-35917)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-35917
https://ubuntu.com/security/CVE-2024-35917

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0016
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-35917

Plugin Information
Published: 2025/08/20, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245308 - Linux Distros Unpatched Vulnerability : CVE-2024-35922
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fbmon: prevent division by zero in fb_videomode_from_videomode() The expression htotal * vtotal can have a zero value on overflow. It is necessary to prevent division by zero like in fb_var_to_videomode(). Found by Linux Verification Center (linuxtesting.org) with Svace. (CVE-2024-35922)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-35922
https://ubuntu.com/security/CVE-2024-35922

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0009
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-35922

Plugin Information
Published: 2025/08/07, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229210 - Linux Distros Unpatched Vulnerability : CVE-2024-35945
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: phy: phy_device: Prevent nullptr exceptions on ISR If phydev->irq is set unconditionally, check for valid interrupt handler or fall back to polling mode to prevent nullptr exceptions in interrupt service routine. (CVE-2024-35945)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-35945
https://security-tracker.debian.org/tracker/CVE-2024-35945
https://ubuntu.com/security/CVE-2024-35945

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0007
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-35945

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228777 - Linux Distros Unpatched Vulnerability : CVE-2024-35974
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: block: fix q->blkg_list corruption during disk rebind Multiple gendisk instances can allocated/added for single request queue in case of disk rebind. blkg may still stay in q->blkg_list when calling blkcg_init_disk() for rebind, then q->blkg_list becomes corrupted. Fix the list corruption issue by: - add blkg_init_queue() to initialize q->blkg_list &
q->blkcg_mutex only - move calling blkg_init_queue() into blk_alloc_queue() The list corruption should be started since commit f1c006f1c685 (blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy()) which delays removing blkg from q->blkg_list into blkg_free_workfn().
(CVE-2024-35974)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-35974
https://ubuntu.com/security/CVE-2024-35974

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0012
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-35974

Plugin Information
Published: 2025/03/05, Modified: 2025/12/23
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228842 - Linux Distros Unpatched Vulnerability : CVE-2024-35980
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: arm64: tlb: Fix TLBI RANGE operand KVM/arm64 relies on TLBI RANGE feature to flush TLBs when the dirty pages are collected by VMM and the page table entries become write protected during live migration. Unfortunately, the operand passed to the TLBI RANGE instruction isn't correctly sorted out due to the commit 117940aa6e5f (KVM: arm64: Define kvm_tlb_flush_vmid_range()). It leads to crash on the destination VM after live migration because TLBs aren't flushed completely and some of the dirty pages are missed. For example, I have a VM where 8GB memory is assigned, starting from 0x40000000 (1GB). Note that the host has 4KB as the base page size. In the middile of migration, kvm_tlb_flush_vmid_range() is executed to flush TLBs. It passes MAX_TLBI_RANGE_PAGES as the argument to __kvm_tlb_flush_vmid_range() and __flush_s2_tlb_range_op().
SCALE#3 and NUM#31, corresponding to MAX_TLBI_RANGE_PAGES, isn't supported by __TLBI_RANGE_NUM(). In this specific case, -1 has been returned from __TLBI_RANGE_NUM() for SCALE#3/2/1/0 and rejected by the loop in the __flush_tlb_range_op() until the variable @scale underflows and becomes -9, 0xffff708000040000 is set as the operand. The operand is wrong since it's sorted out by __TLBI_VADDR_RANGE() according to invalid @scale and @num. Fix it by extending __TLBI_RANGE_NUM() to support the combination of SCALE#3 and NUM#31.
With the changes, [-1 31] instead of [-1 30] can be returned from the macro, meaning the TLBs for 0x200000 pages in the above example can be flushed in one shoot with SCALE#3 and NUM#31. The macro TLBI_RANGE_MASK is dropped since no one uses it any more. The comments are also adjusted accordingly. (CVE-2024-35980)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-35980
https://ubuntu.com/security/CVE-2024-35980

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-35980

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246403 - Linux Distros Unpatched Vulnerability : CVE-2024-35981
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: virtio_net: Do not send RSS key if it is not supported There is a bug when setting the RSS options in virtio_net that can break the whole machine, getting the kernel into an infinite loop. Running the following command in any QEMU virtual machine with virtionet will reproduce this problem: # ethtool -X eth0 hfunc toeplitz This is how the problem happens: 1) ethtool_set_rxfh() calls virtnet_set_rxfh() 2) virtnet_set_rxfh() calls virtnet_commit_rss_command() 3) virtnet_commit_rss_command() populates 4 entries for the rss scatter- gather 4) Since the command above does not have a key, then the last scatter-gatter entry will be zeroed, since rss_key_size == 0. sg_buf_size = vi->rss_key_size; 5) This buffer is passed to qemu, but qemu is not happy with a buffer with zero length, and do the following in virtqueue_map_desc() (QEMU function): if (!sz) { virtio_error(vdev, virtio: zero sized buffers are not allowed); 6) virtio_error() (also QEMU function) set the device as broken vdev->broken = true; 7) Qemu bails out, and do not repond this crazy kernel. 8) The kernel is waiting for the response to come back (function virtnet_send_command()) 9) The kernel is waiting doing the following : while (!virtqueue_get_buf(vi->cvq, &tmp) &&
!virtqueue_is_broken(vi->cvq)) cpu_relax(); 10) None of the following functions above is true, thus, the kernel loops here forever. Keeping in mind that virtqueue_is_broken() does not look at the qemu `vdev->broken`, so, it never realizes that the vitio is broken at QEMU side. Fix it by not sending RSS commands if the feature is not available in the device. (CVE-2024-35981)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-35981
https://ubuntu.com/security/CVE-2024-35981

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0009
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-35981

Plugin Information
Published: 2025/08/08, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229475 - Linux Distros Unpatched Vulnerability : CVE-2024-35999
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smb3: missing lock when picking channel Coverity spotted a place where we should have been holding the channel lock when accessing the ses channel index. Addresses-Coverity: 1582039 (Data race condition (MISSING_LOCK)) (CVE-2024-35999)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-35999
https://security-tracker.debian.org/tracker/CVE-2024-35999
https://ubuntu.com/security/CVE-2024-35999

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0009
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-35999

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228571 - Linux Distros Unpatched Vulnerability : CVE-2024-36004
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue Issue reported by customer during SRIOV testing, call trace: When both i40e and the i40iw driver are loaded, a warning in check_flush_dependency is being triggered. This seems to be because of the i40e driver workqueue is allocated with the WQ_MEM_RECLAIM flag, and the i40iw one is not. Similar error was encountered on ice too and it was fixed by removing the flag. Do the same for i40e too. [Feb 9 09:08]
------------[ cut here ]------------ [ +0.000004] workqueue: WQ_MEM_RECLAIM i40e:i40e_service_task [i40e] is flushing !WQ_MEM_RECLAIM infiniband:0x0 [ +0.000060] WARNING: CPU: 0 PID: 937 at kernel/workqueue.c:2966 check_flush_dependency+0x10b/0x120 [ +0.000007] Modules linked in: snd_seq_dummy snd_hrtimer snd_seq snd_timer snd_seq_device snd soundcore nls_utf8 cifs cifs_arc4 nls_ucs2_utils rdma_cm iw_cm ib_cm cifs_md4 dns_resolver netfs qrtr rfkill sunrpc vfat fat intel_rapl_msr intel_rapl_common irdma intel_uncore_frequency intel_uncore_frequency_common ice ipmi_ssif isst_if_common skx_edac nfit libnvdimm x86_pkg_temp_thermal intel_powerclamp gnss coretemp ib_uverbs rapl intel_cstate ib_core iTCO_wdt iTCO_vendor_support acpi_ipmi mei_me ipmi_si intel_uncore ioatdma i2c_i801 joydev pcspkr mei ipmi_devintf lpc_ich intel_pch_thermal i2c_smbus ipmi_msghandler acpi_power_meter acpi_pad xfs libcrc32c ast sd_mod drm_shmem_helper t10_pi drm_kms_helper sg ixgbe drm i40e ahci crct10dif_pclmul libahci crc32_pclmul igb crc32c_intel libata ghash_clmulni_intel i2c_algo_bit mdio dca wmi dm_mirror dm_region_hash dm_log dm_mod fuse [ +0.000050] CPU: 0 PID: 937 Comm: kworker/0:3 Kdump: loaded Not tainted 6.8.0-rc2-Feb-net_dev- Qiueue-00279-gbd43c5687e05 #1 [ +0.000003] Hardware name: Intel Corporation S2600BPB/S2600BPB, BIOS SE5C620.86B.02.01.0013.121520200651 12/15/2020 [ +0.000001] Workqueue: i40e i40e_service_task [i40e] [ +0.000024] RIP: 0010:check_flush_dependency+0x10b/0x120 [ +0.000003] Code: ff 49 8b 54 24 18 48 8d 8b b0 00 00 00 49 89 e8 48 81 c6 b0 00 00 00 48 c7 c7 b0 97 fa 9f c6 05 8a cc 1f 02 01 e8 35 b3 fd ff <0f> 0b e9 10 ff ff ff 80 3d 78 cc 1f 02 00 75 94 e9 46 ff ff ff 90 [ +0.000002] RSP: 0018:ffffbd294976bcf8 EFLAGS:
00010282 [ +0.000002] RAX: 0000000000000000 RBX: ffff94d4c483c000 RCX: 0000000000000027 [ +0.000001] RDX:
ffff94d47f620bc8 RSI: 0000000000000001 RDI: ffff94d47f620bc0 [ +0.000001] RBP: 0000000000000000 R08:
0000000000000000 R09: 00000000ffff7fff [ +0.000001] R10: ffffbd294976bb98 R11: ffffffffa0be65e8 R12:
ffff94c5451ea180 [ +0.000001] R13: ffff94c5ab5e8000 R14: ffff94c5c20b6e05 R15: ffff94c5f1330ab0 [ +0.000001] FS: 0000000000000000(0000) GS:ffff94d47f600000(0000) knlGS:0000000000000000 [ +0.000002] CS:
0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000001] CR2: 00007f9e6f1fca70 CR3: 0000000038e20004 CR4:
00000000007706f0 [ +0.000000] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ +0.000001] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ +0.000001] PKRU: 55555554 [ +0.000001] Call Trace: [ +0.000001] <TASK> [ +0.000002] ? __warn+0x80/0x130 [ +0.000003] ? check_flush_dependency+0x10b/0x120 [ +0.000002] ? report_bug+0x195/0x1a0 [ +0.000005] ? handle_bug+0x3c/0x70 [ +0.000003] ? exc_invalid_op+0x14/0x70 [ +0.000002] ? asm_exc_invalid_op+0x16/0x20 [ +0.000006] ? check_flush_dependency+0x10b/0x120 [ +0.000002] ? check_flush_dependency+0x10b/0x120 [ +0.000002] __flush_workqueue+0x126/0x3f0 [ +0.000015] ib_cache_cleanup_one+0x1c/0xe0 [ib_core] [ +0.000056] __ib_unregister_device+0x6a/0xb0 [ib_core] [ +0.000023] ib_unregister_device_and_put+0x34/0x50 [ib_core] [ +0.000020] i40iw_close+0x4b/0x90 [irdma] [ +0.000022] i40e_notify_client_of_netdev_close+0x54/0xc0 [i40e] [ +0.000035] i40e_service_task+0x126/0x190 [i40e] [ +0.000024] process_one_work+0x174/0x340 [ +0.000003] worker_th ---truncated--- (CVE-2024-36004)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-36004
https://ubuntu.com/security/CVE-2024-36004

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0037
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-36004

Plugin Information
Published: 2025/03/05, Modified: 2025/11/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246291 - Linux Distros Unpatched Vulnerability : CVE-2024-36007
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix warning during rehash As previously explained, the rehash delayed work migrates filters from one region to another. This is done by iterating over all chunks (all the filters with the same priority) in the region and in each chunk iterating over all the filters. When the work runs out of credits it stores the current chunk and entry as markers in the per-work context so that it would know where to resume the migration from the next time the work is scheduled. Upon error, the chunk marker is reset to NULL, but without resetting the entry markers despite being relative to it. This can result in migration being resumed from an entry that does not belong to the chunk being migrated. In turn, this will eventually lead to a chunk being iterated over as if it is an entry. Because of how the two structures happen to be defined, this does not lead to KASAN splats, but to warnings such as [1]. Fix by creating a helper that resets all the markers and call it from all the places the currently only reset the chunk marker. For good measures also call it when starting a completely new rehash. Add a warning to avoid future cases. [1] WARNING: CPU: 7 PID: 1076 at drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.c:407 mlxsw_afk_encode+0x242/0x2f0 Modules linked in: CPU: 7 PID: 1076 Comm: kworker/7:24 Tainted: G W 6.9.0-rc3-custom-00880-g29e61d91b77b #29 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:mlxsw_afk_encode+0x242/0x2f0 [...] Call Trace: <TASK>
mlxsw_sp_acl_atcam_entry_add+0xd9/0x3c0 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x109/0x290 mlxsw_sp_acl_tcam_vregion_rehash_work+0x6c/0x470 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 </TASK>
(CVE-2024-36007)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-36007
https://ubuntu.com/security/CVE-2024-36007

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0009
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-36007

Plugin Information
Published: 2025/08/08, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244922 - Linux Distros Unpatched Vulnerability : CVE-2024-36008
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ipv4: check for NULL idev in ip_route_use_hint() syzbot was able to trigger a NULL deref in fib_validate_source() in an old tree [1].
It appears the bug exists in latest trees. All calls to __in_dev_get_rcu() must be checked for a NULL result. [1] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 2 PID: 3257 Comm: syz- executor.3 Not tainted 5.10.0-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:fib_validate_source+0xbf/0x15a0 net/ipv4/fib_frontend.c:425 Code: 18 f2 f2 f2 f2 42 c7 44 20 23 f3 f3 f3 f3 48 89 44 24 78 42 c6 44 20 27 f3 e8 5d 88 48 fc 4c 89 e8 48 c1 e8 03 48 89 44 24 18 <42> 80 3c 20 00 74 08 4c 89 ef e8 d2 15 98 fc 48 89 5c 24 10 41 bf RSP: 0018:ffffc900015fee40 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88800f7a4000 RCX: ffff88800f4f90c0 RDX: 0000000000000000 RSI: 0000000004001eac RDI: ffff8880160c64c0 RBP:
ffffc900015ff060 R08: 0000000000000000 R09: ffff88800f7a4000 R10: 0000000000000002 R11: ffff88800f4f90c0 R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88800f7a4000 FS:
00007f938acfe6c0(0000) GS:ffff888058c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 CR2: 00007f938acddd58 CR3: 000000001248e000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400 Call Trace: ip_route_use_hint+0x410/0x9b0 net/ipv4/route.c:2231 ip_rcv_finish_core+0x2c4/0x1a30 net/ipv4/ip_input.c:327 ip_list_rcv_finish net/ipv4/ip_input.c:612 [inline] ip_sublist_rcv+0x3ed/0xe50 net/ipv4/ip_input.c:638 ip_list_rcv+0x422/0x470 net/ipv4/ip_input.c:673 __netif_receive_skb_list_ptype net/core/dev.c:5572 [inline]
__netif_receive_skb_list_core+0x6b1/0x890 net/core/dev.c:5620 __netif_receive_skb_list net/core/dev.c:5672 [inline] netif_receive_skb_list_internal+0x9f9/0xdc0 net/core/dev.c:5764 netif_receive_skb_list+0x55/0x3e0 net/core/dev.c:5816 xdp_recv_frames net/bpf/test_run.c:257 [inline] xdp_test_run_batch net/bpf/test_run.c:335 [inline] bpf_test_run_xdp_live+0x1818/0x1d00 net/bpf/test_run.c:363 bpf_prog_test_run_xdp+0x81f/0x1170 net/bpf/test_run.c:1376 bpf_prog_test_run+0x349/0x3c0 kernel/bpf/syscall.c:3736 __sys_bpf+0x45c/0x710 kernel/bpf/syscall.c:5115 __do_sys_bpf kernel/bpf/syscall.c:5201 [inline] __se_sys_bpf kernel/bpf/syscall.c:5199 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5199 (CVE-2024-36008)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-36008
https://ubuntu.com/security/CVE-2024-36008

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0009
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-36008

Plugin Information
Published: 2025/08/07, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228634 - Linux Distros Unpatched Vulnerability : CVE-2024-36021
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: hns3: fix kernel crash when devlink reload during pf initialization The devlink reload process will access the hardware resources, but the register operation is done before the hardware is initialized. So, processing the devlink reload during initialization may lead to kernel crash. This patch fixes this by taking devl_lock during initialization. (CVE-2024-36021)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-36021
https://ubuntu.com/security/CVE-2024-36021

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0017
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-36021

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228778 - Linux Distros Unpatched Vulnerability : CVE-2024-36286
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() syzbot reported that nf_reinject() could be called without rcu_read_lock() : WARNING: suspicious RCU usage 6.9.0-rc7-syzkaller-02060-g5c1672705a1a #0 Not tainted net/netfilter/nfnetlink_queue.c:263 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 2 locks held by syz-executor.4/13427: #0: ffffffff8e334f60 (rcu_callback){....}-{0:0}, at:
rcu_lock_acquire include/linux/rcupdate.h:329 [inline] #0: ffffffff8e334f60 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2190 [inline] #0: ffffffff8e334f60 (rcu_callback){....}-{0:0}, at:
rcu_core+0xa86/0x1830 kernel/rcu/tree.c:2471 #1: ffff88801ca92958 (&inst->lock){+.-.}-{2:2}, at:
spin_lock_bh include/linux/spinlock.h:356 [inline] #1: ffff88801ca92958 (&inst->lock){+.-.}-{2:2}, at:
nfqnl_flush net/netfilter/nfnetlink_queue.c:405 [inline] #1: ffff88801ca92958 (&inst->lock){+.-.}-{2:2}, at: instance_destroy_rcu+0x30/0x220 net/netfilter/nfnetlink_queue.c:172 stack backtrace: CPU: 0 PID: 13427 Comm: syz-executor.4 Not tainted 6.9.0-rc7-syzkaller-02060-g5c1672705a1a #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712 nf_reinject net/netfilter/nfnetlink_queue.c:323 [inline] nfqnl_reinject+0x6ec/0x1120 net/netfilter/nfnetlink_queue.c:397 nfqnl_flush net/netfilter/nfnetlink_queue.c:410 [inline] instance_destroy_rcu+0x1ae/0x220 net/netfilter/nfnetlink_queue.c:172 rcu_do_batch kernel/rcu/tree.c:2196 [inline] rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2471 handle_softirqs+0x2d6/0x990 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 </IRQ> <TASK> (CVE-2024-36286)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-36286
https://ubuntu.com/security/CVE-2024-36286

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0008
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-36286

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228331 - Linux Distros Unpatched Vulnerability : CVE-2024-36293
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Improper access control in the EDECCSSA user leaf function for some Intel(R) Processors with Intel(R) SGX may allow an authenticated user to potentially enable denial of service via local access. (CVE-2024-36293)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-36293
https://ubuntu.com/security/CVE-2024-36293

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-36293

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- microcode_ctl
228347 - Linux Distros Unpatched Vulnerability : CVE-2024-36353
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Insufficient clearing of GPU global memory could allow a malicious process running on the same GPU to read left over memory values potentially leading to loss of confidentiality. (CVE-2024-36353)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-36353

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-36353

Plugin Information
Published: 2025/03/05, Modified: 2025/11/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228748 - Linux Distros Unpatched Vulnerability : CVE-2024-36893
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Check for port partner validity before consuming it typec_register_partner() does not guarantee partner registration to always succeed. In the event of failure, port->partner is set to the error value or NULL. Given that port->partner validity is not checked, this results in the following crash: Unable to handle kernel NULL pointer dereference at virtual address xx pc : run_state_machine+0x1bc8/0x1c08 lr :
run_state_machine+0x1b90/0x1c08 .. Call trace: run_state_machine+0x1bc8/0x1c08 tcpm_state_machine_work+0x94/0xe4 kthread_worker_fn+0x118/0x328 kthread+0x1d0/0x23c ret_from_fork+0x10/0x20 To prevent the crash, check for port->partner validity before derefencing it in all the call sites. (CVE-2024-36893)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-36893
https://ubuntu.com/security/CVE-2024-36893

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-36893

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229415 - Linux Distros Unpatched Vulnerability : CVE-2024-36909
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. The VMBus ring buffer code could free decrypted/shared pages if set_memory_decrypted() fails.
Check the decrypted field in the struct vmbus_gpadl for the ring buffers to decide whether to free the memory. (CVE-2024-36909)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-36909
https://security-tracker.debian.org/tracker/CVE-2024-36909
https://ubuntu.com/security/CVE-2024-36909

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0017
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-36909

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229339 - Linux Distros Unpatched Vulnerability : CVE-2024-36910
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- uio_hv_generic: Don't free decrypted memory In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. The VMBus device UIO driver could free decrypted/shared pages if set_memory_decrypted() fails. Check the decrypted field in the gpadl to decide whether to free the memory. (CVE-2024-36910)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-36910
https://security-tracker.debian.org/tracker/CVE-2024-36910
https://ubuntu.com/security/CVE-2024-36910

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0009
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-36910

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229420 - Linux Distros Unpatched Vulnerability : CVE-2024-36911
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- hv_netvsc: Don't free decrypted memory In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. The netvsc driver could free decrypted/shared pages if set_memory_decrypted() fails. Check the decrypted field in the gpadl to decide whether to free the memory. (CVE-2024-36911)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-36911
https://security-tracker.debian.org/tracker/CVE-2024-36911
https://ubuntu.com/security/CVE-2024-36911

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0015
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-36911

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229478 - Linux Distros Unpatched Vulnerability : CVE-2024-36918
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Check bloom filter map value size This patch adds a missing check to bloom filter creating, rejecting values above KMALLOC_MAX_SIZE. This brings the bloom map in line with many other map types. The lack of this protection can cause kernel crashes for value sizes that overflow int's. Such a crash was caught by syzkaller. The next patch adds more guard-rails at a lower level. (CVE-2024-36918)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-36918
https://ubuntu.com/security/CVE-2024-36918

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0017
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-36918

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228947 - Linux Distros Unpatched Vulnerability : CVE-2024-36919
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload The session resources are used by FW and driver when session is offloaded, once session is uploaded these resources are not used. The lock is not required as these fields won't be used any longer. The offload and upload calls are sequential, hence lock is not required. This will suppress following BUG_ON(): [ 449.843143] ------------[ cut here ]------------ [ 449.848302] kernel BUG at mm/vmalloc.c:2727! [ 449.853072] invalid opcode: 0000 [#1] PREEMPT SMP PTI [ 449.858712] CPU: 5 PID: 1996 Comm: kworker/u24:2 Not tainted 5.14.0-118.el9.x86_64 #1 Rebooting. [ 449.867454] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.3.4 11/08/2016 [ 449.876966] Workqueue: fc_rport_eq fc_rport_work [libfc] [ 449.882910] RIP: 0010:vunmap+0x2e/0x30 [ 449.887098] Code: 00 65 8b 05 14 a2 f0 4a a9 00 ff ff 00 75 1b 55 48 89 fd e8 34 36 79 00 48 85 ed 74 0b 48 89 ef 31 f6 5d e9 14 fc ff ff 5d c3 <0f> 0b 0f 1f 44 00 00 41 57 41 56 49 89 ce 41 55 49 89 fd 41 54 41 [ 449.908054] RSP: 0018:ffffb83d878b3d68 EFLAGS: 00010206 [ 449.913887] RAX: 0000000080000201 RBX:
ffff8f4355133550 RCX: 000000000d400005 [ 449.921843] RDX: 0000000000000001 RSI: 0000000000001000 RDI:
ffffb83da53f5000 [ 449.929808] RBP: ffff8f4ac6675800 R08: ffffb83d878b3d30 R09: 00000000000efbdf [ 449.937774] R10: 0000000000000003 R11: ffff8f434573e000 R12: 0000000000001000 [ 449.945736] R13:
0000000000001000 R14: ffffb83da53f5000 R15: ffff8f43d4ea3ae0 [ 449.953701] FS: 0000000000000000(0000) GS:ffff8f529fc80000(0000) knlGS:0000000000000000 [ 449.962732] CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 [ 449.969138] CR2: 00007f8cf993e150 CR3: 0000000efbe10003 CR4: 00000000003706e0 [ 449.977102] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 449.985065] DR3:
0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 449.993028] Call Trace: [ 449.995756]
__iommu_dma_free+0x96/0x100 [ 450.000139] bnx2fc_free_session_resc+0x67/0x240 [bnx2fc] [ 450.006171] bnx2fc_upload_session+0xce/0x100 [bnx2fc] [ 450.011910] bnx2fc_rport_event_handler+0x9f/0x240 [bnx2fc] [ 450.018136] fc_rport_work+0x103/0x5b0 [libfc] [ 450.023103] process_one_work+0x1e8/0x3c0 [ 450.027581] worker_thread+0x50/0x3b0 [ 450.031669] ? rescuer_thread+0x370/0x370 [ 450.036143] kthread+0x149/0x170 [ 450.039744] ? set_kthread_struct+0x40/0x40 [ 450.044411] ret_from_fork+0x22/0x30 [ 450.048404] Modules linked in: vfat msdos fat xfs nfs_layout_nfsv41_files rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver dm_service_time qedf qed crc8 bnx2fc libfcoe libfc scsi_transport_fc intel_rapl_msr intel_rapl_common x86_pkg_temp_thermal intel_powerclamp dcdbas rapl intel_cstate intel_uncore mei_me pcspkr mei ipmi_ssif lpc_ich ipmi_si fuse zram ext4 mbcache jbd2 loop nfsv3 nfs_acl nfs lockd grace fscache netfs irdma ice sd_mod t10_pi sg ib_uverbs ib_core 8021q garp mrp stp llc mgag200 i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt mxm_wmi fb_sys_fops cec crct10dif_pclmul ahci crc32_pclmul bnx2x drm ghash_clmulni_intel libahci rfkill i40e libata megaraid_sas mdio wmi sunrpc lrw dm_crypt dm_round_robin dm_multipath dm_snapshot dm_bufio dm_mirror dm_region_hash dm_log dm_zero dm_mod linear raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx raid6_pq libcrc32c crc32c_intel raid1 raid0 iscsi_ibft squashfs be2iscsi bnx2i cnic uio cxgb4i cxgb4 tls [ 450.048497] libcxgbi libcxgb qla4xxx iscsi_boot_sysfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi edd ipmi_devintf ipmi_msghandler [ 450.159753] ---[ end trace 712de2c57c64abc8 ]--- (CVE-2024-36919)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-36919
https://ubuntu.com/security/CVE-2024-36919

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.4 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0035
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-36919

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248766 - Linux Distros Unpatched Vulnerability : CVE-2024-36937
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: xdp: use flags field to disambiguate broadcast redirect When redirecting a packet using XDP, the bpf_redirect_map() helper will set up the redirect destination information in struct bpf_redirect_info (using the __bpf_xdp_redirect_map() helper function), and the xdp_do_redirect() function will read this information after the XDP program returns and pass the frame on to the right redirect destination. When using the BPF_F_BROADCAST flag to do multicast redirect to a whole map, __bpf_xdp_redirect_map() sets the 'map' pointer in struct bpf_redirect_info to point to the destination map to be broadcast. And xdp_do_redirect() reacts to the value of this map pointer to decide whether it's dealing with a broadcast or a single-value redirect. However, if the destination map is being destroyed before xdp_do_redirect() is called, the map pointer will be cleared out (by bpf_clear_redirect_map()) without waiting for any XDP programs to stop running. This causes xdp_do_redirect() to think that the redirect was to a single target, but the target pointer is also NULL (since broadcast redirects don't have a single target), so this causes a crash when a NULL pointer is passed to dev_map_enqueue(). To fix this, change xdp_do_redirect() to react directly to the presence of the BPF_F_BROADCAST flag in the 'flags' value in struct bpf_redirect_info to disambiguate between a single-target and a broadcast redirect. And only read the 'map' pointer if the broadcast flag is set, aborting if that has been cleared out in the meantime. This prevents the crash, while keeping the atomic (cmpxchg-based) clearing of the map pointer itself, and without adding any more checks in the non- broadcast fast path. (CVE-2024-36937)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-36937
https://ubuntu.com/security/CVE-2024-36937

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0013
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-36937

Plugin Information
Published: 2025/08/12, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229286 - Linux Distros Unpatched Vulnerability : CVE-2024-36938
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue Fix NULL pointer data-races in sk_psock_skb_ingress_enqueue() which syzbot reported [1]. [1] BUG: KCSAN: data-race in sk_psock_drop / sk_psock_skb_ingress_enqueue write to 0xffff88814b3278b8 of 8 bytes by task 10724 on cpu 1: sk_psock_stop_verdict net/core/skmsg.c:1257 [inline] sk_psock_drop+0x13e/0x1f0 net/core/skmsg.c:843 sk_psock_put include/linux/skmsg.h:459 [inline] sock_map_close+0x1a7/0x260 net/core/sock_map.c:1648 unix_release+0x4b/0x80 net/unix/af_unix.c:1048
__sock_release net/socket.c:659 [inline] sock_close+0x68/0x150 net/socket.c:1421 __fput+0x2c1/0x660 fs/file_table.c:422 __fput_sync+0x44/0x60 fs/file_table.c:507 __do_sys_close fs/open.c:1556 [inline]
__se_sys_close+0x101/0x1b0 fs/open.c:1541 __x64_sys_close+0x1f/0x30 fs/open.c:1541 do_syscall_64+0xd3/0x1d0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 read to 0xffff88814b3278b8 of 8 bytes by task 10713 on cpu 0: sk_psock_data_ready include/linux/skmsg.h:464 [inline] sk_psock_skb_ingress_enqueue+0x32d/0x390 net/core/skmsg.c:555 sk_psock_skb_ingress_self+0x185/0x1e0 net/core/skmsg.c:606 sk_psock_verdict_apply net/core/skmsg.c:1008 [inline] sk_psock_verdict_recv+0x3e4/0x4a0 net/core/skmsg.c:1202 unix_read_skb net/unix/af_unix.c:2546 [inline] unix_stream_read_skb+0x9e/0xf0 net/unix/af_unix.c:2682 sk_psock_verdict_data_ready+0x77/0x220 net/core/skmsg.c:1223 unix_stream_sendmsg+0x527/0x860 net/unix/af_unix.c:2339 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x140/0x180 net/socket.c:745 ____sys_sendmsg+0x312/0x410 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmsg+0x1e9/0x280 net/socket.c:2667
__do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline]
__x64_sys_sendmsg+0x46/0x50 net/socket.c:2674 do_syscall_64+0xd3/0x1d0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 value changed: 0xffffffff83d7feb0 -> 0x0000000000000000 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 10713 Comm: syz-executor.4 Tainted: G W 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Prior to this, commit 4cd12c6065df (bpf, sockmap: Fix NULL pointer dereference in sk_psock_verdict_data_ready()) fixed one NULL pointer similarly due to no protection of saved_data_ready.
Here is another different caller causing the same issue because of the same reason. So we should protect it with sk_callback_lock read lock because the writer side in the sk_psock_drop() uses write_lock_bh(&sk->sk_callback_lock);. To avoid errors that could happen in future, I move those two pairs of lock into the sk_psock_data_ready(), which is suggested by John Fastabend. (CVE-2024-36938)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-36938
https://ubuntu.com/security/CVE-2024-36938

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0009
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-36938

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229001 - Linux Distros Unpatched Vulnerability : CVE-2024-36949
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- amd/amdkfd: sync all devices to wait all processes being evicted If there are more than one device doing reset in parallel, the first device will call kfd_suspend_all_processes() to evict all processes on all devices, this call takes time to finish. other device will start reset and recover without waiting. if the process has not been evicted before doing recover, it will be restored, then caused page fault.
(CVE-2024-36949)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-36949
https://security-tracker.debian.org/tracker/CVE-2024-36949
https://ubuntu.com/security/CVE-2024-36949

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0015
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-36949

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228403 - Linux Distros Unpatched Vulnerability : CVE-2024-36954
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tipc: fix a possible memleak in tipc_buf_append __skb_linearize() doesn't free the skb when it fails, so move '*buf = NULL' after __skb_linearize(), so that the skb can be freed on the err path. (CVE-2024-36954)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-36954
https://ubuntu.com/security/CVE-2024-36954

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0008
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-36954

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228446 - Linux Distros Unpatched Vulnerability : CVE-2024-36962
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs Currently the driver uses local_bh_disable()/local_bh_enable() in its IRQ handler to avoid triggering net_rx_action() softirq on exit from netif_rx(). The net_rx_action() could trigger this driver .start_xmit callback, which is protected by the same lock as the IRQ handler, so calling the .start_xmit from netif_rx() from the IRQ handler critical section protected by the lock could lead to an attempt to claim the already claimed lock, and a hang. The local_bh_disable()/local_bh_enable() approach works only in case the IRQ handler is protected by a spinlock, but does not work if the IRQ handler is protected by mutex, i.e. this works for KS8851 with Parallel bus interface, but not for KS8851 with SPI bus interface. Remove the BH manipulation and instead of calling netif_rx() inside the IRQ handler code protected by the lock, queue all the received SKBs in the IRQ handler into a queue first, and once the IRQ handler exits the critical section protected by the lock, dequeue all the queued SKBs and push them all into netif_rx(). At this point, it is safe to trigger the net_rx_action() softirq, since the netif_rx() call is outside of the lock that protects the IRQ handler. (CVE-2024-36962)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-36962
https://ubuntu.com/security/CVE-2024-36962

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.4 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0009
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-36962

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228909 - Linux Distros Unpatched Vulnerability : CVE-2024-36966
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- erofs: reliably distinguish block based and fscache mode When erofs_kill_sb() is called in block dev based mode, s_bdev may not have been initialised yet, and if CONFIG_EROFS_FS_ONDEMAND is enabled, it will be mistaken for fscache mode, and then attempt to free an anon_dev that has never been allocated, triggering the following warning: ============================================ ida_free called for id=0 which is not allocated. WARNING: CPU: 14 PID: 926 at lib/idr.c:525 ida_free+0x134/0x140 Modules linked in: CPU: 14 PID:
926 Comm: mount Not tainted 6.9.0-rc3-dirty #630 RIP: 0010:ida_free+0x134/0x140 Call Trace: <TASK>
erofs_kill_sb+0x81/0x90 deactivate_locked_super+0x35/0x80 get_tree_bdev+0x136/0x1e0 vfs_get_tree+0x2c/0xf0 do_new_mount+0x190/0x2f0 [...] ============================================ Now when erofs_kill_sb() is called, erofs_sb_info must have been initialised, so use sbi->fsid to distinguish between the two modes.
(CVE-2024-36966)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-36966
https://ubuntu.com/security/CVE-2024-36966

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0015
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-36966

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228885 - Linux Distros Unpatched Vulnerability : CVE-2024-36970
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: Use request_module_nowait This appears to work around a deadlock regression that came in with the LED merge in 6.9. The deadlock happens on my system with 24 iwlwifi radios, so maybe it something like all worker threads are busy and some work that needs to complete cannot complete. [also remove unnecessary load_module var and now-wrong comment] (CVE-2024-36970)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-36970
https://ubuntu.com/security/CVE-2024-36970

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-36970

Plugin Information
Published: 2025/03/05, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228843 - Linux Distros Unpatched Vulnerability : CVE-2024-36975
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Do not use WARN when encode fails When asn1_encode_sequence() fails, WARN is not the correct solution. 1.
asn1_encode_sequence() is not an internal function (located in lib/asn1_encode.c). 2. Location is known, which makes the stack trace useless. 3. Results a crash if panic_on_warn is set. It is also noteworthy that the use of WARN is undocumented, and it should be avoided unless there is a carefully considered rationale to use it. Replace WARN with pr_err, and print the return value instead, which is only useful piece of information. (CVE-2024-36975)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-36975
https://ubuntu.com/security/CVE-2024-36975

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0026
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-36975

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
259862 - Linux Distros Unpatched Vulnerability : CVE-2024-37535
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape sequence, a related issue to CVE-2000-0476. (CVE-2024-37535)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-37535
https://security-tracker.debian.org/tracker/CVE-2024-37535
https://ubuntu.com/security/CVE-2024-37535

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
4.4 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
3.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0012
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-37535

Plugin Information
Published: 2025/08/30, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vte-profile
- vte291
229438 - Linux Distros Unpatched Vulnerability : CVE-2024-38394
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kernel's underlying device matching logic allow a physically proximate attacker to access some unintended Linux kernel USB functionality, such as USB device-specific kernel modules and filesystem implementations. NOTE: the GSD supplier indicates that consideration of a mitigation for this within GSD would be in the context of a new feature, not a CVE. (CVE-2024-38394)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-38394
https://security-tracker.debian.org/tracker/CVE-2024-38394

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
3.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.4
EPSS Score
0.0014
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-38394

Plugin Information
Published: 2025/03/05, Modified: 2025/08/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gnome-settings-daemon
246206 - Linux Distros Unpatched Vulnerability : CVE-2024-38566
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf: Fix verifier assumptions about socket->sk The verifier assumes that 'sk' field in 'struct socket' is valid and non-NULL when 'socket'
pointer itself is trusted and non-NULL. That may not be the case when socket was just created and passed to LSM socket_accept hook. Fix this verifier assumption and adjust tests. (CVE-2024-38566)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-38566
https://ubuntu.com/security/CVE-2024-38566

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0017
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-38566

Plugin Information
Published: 2025/08/08, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229395 - Linux Distros Unpatched Vulnerability : CVE-2024-38594
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: stmmac: move the EST lock to struct stmmac_priv Reinitialize the whole EST structure would also reset the mutex lock which is embedded in the EST structure, and then trigger the following warning. To address this, move the lock to struct stmmac_priv. We also need to reacquire the mutex lock when doing this initialization. DEBUG_LOCKS_WARN_ON(lock->magic != lock) WARNING: CPU: 3 PID: 505 at kernel/locking/mutex.c:587 __mutex_lock+0xd84/0x1068 Modules linked in: CPU: 3 PID: 505 Comm: tc Not tainted 6.9.0-rc6-00053-g0106679839f7-dirty #29 Hardware name: NXP i.MX8MPlus EVK board (DT) pstate:
60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __mutex_lock+0xd84/0x1068 lr :
__mutex_lock+0xd84/0x1068 sp : ffffffc0864e3570 x29: ffffffc0864e3570 x28: ffffffc0817bdc78 x27:
0000000000000003 x26: ffffff80c54f1808 x25: ffffff80c9164080 x24: ffffffc080d723ac x23: 0000000000000000 x22: 0000000000000002 x21: 0000000000000000 x20: 0000000000000000 x19: ffffffc083bc3000 x18:
ffffffffffffffff x17: ffffffc08117b080 x16: 0000000000000002 x15: ffffff80d2d40000 x14: 00000000000002da x13: ffffff80d2d404b8 x12: ffffffc082b5a5c8 x11: ffffffc082bca680 x10: ffffffc082bb2640 x9 :
ffffffc082bb2698 x8 : 0000000000017fe8 x7 : c0000000ffffefff x6 : 0000000000000001 x5 : ffffff8178fe0d48 x4 : 0000000000000000 x3 : 0000000000000027 x2 : ffffff8178fe0d50 x1 : 0000000000000000 x0 :
0000000000000000 Call trace: __mutex_lock+0xd84/0x1068 mutex_lock_nested+0x28/0x34 tc_setup_taprio+0x118/0x68c stmmac_setup_tc+0x50/0xf0 taprio_change+0x868/0xc9c (CVE-2024-38594)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-38594
https://security-tracker.debian.org/tracker/CVE-2024-38594
https://ubuntu.com/security/CVE-2024-38594

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0017
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-38594

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229032 - Linux Distros Unpatched Vulnerability : CVE-2024-38607
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- macintosh/via-macii: Fix BUG: sleeping function called from invalid context The via-macii ADB driver calls request_irq() after disabling hard interrupts. But disabling interrupts isn't necessary here because the VIA shift register interrupt was masked during VIA1 initialization. (CVE-2024-38607)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-38607
https://ubuntu.com/security/CVE-2024-38607

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0035
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-38607

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228523 - Linux Distros Unpatched Vulnerability : CVE-2024-39468
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: smb: client: fix deadlock in smb2_find_smb_tcon() Unlock cifs_tcp_ses_lock before calling cifs_put_smb_ses() to avoid such deadlock.
(CVE-2024-39468)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-39468
https://ubuntu.com/security/CVE-2024-39468

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-39468

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229154 - Linux Distros Unpatched Vulnerability : CVE-2024-39490
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipv6: sr: fix missing sk_buff release in seg6_input_core The seg6_input() function is responsible for adding the SRH into a packet, delegating the operation to the seg6_input_core(). This function uses the skb_cow_head() to ensure that there is sufficient headroom in the sk_buff for accommodating the link-layer header. In the event that the skb_cow_header() function fails, the seg6_input_core() catches the error but it does not release the sk_buff, which will result in a memory leak. This issue was introduced in commit af3b5158b89d (ipv6: sr: fix BUG due to headroom too small after SRH push) and persists even after commit 7a3f5b0de364 (netfilter: add netfilter hooks to SRv6 data plane), where the entire seg6_input() code was refactored to deal with netfilter hooks. The proposed patch addresses the identified memory leak by requiring the seg6_input_core() function to release the sk_buff in the event that skb_cow_head() fails.
(CVE-2024-39490)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-39490
https://security-tracker.debian.org/tracker/CVE-2024-39490
https://ubuntu.com/security/CVE-2024-39490

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0019
CVSS v2.0 Base Score
6.1 (CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-39490

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229145 - Linux Distros Unpatched Vulnerability : CVE-2024-39493
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak Using completion_done to determine whether the caller has gone away only works after a complete call. Furthermore it's still possible that the caller has not yet called wait_for_completion, resulting in another potential UAF. Fix this by making the caller use cancel_work_sync and then freeing the memory safely. (CVE-2024-39493)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-39493
https://ubuntu.com/security/CVE-2024-39493

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-39493

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229494 - Linux Distros Unpatched Vulnerability : CVE-2024-39509
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- HID: core: remove unnecessary WARN_ON() in implement() Syzkaller hit a warning [1] in a call to implement() when trying to write a value into a field of smaller size in an output report. Since implement() already has a warn message printed out with the help of hid_warn() and value in question gets trimmed with: ... value &= m; ... WARN_ON may be considered superfluous. Remove it to suppress future syzkaller triggers. [1] WARNING: CPU: 0 PID: 5084 at drivers/hid/hid-core.c:1451 implement drivers/hid/hid-core.c:1451 [inline] WARNING: CPU: 0 PID: 5084 at drivers/hid/hid-core.c:1451 hid_output_report+0x548/0x760 drivers/hid/hid-core.c:1863 Modules linked in: CPU: 0 PID: 5084 Comm: syz- executor424 Not tainted 6.9.0-rc7-syzkaller-00183-gcf87f46fd34d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 RIP: 0010:implement drivers/hid/hid-core.c:1451 [inline] RIP: 0010:hid_output_report+0x548/0x760 drivers/hid/hid-core.c:1863 ... Call Trace: <TASK>
__usbhid_submit_report drivers/hid/usbhid/hid-core.c:591 [inline] usbhid_submit_report+0x43d/0x9e0 drivers/hid/usbhid/hid-core.c:636 hiddev_ioctl+0x138b/0x1f00 drivers/hid/usbhid/hiddev.c:726 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:890 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... (CVE-2024-39509)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-39509
https://ubuntu.com/security/CVE-2024-39509

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0016
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-39509

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229278 - Linux Distros Unpatched Vulnerability : CVE-2024-39920
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The TCP protocol in RFC 9293 has a timing side channel that makes it easier for remote attackers to infer the content of one TCP connection from a client system (to any server), when that client system is concurrently obtaining TCP data at a slow rate from an attacker-controlled server, aka the SnailLoad issue. For example, the attack can begin by measuring RTTs via the TCP segments whose role is to provide an ACK control bit and an Acknowledgment Number. (CVE-2024-39920)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-39920

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
3.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.0018
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-39920

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228943 - Linux Distros Unpatched Vulnerability : CVE-2024-40908
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf: Set run context for rawtp test_run callback syzbot reported crash when rawtp program executed through the test_run interface calls bpf_get_attach_cookie helper or any other helper that touches task->bpf_ctx pointer. Setting the run context (task->bpf_ctx pointer) for test_run callback. (CVE-2024-40908)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-40908
https://ubuntu.com/security/CVE-2024-40908

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0009
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-40908

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228835 - Linux Distros Unpatched Vulnerability : CVE-2024-40935
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cachefiles: flush all requests after setting CACHEFILES_DEAD In ondemand mode, when the daemon is processing an open request, if the kernel flags the cache as CACHEFILES_DEAD, the cachefiles_daemon_write() will always return -EIO, so the daemon can't pass the copen to the kernel. Then the kernel process that is waiting for the copen triggers a hung_task. Since the DEAD state is irreversible, it can only be exited by closing /dev/cachefiles.
Therefore, after calling cachefiles_io_error() to mark the cache as CACHEFILES_DEAD, if in ondemand mode, flush all requests to avoid the above hungtask. We may still be able to read some of the cached data before closing the fd of /dev/cachefiles. Note that this relies on the patch that adds reference counting to the req, otherwise it may UAF. (CVE-2024-40935)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-40935
https://ubuntu.com/security/CVE-2024-40935

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0008
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-40935

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228371 - Linux Distros Unpatched Vulnerability : CVE-2024-40937
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: gve: Clear napi->skb before dev_kfree_skb_any() gve_rx_free_skb incorrectly leaves napi->skb referencing an skb after it is freed with dev_kfree_skb_any(). This can result in a subsequent call to napi_get_frags returning a dangling pointer.
Fix this by clearing napi->skb before the skb is freed. (CVE-2024-40937)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-40937
https://ubuntu.com/security/CVE-2024-40937

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0011
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-40937

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246935 - Linux Distros Unpatched Vulnerability : CVE-2024-40964
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l41: Possible null pointer dereference in cs35l41_hda_unbind() The cs35l41_hda_unbind() function clears the hda_component entry matching it's index and then dereferences the codec pointer held in the first element of the hda_component array, this is an issue when the device index was 0. Instead use the codec pointer stashed in the cs35l41_hda structure as it will still be valid. (CVE-2024-40964)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-40964
https://ubuntu.com/security/CVE-2024-40964

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-40964

Plugin Information
Published: 2025/08/09, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229301 - Linux Distros Unpatched Vulnerability : CVE-2024-40980
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drop_monitor: replace spin_lock by raw_spin_lock trace_drop_common() is called with preemption disabled, and it acquires a spin_lock. This is problematic for RT kernels because spin_locks are sleeping locks in this configuration, which causes the following splat: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 449, name:
rcuc/47 preempt_count: 1, expected: 0 RCU nest depth: 2, expected: 2 5 locks held by rcuc/47/449: #0:
ff1100086ec30a60 ((softirq_ctrl.lock)){+.+.}-{2:2}, at: __local_bh_disable_ip+0x105/0x210 #1:
ffffffffb394a280 (rcu_read_lock){....}-{1:2}, at: rt_spin_lock+0xbf/0x130 #2: ffffffffb394a280 (rcu_read_lock){....}-{1:2}, at: __local_bh_disable_ip+0x11c/0x210 #3: ffffffffb394a160 (rcu_callback){....}-{0:0}, at: rcu_do_batch+0x360/0xc70 #4: ff1100086ee07520 (&data->lock){+.+.}-{2:2}, at: trace_drop_common.constprop.0+0xb5/0x290 irq event stamp: 139909 hardirqs last enabled at (139908):
[<ffffffffb1df2b33>] _raw_spin_unlock_irqrestore+0x63/0x80 hardirqs last disabled at (139909):
[<ffffffffb19bd03d>] trace_drop_common.constprop.0+0x26d/0x290 softirqs last enabled at (139892):
[<ffffffffb07a1083>] __local_bh_enable_ip+0x103/0x170 softirqs last disabled at (139898):
[<ffffffffb0909b33>] rcu_cpu_kthread+0x93/0x1f0 Preemption disabled at: [<ffffffffb1de786b>] rt_mutex_slowunlock+0xab/0x2e0 CPU: 47 PID: 449 Comm: rcuc/47 Not tainted 6.9.0-rc2-rt1+ #7 Hardware name:
Dell Inc. PowerEdge R650/0Y2G81, BIOS 1.6.5 04/15/2022 Call Trace: <TASK> dump_stack_lvl+0x8c/0xd0 dump_stack+0x14/0x20 __might_resched+0x21e/0x2f0 rt_spin_lock+0x5e/0x130 ? trace_drop_common.constprop.0+0xb5/0x290 ? skb_queue_purge_reason.part.0+0x1bf/0x230 trace_drop_common.constprop.0+0xb5/0x290 ? preempt_count_sub+0x1c/0xd0 ?
_raw_spin_unlock_irqrestore+0x4a/0x80 ? __pfx_trace_drop_common.constprop.0+0x10/0x10 ? rt_mutex_slowunlock+0x26a/0x2e0 ? skb_queue_purge_reason.part.0+0x1bf/0x230 ?
__pfx_rt_mutex_slowunlock+0x10/0x10 ? skb_queue_purge_reason.part.0+0x1bf/0x230 trace_kfree_skb_hit+0x15/0x20 trace_kfree_skb+0xe9/0x150 kfree_skb_reason+0x7b/0x110 skb_queue_purge_reason.part.0+0x1bf/0x230 ? __pfx_skb_queue_purge_reason.part.0+0x10/0x10 ? mark_lock.part.0+0x8a/0x520 ... trace_drop_common() also disables interrupts, but this is a minor issue because we could easily replace it with a local_lock. Replace the spin_lock with raw_spin_lock to avoid sleeping in atomic context. (CVE-2024-40980)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-40980
https://ubuntu.com/security/CVE-2024-40980

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-40980

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228351 - Linux Distros Unpatched Vulnerability : CVE-2024-40990
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA/mlx5: Add check for srq max_sge attribute max_sge attribute is passed by the user, and is inserted and used unchecked, so verify that the value doesn't exceed maximum allowed value before using it.
(CVE-2024-40990)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-40990
https://ubuntu.com/security/CVE-2024-40990

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0016
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-40990

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246360 - Linux Distros Unpatched Vulnerability : CVE-2024-40992
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder length checking for UD request packets According to the IBA specification: If a UD request packet is detected with an invalid length, the request shall be an invalid request and it shall be silently dropped by the responder. The responder then waits for a new request packet. commit 689c5421bfe0 (RDMA/rxe: Fix incorrect responder length checking) defers responder length check for UD QPs in function `copy_data`.
But it introduces a regression issue for UD QPs. When the packet size is too large to fit in the receive buffer. `copy_data` will return error code -EINVAL. Then `send_data_in` will return RESPST_ERR_MALFORMED_WQE. UD QP will transfer into ERROR state. (CVE-2024-40992)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-40992
https://ubuntu.com/security/CVE-2024-40992

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0009
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-40992

Plugin Information
Published: 2025/08/08, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228650 - Linux Distros Unpatched Vulnerability : CVE-2024-40999
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: ena: Add validation for completion descriptors consistency Validate that `first` flag is set only for the first descriptor in multi-buffer packets. In case of an invalid descriptor, a reset will occur. A new reset reason for RX data corruption has been added. (CVE-2024-40999)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-40999
https://security-tracker.debian.org/tracker/CVE-2024-40999
https://ubuntu.com/security/CVE-2024-40999

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0011
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-40999

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228638 - Linux Distros Unpatched Vulnerability : CVE-2024-41004
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tracing: Build event generation tests only as modules The kprobes and synth event generation test modules add events and lock (get a reference) those event file reference in module init function, and unlock and delete it in module exit function. This is because those are designed for playing as modules. If we make those modules as built-in, those events are left locked in the kernel, and never be removed. This causes kprobe event self-test failure as below.
[ 97.349708] ------------[ cut here ]------------ [ 97.353453] WARNING: CPU: 3 PID: 1 at kernel/trace/trace_kprobe.c:2133 kprobe_trace_self_tests_init+0x3f1/0x480 [ 97.357106] Modules linked in:
[ 97.358488] CPU: 3 PID: 1 Comm: swapper/0 Not tainted 6.9.0-g699646734ab5-dirty #14 [ 97.361556] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [ 97.363880] RIP:
0010:kprobe_trace_self_tests_init+0x3f1/0x480 [ 97.365538] Code: a8 24 08 82 e9 ae fd ff ff 90 0f 0b 90 48 c7 c7 e5 aa 0b 82 e9 ee fc ff ff 90 0f 0b 90 48 c7 c7 2d 61 06 82 e9 8e fd ff ff 90 <0f> 0b 90 48 c7 c7 33 0b 0c 82 89 c6 e8 6e 03 1f ff 41 ff c7 e9 90 [ 97.370429] RSP: 0000:ffffc90000013b50 EFLAGS: 00010286 [ 97.371852] RAX: 00000000fffffff0 RBX: ffff888005919c00 RCX: 0000000000000000 [ 97.373829] RDX:
ffff888003f40000 RSI: ffffffff8236a598 RDI: ffff888003f40a68 [ 97.375715] RBP: 0000000000000000 R08:
0000000000000001 R09: 0000000000000000 [ 97.377675] R10: ffffffff811c9ae5 R11: ffffffff8120c4e0 R12:
0000000000000000 [ 97.379591] R13: 0000000000000001 R14: 0000000000000015 R15: 0000000000000000 [ 97.381536] FS: 0000000000000000(0000) GS:ffff88807dcc0000(0000) knlGS:0000000000000000 [ 97.383813] CS:
0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 97.385449] CR2: 0000000000000000 CR3: 0000000002244000 CR4:
00000000000006b0 [ 97.387347] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 97.389277] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 97.391196] Call Trace: [ 97.391967] <TASK> [ 97.392647] ? __warn+0xcc/0x180 [ 97.393640] ? kprobe_trace_self_tests_init+0x3f1/0x480 [ 97.395181] ? report_bug+0xbd/0x150 [ 97.396234] ? handle_bug+0x3e/0x60 [ 97.397311] ? exc_invalid_op+0x1a/0x50 [ 97.398434] ? asm_exc_invalid_op+0x1a/0x20 [ 97.399652] ? trace_kprobe_is_busy+0x20/0x20 [ 97.400904] ? tracing_reset_all_online_cpus+0x15/0x90 [ 97.402304] ? kprobe_trace_self_tests_init+0x3f1/0x480 [ 97.403773] ? init_kprobe_trace+0x50/0x50 [ 97.404972] do_one_initcall+0x112/0x240 [ 97.406113] do_initcall_level+0x95/0xb0 [ 97.407286] ? kernel_init+0x1a/0x1a0 [ 97.408401] do_initcalls+0x3f/0x70 [ 97.409452] kernel_init_freeable+0x16f/0x1e0 [ 97.410662] ? rest_init+0x1f0/0x1f0 [ 97.411738] kernel_init+0x1a/0x1a0 [ 97.412788] ret_from_fork+0x39/0x50 [ 97.413817] ? rest_init+0x1f0/0x1f0 [ 97.414844] ret_from_fork_asm+0x11/0x20 [ 97.416285] </TASK> [ 97.417134] irq event stamp: 13437323 [ 97.418376] hardirqs last enabled at (13437337):
[<ffffffff8110bc0c>] console_unlock+0x11c/0x150 [ 97.421285] hardirqs last disabled at (13437370):
[<ffffffff8110bbf1>] console_unlock+0x101/0x150 [ 97.423838] softirqs last enabled at (13437366):
[<ffffffff8108e17f>] handle_softirqs+0x23f/0x2a0 [ 97.426450] softirqs last disabled at (13437393):
[<ffffffff8108e346>] __irq_exit_rcu+0x66/0xd0 [ 97.428850] ---[ end trace 0000000000000000 ]--- And also, since we can not cleanup dynamic_event file, ftracetest are failed too. To avoid these issues, build these tests only as modules. (CVE-2024-41004)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-41004
https://ubuntu.com/security/CVE-2024-41004

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.002
CVSS v2.0 Base Score
3.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
3.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-41004

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229169 - Linux Distros Unpatched Vulnerability : CVE-2024-41023
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sched/deadline: Fix task_struct reference leak During the execution of the following stress test with linux-rt: stress-ng --cyclic 30 --timeout 30 --minimize --quiet kmemleak frequently reported a memory leak concerning the task_struct: unreferenced object 0xffff8881305b8000 (size 16136): comm stress-ng, pid 614, jiffies 4294883961 (age 286.412s) object hex dump (first 32 bytes): 02 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .@.............. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ debug hex dump (first 16 bytes): 53 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 S............... backtrace:
[<00000000046b6790>] dup_task_struct+0x30/0x540 [<00000000c5ca0f0b>] copy_process+0x3d9/0x50e0 [<00000000ced59777>] kernel_clone+0xb0/0x770 [<00000000a50befdc>] __do_sys_clone+0xb6/0xf0 [<000000001dbf2008>] do_syscall_64+0x5d/0xf0 [<00000000552900ff>] entry_SYSCALL_64_after_hwframe+0x6e/0x76 The issue occurs in start_dl_timer(), which increments the task_struct reference count and sets a timer.
The timer callback, dl_task_timer, is supposed to decrement the reference count upon expiration. However, if enqueue_task_dl() is called before the timer expires and cancels it, the reference count is not decremented, leading to the leak. This patch fixes the reference leak by ensuring the task_struct reference count is properly decremented when the timer is canceled. (CVE-2024-41023)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-41023
https://security-tracker.debian.org/tracker/CVE-2024-41023
https://ubuntu.com/security/CVE-2024-41023

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)
CVSS v3.0 Temporal Score
5.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.2
EPSS Score
0.0004
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-41023

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229062 - Linux Distros Unpatched Vulnerability : CVE-2024-41031
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm/filemap: skip to create PMD-sized page cache if needed On ARM64, HPAGE_PMD_ORDER is 13 when the base page size is 64KB. The PMD-sized page cache can't be supported by xarray as the following error messages indicate. ------------[ cut here ]------------ WARNING: CPU: 35 PID: 7484 at lib/xarray.c:1025 xas_split_alloc+0xf8/0x128 Modules linked in: nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib \ nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct \ nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 \ ip_set rfkill nf_tables nfnetlink vfat fat virtio_balloon drm \ fuse xfs libcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64 \ sha1_ce virtio_net net_failover virtio_console virtio_blk failover \ dimlib virtio_mmio CPU: 35 PID: 7484 Comm: test Kdump: loaded Tainted: G W 6.10.0-rc5-gavin+ #9 Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20240524-1.el9 05/24/2024 pstate:
83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : xas_split_alloc+0xf8/0x128 lr :
split_huge_page_to_list_to_order+0x1c4/0x720 sp : ffff800087a4f6c0 x29: ffff800087a4f6c0 x28:
ffff800087a4f720 x27: 000000001fffffff x26: 0000000000000c40 x25: 000000000000000d x24: ffff00010625b858 x23: ffff800087a4f720 x22: ffffffdfc0780000 x21: 0000000000000000 x20: 0000000000000000 x19:
ffffffdfc0780000 x18: 000000001ff40000 x17: 00000000ffffffff x16: 0000018000000000 x15: 51ec004000000000 x14: 0000e00000000000 x13: 0000000000002000 x12: 0000000000000020 x11: 51ec000000000000 x10:
51ece1c0ffff8000 x9 : ffffbeb961a44d28 x8 : 0000000000000003 x7 : ffffffdfc0456420 x6 : ffff0000e1aa6eb8 x5 : 20bf08b4fe778fca x4 : ffffffdfc0456420 x3 : 0000000000000c40 x2 : 000000000000000d x1 :
000000000000000c x0 : 0000000000000000 Call trace: xas_split_alloc+0xf8/0x128 split_huge_page_to_list_to_order+0x1c4/0x720 truncate_inode_partial_folio+0xdc/0x160 truncate_inode_pages_range+0x1b4/0x4a8 truncate_pagecache_range+0x84/0xa0 xfs_flush_unmap_range+0x70/0x90 [xfs] xfs_file_fallocate+0xfc/0x4d8 [xfs] vfs_fallocate+0x124/0x2e8 ksys_fallocate+0x4c/0xa0
__arm64_sys_fallocate+0x24/0x38 invoke_syscall.constprop.0+0x7c/0xd8 do_el0_svc+0xb4/0xd0 el0_svc+0x44/0x1d8 el0t_64_sync_handler+0x134/0x150 el0t_64_sync+0x17c/0x180 Fix it by skipping to allocate PMD-sized page cache when its size is larger than MAX_PAGECACHE_ORDER. For this specific case, we will fall to regular path where the readahead window is determined by BDI's sysfs file (read_ahead_kb).
(CVE-2024-41031)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-41031
https://security-tracker.debian.org/tracker/CVE-2024-41031
https://ubuntu.com/security/CVE-2024-41031

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0012
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-41031

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228995 - Linux Distros Unpatched Vulnerability : CVE-2024-41035
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor Syzbot has identified a bug in usbcore (see the Closes: tag below) caused by our assumption that the reserved bits in an endpoint descriptor's bEndpointAddress field will always be 0. As a result of the bug, the endpoint_is_duplicate() routine in config.c (and possibly other routines as well) may believe that two descriptors are for distinct endpoints, even though they have the same direction and endpoint number. This can lead to confusion, including the bug identified by syzbot (two descriptors with matching endpoint numbers and directions, where one was interrupt and the other was bulk). To fix the bug, we will clear the reserved bits in bEndpointAddress when we parse the descriptor. (Note that both the USB-2.0 and USB-3.1 specs say these bits are Reserved, reset to zero.) This requires us to make a copy of the descriptor earlier in usb_parse_endpoint() and use the copy instead of the original when checking for duplicates.
(CVE-2024-41035)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-41035
https://ubuntu.com/security/CVE-2024-41035

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-41035

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229194 - Linux Distros Unpatched Vulnerability : CVE-2024-41037
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: fix null deref on system suspend entry When system enters suspend with an active stream, SOF core calls hw_params_upon_resume(). On Intel platforms with HDA DMA used to manage the link DMA, this leads to call chain of hda_dsp_set_hw_params_upon_resume() -> hda_dsp_dais_suspend() -> hda_dai_suspend() ->
hda_ipc4_post_trigger() A bug is hit in hda_dai_suspend() as hda_link_dma_cleanup() is run first, which clears hext_stream->link_substream, and then hda_ipc4_post_trigger() is called with a NULL snd_pcm_substream pointer. (CVE-2024-41037)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-41037
https://ubuntu.com/security/CVE-2024-41037

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-41037

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244448 - Linux Distros Unpatched Vulnerability : CVE-2024-41047
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: i40e: Fix XDP program unloading while removing the driver The commit 6533e558c650 (i40e: Fix reset path while removing the driver) introduced a new PF state __I40E_IN_REMOVE to block modifying the XDP program while the driver is being removed.
Unfortunately, such a change is useful only if the .ndo_bpf() callback was called out of the rmmod context because unloading the existing XDP program is also a part of driver removing procedure. In other words, from the rmmod context the driver is expected to unload the XDP program without reporting any errors. Otherwise, the kernel warning with callstack is printed out to dmesg. Example failing scenario: 1.
Load the i40e driver. 2. Load the XDP program. 3. Unload the i40e driver (using rmmod command). The example kernel warning log: [ +0.004646] WARNING: CPU: 94 PID: 10395 at net/core/dev.c:9290 unregister_netdevice_many_notify+0x7a9/0x870 [...] [ +0.010959] RIP:
0010:unregister_netdevice_many_notify+0x7a9/0x870 [...] [ +0.002726] Call Trace: [ +0.002457] <TASK> [ +0.002119] ? __warn+0x80/0x120 [ +0.003245] ? unregister_netdevice_many_notify+0x7a9/0x870 [ +0.005586] ? report_bug+0x164/0x190 [ +0.003678] ? handle_bug+0x3c/0x80 [ +0.003503] ? exc_invalid_op+0x17/0x70 [ +0.003846] ? asm_exc_invalid_op+0x1a/0x20 [ +0.004200] ? unregister_netdevice_many_notify+0x7a9/0x870 [ +0.005579] ? unregister_netdevice_many_notify+0x3cc/0x870 [ +0.005586] unregister_netdevice_queue+0xf7/0x140 [ +0.004806] unregister_netdev+0x1c/0x30 [ +0.003933] i40e_vsi_release+0x87/0x2f0 [i40e] [ +0.004604] i40e_remove+0x1a1/0x420 [i40e] [ +0.004220] pci_device_remove+0x3f/0xb0 [ +0.003943] device_release_driver_internal+0x19f/0x200 [ +0.005243] driver_detach+0x48/0x90 [ +0.003586] bus_remove_driver+0x6d/0xf0 [ +0.003939] pci_unregister_driver+0x2e/0xb0 [ +0.004278] i40e_exit_module+0x10/0x5f0 [i40e] [ +0.004570]
__do_sys_delete_module.isra.0+0x197/0x310 [ +0.005153] do_syscall_64+0x85/0x170 [ +0.003684] ? syscall_exit_to_user_mode+0x69/0x220 [ +0.004886] ? do_syscall_64+0x95/0x170 [ +0.003851] ? exc_page_fault+0x7e/0x180 [ +0.003932] entry_SYSCALL_64_after_hwframe+0x71/0x79 [ +0.005064] RIP:
0033:0x7f59dc9347cb [ +0.003648] Code: 73 01 c3 48 8b 0d 65 16 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 35 16 0c 00 f7 d8 64 89 01 48 [ +0.018753] RSP: 002b:00007ffffac99048 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 [ +0.007577] RAX: ffffffffffffffda RBX: 0000559b9bb2f6e0 RCX: 00007f59dc9347cb [ +0.007140] RDX:
0000000000000000 RSI: 0000000000000800 RDI: 0000559b9bb2f748 [ +0.007146] RBP: 00007ffffac99070 R08:
1999999999999999 R09: 0000000000000000 [ +0.007133] R10: 00007f59dc9a5ac0 R11: 0000000000000206 R12:
0000000000000000 [ +0.007141] R13: 00007ffffac992d8 R14: 0000559b9bb2f6e0 R15: 0000000000000000 [ +0.007151] </TASK> [ +0.002204] ---[ end trace 0000000000000000 ]--- Fix this by checking if the XDP program is being loaded or unloaded. Then, block only loading a new program while __I40E_IN_REMOVE is set. Also, move testing __I40E_IN_REMOVE flag to the beginning of XDP_SETUP callback to avoid unnecessary operations and checks. (CVE-2024-41047)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-41047
https://ubuntu.com/security/CVE-2024-41047

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0014
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-41047

Plugin Information
Published: 2025/08/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229309 - Linux Distros Unpatched Vulnerability : CVE-2024-41064
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- powerpc/eeh: avoid possible crash when edev->pdev changes If a PCI device is removed during eeh_pe_report_edev(), edev->pdev will change and can cause a crash, hold the PCI rescan/remove lock while taking a copy of edev->pdev->bus. (CVE-2024-41064)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-41064
https://ubuntu.com/security/CVE-2024-41064

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-41064

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229374 - Linux Distros Unpatched Vulnerability : CVE-2024-41066
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ibmvnic: Add tx check to prevent skb leak Below is a summary of how the driver stores a reference to an skb during transmit: tx_buff[free_map[consumer_index]]->skb = new_skb; free_map[consumer_index] = IBMVNIC_INVALID_MAP; consumer_index ++; Where variable data looks like this: free_map == [4, IBMVNIC_INVALID_MAP, IBMVNIC_INVALID_MAP, 0, 3] consumer_index^ tx_buff == [skb=null, skb=<ptr>, skb=<ptr>, skb=null, skb=null] The driver has checks to ensure that free_map[consumer_index] pointed to a valid index but there was no check to ensure that this index pointed to an unused/null skb address. So, if, by some chance, our free_map and tx_buff lists become out of sync then we were previously risking an skb memory leak. This could then cause tcp congestion control to stop sending packets, eventually leading to ETIMEDOUT. Therefore, add a conditional to ensure that the skb address is null. If not then warn the user (because this is still a bug that should be patched) and free the old pointer to prevent memleak/tcp problems. (CVE-2024-41066)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-41066
https://security-tracker.debian.org/tracker/CVE-2024-41066
https://ubuntu.com/security/CVE-2024-41066

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-41066

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228433 - Linux Distros Unpatched Vulnerability : CVE-2024-41068
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- s390/sclp: Fix sclp_init() cleanup on failure If sclp_init() fails it only partially cleans up: if there are multiple failing calls to sclp_init() sclp_state_change_event will be added several times to sclp_reg_list, which results in the following warning: ------------[ cut here ]------------ list_add double add: new=000003ffe1598c10, prev=000003ffe1598bf0, next=000003ffe1598c10. WARNING: CPU: 0 PID: 1 at lib/list_debug.c:35 __list_add_valid_or_report+0xde/0xf8 CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.10.0-rc3 Krnl PSW : 0404c00180000000 000003ffe0d6076a (__list_add_valid_or_report+0xe2/0xf8) R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3 ... Call Trace: [<000003ffe0d6076a>]
__list_add_valid_or_report+0xe2/0xf8 ([<000003ffe0d60766>] __list_add_valid_or_report+0xde/0xf8) [<000003ffe0a8d37e>] sclp_init+0x40e/0x450 [<000003ffe00009f2>] do_one_initcall+0x42/0x1e0 [<000003ffe15b77a6>] do_initcalls+0x126/0x150 [<000003ffe15b7a0a>] kernel_init_freeable+0x1ba/0x1f8 [<000003ffe0d6650e>] kernel_init+0x2e/0x180 [<000003ffe000301c>] __ret_from_fork+0x3c/0x60 [<000003ffe0d759ca>] ret_from_fork+0xa/0x30 Fix this by removing sclp_state_change_event from sclp_reg_list when sclp_init() fails. (CVE-2024-41068)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-41068
https://ubuntu.com/security/CVE-2024-41068

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-41068

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229503 - Linux Distros Unpatched Vulnerability : CVE-2024-41072
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: cfg80211: wext: add extra SIOCSIWSCAN data check In 'cfg80211_wext_siwscan()', add extra check whether number of channels passed via 'ioctl(sock, SIOCSIWSCAN, ...)' doesn't exceed IW_MAX_FREQUENCIES and reject invalid request with -EINVAL otherwise. (CVE-2024-41072)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-41072
https://ubuntu.com/security/CVE-2024-41072

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-41072

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228372 - Linux Distros Unpatched Vulnerability : CVE-2024-41097
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: atm: cxacru: fix endpoint checking in cxacru_bind() Syzbot is still reporting quite an old issue [1] that occurs due to incomplete checking of present usb endpoints. As such, wrong endpoints types may be used at urb sumbitting stage which in turn triggers a warning in usb_submit_urb(). Fix the issue by verifying that required endpoint types are present for both in and out endpoints, taking into account cmd endpoint type. Unfortunately, this patch has not been tested on real hardware. [1] Syzbot report: usb 1-1:
BOGUS urb xfer, pipe 1 != type 3 WARNING: CPU: 0 PID: 8667 at drivers/usb/core/urb.c:502 usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502 Modules linked in: CPU: 0 PID: 8667 Comm:
kworker/0:4 Not tainted 5.14.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502 ... Call Trace: cxacru_cm+0x3c0/0x8e0 drivers/usb/atm/cxacru.c:649 cxacru_card_status+0x22/0xd0 drivers/usb/atm/cxacru.c:760 cxacru_bind+0x7ac/0x11a0 drivers/usb/atm/cxacru.c:1209 usbatm_usb_probe+0x321/0x1ae0 drivers/usb/atm/usbatm.c:1055 cxacru_usb_probe+0xdf/0x1e0 drivers/usb/atm/cxacru.c:1363 usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:517 [inline] really_probe+0x23c/0xcd0 drivers/base/dd.c:595 __driver_probe_device+0x338/0x4d0 drivers/base/dd.c:747 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:777 __device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:894 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427 __device_attach+0x228/0x4a0 drivers/base/dd.c:965 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487 device_add+0xc2f/0x2180 drivers/base/core.c:3354 usb_set_configuration+0x113a/0x1910 drivers/usb/core/message.c:2170 usb_generic_driver_probe+0xba/0x100 drivers/usb/core/generic.c:238 usb_probe_device+0xd9/0x2c0 drivers/usb/core/driver.c:293 (CVE-2024-41097)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-41097
https://ubuntu.com/security/CVE-2024-41097

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-41097

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229480 - Linux Distros Unpatched Vulnerability : CVE-2024-41098
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Fix null pointer dereference on error If the ata_port_alloc() call in ata_host_alloc() fails, ata_host_release() will get called. However, the code in ata_host_release() tries to free ata_port struct members unconditionally, which can lead to the following: BUG: unable to handle page fault for address: 0000000000003990 PGD 0 P4D 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 10 PID: 594 Comm: (udev-worker) Not tainted 6.10.0-rc5 #44 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 RIP:
0010:ata_host_release.cold+0x2f/0x6e [libata] Code: e4 4d 63 f4 44 89 e2 48 c7 c6 90 ad 32 c0 48 c7 c7 d0 70 33 c0 49 83 c6 0e 41 RSP: 0018:ffffc90000ebb968 EFLAGS: 00010246 RAX: 0000000000000041 RBX:
ffff88810fb52e78 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff88813b3218c0 RDI: ffff88813b3218c0 RBP: ffff88810fb52e40 R08: 0000000000000000 R09: 6c65725f74736f68 R10: ffffc90000ebb738 R11:
73692033203a746e R12: 0000000000000004 R13: 0000000000000000 R14: 0000000000000011 R15: 0000000000000006 FS: 00007f6cc55b9980(0000) GS:ffff88813b300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000003990 CR3: 00000001122a2000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> ? __die_body.cold+0x19/0x27 ? page_fault_oops+0x15a/0x2f0 ? exc_page_fault+0x7e/0x180 ? asm_exc_page_fault+0x26/0x30 ? ata_host_release.cold+0x2f/0x6e [libata] ? ata_host_release.cold+0x2f/0x6e [libata] release_nodes+0x35/0xb0 devres_release_group+0x113/0x140 ata_host_alloc+0xed/0x120 [libata] ata_host_alloc_pinfo+0x14/0xa0 [libata] ahci_init_one+0x6c9/0xd20 [ahci] Do not access ata_port struct members unconditionally. (CVE-2024-41098)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-41098
https://ubuntu.com/security/CVE-2024-41098

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-41098

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229343 - Linux Distros Unpatched Vulnerability : CVE-2024-41957
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vim is an open source command line text editor. Vim < v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack data will be cleared and freed. However a bit later, the quickfix list belonging to that window will also be cleared and if that quickfix list points to the same tagstack data, Vim will try to free it again, resulting in a double-free/use-after-free access exception.
Impact is low since the user must intentionally execute vim with several non-default flags, but it may cause a crash of Vim. The issue has been fixed as of Vim patch v9.1.0647 (CVE-2024-41957)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-41957
https://security-tracker.debian.org/tracker/CVE-2024-41957

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.2
EPSS Score
0.0007
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-41957

Plugin Information
Published: 2025/03/05, Modified: 2025/11/07
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
228866 - Linux Distros Unpatched Vulnerability : CVE-2024-41965
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet.
However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash. The issue has been fixed as of Vim patch v9.1.0648. (CVE-2024-41965)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-41965
https://security-tracker.debian.org/tracker/CVE-2024-41965

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.2 (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
3.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.4
EPSS Score
0.0007
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-41965

Plugin Information
Published: 2025/03/05, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
228455 - Linux Distros Unpatched Vulnerability : CVE-2024-42063
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode syzbot reported uninit memory usages during map_{lookup,delete}_elem. ========== BUG: KMSAN: uninit-value in __dev_map_lookup_elem kernel/bpf/devmap.c:441 [inline] BUG: KMSAN: uninit-value in dev_map_lookup_elem+0xf3/0x170 kernel/bpf/devmap.c:796 __dev_map_lookup_elem kernel/bpf/devmap.c:441 [inline] dev_map_lookup_elem+0xf3/0x170 kernel/bpf/devmap.c:796 ____bpf_map_lookup_elem kernel/bpf/helpers.c:42 [inline] bpf_map_lookup_elem+0x5c/0x80 kernel/bpf/helpers.c:38 ___bpf_prog_run+0x13fe/0xe0f0 kernel/bpf/core.c:1997 __bpf_prog_run256+0xb5/0xe0 kernel/bpf/core.c:2237 ========== The reproducer should be in the interpreter mode. The C reproducer is trying to run the following bpf prog: 0: (18) r0 = 0x0 2:
(18) r1 = map[id:49] 4: (b7) r8 = 16777216 5: (7b) *(u64 *)(r10 -8) = r8 6: (bf) r2 = r10 7: (07) r2 +=
-229 ^^^^^^^^^^ 8: (b7) r3 = 8 9: (b7) r4 = 0 10: (85) call dev_map_lookup_elem#1543472 11: (95) exit It is due to the void *key (r2) passed to the helper. bpf allows uninit stack memory access for bpf prog with the right privileges. This patch uses kmsan_unpoison_memory() to mark the stack as initialized. This should address different syzbot reports on the uninit void *key argument during map_{lookup,delete}_elem. (CVE-2024-42063)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42063
https://security-tracker.debian.org/tracker/CVE-2024-42063
https://ubuntu.com/security/CVE-2024-42063

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-42063

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228848 - Linux Distros Unpatched Vulnerability : CVE-2024-42067
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro() set_memory_rox() can fail, leaving memory unprotected. Check return and bail out when bpf_jit_binary_lock_ro() returns an error. (CVE-2024-42067)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42067
https://security-tracker.debian.org/tracker/CVE-2024-42067
https://ubuntu.com/security/CVE-2024-42067

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42067

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228734 - Linux Distros Unpatched Vulnerability : CVE-2024-42068
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro() set_memory_ro() can fail, leaving memory unprotected. Check its return and take it into account as an error. (CVE-2024-42068)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42068
https://security-tracker.debian.org/tracker/CVE-2024-42068
https://ubuntu.com/security/CVE-2024-42068

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42068

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228838 - Linux Distros Unpatched Vulnerability : CVE-2024-42069
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix possible double free in error handling path When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), callback function adev_release calls kfree(madev). We shouldn't call kfree(madev) again in the error handling path. Set 'madev' to NULL. (CVE-2024-42069)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42069
https://ubuntu.com/security/CVE-2024-42069

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42069

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229160 - Linux Distros Unpatched Vulnerability : CVE-2024-42071
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ionic: use dev_consume_skb_any outside of napi If we're not in a NAPI softirq context, we need to be careful about how we call napi_consume_skb(), specifically we need to call it with budget==0 to signal to it that we're not in a safe context. This was found while running some configuration stress testing of traffic and a change queue config loop running, and this curious note popped out: [ 4371.402645] BUG: using smp_processor_id() in preemptible [00000000] code: ethtool/20545 [ 4371.402897] caller is napi_skb_cache_put+0x16/0x80 [ 4371.403120] CPU: 25 PID: 20545 Comm: ethtool Kdump: loaded Tainted: G OE 6.10.0-rc3-netnext+ #8 [ 4371.403302] Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 01/23/2021 [ 4371.403460] Call Trace: [ 4371.403613] <TASK> [ 4371.403758] dump_stack_lvl+0x4f/0x70 [ 4371.403904] check_preemption_disabled+0xc1/0xe0 [ 4371.404051] napi_skb_cache_put+0x16/0x80 [ 4371.404199] ionic_tx_clean+0x18a/0x240 [ionic] [ 4371.404354] ionic_tx_cq_service+0xc4/0x200 [ionic] [ 4371.404505] ionic_tx_flush+0x15/0x70 [ionic] [ 4371.404653] ? ionic_lif_qcq_deinit.isra.23+0x5b/0x70 [ionic] [ 4371.404805] ionic_txrx_deinit+0x71/0x190 [ionic] [ 4371.404956] ionic_reconfigure_queues+0x5f5/0xff0 [ionic] [ 4371.405111] ionic_set_ringparam+0x2e8/0x3e0 [ionic] [ 4371.405265] ethnl_set_rings+0x1f1/0x300 [ 4371.405418] ethnl_default_set_doit+0xbb/0x160 [ 4371.405571] genl_family_rcv_msg_doit+0xff/0x130 [...] I found that ionic_tx_clean() calls napi_consume_skb() which calls napi_skb_cache_put(), but before that last call is the note /* Zero budget indicate non-NAPI context called us, like netpoll */ and DEBUG_NET_WARN_ON_ONCE(!in_softirq()); Those are pretty big hints that we're doing it wrong. We can pass a context hint down through the calls to let ionic_tx_clean() know what we're doing so it can call napi_consume_skb() correctly. (CVE-2024-42071)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42071
https://ubuntu.com/security/CVE-2024-42071

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-42071

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248194 - Linux Distros Unpatched Vulnerability : CVE-2024-42073
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems The following two shared buffer operations make use of the Shared Buffer Status Register (SBSR): # devlink sb occupancy snapshot pci/0000:01:00.0 # devlink sb occupancy clearmax pci/0000:01:00.0 The register has two masks of 256 bits to denote on which ingress / egress ports the register should operate on. Spectrum-4 has more than 256 ports, so the register was extended by cited commit with a new 'port_page' field. However, when filling the register's payload, the driver specifies the ports as absolute numbers and not relative to the first port of the port page, resulting in memory corruptions [1]. Fix by specifying the ports relative to the first port of the port page. [1] BUG: KASAN:
slab-use-after-free in mlxsw_sp_sb_occ_snapshot+0xb6d/0xbc0 Read of size 1 at addr ffff8881068cb00f by task devlink/1566 [...] Call Trace: <TASK> dump_stack_lvl+0xc6/0x120 print_report+0xce/0x670 kasan_report+0xd7/0x110 mlxsw_sp_sb_occ_snapshot+0xb6d/0xbc0 mlxsw_devlink_sb_occ_snapshot+0x75/0xb0 devlink_nl_sb_occ_snapshot_doit+0x1f9/0x2a0 genl_family_rcv_msg_doit+0x20c/0x300 genl_rcv_msg+0x567/0x800 netlink_rcv_skb+0x170/0x450 genl_rcv+0x2d/0x40 netlink_unicast+0x547/0x830 netlink_sendmsg+0x8d4/0xdb0
__sys_sendto+0x49b/0x510 __x64_sys_sendto+0xe5/0x1c0 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f [...] Allocated by task 1: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 copy_verifier_state+0xbc2/0xfb0 do_check_common+0x2c51/0xc7e0 bpf_check+0x5107/0x9960 bpf_prog_load+0xf0e/0x2690 __sys_bpf+0x1a61/0x49d0
__x64_sys_bpf+0x7d/0xc0 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 1:
kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 poison_slab_object+0x109/0x170 __kasan_slab_free+0x14/0x30 kfree+0xca/0x2b0 free_verifier_state+0xce/0x270 do_check_common+0x4828/0xc7e0 bpf_check+0x5107/0x9960 bpf_prog_load+0xf0e/0x2690 __sys_bpf+0x1a61/0x49d0
__x64_sys_bpf+0x7d/0xc0 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f (CVE-2024-42073)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42073
https://ubuntu.com/security/CVE-2024-42073

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-42073

Plugin Information
Published: 2025/08/11, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229142 - Linux Distros Unpatched Vulnerability : CVE-2024-42076
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: can: j1939: Initialize unused data in j1939_send_one() syzbot reported kernel-infoleak in raw_recvmsg() [1]. j1939_send_one() creates full frame including unused data, but it doesn't initialize it. This causes the kernel-infoleak issue. Fix this by initializing unused data. [1] BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline] BUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:29 [inline] BUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:245 [inline] BUG:
KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:271 [inline] BUG: KMSAN: kernel- infoleak in _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copy_to_user_iter lib/iov_iter.c:24 [inline] iterate_ubuf include/linux/iov_iter.h:29 [inline] iterate_and_advance2 include/linux/iov_iter.h:245 [inline] iterate_and_advance include/linux/iov_iter.h:271 [inline] _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185 copy_to_iter include/linux/uio.h:196 [inline] memcpy_to_msg include/linux/skbuff.h:4113 [inline] raw_recvmsg+0x2b8/0x9e0 net/can/raw.c:1008 sock_recvmsg_nosec net/socket.c:1046 [inline] sock_recvmsg+0x2c4/0x340 net/socket.c:1068 ____sys_recvmsg+0x18a/0x620 net/socket.c:2803
___sys_recvmsg+0x223/0x840 net/socket.c:2845 do_recvmmsg+0x4fc/0xfd0 net/socket.c:2939 __sys_recvmmsg net/socket.c:3018 [inline] __do_sys_recvmmsg net/socket.c:3041 [inline] __se_sys_recvmmsg net/socket.c:3034 [inline] __x64_sys_recvmmsg+0x397/0x490 net/socket.c:3034 x64_sys_call+0xf6c/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:300 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:3804 [inline] slab_alloc_node mm/slub.c:3845 [inline] kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577
__alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668 alloc_skb include/linux/skbuff.h:1313 [inline] alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504 sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795 sock_alloc_send_skb include/net/sock.h:1842 [inline] j1939_sk_alloc_skb net/can/j1939/socket.c:878 [inline] j1939_sk_send_loop net/can/j1939/socket.c:1142 [inline] j1939_sk_sendmsg+0xc0a/0x2730 net/can/j1939/socket.c:1277 sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x30f/0x380 net/socket.c:745 ____sys_sendmsg+0x877/0xb60 net/socket.c:2584
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674 x64_sys_call+0xc4b/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Bytes 12-15 of 16 are uninitialized Memory access of size 16 starts at ffff888120969690 Data copied to user address 00000000200017c0 CPU: 1 PID: 5050 Comm: syz- executor198 Not tainted 6.9.0-rc5-syzkaller-00031-g71b1543c83d6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 (CVE-2024-42076)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42076
https://ubuntu.com/security/CVE-2024-42076

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42076

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228956 - Linux Distros Unpatched Vulnerability : CVE-2024-42080
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA/restrack: Fix potential invalid address access struct rdma_restrack_entry's kern_name was set to KBUILD_MODNAME in ib_create_cq(), while if the module exited but forgot del this rdma_restrack_entry, it would cause a invalid address access in rdma_restrack_clean() when print the owner of this rdma_restrack_entry. These code is used to help find one forgotten PD release in one of the ULPs. But it is not needed anymore, so delete them. (CVE-2024-42080)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42080
https://security-tracker.debian.org/tracker/CVE-2024-42080
https://ubuntu.com/security/CVE-2024-42080

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.001
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42080

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229419 - Linux Distros Unpatched Vulnerability : CVE-2024-42083
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ionic: fix kernel panic due to multi- buffer handling Currently, the ionic_run_xdp() doesn't handle multi-buffer packets properly for XDP_TX and XDP_REDIRECT. When a jumbo frame is received, the ionic_run_xdp() first makes xdp frame with all necessary pages in the rx descriptor. And if the action is either XDP_TX or XDP_REDIRECT, it should unmap dma- mapping and reset page pointer to NULL for all pages, not only the first page. But it doesn't for SG pages. So, SG pages unexpectedly will be reused. It eventually causes kernel panic. Oops: general protection fault, probably for non-canonical address 0x504f4e4dbebc64ff: 0000 [#1] PREEMPT SMP NOPTI CPU:
3 PID: 0 Comm: swapper/3 Not tainted 6.10.0-rc3+ #25 RIP: 0010:xdp_return_frame+0x42/0x90 Code: 01 75 12 5b 4c 89 e6 5d 31 c9 41 5c 31 d2 41 5d e9 73 fd ff ff 44 8b 6b 20 0f b7 43 0a 49 81 ed 68 01 00 00 49 29 c5 49 01 fd <41> 80 7d0 RSP: 0018:ffff99d00122ce08 EFLAGS: 00010202 RAX: 0000000000005453 RBX:
ffff8d325f904000 RCX: 0000000000000001 RDX: 00000000670e1000 RSI: 000000011f90d000 RDI: 504f4e4d4c4b4a49 RBP: ffff99d003907740 R08: 0000000000000000 R09: 0000000000000000 R10: 000000011f90d000 R11:
0000000000000000 R12: ffff8d325f904010 R13: 504f4e4dbebc64fd R14: ffff8d3242b070c8 R15: ffff99d0039077c0 FS: 0000000000000000(0000) GS:ffff8d399f780000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f41f6c85e38 CR3: 000000037ac30000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <IRQ> ? die_addr+0x33/0x90 ? exc_general_protection+0x251/0x2f0 ? asm_exc_general_protection+0x22/0x30 ? xdp_return_frame+0x42/0x90 ionic_tx_clean+0x211/0x280 [ionic 15881354510e6a9c655c59c54812b319ed2cd015] ionic_tx_cq_service+0xd3/0x210 [ionic 15881354510e6a9c655c59c54812b319ed2cd015] ionic_txrx_napi+0x41/0x1b0 [ionic 15881354510e6a9c655c59c54812b319ed2cd015] __napi_poll.constprop.0+0x29/0x1b0 net_rx_action+0x2c4/0x350 handle_softirqs+0xf4/0x320 irq_exit_rcu+0x78/0xa0 common_interrupt+0x77/0x90 (CVE-2024-42083)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42083
https://ubuntu.com/security/CVE-2024-42083

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-42083

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228587 - Linux Distros Unpatched Vulnerability : CVE-2024-42085
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to avoid deadlock When config CONFIG_USB_DWC3_DUAL_ROLE is selected, and trigger system to enter suspend status with below command: echo mem > /sys/power/state There will be a deadlock issue occurring. Detailed invoking path as below: dwc3_suspend_common() spin_lock_irqsave(&dwc->lock, flags); <-- 1st dwc3_gadget_suspend(dwc); dwc3_gadget_soft_disconnect(dwc);
spin_lock_irqsave(&dwc->lock, flags); <-- 2nd This issue is exposed by commit c7ebd8149ee5 (usb: dwc3:
gadget: Fix NULL pointer dereference in dwc3_gadget_suspend) that removes the code of checking whether dwc->gadget_driver is NULL or not. It causes the following code is executed and deadlock occurs when trying to get the spinlock. In fact, the root cause is the commit 5265397f9442(usb: dwc3: Remove DWC3 locking during gadget suspend/resume) that forgot to remove the lock of otg mode. So, remove the redundant lock of otg mode during gadget suspend/resume. (CVE-2024-42085)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42085
https://ubuntu.com/security/CVE-2024-42085

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42085

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249808 - Linux Distros Unpatched Vulnerability : CVE-2024-42097
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: emux: improve patch ioctl data validation In load_data(), make the validation of and skipping over the main info block match that in load_guspatch(). In load_guspatch(), add checking that the specified patch length matches the actually supplied data, like load_data() already did. (CVE-2024-42097)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42097
https://ubuntu.com/security/CVE-2024-42097

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42097

Plugin Information
Published: 2025/08/15, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229297 - Linux Distros Unpatched Vulnerability : CVE-2024-42098
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- crypto: ecdh - explicitly zeroize private_key private_key is overwritten with the key parameter passed in by the caller (if present), or alternatively a newly generated private key. However, it is possible that the caller provides a key (or the newly generated key) which is shorter than the previous key. In that scenario, some key material from the previous key would not be overwritten. The easiest solution is to explicitly zeroize the entire private_key array first. Note that this patch slightly changes the behavior of this function: previously, if the ecc_gen_privkey failed, the old private_key would remain. Now, the private_key is always zeroized. This behavior is consistent with the case where params.key is set and ecc_is_key_valid fails. (CVE-2024-42098)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42098
https://security-tracker.debian.org/tracker/CVE-2024-42098
https://ubuntu.com/security/CVE-2024-42098

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42098

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229598 - Linux Distros Unpatched Vulnerability : CVE-2024-42106
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- inet_diag: Initialize pad field in struct inet_diag_req_v2 KMSAN reported uninit-value access in raw_lookup() [1]. Diag for raw sockets uses the pad field in struct inet_diag_req_v2 for the underlying protocol. This field corresponds to the sdiag_raw_protocol field in struct inet_diag_req_raw.
inet_diag_get_exact_compat() converts inet_diag_req to inet_diag_req_v2, but leaves the pad field uninitialized. So the issue occurs when raw_lookup() accesses the sdiag_raw_protocol field. Fix this by initializing the pad field in inet_diag_get_exact_compat(). Also, do the same fix in inet_diag_dump_compat() to avoid the similar issue in the future. [1] BUG: KMSAN: uninit-value in raw_lookup net/ipv4/raw_diag.c:49 [inline] BUG: KMSAN: uninit-value in raw_sock_get+0x657/0x800 net/ipv4/raw_diag.c:71 raw_lookup net/ipv4/raw_diag.c:49 [inline] raw_sock_get+0x657/0x800 net/ipv4/raw_diag.c:71 raw_diag_dump_one+0xa1/0x660 net/ipv4/raw_diag.c:99 inet_diag_cmd_exact+0x7d9/0x980 inet_diag_get_exact_compat net/ipv4/inet_diag.c:1404 [inline] inet_diag_rcv_msg_compat+0x469/0x530 net/ipv4/inet_diag.c:1426 sock_diag_rcv_msg+0x23d/0x740 net/core/sock_diag.c:282 netlink_rcv_skb+0x537/0x670 net/netlink/af_netlink.c:2564 sock_diag_rcv+0x35/0x40 net/core/sock_diag.c:297 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0xe74/0x1240 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x10c6/0x1260 net/netlink/af_netlink.c:1905 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x332/0x3d0 net/socket.c:745
____sys_sendmsg+0x7f0/0xb70 net/socket.c:2585 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2639 __sys_sendmsg net/socket.c:2668 [inline] __do_sys_sendmsg net/socket.c:2677 [inline] __se_sys_sendmsg net/socket.c:2675 [inline] __x64_sys_sendmsg+0x27e/0x4a0 net/socket.c:2675 x64_sys_call+0x135e/0x3ce0 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd9/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: raw_sock_get+0x650/0x800 net/ipv4/raw_diag.c:71 raw_diag_dump_one+0xa1/0x660 net/ipv4/raw_diag.c:99 inet_diag_cmd_exact+0x7d9/0x980 inet_diag_get_exact_compat net/ipv4/inet_diag.c:1404 [inline] inet_diag_rcv_msg_compat+0x469/0x530 net/ipv4/inet_diag.c:1426 sock_diag_rcv_msg+0x23d/0x740 net/core/sock_diag.c:282 netlink_rcv_skb+0x537/0x670 net/netlink/af_netlink.c:2564 sock_diag_rcv+0x35/0x40 net/core/sock_diag.c:297 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0xe74/0x1240 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x10c6/0x1260 net/netlink/af_netlink.c:1905 sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x332/0x3d0 net/socket.c:745 ____sys_sendmsg+0x7f0/0xb70 net/socket.c:2585
___sys_sendmsg+0x271/0x3b0 net/socket.c:2639 __sys_sendmsg net/socket.c:2668 [inline] __do_sys_sendmsg net/socket.c:2677 [inline] __se_sys_sendmsg net/socket.c:2675 [inline] __x64_sys_sendmsg+0x27e/0x4a0 net/socket.c:2675 x64_sys_call+0x135e/0x3ce0 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd9/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Local variable req.i created at: inet_diag_get_exact_compat net/ipv4/inet_diag.c:1396 [inline] inet_diag_rcv_msg_compat+0x2a6/0x530 net/ipv4/inet_diag.c:1426 sock_diag_rcv_msg+0x23d/0x740 net/core/sock_diag.c:282 CPU: 1 PID: 8888 Comm: syz-executor.6 Not tainted 6.10.0-rc4-00217-g35bb670d65fc #32 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 (CVE-2024-42106)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42106
https://ubuntu.com/security/CVE-2024-42106

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42106

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228476 - Linux Distros Unpatched Vulnerability : CVE-2024-42107
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ice: Don't process extts if PTP is disabled The ice_ptp_extts_event() function can race with ice_ptp_release() and result in a NULL pointer dereference which leads to a kernel panic. Panic occurs because the ice_ptp_extts_event() function calls ptp_clock_event() with a NULL pointer. The ice driver has already released the PTP clock by the time the interrupt for the next external timestamp event occurs. To fix this, modify the ice_ptp_extts_event() function to check the PTP state and bail early if PTP is not ready. (CVE-2024-42107)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42107
https://security-tracker.debian.org/tracker/CVE-2024-42107
https://ubuntu.com/security/CVE-2024-42107

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42107

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228335 - Linux Distros Unpatched Vulnerability : CVE-2024-42109
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: unconditionally flush pending work before notifier syzbot reports: KASAN: slab-uaf in nft_ctx_update include/net/netfilter/nf_tables.h:1831 KASAN: slab-uaf in nft_commit_release net/netfilter/nf_tables_api.c:9530 KASAN: slab-uaf int nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597 Read of size 2 at addr ffff88802b0051c4 by task kworker/1:1/45 [..] Workqueue: events nf_tables_trans_destroy_work Call Trace: nft_ctx_update include/net/netfilter/nf_tables.h:1831 [inline] nft_commit_release net/netfilter/nf_tables_api.c:9530 [inline] nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597 Problem is that the notifier does a conditional flush, but its possible that the table-to-be-removed is still referenced by transactions being processed by the worker, so we need to flush unconditionally. We could make the flush_work depend on whether we found a table to delete in nf-next to avoid the flush for most cases.
AFAICS this problem is only exposed in nf-next, with commit e169285f8c56 (netfilter: nf_tables: do not store nft_ctx in transaction objects), with this commit applied there is an unconditional fetch of table->family which is whats triggering the above splat. (CVE-2024-42109)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42109
https://ubuntu.com/security/CVE-2024-42109

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42109

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229500 - Linux Distros Unpatched Vulnerability : CVE-2024-42126
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt. nmi_enter()/nmi_exit() touches per cpu variables which can lead to kernel crash when invoked during real mode interrupt handling (e.g. early HMI/MCE interrupt handler) if percpu allocation comes from vmalloc area. Early HMI/MCE handlers are called through DEFINE_INTERRUPT_HANDLER_NMI() wrapper which invokes nmi_enter/nmi_exit calls. We don't see any issue when percpu allocation is from the embedded first chunk. However with CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK enabled there are chances where percpu allocation can come from the vmalloc area. With kernel command line percpu_alloc=page we can force percpu allocation to come from vmalloc area and can see kernel crash in machine_check_early: [ 1.215714] NIP [c000000000e49eb4] rcu_nmi_enter+0x24/0x110 [ 1.215717] LR [c0000000000461a0] machine_check_early+0xf0/0x2c0 [ 1.215719] --- interrupt: 200 [ 1.215720] [c000000fffd73180] [0000000000000000] 0x0 (unreliable) [ 1.215722] [c000000fffd731b0] [0000000000000000] 0x0 [ 1.215724] [c000000fffd73210] [c000000000008364] machine_check_early_common+0x134/0x1f8 Fix this by avoiding use of nmi_enter()/nmi_exit() in real mode if percpu first chunk is not embedded.
(CVE-2024-42126)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42126
https://ubuntu.com/security/CVE-2024-42126

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0015
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42126

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228424 - Linux Distros Unpatched Vulnerability : CVE-2024-42129
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- leds: mlxreg: Use devm_mutex_init() for mutex initialization In this driver LEDs are registered using devm_led_classdev_register() so they are automatically unregistered after module's remove() is done.
led_classdev_unregister() calls module's led_set_brightness() to turn off the LEDs and that callback uses mutex which was destroyed already in module's remove() so use devm API instead. (CVE-2024-42129)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42129
https://security-tracker.debian.org/tracker/CVE-2024-42129
https://ubuntu.com/security/CVE-2024-42129

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0012
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42129

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228515 - Linux Distros Unpatched Vulnerability : CVE-2024-42135
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vhost_task: Handle SIGKILL by flushing work and exiting Instead of lingering until the device is closed, this has us handle SIGKILL by: 1. marking the worker as killed so we no longer try to use it with new virtqueues and new flush operations. 2. setting the virtqueue to worker mapping so no new works are queued. 3. running all the exiting works. (CVE-2024-42135)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42135
https://security-tracker.debian.org/tracker/CVE-2024-42135
https://ubuntu.com/security/CVE-2024-42135

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42135

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229609 - Linux Distros Unpatched Vulnerability : CVE-2024-42139
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ice: Fix improper extts handling Extts events are disabled and enabled by the application ts2phc. However, in case where the driver is removed when the application is running, a specific extts event remains enabled and can cause a kernel crash. As a side effect, when the driver is reloaded and application is started again, remaining extts event for the channel from a previous run will keep firing and the message extts on unexpected channel might be printed to the user. To avoid that, extts events shall be disabled when PTP is released. (CVE-2024-42139)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42139
https://security-tracker.debian.org/tracker/CVE-2024-42139
https://ubuntu.com/security/CVE-2024-42139

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42139

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229077 - Linux Distros Unpatched Vulnerability : CVE-2024-42145
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- IB/core: Implement a limit on UMAD receive List The existing behavior of ib_umad, which maintains received MAD packets in an unbounded list, poses a risk of uncontrolled growth. As user-space applications extract packets from this list, the rate of extraction may not match the rate of incoming packets, leading to potential list overflow. To address this, we introduce a limit to the size of the list. After considering typical scenarios, such as OpenSM processing, which can handle approximately 100k packets per second, and the 1-second retry timeout for most packets, we set the list size limit to 200k. Packets received beyond this limit are dropped, assuming they are likely timed out by the time they are handled by user-space.
Notably, packets queued on the receive list due to reasons like timed-out sends are preserved even when the list is full. (CVE-2024-42145)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42145
https://ubuntu.com/security/CVE-2024-42145

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42145

Plugin Information
Published: 2025/03/05, Modified: 2025/10/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229590 - Linux Distros Unpatched Vulnerability : CVE-2024-42151
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable Test case dummy_st_ops/dummy_init_ret_value passes NULL as the first parameter of the test_1() function. Mark this parameter as nullable to make verifier aware of such possibility.
Otherwise, NULL check in the test_1() code: SEC(struct_ops/test_1) int BPF_PROG(test_1, struct bpf_dummy_ops_state *state) { if (!state) return ...; ... access state ... } Might be removed by verifier, thus triggering NULL pointer dereference under certain conditions. (CVE-2024-42151)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42151
https://ubuntu.com/security/CVE-2024-42151

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-42151

Plugin Information
Published: 2025/03/05, Modified: 2025/09/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229103 - Linux Distros Unpatched Vulnerability : CVE-2024-42161
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD [Changes from V1: - Use a default branch in the switch statement to initialize `val'.] GCC warns that `val' may be used uninitialized in the BPF_CRE_READ_BITFIELD macro, defined in bpf_core_read.h as: [...] unsigned long long val; \ [...] \ switch (__CORE_RELO(s, field, BYTE_SIZE)) { \ case 1: val = *(const unsigned char *)p; break; \ case 2: val = *(const unsigned short *)p; break; \ case 4: val = *(const unsigned int *)p; break; \ case 8: val = *(const unsigned long long *)p; break; \ } \ [...] val; \ } \ This patch adds a default entry in the switch statement that sets `val' to zero in order to avoid the warning, and random values to be used in case __builtin_preserve_field_info returns unexpected values for BPF_FIELD_BYTE_SIZE. Tested in bpf-next master. No regressions. (CVE-2024-42161)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42161
https://ubuntu.com/security/CVE-2024-42161

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.3
EPSS Score
0.0005
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42161

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228732 - Linux Distros Unpatched Vulnerability : CVE-2024-42224
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: Correct check for empty list Since commit a3c53be55c95 (net: dsa: mv88e6xxx: Support multiple MDIO busses) mv88e6xxx_default_mdio_bus() has checked that the return value of list_first_entry() is non-NULL. This appears to be intended to guard against the list chip->mdios being empty. However, it is not the correct check as the implementation of list_first_entry is not designed to return NULL for empty lists. Instead, use list_first_entry_or_null() which does return NULL if the list is empty. Flagged by Smatch. Compile tested only. (CVE-2024-42224)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42224
https://ubuntu.com/security/CVE-2024-42224

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H)
CVSS v3.0 Temporal Score
5.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.0
EPSS Score
0.0007
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42224

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228952 - Linux Distros Unpatched Vulnerability : CVE-2024-42229
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- crypto: aead,cipher - zeroize key buffer after use I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding cryptographic information should be zeroized once they are no longer needed.
Accomplish this by using kfree_sensitive for buffers that previously held the private key.
(CVE-2024-42229)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42229
https://ubuntu.com/security/CVE-2024-42229

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
4.1 (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
3.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42229

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228880 - Linux Distros Unpatched Vulnerability : CVE-2024-42230
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- powerpc/pseries: Fix scv instruction crash with kexec kexec on pseries disables AIL (reloc_on_exc), required for scv instruction support, before other CPUs have been shut down. This means they can execute scv instructions after AIL is disabled, which causes an interrupt at an unexpected entry location that crashes the kernel. Change the kexec sequence to disable AIL after other CPUs have been brought down. As a refresher, the real-mode scv interrupt vector is 0x17000, and the fixed-location head code probably couldn't easily deal with implementing such high addresses so it was just decided not to support that interrupt at all. (CVE-2024-42230)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42230
https://security-tracker.debian.org/tracker/CVE-2024-42230
https://ubuntu.com/security/CVE-2024-42230

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.4 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42230

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229359 - Linux Distros Unpatched Vulnerability : CVE-2024-42232
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- libceph: fix race between delayed_work() and ceph_monc_stop() The way the delayed work is handled in ceph_monc_stop() is prone to races with mon_fault() and possibly also finish_hunting(). Both of these can requeue the delayed work which wouldn't be canceled by any of the following code in case that happens after cancel_delayed_work_sync() runs -- __close_session() doesn't mess with the delayed work in order to avoid interfering with the hunting interval logic. This part was missed in commit b5d91704f53e (libceph:
behave in mon_fault() if cur_mon < 0) and use-after-free can still ensue on monc and objects that hang off of it, with monc->auth and monc->monmap being particularly susceptible to quickly being reused. To fix this: - clear monc->cur_mon and monc->hunting as part of closing the session in ceph_monc_stop() - bail from delayed_work() if monc->cur_mon is cleared, similar to how it's done in mon_fault() and finish_hunting() (based on monc->hunting) - call cancel_delayed_work_sync() after the session is closed (CVE-2024-42232)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42232
https://ubuntu.com/security/CVE-2024-42232

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
5.9 (CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42232

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228911 - Linux Distros Unpatched Vulnerability : CVE-2024-42239
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Fail bpf_timer_cancel when callback is being cancelled Given a schedule: timer1 cb timer2 cb bpf_timer_cancel(timer2); bpf_timer_cancel(timer1); Both bpf_timer_cancel calls would wait for the other callback to finish executing, introducing a lockup. Add an atomic_t count named 'cancelling' in bpf_hrtimer. This keeps track of all in-flight cancellation requests for a given BPF timer. Whenever cancelling a BPF timer, we must check if we have outstanding cancellation requests, and if so, we must fail the operation with an error (-EDEADLK) since cancellation is synchronous and waits for the callback to finish executing. This implies that we can enter a deadlock situation involving two or more timer callbacks executing in parallel and attempting to cancel one another. Note that we avoid incrementing the cancelling counter for the target timer (the one being cancelled) if bpf_timer_cancel is not invoked from a callback, to avoid spurious errors. The whole point of detecting cur->cancelling and returning -EDEADLK is to not enter a busy wait loop (which may or may not lead to a lockup). This does not apply in case the caller is in a non-callback context, the other side can continue to cancel as it sees fit without running into errors. Background on prior attempts: Earlier versions of this patch used a bool 'cancelling' bit and used the following pattern under timer->lock to publish cancellation status. lock(t->lock); t->cancelling = true; mb(); if (cur->cancelling) return -EDEADLK; unlock(t->lock); hrtimer_cancel(t->timer);
t->cancelling = false; The store outside the critical section could overwrite a parallel requests t->cancelling assignment to true, to ensure the parallely executing callback observes its cancellation status. It would be necessary to clear this cancelling bit once hrtimer_cancel is done, but lack of serialization introduced races. Another option was explored where bpf_timer_start would clear the bit when (re)starting the timer under timer->lock. This would ensure serialized access to the cancelling bit, but may allow it to be cleared before in-flight hrtimer_cancel has finished executing, such that lockups can occur again. Thus, we choose an atomic counter to keep track of all outstanding cancellation requests and use it to prevent lockups in case callbacks attempt to cancel each other while executing in parallel.
(CVE-2024-42239)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42239
https://security-tracker.debian.org/tracker/CVE-2024-42239
https://ubuntu.com/security/CVE-2024-42239

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42239

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228979 - Linux Distros Unpatched Vulnerability : CVE-2024-42241
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm/shmem: disable PMD-sized page cache if needed For shmem files, it's possible that PMD-sized page cache can't be supported by xarray. For example, 512MB page cache on ARM64 when the base page size is 64KB can't be supported by xarray. It leads to errors as the following messages indicate when this sort of xarray entry is split. WARNING: CPU: 34 PID: 7578 at lib/xarray.c:1025 xas_split_alloc+0xf8/0x128 Modules linked in: binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 \ nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject \ nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 \ ip_set rfkill nf_tables nfnetlink vfat fat virtio_balloon drm fuse xfs \ libcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64 sha1_ce virtio_net \ net_failover virtio_console virtio_blk failover dimlib virtio_mmio CPU: 34 PID: 7578 Comm: test Kdump: loaded Tainted: G W 6.10.0-rc5-gavin+ #9 Hardware name:
QEMU KVM Virtual Machine, BIOS edk2-20240524-1.el9 05/24/2024 pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : xas_split_alloc+0xf8/0x128 lr : split_huge_page_to_list_to_order+0x1c4/0x720 sp : ffff8000882af5f0 x29: ffff8000882af5f0 x28: ffff8000882af650 x27: ffff8000882af768 x26: 0000000000000cc0 x25: 000000000000000d x24: ffff00010625b858 x23: ffff8000882af650 x22: ffffffdfc0900000 x21:
0000000000000000 x20: 0000000000000000 x19: ffffffdfc0900000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000018000000000 x15: 52f8004000000000 x14: 0000e00000000000 x13: 0000000000002000 x12:
0000000000000020 x11: 52f8000000000000 x10: 52f8e1c0ffff6000 x9 : ffffbeb9619a681c x8 : 0000000000000003 x7 : 0000000000000000 x6 : ffff00010b02ddb0 x5 : ffffbeb96395e378 x4 : 0000000000000000 x3 :
0000000000000cc0 x2 : 000000000000000d x1 : 000000000000000c x0 : 0000000000000000 Call trace:
xas_split_alloc+0xf8/0x128 split_huge_page_to_list_to_order+0x1c4/0x720 truncate_inode_partial_folio+0xdc/0x160 shmem_undo_range+0x2bc/0x6a8 shmem_fallocate+0x134/0x430 vfs_fallocate+0x124/0x2e8 ksys_fallocate+0x4c/0xa0 __arm64_sys_fallocate+0x24/0x38 invoke_syscall.constprop.0+0x7c/0xd8 do_el0_svc+0xb4/0xd0 el0_svc+0x44/0x1d8 el0t_64_sync_handler+0x134/0x150 el0t_64_sync+0x17c/0x180 Fix it by disabling PMD-sized page cache when HPAGE_PMD_ORDER is larger than MAX_PAGECACHE_ORDER. As Matthew Wilcox pointed, the page cache in a shmem file isn't represented by a multi-index entry and doesn't have this limitation when the xarry entry is split until commit 6b24ca4a1a8d (mm: Use multi-index entries in the page cache). (CVE-2024-42241)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42241
https://security-tracker.debian.org/tracker/CVE-2024-42241
https://ubuntu.com/security/CVE-2024-42241

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-42241

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229329 - Linux Distros Unpatched Vulnerability : CVE-2024-42243
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray Patch series mm/filemap: Limit page cache size to that supported by xarray, v2. Currently, xarray can't support arbitrary page cache size. More details can be found from the WARN_ON() statement in xas_split_alloc(). In our test whose code is attached below, we hit the WARN_ON() on ARM64 system where the base page size is 64KB and huge page size is 512MB. The issue was reported long time ago and some discussions on it can be found here [1]. [1] https://www.spinics.net/lists/linux-xfs/msg75404.html In order to fix the issue, we need to adjust MAX_PAGECACHE_ORDER to one supported by xarray and avoid PMD-sized page cache if needed. The code changes are suggested by David Hildenbrand. PATCH[1] adjusts MAX_PAGECACHE_ORDER to that supported by xarray PATCH[2-3] avoids PMD-sized page cache in the synchronous readahead path PATCH[4] avoids PMD-sized page cache for shmem files if needed Test program ============ # cat test.c #define _GNU_SOURCE #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <string.h> #include <fcntl.h> #include <errno.h> #include <sys/syscall.h> #include <sys/mman.h> #define TEST_XFS_FILENAME /tmp/data #define TEST_SHMEM_FILENAME /dev/shm/data #define TEST_MEM_SIZE 0x20000000 int main(int argc, char **argv) { const char *filename; int fd = 0; void *buf = (void *)-1, *p; int pgsize = getpagesize(); int ret; if (pgsize != 0x10000) { fprintf(stderr, 64KB base page size is required ); return -EPERM; } system(echo force > /sys/kernel/mm/transparent_hugepage/shmem_enabled); system(rm -fr /tmp/data); system(rm -fr /dev/shm/data); system(echo 1 > /proc/sys/vm/drop_caches); /* Open xfs or shmem file */ filename = TEST_XFS_FILENAME; if (argc > 1 && !strcmp(argv[1], shmem)) filename = TEST_SHMEM_FILENAME; fd = open(filename, O_CREAT | O_RDWR | O_TRUNC); if (fd < 0) { fprintf(stderr, Unable to open <%s>
, filename); return -EIO; } /* Extend file size */ ret = ftruncate(fd, TEST_MEM_SIZE); if (ret) { fprintf(stderr, Error %d to ftruncate() , ret); goto cleanup; } /* Create VMA */ buf = mmap(NULL, TEST_MEM_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); if (buf == (void *)-1) { fprintf(stderr, Unable to mmap <%s>
, filename); goto cleanup; } fprintf(stdout, mapped buffer at 0x%p , buf); ret = madvise(buf, TEST_MEM_SIZE, MADV_HUGEPAGE); if (ret) { fprintf(stderr, Unable to madvise(MADV_HUGEPAGE) ); goto cleanup; } /* Populate VMA */ ret = madvise(buf, TEST_MEM_SIZE, MADV_POPULATE_WRITE); if (ret) { fprintf(stderr, Error %d to madvise(MADV_POPULATE_WRITE) , ret); goto cleanup; } /* Punch the file to enforce xarray split */ ret = fallocate(fd, FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE, TEST_MEM_SIZE - pgsize, pgsize); if (ret) fprintf(stderr, Error %d to fallocate() , ret); cleanup: if (buf != (void *)-1) munmap(buf, TEST_MEM_SIZE); if (fd > 0) close(fd);
return 0; } # gcc test.c -o test # cat /proc/1/smaps | grep KernelPageSize | head -n 1 KernelPageSize: 64 kB # ./test shmem : ------------[ cut here ]------------ WARNING: CPU: 17 PID: 5253 at lib/xarray.c:1025 xas_split_alloc+0xf8/0x128 Modules linked in: nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib \ nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct \ nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 \ ip_set nf_tables rfkill nfnetlink vfat fat virtio_balloon \ drm fuse xfs libcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64 \ virtio_net sha1_ce net_failover failover virtio_console virtio_blk \ dimlib virtio_mmio CPU: 17 PID: 5253 Comm: test Kdump: loaded Tainted: G W 6.10.0-rc5-gavin+ #12 Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20240524-1.el9 05/24/2024 pstate:
83400005 (Nzcv daif +PAN -UAO +TC ---truncated--- (CVE-2024-42243)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42243
https://security-tracker.debian.org/tracker/CVE-2024-42243
https://ubuntu.com/security/CVE-2024-42243

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-42243

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229490 - Linux Distros Unpatched Vulnerability : CVE-2024-42259
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/i915/gem: Fix Virtual Memory mapping boundaries calculation Calculating the size of the mapped area as the lesser value between the requested size and the actual size does not consider the partial mapping offset. This can cause page fault access. Fix the calculation of the starting and ending addresses, the total size is now deduced from the difference between the end and start addresses. Additionally, the calculations have been rewritten in a clearer and more understandable form. [Joonas: Add Requires: tag] Requires: 60a2066c5005 (drm/i915/gem: Adjust vma offset for framebuffer mmap offset) (cherry picked from commit 97b6784753da06d9d40232328efc5c5367e53417) (CVE-2024-42259)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42259
https://ubuntu.com/security/CVE-2024-42259

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.4 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2024-42259

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229063 - Linux Distros Unpatched Vulnerability : CVE-2024-42281
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Fix a segment issue when downgrading gso_size Linearize the skb when downgrading gso_size because it may trigger a BUG_ON() later when the skb is segmented as described in [1,2]. (CVE-2024-42281)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42281
https://ubuntu.com/security/CVE-2024-42281

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0015
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42281

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228422 - Linux Distros Unpatched Vulnerability : CVE-2024-42286
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: validate nvme_local_port correctly The driver load failed with error message, qla2xxx [0000:04:00.0]-ffff:0:
register_localport failed: ret=ffffffef and with a kernel crash, BUG: unable to handle kernel NULL pointer dereference at 0000000000000070 Workqueue: events_unbound qla_register_fcport_fn [qla2xxx] RIP:
0010:nvme_fc_register_remoteport+0x16/0x430 [nvme_fc] RSP: 0018:ffffaaa040eb3d98 EFLAGS: 00010282 RAX:
0000000000000000 RBX: ffff9dfb46b78c00 RCX: 0000000000000000 RDX: ffff9dfb46b78da8 RSI: ffffaaa040eb3e08 RDI: 0000000000000000 RBP: ffff9dfb612a0a58 R08: ffffffffaf1d6270 R09: 3a34303a30303030 R10:
34303a303030305b R11: 2078787832616c71 R12: ffff9dfb46b78dd4 R13: ffff9dfb46b78c24 R14: ffff9dfb41525300 R15: ffff9dfb46b78da8 FS: 0000000000000000(0000) GS:ffff9dfc67c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000070 CR3: 000000018da10004 CR4: 00000000000206f0 Call Trace: qla_nvme_register_remote+0xeb/0x1f0 [qla2xxx] ? qla2x00_dfs_create_rport+0x231/0x270 [qla2xxx] qla2x00_update_fcport+0x2a1/0x3c0 [qla2xxx] qla_register_fcport_fn+0x54/0xc0 [qla2xxx] Exit the qla_nvme_register_remote() function when qla_nvme_register_hba() fails and correctly validate nvme_local_port. (CVE-2024-42286)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42286
https://ubuntu.com/security/CVE-2024-42286

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42286

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229484 - Linux Distros Unpatched Vulnerability : CVE-2024-42287
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Complete command early within lock A crash was observed while performing NPIV and FW reset, BUG: kernel NULL pointer dereference, address: 000000000000001c #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 1 PREEMPT_RT SMP NOPTI RIP: 0010:dma_direct_unmap_sg+0x51/0x1e0 RSP:
0018:ffffc90026f47b88 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000021 RCX: 0000000000000002 RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff8881041130d0 RBP: ffff8881041130d0 R08:
0000000000000000 R09: 0000000000000034 R10: ffffc90026f47c48 R11: 0000000000000031 R12: 0000000000000000 R13: 0000000000000000 R14: ffff8881565e4a20 R15: 0000000000000000 FS: 00007f4c69ed3d00(0000) GS:ffff889faac80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
000000000000001c CR3: 0000000288a50002 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __die_body+0x1a/0x60 ? page_fault_oops+0x16f/0x4a0 ? do_user_addr_fault+0x174/0x7f0 ? exc_page_fault+0x69/0x1a0 ? asm_exc_page_fault+0x22/0x30 ? dma_direct_unmap_sg+0x51/0x1e0 ? preempt_count_sub+0x96/0xe0 qla2xxx_qpair_sp_free_dma+0x29f/0x3b0 [qla2xxx] qla2xxx_qpair_sp_compl+0x60/0x80 [qla2xxx] __qla2x00_abort_all_cmds+0xa2/0x450 [qla2xxx] The command completion was done early while aborting the commands in driver unload path but outside lock to avoid the WARN_ON condition of performing dma_free_attr within the lock. However this caused race condition while command completion via multiple paths causing system crash. Hence complete the command early in unload path but within the lock to avoid race condition. (CVE-2024-42287)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42287
https://ubuntu.com/security/CVE-2024-42287

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
4.0 (CVSS2#AV:L/AC:H/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42287

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228363 - Linux Distros Unpatched Vulnerability : CVE-2024-42288
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix for possible memory corruption Init Control Block is dereferenced incorrectly. Correctly dereference ICB (CVE-2024-42288)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42288
https://ubuntu.com/security/CVE-2024-42288

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0007
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42288

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228930 - Linux Distros Unpatched Vulnerability : CVE-2024-42289
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: qla2xxx: During vport delete send async logout explicitly During vport delete, it is observed that during unload we hit a crash because of stale entries in outstanding command array. For all these stale I/O entries, eh_abort was issued and aborted (fast_fail_io = 2009h) but I/Os could not complete while vport delete is in process of deleting. BUG: kernel NULL pointer dereference, address: 000000000000001c #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops:
0000 [#1] PREEMPT SMP NOPTI Workqueue: qla2xxx_wq qla_do_work [qla2xxx] RIP:
0010:dma_direct_unmap_sg+0x51/0x1e0 RSP: 0018:ffffa1e1e150fc68 EFLAGS: 00010046 RAX: 0000000000000000 RBX:
0000000000000021 RCX: 0000000000000001 RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff8ce208a7a0d0 RBP: ffff8ce208a7a0d0 R08: 0000000000000000 R09: ffff8ce378aac9c8 R10: ffff8ce378aac8a0 R11:
ffffa1e1e150f9d8 R12: 0000000000000000 R13: 0000000000000000 R14: ffff8ce378aac9c8 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8d217f000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000001c CR3: 0000002089acc000 CR4: 0000000000350ee0 Call Trace: <TASK>
qla2xxx_qpair_sp_free_dma+0x417/0x4e0 ? qla2xxx_qpair_sp_compl+0x10d/0x1a0 ? qla2x00_status_entry+0x768/0x2830 ? newidle_balance+0x2f0/0x430 ? dequeue_entity+0x100/0x3c0 ? qla24xx_process_response_queue+0x6a1/0x19e0 ? __schedule+0x2d5/0x1140 ? qla_do_work+0x47/0x60 ? process_one_work+0x267/0x440 ? process_one_work+0x440/0x440 ? worker_thread+0x2d/0x3d0 ? process_one_work+0x440/0x440 ? kthread+0x156/0x180 ? set_kthread_struct+0x50/0x50 ? ret_from_fork+0x22/0x30 </TASK> Send out async logout explicitly for all the ports during vport delete.
(CVE-2024-42289)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42289
https://ubuntu.com/security/CVE-2024-42289

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42289

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229570 - Linux Distros Unpatched Vulnerability : CVE-2024-42290
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: irqchip/imx-irqsteer: Handle runtime power management correctly The power domain is automatically activated from clk_prepare(). However, on certain platforms like i.MX8QM and i.MX8QXP, the power-on handling invokes sleeping functions, which triggers the 'scheduling while atomic' bug in the context switch path during device probing: BUG:
scheduling while atomic: kworker/u13:1/48/0x00000002 Call trace: __schedule_bug+0x54/0x6c
__schedule+0x7f0/0xa94 schedule+0x5c/0xc4 schedule_preempt_disabled+0x24/0x40
__mutex_lock.constprop.0+0x2c0/0x540 __mutex_lock_slowpath+0x14/0x20 mutex_lock+0x48/0x54 clk_prepare_lock+0x44/0xa0 clk_prepare+0x20/0x44 imx_irqsteer_resume+0x28/0xe0 pm_generic_runtime_resume+0x2c/0x44 __genpd_runtime_resume+0x30/0x80 genpd_runtime_resume+0xc8/0x2c0
__rpm_callback+0x48/0x1d8 rpm_callback+0x6c/0x78 rpm_resume+0x490/0x6b4 __pm_runtime_resume+0x50/0x94 irq_chip_pm_get+0x2c/0xa0 __irq_do_set_handler+0x178/0x24c irq_set_chained_handler_and_data+0x60/0xa4 mxc_gpio_probe+0x160/0x4b0 Cure this by implementing the irq_bus_lock/sync_unlock() interrupt chip callbacks and handle power management in them as they are invoked from non-atomic context. [ tglx: Rewrote change log, added Fixes tag ] (CVE-2024-42290)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-42290
https://ubuntu.com/security/CVE-2024-42290

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0015
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-42290

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228502 - Linux Distros Unpatched Vulnerability : CVE-2024-43098
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock A deadlock may happen since the i3c_master_register() acquires &i3cbus->lock twice. See the log below. Use i3cdev->desc->info instead of calling i3c_device_info() to avoid acquiring the lock twice. v2: - Modified the title and commit message ============================================ WARNING: possible recursive locking detected 6.11.0-mainline -------------------------------------------- init/1 is trying to acquire lock: f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_bus_normaluse_lock but task is already holding lock: f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_master_register other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&i3cbus->lock); lock(&i3cbus->lock); *** DEADLOCK *** May be due to missing lock nesting notation 2 locks held by init/1: #0: fcffff809b6798f8 (&dev->mutex){....}-{3:3}, at: __driver_attach #1: f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at:
i3c_master_register stack backtrace: CPU: 6 UID: 0 PID: 1 Comm: init Call trace: dump_backtrace+0xfc/0x17c show_stack+0x18/0x28 dump_stack_lvl+0x40/0xc0 dump_stack+0x18/0x24 print_deadlock_bug+0x388/0x390
__lock_acquire+0x18bc/0x32ec lock_acquire+0x134/0x2b0 down_read+0x50/0x19c i3c_bus_normaluse_lock+0x14/0x24 i3c_device_get_info+0x24/0x58 i3c_device_uevent+0x34/0xa4 dev_uevent+0x310/0x384 kobject_uevent_env+0x244/0x414 kobject_uevent+0x14/0x20 device_add+0x278/0x460 device_register+0x20/0x34 i3c_master_register_new_i3c_devs+0x78/0x154 i3c_master_register+0x6a0/0x6d4 mtk_i3c_master_probe+0x3b8/0x4d8 platform_probe+0xa0/0xe0 really_probe+0x114/0x454
__driver_probe_device+0xa0/0x15c driver_probe_device+0x3c/0x1ac __driver_attach+0xc4/0x1f0 bus_for_each_dev+0x104/0x160 driver_attach+0x24/0x34 bus_add_driver+0x14c/0x294 driver_register+0x68/0x104
__platform_driver_register+0x20/0x30 init_module+0x20/0xfe4 do_one_initcall+0x184/0x464 do_init_module+0x58/0x1ec load_module+0xefc/0x10c8 __arm64_sys_finit_module+0x238/0x33c invoke_syscall+0x58/0x10c el0_svc_common+0xa8/0xdc do_el0_svc+0x1c/0x28 el0_svc+0x50/0xac el0t_64_sync_handler+0x70/0xbc el0t_64_sync+0x1a8/0x1ac (CVE-2024-43098)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-43098
https://ubuntu.com/security/CVE-2024-43098

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-43098

Plugin Information
Published: 2025/03/05, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228359 - Linux Distros Unpatched Vulnerability : CVE-2024-43168
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs has no further information about the claim, and suggests that affected Red Hat customers refer to available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A heap-buffer-overflow flaw was found in the cfg_mark_ports function within Unbound's config_file.c, which can lead to memory corruption.
This issue could allow an attacker with local access to provide specially crafted input, potentially causing the application to crash or allowing arbitrary code execution. This could result in a denial of service or unauthorized actions on the system. (CVE-2024-43168)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-43168

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
4.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
4.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.4
EPSS Score
0.0009
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-43168

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- unbound-libs
228736 - Linux Distros Unpatched Vulnerability : CVE-2024-43374
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument list, this triggers `Buf*` autocommands. If in such an autocommand the buffer that was just opened is closed (including the window where it is shown), this causes the window structure to be freed which contains a reference to the argument list that we are actually modifying. Once the autocommands are completed, the references to the window and argument list are no longer valid and as such cause an use-after-free. Impact is low since the user must either intentionally add some unusual autocommands that wipe a buffer during creation (either manually or by sourcing a malicious plugin), but it will crash Vim. The issue has been fixed as of Vim patch v9.1.0678. (CVE-2024-43374)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-43374
https://security-tracker.debian.org/tracker/CVE-2024-43374

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0007
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-43374

Plugin Information
Published: 2025/03/05, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
229370 - Linux Distros Unpatched Vulnerability : CVE-2024-43802
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vim is an improved version of the unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. So this may lead to the tb_off position within the typebuf variable to point outside of the valid buffer size, which can then later lead to a heap-buffer overflow in e.g.
ins_typebuf(). Therefore, when flushing the typeahead buffer, check if there is enough space left before advancing the off position. If not, fall back to flush current typebuf contents. It's not quite clear yet, what can lead to this situation. It seems to happen when error messages occur (which will cause Vim to flush the typeahead buffer) in comnination with several long mappgins and so it may eventually move the off position out of a valid buffer size. Impact is low since it is not easily reproducible and requires to have several mappings active and run into some error condition. But when this happens, this will cause a crash. The issue has been fixed as of Vim patch v9.1.0697. Users are advised to upgrade. There are no known workarounds for this issue. (CVE-2024-43802)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-43802

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
4.5 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
4.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.4
EPSS Score
0.0005
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-43802

Plugin Information
Published: 2025/03/05, Modified: 2025/11/07
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
228682 - Linux Distros Unpatched Vulnerability : CVE-2024-43816
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages On big endian architectures, it is possible to run into a memory out of bounds pointer dereference when FCP targets are zoned. In lpfc_prep_embed_io, the memcpy(ptr, fcp_cmnd, sgl->sge_len) is referencing a little endian formatted sgl->sge_len value. So, the memcpy can cause big endian systems to crash. Redefine the *sgl ptr as a struct sli4_sge_le to make it clear that we are referring to a little endian formatted data structure. And, update the routine with proper le32_to_cpu macro usages. (CVE-2024-43816)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-43816
https://ubuntu.com/security/CVE-2024-43816

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-43816

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228481 - Linux Distros Unpatched Vulnerability : CVE-2024-43829
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/qxl: Add check for drm_cvt_mode Add check for the return value of drm_cvt_mode() and return the error if it fails in order to avoid NULL pointer dereference. (CVE-2024-43829)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-43829
https://ubuntu.com/security/CVE-2024-43829

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-43829

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228876 - Linux Distros Unpatched Vulnerability : CVE-2024-43835
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix napi_skb_cache_put warning After the commit bdacf3e34945 (net: Use nested-BH locking for napi_alloc_cache.) was merged, the following warning began to appear: WARNING: CPU: 5 PID: 1 at net/core/skbuff.c:1451 napi_skb_cache_put+0x82/0x4b0 __warn+0x12f/0x340 napi_skb_cache_put+0x82/0x4b0 napi_skb_cache_put+0x82/0x4b0 report_bug+0x165/0x370 handle_bug+0x3d/0x80 exc_invalid_op+0x1a/0x50 asm_exc_invalid_op+0x1a/0x20 __free_old_xmit+0x1c8/0x510 napi_skb_cache_put+0x82/0x4b0
__free_old_xmit+0x1c8/0x510 __free_old_xmit+0x1c8/0x510 __pfx___free_old_xmit+0x10/0x10 The issue arises because virtio is assuming it's running in NAPI context even when it's not, such as in the netpoll case.
To resolve this, modify virtnet_poll_tx() to only set NAPI when budget is available. Same for virtnet_poll_cleantx(), which always assumed that it was in a NAPI context. (CVE-2024-43835)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-43835
https://ubuntu.com/security/CVE-2024-43835

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-43835

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229363 - Linux Distros Unpatched Vulnerability : CVE-2024-43840
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG When BPF_TRAMP_F_CALL_ORIG is set, the trampoline calls __bpf_tramp_enter() and
__bpf_tramp_exit() functions, passing them the struct bpf_tramp_image *im pointer as an argument in R0.
The trampoline generation code uses emit_addr_mov_i64() to emit instructions for moving the bpf_tramp_image address into R0, but emit_addr_mov_i64() assumes the address to be in the vmalloc() space and uses only 48 bits. Because bpf_tramp_image is allocated using kzalloc(), its address can use more than 48-bits, in this case the trampoline will pass an invalid address to __bpf_tramp_enter/exit() causing a kernel crash. Fix this by using emit_a64_mov_i64() in place of emit_addr_mov_i64() as it can work with addresses that are greater than 48-bits. (CVE-2024-43840)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-43840
https://ubuntu.com/security/CVE-2024-43840

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-43840

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228525 - Linux Distros Unpatched Vulnerability : CVE-2024-43861
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: usb: qmi_wwan: fix memory leak for not ip packets Free the unused skb when not ip packets arrive.
(CVE-2024-43861)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-43861
https://ubuntu.com/security/CVE-2024-43861

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-43861

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228632 - Linux Distros Unpatched Vulnerability : CVE-2024-43863
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix a deadlock in dma buf fence polling Introduce a version of the fence ops that on release doesn't remove the fence from the pending list, and thus doesn't require a lock to fix poll->fence wait->fence unref deadlocks. vmwgfx overwrites the wait callback to iterate over the list of all fences and update their status, to do that it holds a lock to prevent the list modifcations from other threads. The fence destroy callback both deletes the fence and removes it from the list of pending fences, for which it holds a lock. dma buf polling cb unrefs a fence after it's been signaled: so the poll calls the wait, which signals the fences, which are being destroyed. The destruction tries to acquire the lock on the pending fences list which it can never get because it's held by the wait from which it was called. Old bug, but not a lot of userspace apps were using dma-buf polling interfaces. Fix those, in particular this fixes KDE stalls/deadlock.
(CVE-2024-43863)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-43863
https://ubuntu.com/security/CVE-2024-43863

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-43863

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229071 - Linux Distros Unpatched Vulnerability : CVE-2024-43874
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix null pointer dereference in __sev_snp_shutdown_locked Fix a null pointer dereference induced by DEBUG_TEST_DRIVER_REMOVE. Return from __sev_snp_shutdown_locked() if the psp_device or the sev_device structs are not initialized. Without the fix, the driver will produce the following splat: ccp 0000:55:00.5: enabling device (0000 -> 0002) ccp 0000:55:00.5: sev enabled ccp 0000:55:00.5: psp enabled BUG: kernel NULL pointer dereference, address: 00000000000000f0 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC NOPTI CPU: 262 PID: 1 Comm: swapper/0 Not tainted 6.9.0-rc1+ #29 RIP: 0010:__sev_snp_shutdown_locked+0x2e/0x150 Code: 00 55 48 89 e5 41 57 41 56 41 54 53 48 83 ec 10 41 89 f7 49 89 fe 65 48 8b 04 25 28 00 00 00 48 89 45 d8 48 8b 05 6a 5a 7f 06 <4c> 8b a0 f0 00 00 00 41 0f b6 9c 24 a2 00 00 00 48 83 fb 02 0f 83 RSP:
0018:ffffb2ea4014b7b8 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff9e4acd2e0a28 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffb2ea4014b808 RBP: ffffb2ea4014b7e8 R08:
0000000000000106 R09: 000000000003d9c0 R10: 0000000000000001 R11: ffffffffa39ff070 R12: ffff9e49d40590c8 R13: 0000000000000000 R14: ffffb2ea4014b808 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff9e58b1e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
00000000000000f0 CR3: 0000000418a3e001 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <TASK> ?
__die_body+0x6f/0xb0 ? __die+0xcc/0xf0 ? page_fault_oops+0x330/0x3a0 ? save_trace+0x2a5/0x360 ? do_user_addr_fault+0x583/0x630 ? exc_page_fault+0x81/0x120 ? asm_exc_page_fault+0x2b/0x30 ?
__sev_snp_shutdown_locked+0x2e/0x150 __sev_firmware_shutdown+0x349/0x5b0 ? pm_runtime_barrier+0x66/0xe0 sev_dev_destroy+0x34/0xb0 psp_dev_destroy+0x27/0x60 sp_destroy+0x39/0x90 sp_pci_remove+0x22/0x60 pci_device_remove+0x4e/0x110 really_probe+0x271/0x4e0 __driver_probe_device+0x8f/0x160 driver_probe_device+0x24/0x120 __driver_attach+0xc7/0x280 ? driver_attach+0x30/0x30 bus_for_each_dev+0x10d/0x130 driver_attach+0x22/0x30 bus_add_driver+0x171/0x2b0 ? unaccepted_memory_init_kdump+0x20/0x20 driver_register+0x67/0x100 __pci_register_driver+0x83/0x90 sp_pci_init+0x22/0x30 sp_mod_init+0x13/0x30 do_one_initcall+0xb8/0x290 ? sched_clock_noinstr+0xd/0x10 ? local_clock_noinstr+0x3e/0x100 ? stack_depot_save_flags+0x21e/0x6a0 ? local_clock+0x1c/0x60 ? stack_depot_save_flags+0x21e/0x6a0 ? sched_clock_noinstr+0xd/0x10 ? local_clock_noinstr+0x3e/0x100 ?
__lock_acquire+0xd90/0xe30 ? sched_clock_noinstr+0xd/0x10 ? local_clock_noinstr+0x3e/0x100 ?
__create_object+0x66/0x100 ? local_clock+0x1c/0x60 ? __create_object+0x66/0x100 ? parameq+0x1b/0x90 ? parse_one+0x6d/0x1d0 ? parse_args+0xd7/0x1f0 ? do_initcall_level+0x180/0x180 do_initcall_level+0xb0/0x180 do_initcalls+0x60/0xa0 ? kernel_init+0x1f/0x1d0 do_basic_setup+0x41/0x50 kernel_init_freeable+0x1ac/0x230 ? rest_init+0x1f0/0x1f0 kernel_init+0x1f/0x1d0 ? rest_init+0x1f0/0x1f0 ret_from_fork+0x3d/0x50 ? rest_init+0x1f0/0x1f0 ret_from_fork_asm+0x11/0x20 </TASK> Modules linked in: CR2: 00000000000000f0 ---[ end trace 0000000000000000 ]--- RIP: 0010:__sev_snp_shutdown_locked+0x2e/0x150 Code: 00 55 48 89 e5 41 57 41 56 41 54 53 48 83 ec 10 41 89 f7 49 89 fe 65 48 8b 04 25 28 00 00 00 48 89 45 d8 48 8b 05 6a 5a 7f 06 <4c> 8b a0 f0 00 00 00 41 0f b6 9c 24 a2 00 00 00 48 83 fb 02 0f 83 RSP: 0018:ffffb2ea4014b7b8 EFLAGS:
00010286 RAX: 0000000000000000 RBX: ffff9e4acd2e0a28 RCX: 0000000000000000 RDX: 0000000 ---truncated--- (CVE-2024-43874)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-43874
https://ubuntu.com/security/CVE-2024-43874

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-43874

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229541 - Linux Distros Unpatched Vulnerability : CVE-2024-43880
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_erp: Fix object nesting warning ACLs in Spectrum-2 and newer ASICs can reside in the algorithmic TCAM (A-TCAM) or in the ordinary circuit TCAM (C-TCAM). The former can contain more ACLs (i.e., tc filters), but the number of masks in each region (i.e., tc chain) is limited. In order to mitigate the effects of the above limitation, the device allows filters to share a single mask if their masks only differ in up to 8 consecutive bits. For example, dst_ip/25 can be represented using dst_ip/24 with a delta of 1 bit. The C-TCAM does not have a limit on the number of masks being used (and therefore does not support mask aggregation), but can contain a limited number of filters. The driver uses the objagg library to perform the mask aggregation by passing it objects that consist of the filter's mask and whether the filter is to be inserted into the A-TCAM or the C-TCAM since filters in different TCAMs cannot share a mask. The set of created objects is dependent on the insertion order of the filters and is not necessarily optimal.
Therefore, the driver will periodically ask the library to compute a more optimal set (hints) by looking at all the existing objects. When the library asks the driver whether two objects can be aggregated the driver only compares the provided masks and ignores the A-TCAM / C-TCAM indication. This is the right thing to do since the goal is to move as many filters as possible to the A-TCAM. The driver also forbids two identical masks from being aggregated since this can only happen if one was intentionally put in the C-TCAM to avoid a conflict in the A-TCAM. The above can result in the following set of hints: H1: {mask X, A-TCAM} -> H2: {mask Y, A-TCAM} // X is Y + delta H3: {mask Y, C-TCAM} -> H4: {mask Z, A-TCAM} // Y is Z + delta After getting the hints from the library the driver will start migrating filters from one region to another while consulting the computed hints and instructing the device to perform a lookup in both regions during the transition. Assuming a filter with mask X is being migrated into the A-TCAM in the new region, the hints lookup will return H1. Since H2 is the parent of H1, the library will try to find the object associated with it and create it if necessary in which case another hints lookup (recursive) will be performed. This hints lookup for {mask Y, A-TCAM} will either return H2 or H3 since the driver passes the library an object comparison function that ignores the A-TCAM / C-TCAM indication. This can eventually lead to nested objects which are not supported by the library [1]. Fix by removing the object comparison function from both the driver and the library as the driver was the only user. That way the lookup will only return exact matches. I do not have a reliable reproducer that can reproduce the issue in a timely manner, but before the fix the issue would reproduce in several minutes and with the fix it does not reproduce in over an hour. Note that the current usefulness of the hints is limited because they include the C-TCAM indication and represent aggregation that cannot actually happen. This will be addressed in net-next. [1] WARNING: CPU: 0 PID: 153 at lib/objagg.c:170 objagg_obj_parent_assign+0xb5/0xd0 Modules linked in: CPU: 0 PID: 153 Comm: kworker/0:18 Not tainted 6.9.0-rc6-custom-g70fbc2c1c38b #42 Hardware name: Mellanox Technologies Ltd. MSN3700C/VMOD0008, BIOS 5.11 10/10/2018 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:objagg_obj_parent_assign+0xb5/0xd0 [...] Call Trace:
<TASK> __objagg_obj_get+0x2bb/0x580 objagg_obj_get+0xe/0x80 mlxsw_sp_acl_erp_mask_get+0xb5/0xf0 mlxsw_sp_acl_atcam_entry_add+0xe8/0x3c0 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270 mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510 process_one_work+0x151/0x370 (CVE-2024-43880)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-43880
https://ubuntu.com/security/CVE-2024-43880

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0013
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-43880

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229135 - Linux Distros Unpatched Vulnerability : CVE-2024-43890
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tracing: Fix overflow in get_free_elt() tracing_map->next_elt in get_free_elt() is at risk of overflowing. Once it overflows, new elements can still be inserted into the tracing_map even though the maximum number of elements (`max_elts`) has been reached. Continuing to insert elements after the overflow could result in the tracing_map containing tracing_map->max_size elements, leaving no empty entries. If any attempt is made to insert an element into a full tracing_map using `__tracing_map_insert()`, it will cause an infinite loop with preemption disabled, leading to a CPU hang problem. Fix this by preventing any further increments to tracing_map->next_elt once it reaches tracing_map->max_elt. (CVE-2024-43890)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-43890
https://ubuntu.com/security/CVE-2024-43890

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-43890

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228630 - Linux Distros Unpatched Vulnerability : CVE-2024-43893
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- serial: core: check uartclk for zero to avoid divide by zero Calling ioctl TIOCSSERIAL with an invalid baud_base can result in uartclk being zero, which will result in a divide by zero error in uart_get_divisor(). The check for uartclk being zero in uart_set_info() needs to be done before other settings are made as subsequent calls to ioctl TIOCSSERIAL for the same port would be impacted if the uartclk check was done where uartclk gets set. Oops: divide error: 0000 PREEMPT SMP KASAN PTI RIP:
0010:uart_get_divisor (drivers/tty/serial/serial_core.c:580) Call Trace: <TASK> serial8250_get_divisor (drivers/tty/serial/8250/8250_port.c:2576 drivers/tty/serial/8250/8250_port.c:2589) serial8250_do_set_termios (drivers/tty/serial/8250/8250_port.c:502 drivers/tty/serial/8250/8250_port.c:2741) serial8250_set_termios (drivers/tty/serial/8250/8250_port.c:2862) uart_change_line_settings (./include/linux/spinlock.h:376 ./include/linux/serial_core.h:608 drivers/tty/serial/serial_core.c:222) uart_port_startup (drivers/tty/serial/serial_core.c:342) uart_startup (drivers/tty/serial/serial_core.c:368) uart_set_info (drivers/tty/serial/serial_core.c:1034) uart_set_info_user (drivers/tty/serial/serial_core.c:1059) tty_set_serial (drivers/tty/tty_io.c:2637) tty_ioctl (drivers/tty/tty_io.c:2647 drivers/tty/tty_io.c:2791)
__x64_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:907 fs/ioctl.c:893 fs/ioctl.c:893) do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1)) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Rule: add (CVE-2024-43893)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-43893
https://ubuntu.com/security/CVE-2024-43893

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-43893

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228599 - Linux Distros Unpatched Vulnerability : CVE-2024-43894
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/client: fix null pointer dereference in drm_client_modeset_probe In drm_client_modeset_probe(), the return value of drm_mode_duplicate() is assigned to modeset->mode, which will lead to a possible NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. (CVE-2024-43894)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-43894
https://ubuntu.com/security/CVE-2024-43894

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-43894

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228482 - Linux Distros Unpatched Vulnerability : CVE-2024-43896
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ASoC: cs-amp-lib: Fix NULL pointer crash if efi.get_variable is NULL Call efi_rt_services_supported() to check that efi.get_variable exists before calling it. (CVE-2024-43896)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-43896
https://ubuntu.com/security/CVE-2024-43896

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-43896

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228477 - Linux Distros Unpatched Vulnerability : CVE-2024-43906
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/admgpu: fix dereferencing null pointer context When user space sets an invalid ta type, the pointer context will be empty. So it need to check the pointer context before using it (CVE-2024-43906)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-43906
https://ubuntu.com/security/CVE-2024-43906

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-43906

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229116 - Linux Distros Unpatched Vulnerability : CVE-2024-43908
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix the null pointer dereference to ras_manager Check ras_manager before using it (CVE-2024-43908)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-43908
https://ubuntu.com/security/CVE-2024-43908

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-43908

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229605 - Linux Distros Unpatched Vulnerability : CVE-2024-43912
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: nl80211: disallow setting special AP channel widths Setting the AP channel width is meant for use with the normal 20/40/... MHz channel width progression, and switching around in S1G or narrow channels isn't supported. Disallow that. (CVE-2024-43912)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-43912
https://security-tracker.debian.org/tracker/CVE-2024-43912
https://ubuntu.com/security/CVE-2024-43912

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-43912

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228633 - Linux Distros Unpatched Vulnerability : CVE-2024-44296
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The issue was addressed with improved checks. This issue is fixed in tvOS 18.1, iOS 18.1 and iPadOS 18.1, iOS 17.7.1 and iPadOS 17.7.1, watchOS 11.1, visionOS 2.1, macOS Sequoia 15.1, Safari 18.1. Processing maliciously crafted web content may prevent Content Security Policy from being enforced. (CVE-2024-44296)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-44296
https://security-tracker.debian.org/tracker/CVE-2024-44296
https://ubuntu.com/security/CVE-2024-44296

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
4.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.3
EPSS Score
0.0019
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-44296

Plugin Information
Published: 2025/03/05, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- webkit2gtk3
- webkit2gtk3-jsc
228485 - Linux Distros Unpatched Vulnerability : CVE-2024-44935
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: sctp: Fix null-ptr-deref in reuseport_add_sock(). syzbot reported a null-ptr-deref while accessing sk2->sk_reuseport_cb in reuseport_add_sock(). [0] The repro first creates a listener with SO_REUSEPORT. Then, it creates another listener on the same port and concurrently closes the first listener. The second listen() calls reuseport_add_sock() with the first listener as sk2, where sk2->sk_reuseport_cb is not expected to be cleared concurrently, but the close() does clear it by reuseport_detach_sock(). The problem is SCTP does not properly synchronise reuseport_alloc(), reuseport_add_sock(), and reuseport_detach_sock(). The caller of reuseport_alloc() and reuseport_{add,detach}_sock() must provide synchronisation for sockets that are classified into the same reuseport group. Otherwise, such sockets form multiple identical reuseport groups, and all groups except one would be silently dead. 1. Two sockets call listen() concurrently 2. No socket in the same group found in sctp_ep_hashtable[] 3. Two sockets call reuseport_alloc() and form two reuseport groups 4. Only one group hit first in __sctp_rcv_lookup_endpoint() receives incoming packets Also, the reported null-ptr-deref could occur. TCP/UDP guarantees that would not happen by holding the hash bucket lock. Let's apply the locking strategy to __sctp_hash_endpoint() and __sctp_unhash_endpoint().
[0]: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 1 UID: 0 PID: 10230 Comm: syz-executor119 Not tainted 6.10.0-syzkaller-12585-g301927d2d2eb #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 RIP:
0010:reuseport_add_sock+0x27e/0x5e0 net/core/sock_reuseport.c:350 Code: 00 0f b7 5d 00 bf 01 00 00 00 89 de e8 1b a4 ff f7 83 fb 01 0f 85 a3 01 00 00 e8 6d a0 ff f7 49 8d 7e 12 48 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 4b 02 00 00 41 0f b7 5e 12 49 8d 7e 14 RSP: 0018:ffffc9000b947c98 EFLAGS: 00010202 RAX:
0000000000000002 RBX: ffff8880252ddf98 RCX: ffff888079478000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000012 RBP: 0000000000000001 R08: ffffffff8993e18d R09: 1ffffffff1fef385 R10:
dffffc0000000000 R11: fffffbfff1fef386 R12: ffff8880252ddac0 R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f24e45b96c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffcced5f7b8 CR3: 00000000241be000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6:
00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __sctp_hash_endpoint net/sctp/input.c:762 [inline] sctp_hash_endpoint+0x52a/0x600 net/sctp/input.c:790 sctp_listen_start net/sctp/socket.c:8570 [inline] sctp_inet_listen+0x767/0xa20 net/sctp/socket.c:8625 __sys_listen_socket net/socket.c:1883 [inline] __sys_listen+0x1b7/0x230 net/socket.c:1894 __do_sys_listen net/socket.c:1902 [inline]
__se_sys_listen net/socket.c:1900 [inline] __x64_sys_listen+0x5a/0x70 net/socket.c:1900 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f24e46039b9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 91 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f24e45b9228 EFLAGS: 00000246 ORIG_RAX: 0000000000000032 RAX: ffffffffffffffda RBX: 00007f24e468e428 RCX: 00007f24e46039b9 RDX:
00007f24e46039b9 RSI: 0000000000000003 RDI: 0000000000000004 RBP: 00007f24e468e420 R08: 00007f24e45b96c0 R09: 00007f24e45b96c0 R10: 00007f24e45b96c0 R11: 0000000000000246 R12: 00007f24e468e42c R13:
---truncated--- (CVE-2024-44935)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-44935
https://ubuntu.com/security/CVE-2024-44935

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-44935

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228628 - Linux Distros Unpatched Vulnerability : CVE-2024-44944
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: use helper function to calculate expect ID Delete expectation path is missing a call to the nf_expect_get_id() helper function to calculate the expectation ID, otherwise LSB of the expectation object address is leaked to userspace. (CVE-2024-44944)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-44944
https://ubuntu.com/security/CVE-2024-44944

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-44944

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229261 - Linux Distros Unpatched Vulnerability : CVE-2024-44954
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: line6: Fix racy access to midibuf There can be concurrent accesses to line6 midibuf from both the URB completion callback and the rawmidi API access. This could be a cause of KMSAN warning triggered by syzkaller below (so put as reported-by here). This patch protects the midibuf call of the former code path with a spinlock for avoiding the possible races. (CVE-2024-44954)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-44954
https://ubuntu.com/security/CVE-2024-44954

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-44954

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229061 - Linux Distros Unpatched Vulnerability : CVE-2024-44957
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xen: privcmd: Switch from mutex to spinlock for irqfds irqfd_wakeup() gets EPOLLHUP, when it is called by eventfd_release() by way of wake_up_poll(&ctx->wqh, EPOLLHUP), which gets called under spin_lock_irqsave(). We can't use a mutex here as it will lead to a deadlock. Fix it by switching over to a spin lock. (CVE-2024-44957)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-44957
https://security-tracker.debian.org/tracker/CVE-2024-44957
https://ubuntu.com/security/CVE-2024-44957

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-44957

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228615 - Linux Distros Unpatched Vulnerability : CVE-2024-44961
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/amdgpu: Forward soft recovery errors to userspace As we discussed before[1], soft recovery should be forwarded to userspace, or we can get into a really bad state where apps will keep submitting hanging command buffers cascading us to a hard reset. 1:
https://lore.kernel.org/all/bf23d5ed-9a6b-43e7-84ee-8cbfd0d60f18@froggi.es/ (cherry picked from commit 434967aadbbbe3ad9103cc29e9a327de20fdba01) (CVE-2024-44961)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-44961
https://ubuntu.com/security/CVE-2024-44961

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-44961

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229050 - Linux Distros Unpatched Vulnerability : CVE-2024-44996
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: vsock: fix recursive ->recvmsg calls After a vsock socket has been added to a BPF sockmap, its prot->recvmsg has been replaced with vsock_bpf_recvmsg(). Thus the following recursiion could happen: vsock_bpf_recvmsg() -> __vsock_recvmsg()
-> vsock_connectible_recvmsg() -> prot->recvmsg() -> vsock_bpf_recvmsg() again We need to fix it by calling the original ->recvmsg() without any BPF sockmap logic in __vsock_recvmsg(). (CVE-2024-44996)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-44996
https://ubuntu.com/security/CVE-2024-44996

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-44996

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228817 - Linux Distros Unpatched Vulnerability : CVE-2024-45001
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix RX buf alloc_size alignment and atomic op panic The MANA driver's RX buffer alloc_size is passed into napi_build_skb() to create SKB. skb_shinfo(skb) is located at the end of skb, and its alignment is affected by the alloc_size passed into napi_build_skb(). The size needs to be aligned properly for better performance and atomic operations. Otherwise, on ARM64 CPU, for certain MTU settings like 4000, atomic operations may panic on the skb_shinfo(skb)->dataref due to alignment fault. To fix this bug, add proper alignment to the alloc_size calculation. Sample panic info: [ 253.298819] Unable to handle kernel paging request at virtual address ffff000129ba5cce [ 253.300900] Mem abort info: [ 253.301760] ESR = 0x0000000096000021 [ 253.302825] EC = 0x25: DABT (current EL), IL = 32 bits [ 253.304268] SET = 0, FnV = 0 [ 253.305172] EA = 0, S1PTW = 0 [ 253.306103] FSC = 0x21: alignment fault Call trace: __skb_clone+0xfc/0x198 skb_clone+0x78/0xe0 raw6_local_deliver+0xfc/0x228 ip6_protocol_deliver_rcu+0x80/0x500 ip6_input_finish+0x48/0x80 ip6_input+0x48/0xc0 ip6_sublist_rcv_finish+0x50/0x78 ip6_sublist_rcv+0x1cc/0x2b8 ipv6_list_rcv+0x100/0x150 __netif_receive_skb_list_core+0x180/0x220 netif_receive_skb_list_internal+0x198/0x2a8 __napi_poll+0x138/0x250 net_rx_action+0x148/0x330 handle_softirqs+0x12c/0x3a0 (CVE-2024-45001)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-45001
https://ubuntu.com/security/CVE-2024-45001

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-45001

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229526 - Linux Distros Unpatched Vulnerability : CVE-2024-45003
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vfs: Don't evict inode under the inode lru traversing context The inode reclaiming process(See function prune_icache_sb) collects all reclaimable inodes and mark them with I_FREEING flag at first, at that time, other processes will be stuck if they try getting these inodes (See function find_inode_fast), then the reclaiming process destroy the inodes by function dispose_list(). Some filesystems(eg. ext4 with ea_inode feature, ubifs with xattr) may do inode lookup in the inode evicting callback function, if the inode lookup is operated under the inode lru traversing context, deadlock problems may happen. Case 1: In function ext4_evict_inode(), the ea inode lookup could happen if ea_inode feature is enabled, the lookup process will be stuck under the evicting context like this: 1. File A has inode i_reg and an ea inode i_ea 2. getfattr(A, xattr_buf) // i_ea is added into lru // lru->i_ea 3. Then, following three processes running like this: PA PB echo 2 > /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // i_reg is added into lru, lru->i_ea->i_reg prune_icache_sb list_lru_walk_one inode_lru_isolate i_ea->i_state |= I_FREEING // set inode state inode_lru_isolate __iget(i_reg) spin_unlock(&i_reg->i_lock) spin_unlock(lru_lock) rm file A i_reg->nlink = 0 iput(i_reg) // i_reg->nlink is 0, do evict ext4_evict_inode ext4_xattr_delete_inode ext4_xattr_inode_dec_ref_all ext4_xattr_inode_iget ext4_iget(i_ea->i_ino) iget_locked find_inode_fast __wait_on_freeing_inode(i_ea) ---- AA deadlock dispose_list // cannot be executed by prune_icache_sb wake_up_bit(&i_ea->i_state) Case 2: In deleted inode writing function ubifs_jnl_write_inode(), file deleting process holds BASEHD's wbuf->io_mutex while getting the xattr inode, which could race with inode reclaiming process(The reclaiming process could try locking BASEHD's wbuf->io_mutex in inode evicting function), then an ABBA deadlock problem would happen as following: 1.
File A has inode ia and a xattr(with inode ixa), regular file B has inode ib and a xattr. 2. getfattr(A, xattr_buf) // ixa is added into lru // lru->ixa 3. Then, following three processes running like this: PA PB PC echo 2 > /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // ib and ia are added into lru, lru->ixa->ib->ia prune_icache_sb list_lru_walk_one inode_lru_isolate ixa->i_state |= I_FREEING // set inode state inode_lru_isolate __iget(ib) spin_unlock(&ib->i_lock) spin_unlock(lru_lock) rm file B ib->nlink = 0 rm file A iput(ia) ubifs_evict_inode(ia) ubifs_jnl_delete_inode(ia) ubifs_jnl_write_inode(ia) make_reservation(BASEHD) // Lock wbuf->io_mutex ubifs_iget(ixa->i_ino) iget_locked find_inode_fast __wait_on_freeing_inode(ixa) | iput(ib) // ib->nlink is 0, do evict | ubifs_evict_inode | ubifs_jnl_delete_inode(ib) ubifs_jnl_write_inode ABBA deadlock
-----make_reservation(BASEHD) dispose_list // cannot be executed by prune_icache_sb wake_up_bit(&ixa->i_state) Fix the possible deadlock by using new inode state flag I_LRU_ISOLATING to pin the inode in memory while inode_lru_isolate( ---truncated--- (CVE-2024-45003)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-45003
https://ubuntu.com/security/CVE-2024-45003

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-45003

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229055 - Linux Distros Unpatched Vulnerability : CVE-2024-45006
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration re-enumerating full-speed devices after a failed address device command can trigger a NULL pointer dereference. Full-speed devices may need to reconfigure the endpoint 0 Max Packet Size value during enumeration. Usb core calls usb_ep0_reinit() in this case, which ends up calling xhci_configure_endpoint(). On Panther point xHC the xhci_configure_endpoint() function will additionally check and reserve bandwidth in software. Other hosts do this in hardware If xHC address device command fails then a new xhci_virt_device structure is allocated as part of re-enabling the slot, but the bandwidth table pointers are not set up properly here. This triggers the NULL pointer dereference the next time usb_ep0_reinit() is called and xhci_configure_endpoint() tries to check and reserve bandwidth [46710.713538] usb 3-1: new full-speed USB device number 5 using xhci_hcd [46710.713699] usb 3-1: Device not responding to setup address. [46710.917684] usb 3-1: Device not responding to setup address.
[46711.125536] usb 3-1: device not accepting address 5, error -71 [46711.125594] BUG: kernel NULL pointer dereference, address: 0000000000000008 [46711.125600] #PF: supervisor read access in kernel mode [46711.125603] #PF: error_code(0x0000) - not-present page [46711.125606] PGD 0 P4D 0 [46711.125610] Oops:
Oops: 0000 [#1] PREEMPT SMP PTI [46711.125615] CPU: 1 PID: 25760 Comm: kworker/1:2 Not tainted 6.10.3_2 #1 [46711.125620] Hardware name: Gigabyte Technology Co., Ltd. [46711.125623] Workqueue: usb_hub_wq hub_event [usbcore] [46711.125668] RIP: 0010:xhci_reserve_bandwidth (drivers/usb/host/xhci.c Fix this by making sure bandwidth table pointers are set up correctly after a failed address device command, and additionally by avoiding checking for bandwidth in cases like this where no actual endpoints are added or removed, i.e.
only context for default control endpoint 0 is evaluated. (CVE-2024-45006)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-45006
https://ubuntu.com/security/CVE-2024-45006

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-45006

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228764 - Linux Distros Unpatched Vulnerability : CVE-2024-45008
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Input: MT - limit max slots syzbot is reporting too large allocation at input_mt_init_slots(), for num_slots is supplied from userspace using ioctl(UI_DEV_CREATE). Since nobody knows possible max slots, this patch chose 1024. (CVE-2024-45008)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-45008
https://ubuntu.com/security/CVE-2024-45008

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0011
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-45008

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249457 - Linux Distros Unpatched Vulnerability : CVE-2024-45012
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: nouveau/firmware: use dma non-coherent allocator Currently, enabling SG_DEBUG in the kernel will cause nouveau to hit a BUG() on startup, when the iommu is enabled: kernel BUG at include/linux/scatterlist.h:187! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 7 PID: 930 Comm: (udev-worker) Not tainted 6.9.0-rc3Lyude-Test+ #30 Hardware name: MSI MS-7A39/A320M GAMING PRO (MS-7A39), BIOS 1.I0 01/22/2019 RIP: 0010:sg_init_one+0x85/0xa0 Code: 69 88 32 01 83 e1 03 f6 c3 03 75 20 a8 01 75 1e 48 09 cb 41 89 54 24 08 49 89 1c 24 41 89 6c 24 0c 5b 5d 41 5c e9 7b b9 88 00 <0f> 0b 0f 0b 0f 0b 48 8b 05 5e 46 9a 01 eb b2 66 66 2e 0f 1f 84 00 RSP: 0018:ffffa776017bf6a0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffa77600d87000 RCX: 000000000000002b RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffa77680d87000 RBP: 000000000000e000 R08: 0000000000000000 R09:
0000000000000000 R10: ffff98f4c46aa508 R11: 0000000000000000 R12: ffff98f4c46aa508 R13: ffff98f4c46aa008 R14: ffffa77600d4a000 R15: ffffa77600d4a018 FS: 00007feeb5aae980(0000) GS:ffff98f5c4dc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f22cb9a4520 CR3:
00000001043ba000 CR4: 00000000003506f0 Call Trace: <TASK> ? die+0x36/0x90 ? do_trap+0xdd/0x100 ? sg_init_one+0x85/0xa0 ? do_error_trap+0x65/0x80 ? sg_init_one+0x85/0xa0 ? exc_invalid_op+0x50/0x70 ? sg_init_one+0x85/0xa0 ? asm_exc_invalid_op+0x1a/0x20 ? sg_init_one+0x85/0xa0 nvkm_firmware_ctor+0x14a/0x250 [nouveau] nvkm_falcon_fw_ctor+0x42/0x70 [nouveau] ga102_gsp_booter_ctor+0xb4/0x1a0 [nouveau] r535_gsp_oneinit+0xb3/0x15f0 [nouveau] ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? nvkm_udevice_new+0x95/0x140 [nouveau] ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? ktime_get+0x47/0xb0 Fix this by using the non- coherent allocator instead, I think there might be a better answer to this, but it involve ripping up some of APIs using sg lists. (CVE-2024-45012)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-45012
https://ubuntu.com/security/CVE-2024-45012

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-45012

Plugin Information
Published: 2025/08/15, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228583 - Linux Distros Unpatched Vulnerability : CVE-2024-45013
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: nvme: move stopping keep-alive into nvme_uninit_ctrl() Commit 4733b65d82bd (nvme: start keep-alive after admin queue setup) moves starting keep-alive from nvme_start_ctrl() into nvme_init_ctrl_finish(), but don't move stopping keep-alive into nvme_uninit_ctrl(), so keep-alive work can be started and keep pending after failing to start controller, finally use-after-free is triggered if nvme host driver is unloaded. This patch fixes kernel panic when running nvme/004 in case that connection failure is triggered, by moving stopping keep-alive into nvme_uninit_ctrl(). This way is reasonable because keep-alive is now started in nvme_init_ctrl_finish().
(CVE-2024-45013)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-45013
https://ubuntu.com/security/CVE-2024-45013

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-45013

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229008 - Linux Distros Unpatched Vulnerability : CVE-2024-45017
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix IPsec RoCE MPV trace call Prevent the call trace below from happening, by not allowing IPsec creation over a slave, if master device doesn't support IPsec. WARNING: CPU: 44 PID: 16136 at kernel/locking/rwsem.c:240 down_read+0x75/0x94 Modules linked in: esp4_offload esp4 act_mirred act_vlan cls_flower sch_ingress mlx5_vdpa vringh vhost_iotlb vdpa mst_pciconf(OE) nfsv3 nfs_acl nfs lockd grace fscache netfs xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_counter nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 rfkill cuse fuse rpcrdma sunrpc rdma_ucm ib_srpt ib_isert iscsi_target_mod target_core_mod ib_umad ib_iser libiscsi scsi_transport_iscsi rdma_cm ib_ipoib iw_cm ib_cm ipmi_ssif intel_rapl_msr intel_rapl_common amd64_edac edac_mce_amd kvm_amd kvm irqbypass crct10dif_pclmul crc32_pclmul mlx5_ib ghash_clmulni_intel sha1_ssse3 dell_smbios ib_uverbs aesni_intel crypto_simd dcdbas wmi_bmof dell_wmi_descriptor cryptd pcspkr ib_core acpi_ipmi sp5100_tco ccp i2c_piix4 ipmi_si ptdma k10temp ipmi_devintf ipmi_msghandler acpi_power_meter acpi_cpufreq ext4 mbcache jbd2 sd_mod t10_pi sg mgag200 drm_kms_helper syscopyarea sysfillrect mlx5_core sysimgblt fb_sys_fops cec ahci libahci mlxfw drm pci_hyperv_intf libata tg3 sha256_ssse3 tls megaraid_sas i2c_algo_bit psample wmi dm_mirror dm_region_hash dm_log dm_mod [last unloaded: mst_pci] CPU: 44 PID: 16136 Comm: kworker/44:3 Kdump: loaded Tainted: GOE 5.15.0-20240509.el8uek.uek7_u3_update_v6.6_ipsec_bf.x86_64 #2 Hardware name: Dell Inc.
PowerEdge R7525/074H08, BIOS 2.0.3 01/15/2021 Workqueue: events xfrm_state_gc_task RIP:
0010:down_read+0x75/0x94 Code: 00 48 8b 45 08 65 48 8b 14 25 80 fc 01 00 83 e0 02 48 09 d0 48 83 c8 01 48 89 45 08 5d 31 c0 89 c2 89 c6 89 c7 e9 cb 88 3b 00 <0f> 0b 48 8b 45 08 a8 01 74 b2 a8 02 75 ae 48 89 c2 48 83 ca 02 f0 RSP: 0018:ffffb26387773da8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffa08b658af900 RCX:
0000000000000001 RDX: 0000000000000000 RSI: ff886bc5e1366f2f RDI: 0000000000000000 RBP: ffffa08b658af940 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12:
ffffa0a9bfb31540 R13: ffffa0a9bfb37900 R14: 0000000000000000 R15: ffffa0a9bfb37905 FS:
0000000000000000(0000) GS:ffffa0a9bfb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 CR2: 000055a45ed814e8 CR3: 000000109038a000 CR4: 0000000000350ee0 Call Trace: <TASK> ? show_trace_log_lvl+0x1d6/0x2f9 ? show_trace_log_lvl+0x1d6/0x2f9 ? mlx5_devcom_for_each_peer_begin+0x29/0x60 [mlx5_core] ? down_read+0x75/0x94 ? __warn+0x80/0x113 ? down_read+0x75/0x94 ? report_bug+0xa4/0x11d ? handle_bug+0x35/0x8b ? exc_invalid_op+0x14/0x75 ? asm_exc_invalid_op+0x16/0x1b ? down_read+0x75/0x94 ? down_read+0xe/0x94 mlx5_devcom_for_each_peer_begin+0x29/0x60 [mlx5_core] mlx5_ipsec_fs_roce_tx_destroy+0xb1/0x130 [mlx5_core] tx_destroy+0x1b/0xc0 [mlx5_core] tx_ft_put+0x53/0xc0 [mlx5_core] mlx5e_xfrm_free_state+0x45/0x90 [mlx5_core] ___xfrm_state_destroy+0x10f/0x1a2 xfrm_state_gc_task+0x81/0xa9 process_one_work+0x1f1/0x3c6 worker_thread+0x53/0x3e4 ? process_one_work.cold+0x46/0x3c kthread+0x127/0x144 ? set_kthread_struct+0x60/0x52 ret_from_fork+0x22/0x2d </TASK> ---[ end trace 5ef7896144d398e1 ]--- (CVE-2024-45017)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-45017
https://ubuntu.com/security/CVE-2024-45017

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-45017

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229431 - Linux Distros Unpatched Vulnerability : CVE-2024-45019
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Take state lock during tx timeout reporter mlx5e_safe_reopen_channels() requires the state lock taken. The referenced changed in the Fixes tag removed the lock to fix another issue. This patch adds it back but at a later point (when calling mlx5e_safe_reopen_channels()) to avoid the deadlock referenced in the Fixes tag. (CVE-2024-45019)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-45019
https://ubuntu.com/security/CVE-2024-45019

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-45019

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228672 - Linux Distros Unpatched Vulnerability : CVE-2024-45025
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE copy_fd_bitmaps(new, old, count) is expected to copy the first count/BITS_PER_LONG bits from old->full_fds_bits[] and fill the rest with zeroes. What it does is copying enough words (BITS_TO_LONGS(count/BITS_PER_LONG)), then memsets the rest.
That works fine, *if* all bits past the cutoff point are clear. Otherwise we are risking garbage from the last word we'd copied. For most of the callers that is true - expand_fdtable() has count equal to old->max_fds, so there's no open descriptors past count, let alone fully occupied words in ->open_fds[], which is what bits in ->full_fds_bits[] correspond to. The other caller (dup_fd()) passes sane_fdtable_size(old_fdt, max_fds), which is the smallest multiple of BITS_PER_LONG that covers all opened descriptors below max_fds. In the common case (copying on fork()) max_fds is ~0U, so all opened descriptors will be below it and we are fine, by the same reasons why the call in expand_fdtable() is safe. Unfortunately, there is a case where max_fds is less than that and where we might, indeed, end up with junk in ->full_fds_bits[] - close_range(from, to, CLOSE_RANGE_UNSHARE) with * descriptor table being currently shared * 'to' being above the current capacity of descriptor table * 'from' being just under some chunk of opened descriptors. In that case we end up with observably wrong behaviour - e.g. spawn a child with CLONE_FILES, get all descriptors in range 0..127 open, then close_range(64, ~0U, CLOSE_RANGE_UNSHARE) and watch dup(0) ending up with descriptor #128, despite #64 being observably not open. The minimally invasive fix would be to deal with that in dup_fd(). If this proves to add measurable overhead, we can go that way, but let's try to fix copy_fd_bitmaps() first. * new helper:
bitmap_copy_and_expand(to, from, bits_to_copy, size). * make copy_fd_bitmaps() take the bitmap size in words, rather than bits; it's 'count' argument is always a multiple of BITS_PER_LONG, so we are not losing any information, and that way we can use the same helper for all three bitmaps - compiler will see that count is a multiple of BITS_PER_LONG for the large ones, so it'll generate plain memcpy()+memset().
Reproducer added to tools/testing/selftests/core/close_range_test.c (CVE-2024-45025)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-45025
https://ubuntu.com/security/CVE-2024-45025

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-45025

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245816 - Linux Distros Unpatched Vulnerability : CVE-2024-45027
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Check for xhci->interrupters being allocated in xhci_mem_clearup() If xhci_mem_init() fails, it calls into xhci_mem_cleanup() to mop up the damage. If it fails early enough, before xhci->interrupters is allocated but after xhci->max_interrupters has been set, which happens in most (all?) cases, things get uglier, as xhci_mem_cleanup() unconditionally derefences xhci->interrupters. With prejudice. Gate the interrupt freeing loop with a check on xhci->interrupters being non-NULL. Found while debugging a DMA allocation issue that led the XHCI driver on this exact path. (CVE-2024-45027)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-45027
https://ubuntu.com/security/CVE-2024-45027

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-45027

Plugin Information
Published: 2025/08/08, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244218 - Linux Distros Unpatched Vulnerability : CVE-2024-45029
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: i2c: tegra: Do not mark ACPI devices as irq safe On ACPI machines, the tegra i2c module encounters an issue due to a mutex being called inside a spinlock. This leads to the following bug: BUG: sleeping function called from invalid context at kernel/locking/mutex.c:585 ... Call trace: __might_sleep __mutex_lock_common mutex_lock_nested acpi_subsys_runtime_resume rpm_resume tegra_i2c_xfer The problem arises because during
__pm_runtime_resume(), the spinlock &dev->power.lock is acquired before rpm_resume() is called. Later, rpm_resume() invokes acpi_subsys_runtime_resume(), which relies on mutexes, triggering the error. To address this issue, devices on ACPI are now marked as not IRQ-safe, considering the dependency of acpi_subsys_runtime_resume() on mutexes. (CVE-2024-45029)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-45029
https://ubuntu.com/security/CVE-2024-45029

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-45029

Plugin Information
Published: 2025/08/06, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260277 - Linux Distros Unpatched Vulnerability : CVE-2024-45306
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vim is an open source, command line text editor. Patch v9.1.0038 optimized how the cursor position is calculated and removed a loop, that verified that the cursor position always points inside a line and does not become invalid by pointing beyond the end of a line. Back then we assumed this loop is unnecessary.
However, this change made it possible that the cursor position stays invalid and points beyond the end of a line, which would eventually cause a heap-buffer-overflow when trying to access the line pointer at the specified cursor position. It's not quite clear yet, what can lead to this situation that the cursor points to an invalid position. That's why patch v9.1.0707 does not include a test case. The only observed impact has been a program crash. This issue has been addressed in with the patch v9.1.0707. All users are advised to upgrade. (CVE-2024-45306)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-45306

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0008
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-45306

Plugin Information
Published: 2025/09/02, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
228792 - Linux Distros Unpatched Vulnerability : CVE-2024-45336
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2. (CVE-2024-45336)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-45336
https://security-tracker.debian.org/tracker/CVE-2024-45336
https://ubuntu.com/security/CVE-2024-45336

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
5.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.0
EPSS Score
0.0008
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-45336

Plugin Information
Published: 2025/03/05, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- containernetworking-plugins
- podman
228810 - Linux Distros Unpatched Vulnerability : CVE-2024-45341
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs. (CVE-2024-45341)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-45341
https://security-tracker.debian.org/tracker/CVE-2024-45341
https://ubuntu.com/security/CVE-2024-45341

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
5.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.0
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-45341

Plugin Information
Published: 2025/03/05, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- conmon
- containernetworking-plugins
- podman
- rhc
229486 - Linux Distros Unpatched Vulnerability : CVE-2024-46672
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion wpa_supplicant 2.11 sends since 1efdba5fdc2c (Handle PMKSA flush in the driver for SAE/OWE offload cases) SSID based PMKSA del commands. brcmfmac is not prepared and tries to dereference the NULL bssid and pmkid pointers in cfg80211_pmksa. PMKID_V3 operations support SSID based updates so copy the SSID. (CVE-2024-46672)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46672
https://ubuntu.com/security/CVE-2024-46672

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-46672

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228944 - Linux Distros Unpatched Vulnerability : CVE-2024-46678
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bonding: change ipsec_lock from spin lock to mutex In the cited commit, bond->ipsec_lock is added to protect ipsec_list, hence xdo_dev_state_add and xdo_dev_state_delete are called inside this lock. As ipsec_lock is a spin lock and such xfrmdev ops may sleep, scheduling while atomic will be triggered when changing bond's active slave. [ 101.055189] BUG: scheduling while atomic: bash/902/0x00000200 [ 101.055726] Modules linked in: [ 101.058211] CPU: 3 PID: 902 Comm: bash Not tainted 6.9.0-rc4+ #1 [ 101.058760] Hardware name: [ 101.059434] Call Trace: [ 101.059436] <TASK> [ 101.060873] dump_stack_lvl+0x51/0x60 [ 101.061275] __schedule_bug+0x4e/0x60 [ 101.061682] __schedule+0x612/0x7c0 [ 101.062078] ? __mod_timer+0x25c/0x370 [ 101.062486] schedule+0x25/0xd0 [ 101.062845] schedule_timeout+0x77/0xf0 [ 101.063265] ? asm_common_interrupt+0x22/0x40 [ 101.063724] ?
__bpf_trace_itimer_state+0x10/0x10 [ 101.064215] __wait_for_common+0x87/0x190 [ 101.064648] ? usleep_range_state+0x90/0x90 [ 101.065091] cmd_exec+0x437/0xb20 [mlx5_core] [ 101.065569] mlx5_cmd_do+0x1e/0x40 [mlx5_core] [ 101.066051] mlx5_cmd_exec+0x18/0x30 [mlx5_core] [ 101.066552] mlx5_crypto_create_dek_key+0xea/0x120 [mlx5_core] [ 101.067163] ? bonding_sysfs_store_option+0x4d/0x80 [bonding] [ 101.067738] ? kmalloc_trace+0x4d/0x350 [ 101.068156] mlx5_ipsec_create_sa_ctx+0x33/0x100 [mlx5_core] [ 101.068747] mlx5e_xfrm_add_state+0x47b/0xaa0 [mlx5_core] [ 101.069312] bond_change_active_slave+0x392/0x900 [bonding] [ 101.069868] bond_option_active_slave_set+0x1c2/0x240 [bonding] [ 101.070454] __bond_opt_set+0xa6/0x430 [bonding] [ 101.070935] __bond_opt_set_notify+0x2f/0x90 [bonding] [ 101.071453] bond_opt_tryset_rtnl+0x72/0xb0 [bonding] [ 101.071965] bonding_sysfs_store_option+0x4d/0x80 [bonding] [ 101.072567] kernfs_fop_write_iter+0x10c/0x1a0 [ 101.073033] vfs_write+0x2d8/0x400 [ 101.073416] ? alloc_fd+0x48/0x180 [ 101.073798] ksys_write+0x5f/0xe0 [ 101.074175] do_syscall_64+0x52/0x110 [ 101.074576] entry_SYSCALL_64_after_hwframe+0x4b/0x53 As bond_ipsec_add_sa_all and bond_ipsec_del_sa_all are only called from bond_change_active_slave, which requires holding the RTNL lock. And bond_ipsec_add_sa and bond_ipsec_del_sa are xfrm state xdo_dev_state_add and xdo_dev_state_delete APIs, which are in user context. So ipsec_lock doesn't have to be spin lock, change it to mutex, and thus the above issue can be resolved. (CVE-2024-46678)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46678
https://security-tracker.debian.org/tracker/CVE-2024-46678
https://ubuntu.com/security/CVE-2024-46678

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
3.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
3.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46678

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229400 - Linux Distros Unpatched Vulnerability : CVE-2024-46681
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- pktgen: use cpus_read_lock() in pg_net_init() I have seen the WARN_ON(smp_processor_id() != cpu) firing in pktgen_thread_worker() during tests. We must use cpus_read_lock()/cpus_read_unlock() around the for_each_online_cpu(cpu) loop. While we are at it use WARN_ON_ONCE() to avoid a possible syslog flood.
(CVE-2024-46681)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46681
https://security-tracker.debian.org/tracker/CVE-2024-46681
https://ubuntu.com/security/CVE-2024-46681

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46681

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246601 - Linux Distros Unpatched Vulnerability : CVE-2024-46692
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: Mark get_wq_ctx() as atomic call Currently get_wq_ctx() is wrongly configured as a standard call. When two SMC calls are in sleep and one SMC wakes up, it calls get_wq_ctx() to resume the corresponding sleeping thread. But if get_wq_ctx() is interrupted, goes to sleep and another SMC call is waiting to be allocated a waitq context, it leads to a deadlock. To avoid this get_wq_ctx() must be an atomic call and can't be a standard SMC call. Hence mark get_wq_ctx() as a fast call. (CVE-2024-46692)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46692
https://ubuntu.com/security/CVE-2024-46692

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-46692

Plugin Information
Published: 2025/08/09, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228529 - Linux Distros Unpatched Vulnerability : CVE-2024-46698
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- video/aperture: optionally match the device in sysfb_disable() In aperture_remove_conflicting_pci_devices(), we currently only call sysfb_disable() on vga class devices.
This leads to the following problem when the pimary device is not VGA compatible: 1. A PCI device with a non-VGA class is the boot display 2. That device is probed first and it is not a VGA device so sysfb_disable() is not called, but the device resources are freed by aperture_detach_platform_device() 3.
Non-primary GPU has a VGA class and it ends up calling sysfb_disable() 4. NULL pointer dereference via sysfb_disable() since the resources have already been freed by aperture_detach_platform_device() when it was called by the other device. Fix this by passing a device pointer to sysfb_disable() and checking the device to determine if we should execute it or not. v2: Fix build when CONFIG_SCREEN_INFO is not set v3:
Move device check into the mutex Drop primary variable in aperture_remove_conflicting_pci_devices() Drop
__init on pci sysfb_pci_dev_is_enabled() (CVE-2024-46698)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46698
https://security-tracker.debian.org/tracker/CVE-2024-46698
https://ubuntu.com/security/CVE-2024-46698

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-46698

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248590 - Linux Distros Unpatched Vulnerability : CVE-2024-46706
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tty: serial: fsl_lpuart: mark last busy before uart_add_one_port With earlycon initcall_debug=1 loglevel=8 in bootargs, kernel sometimes boot hang. It is because normal console still is not ready, but runtime suspend is called, so early console putchar will hang in waiting TRDE set in UARTSTAT. The lpuart driver has auto suspend delay set to 3000ms, but during uart_add_one_port, a child device serial ctrl will added and probed with its pm runtime enabled(see serial_ctrl.c). The runtime suspend call path is: device_add |-> bus_probe_device |->device_initial_probe |->__device_attach |-> pm_runtime_get_sync(dev->parent); |-> pm_request_idle(dev);
|-> pm_runtime_put(dev->parent); So in the end, before normal console ready, the lpuart get runtime suspended. And earlycon putchar will hang. To address the issue, mark last busy just after pm_runtime_enable, three seconds is long enough to switch from bootconsole to normal console.
(CVE-2024-46706)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46706
https://ubuntu.com/security/CVE-2024-46706

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-46706

Plugin Information
Published: 2025/08/12, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228579 - Linux Distros Unpatched Vulnerability : CVE-2024-46707
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3 On a system with a GICv3, if a guest hasn't been configured with GICv3 and that the host is not capable of GICv2 emulation, a write to any of the ICC_*SGI*_EL1 registers is trapped to EL2. We therefore try to emulate the SGI access, only to hit a NULL pointer as no private interrupt is allocated (no GIC, remember?). The obvious fix is to give the guest what it deserves, in the shape of a UNDEF exception. (CVE-2024-46707)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46707
https://ubuntu.com/security/CVE-2024-46707

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46707

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248732 - Linux Distros Unpatched Vulnerability : CVE-2024-46709
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix prime with external buffers Make sure that for external buffers mapping goes through the dma_buf interface instead of trying to access pages directly. External buffers might not provide direct access to readable/writable pages so to make sure the bo's created from external dma_bufs can be read dma_buf interface has to be used. Fixes crashes in IGT's kms_prime with vgem. Regular desktop usage won't trigger this due to the fact that virtual machines will not have multiple GPUs but it enables better test coverage in IGT. (CVE-2024-46709)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46709
https://ubuntu.com/security/CVE-2024-46709

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-46709

Plugin Information
Published: 2025/08/12, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244266 - Linux Distros Unpatched Vulnerability : CVE-2024-46710
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Prevent unmapping active read buffers The kms paths keep a persistent map active to read and compare the cursor buffer. These maps can race with each other in simple scenario where: a) buffer a mapped for update b) buffer a mapped for compare c) do the compare d) unmap a for compare e) update the cursor f) unmap a for update At step e the buffer has been unmapped and the read contents is bogus. Prevent unmapping of active read buffers by simply keeping a count of how many paths have currently active maps and unmap only when the count reaches 0. (CVE-2024-46710)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46710
https://ubuntu.com/security/CVE-2024-46710

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-46710

Plugin Information
Published: 2025/08/06, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229236 - Linux Distros Unpatched Vulnerability : CVE-2024-46715
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- driver: iio: add missing checks on iio_info's callback access Some callbacks from iio_info structure are accessed without any check, so if a driver doesn't implement them trying to access the corresponding sysfs entries produce a kernel oops such as: [ 2203.527791] Unable to handle kernel NULL pointer dereference at virtual address 00000000 when execute [...] [ 2203.783416] Call trace: [ 2203.783429] iio_read_channel_info_avail from dev_attr_show+0x18/0x48 [ 2203.789807] dev_attr_show from sysfs_kf_seq_show+0x90/0x120 [ 2203.794181] sysfs_kf_seq_show from seq_read_iter+0xd0/0x4e4 [ 2203.798555] seq_read_iter from vfs_read+0x238/0x2a0 [ 2203.802236] vfs_read from ksys_read+0xa4/0xd4 [ 2203.805385] ksys_read from ret_fast_syscall+0x0/0x54 [ 2203.809135] Exception stack(0xe0badfa8 to 0xe0badff0) [ 2203.812880] dfa0: 00000003 b6f10f80 00000003 b6eab000 00020000 00000000 [ 2203.819746] dfc0: 00000003 b6f10f80 7ff00000 00000003 00000003 00000000 00020000 00000000 [ 2203.826619] dfe0: b6e1bc88 bed80958 b6e1bc94 b6e1bcb0 [ 2203.830363] Code: bad PC value [ 2203.832695] ---[ end trace 0000000000000000 ]--- (CVE-2024-46715)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46715
https://security-tracker.debian.org/tracker/CVE-2024-46715
https://ubuntu.com/security/CVE-2024-46715

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46715

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228707 - Linux Distros Unpatched Vulnerability : CVE-2024-46717
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mlx5e: SHAMPO, Fix incorrect page release Under the following conditions: 1) No skb created yet 2) header_size == 0 (no SHAMPO header) 3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAGE == 0 (this is the last page fragment of a SHAMPO header page) a new skb is formed with a page that is NOT a SHAMPO header page (it is a regular data page). Further down in the same function (mlx5e_handle_rx_cqe_mpwrq_shampo()), a SHAMPO header page from header_index is released. This is wrong and it leads to SHAMPO header pages being released more than once. (CVE-2024-46717)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46717
https://security-tracker.debian.org/tracker/CVE-2024-46717
https://ubuntu.com/security/CVE-2024-46717

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46717

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229205 - Linux Distros Unpatched Vulnerability : CVE-2024-46719
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Fix null pointer dereference in trace ucsi_register_altmode checks IS_ERR for the alt pointer and treats NULL as valid.
When CONFIG_TYPEC_DP_ALTMODE is not enabled, ucsi_register_displayport returns NULL which causes a NULL pointer dereference in trace. Rather than return NULL, call typec_port_register_altmode to register DisplayPort alternate mode as a non-controllable mode when CONFIG_TYPEC_DP_ALTMODE is not enabled.
(CVE-2024-46719)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46719
https://ubuntu.com/security/CVE-2024-46719

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46719

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228651 - Linux Distros Unpatched Vulnerability : CVE-2024-46720
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/amdgpu: fix dereference after null check check the pointer hive before use. (CVE-2024-46720)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46720
https://security-tracker.debian.org/tracker/CVE-2024-46720
https://ubuntu.com/security/CVE-2024-46720

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46720

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228805 - Linux Distros Unpatched Vulnerability : CVE-2024-46736
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double put of @cfile in smb2_rename_path() If smb2_set_path_attr() is called with a valid @cfile and returned -EINVAL, we need to call cifs_get_writable_path() again as the reference of @cfile was already dropped by previous smb2_compound_op() call. (CVE-2024-46736)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46736
https://ubuntu.com/security/CVE-2024-46736

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.9
EPSS Score
0.0006
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-46736

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228361 - Linux Distros Unpatched Vulnerability : CVE-2024-46737
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix kernel crash if commands allocation fails If the commands allocation fails in nvmet_tcp_alloc_cmds() the kernel crashes in nvmet_tcp_release_queue_work() because of a NULL pointer dereference. nvmet: failed to install queue 0 cntlid 1 ret 6 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Fix the bug by setting queue->nr_cmds to zero in case nvmet_tcp_alloc_cmd() fails. (CVE-2024-46737)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46737
https://ubuntu.com/security/CVE-2024-46737

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46737

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229182 - Linux Distros Unpatched Vulnerability : CVE-2024-46739
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind For primary VM Bus channels, primary_channel pointer is always NULL.
This pointer is valid only for the secondary channels. Also, rescind callback is meant for primary channels only. Fix NULL pointer dereference by retrieving the device_obj from the parent for the primary channel. (CVE-2024-46739)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46739
https://ubuntu.com/security/CVE-2024-46739

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46739

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228884 - Linux Distros Unpatched Vulnerability : CVE-2024-46748
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cachefiles: Set the max subreq size for cache writes to MAX_RW_COUNT Set the maximum size of a subrequest that writes to cachefiles to be MAX_RW_COUNT so that we don't overrun the maximum write we can make to the backing filesystem. (CVE-2024-46748)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46748
https://ubuntu.com/security/CVE-2024-46748

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46748

Plugin Information
Published: 2025/03/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229546 - Linux Distros Unpatched Vulnerability : CVE-2024-46755
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() mwifiex_get_priv_by_id() returns the priv pointer corresponding to the bss_num and bss_type, but without checking if the priv is actually currently in use. Unused priv pointers do not have a wiphy attached to them which can lead to NULL pointer dereferences further down the callstack. Fix this by returning only used priv pointers which have priv->bss_mode set to something else than NL80211_IFTYPE_UNSPECIFIED. Said NULL pointer dereference happened when an Accesspoint was started with wpa_supplicant -i mlan0 with this config: network={ ssid=somessid mode=2 frequency=2412 key_mgmt=WPA-PSK WPA-PSK-SHA256 proto=RSN group=CCMP pairwise=CCMP psk=12345678 } When waiting for the AP to be established, interrupting wpa_supplicant with <ctrl-c> and starting it again this happens: | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000140 | Mem abort info: | ESR = 0x0000000096000004 | EC = 0x25: DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x04: level 0 translation fault | Data abort info: | ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 | CM = 0, WnR = 0, TnD = 0, TagAccess = 0 | GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 | user pgtable: 4k pages, 48-bit VAs, pgdp=0000000046d96000 | [0000000000000140] pgd=0000000000000000, p4d=0000000000000000 | Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP | Modules linked in: caam_jr caamhash_desc spidev caamalg_desc crypto_engine authenc libdes mwifiex_sdio +mwifiex crct10dif_ce cdc_acm onboard_usb_hub fsl_imx8_ddr_perf imx8m_ddrc rtc_ds1307 lm75 rtc_snvs +imx_sdma caam imx8mm_thermal spi_imx error imx_cpufreq_dt fuse ip_tables x_tables ipv6 | CPU: 0 PID: 8 Comm: kworker/0:1 Not tainted 6.9.0-00007-g937242013fce-dirty #18 | Hardware name: somemachine (DT) | Workqueue: events sdio_irq_work | pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc :
mwifiex_get_cfp+0xd8/0x15c [mwifiex] | lr : mwifiex_get_cfp+0x34/0x15c [mwifiex] | sp : ffff8000818b3a70 | x29: ffff8000818b3a70 x28: ffff000006bfd8a5 x27: 0000000000000004 | x26: 000000000000002c x25:
0000000000001511 x24: 0000000002e86bc9 | x23: ffff000006bfd996 x22: 0000000000000004 x21: ffff000007bec000 | x20: 000000000000002c x19: 0000000000000000 x18: 0000000000000000 | x17: 000000040044ffff x16:
00500072b5503510 x15: ccc283740681e517 | x14: 0201000101006d15 x13: 0000000002e8ff43 x12: 002c01000000ffb1 | x11: 0100000000000000 x10: 02e8ff43002c0100 x9 : 0000ffb100100157 | x8 : ffff000003d20000 x7 :
00000000000002f1 x6 : 00000000ffffe124 | x5 : 0000000000000001 x4 : 0000000000000003 x3 : 0000000000000000 | x2 : 0000000000000000 x1 : 0001000000011001 x0 : 0000000000000000 | Call trace: | mwifiex_get_cfp+0xd8/0x15c [mwifiex] | mwifiex_parse_single_response_buf+0x1d0/0x504 [mwifiex] | mwifiex_handle_event_ext_scan_report+0x19c/0x2f8 [mwifiex] | mwifiex_process_sta_event+0x298/0xf0c [mwifiex] | mwifiex_process_event+0x110/0x238 [mwifiex] | mwifiex_main_process+0x428/0xa44 [mwifiex] | mwifiex_sdio_interrupt+0x64/0x12c [mwifiex_sdio] | process_sdio_pending_irqs+0x64/0x1b8 | sdio_irq_work+0x4c/0x7c | process_one_work+0x148/0x2a0 | worker_thread+0x2fc/0x40c | kthread+0x110/0x114 | ret_from_fork+0x10/0x20 | Code: a94153f3 a8c37bfd d50323bf d65f03c0 (f940a000) | ---[ end trace 0000000000000000 ]--- (CVE-2024-46755)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46755
https://ubuntu.com/security/CVE-2024-46755

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46755

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228951 - Linux Distros Unpatched Vulnerability : CVE-2024-46760
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: rtw88: usb: schedule rx work after everything is set up Right now it's possible to hit NULL pointer dereference in rtw_rx_fill_rx_status on hw object and/or its fields because initialization routine can start getting USB replies before rtw_dev is fully setup. The stack trace looks like this:
rtw_rx_fill_rx_status rtw8821c_query_rx_desc rtw_usb_rx_handler ... queue_work rtw_usb_read_port_complete ... usb_submit_urb rtw_usb_rx_resubmit rtw_usb_init_rx rtw_usb_probe So while we do the async stuff rtw_usb_probe continues and calls rtw_register_hw, which does all kinds of initialization (e.g. via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on. Fix this by moving the first usb_submit_urb after everything is set up. For me, this bug manifested as: [ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped [ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_status because I'm using Larry's backport of rtw88 driver with the NULL checks in rtw_rx_fill_rx_status. (CVE-2024-46760)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46760
https://security-tracker.debian.org/tracker/CVE-2024-46760
https://ubuntu.com/security/CVE-2024-46760

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-46760

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228496 - Linux Distros Unpatched Vulnerability : CVE-2024-46762
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xen: privcmd: Fix possible access to a freed kirqfd instance Nothing prevents simultaneous ioctl calls to privcmd_irqfd_assign() and privcmd_irqfd_deassign(). If that happens, it is possible that a kirqfd created and added to the irqfds_list by privcmd_irqfd_assign() may get removed by another thread executing privcmd_irqfd_deassign(), while the former is still using it after dropping the locks. This can lead to a situation where an already freed kirqfd instance may be accessed and cause kernel oops. Use SRCU locking to prevent the same, as is done for the KVM implementation for irqfds. (CVE-2024-46762)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46762
https://security-tracker.debian.org/tracker/CVE-2024-46762
https://ubuntu.com/security/CVE-2024-46762

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46762

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228500 - Linux Distros Unpatched Vulnerability : CVE-2024-46765
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ice: protect XDP configuration with a mutex The main threat to data consistency in ice_xdp() is a possible asynchronous PF reset. It can be triggered by a user or by TX timeout handler. XDP setup and PF reset code access the same resources in the following sections: * ice_vsi_close() in ice_prepare_for_reset() - already rtnl-locked * ice_vsi_rebuild() for the PF VSI - not protected * ice_vsi_open() - already rtnl- locked With an unfortunate timing, such accesses can result in a crash such as the one below: [ +1.999878] ice 0000:b1:00.0: Registered XDP mem model MEM_TYPE_XSK_BUFF_POOL on Rx ring 14 [ +2.002992] ice 0000:b1:00.0: Registered XDP mem model MEM_TYPE_XSK_BUFF_POOL on Rx ring 18 [Mar15 18:17] ice 0000:b1:00.0 ens801f0np0: NETDEV WATCHDOG: CPU: 38: transmit queue 14 timed out 80692736 ms [ +0.000093] ice 0000:b1:00.0 ens801f0np0: tx_timeout: VSI_num: 6, Q 14, NTC: 0x0, HW_HEAD: 0x0, NTU: 0x0, INT: 0x4000001 [ +0.000012] ice 0000:b1:00.0 ens801f0np0: tx_timeout recovery level 1, txqueue 14 [ +0.394718] ice 0000:b1:00.0: PTP reset successful [ +0.006184] BUG: kernel NULL pointer dereference, address:
0000000000000098 [ +0.000045] #PF: supervisor read access in kernel mode [ +0.000023] #PF:
error_code(0x0000) - not-present page [ +0.000023] PGD 0 P4D 0 [ +0.000018] Oops: 0000 [#1] PREEMPT SMP NOPTI [ +0.000023] CPU: 38 PID: 7540 Comm: kworker/38:1 Not tainted 6.8.0-rc7 #1 [ +0.000031] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0014.082620210524 08/26/2021 [ +0.000036] Workqueue: ice ice_service_task [ice] [ +0.000183] RIP: 0010:ice_clean_tx_ring+0xa/0xd0 [ice] [...] [ +0.000013] Call Trace: [ +0.000016] <TASK> [ +0.000014] ? __die+0x1f/0x70 [ +0.000029] ? page_fault_oops+0x171/0x4f0 [ +0.000029] ? schedule+0x3b/0xd0 [ +0.000027] ? exc_page_fault+0x7b/0x180 [ +0.000022] ? asm_exc_page_fault+0x22/0x30 [ +0.000031] ? ice_clean_tx_ring+0xa/0xd0 [ice] [ +0.000194] ice_free_tx_ring+0xe/0x60 [ice] [ +0.000186] ice_destroy_xdp_rings+0x157/0x310 [ice] [ +0.000151] ice_vsi_decfg+0x53/0xe0 [ice] [ +0.000180] ice_vsi_rebuild+0x239/0x540 [ice] [ +0.000186] ice_vsi_rebuild_by_type+0x76/0x180 [ice] [ +0.000145] ice_rebuild+0x18c/0x840 [ice] [ +0.000145] ? delay_tsc+0x4a/0xc0 [ +0.000022] ? delay_tsc+0x92/0xc0 [ +0.000020] ice_do_reset+0x140/0x180 [ice] [ +0.000886] ice_service_task+0x404/0x1030 [ice] [ +0.000824] process_one_work+0x171/0x340 [ +0.000685] worker_thread+0x277/0x3a0 [ +0.000675] ? preempt_count_add+0x6a/0xa0 [ +0.000677] ?
_raw_spin_lock_irqsave+0x23/0x50 [ +0.000679] ? __pfx_worker_thread+0x10/0x10 [ +0.000653] kthread+0xf0/0x120 [ +0.000635] ? __pfx_kthread+0x10/0x10 [ +0.000616] ret_from_fork+0x2d/0x50 [ +0.000612] ? __pfx_kthread+0x10/0x10 [ +0.000604] ret_from_fork_asm+0x1b/0x30 [ +0.000604] </TASK> The previous way of handling this through returning -EBUSY is not viable, particularly when destroying AF_XDP socket, because the kernel proceeds with removal anyway. There is plenty of code between those calls and there is no need to create a large critical section that covers all of them, same as there is no need to protect ice_vsi_rebuild() with rtnl_lock(). Add xdp_state_lock mutex to protect ice_vsi_rebuild() and ice_xdp(). Leaving unprotected sections in between would result in two states that have to be considered:
1. when the VSI is closed, but not yet rebuild 2. when VSI is already rebuild, but not yet open The latter case is actually already handled through !netif_running() case, we just need to adjust flag checking a little. The former one is not as trivial, because between ice_vsi_close() and ice_vsi_rebuild(), a lot of hardware interaction happens, this can make adding/deleting rings exit with an error. Luckily, VSI rebuild is pending and can apply new configuration for us in a managed fashion. Therefore, add an additional VSI state flag ICE_VSI_REBUILD_PENDING to indicate that ice_x ---truncated--- (CVE-2024-46765)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46765
https://security-tracker.debian.org/tracker/CVE-2024-46765
https://ubuntu.com/security/CVE-2024-46765

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46765

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228597 - Linux Distros Unpatched Vulnerability : CVE-2024-46767
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: phy: Fix missing of_node_put() for leds The call of of_get_child_by_name() will cause refcount incremented for leds, if it succeeds, it should call of_node_put() to decrease it, fix it. (CVE-2024-46767)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46767
https://ubuntu.com/security/CVE-2024-46767

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-46767

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229265 - Linux Distros Unpatched Vulnerability : CVE-2024-46770
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ice: Add netif_device_attach/detach into PF reset flow Ethtool callbacks can be executed while reset is in progress and try to access deleted resources, e.g. getting coalesce settings can result in a NULL pointer dereference seen below. Reproduction steps: Once the driver is fully initialized, trigger reset: # echo 1 > /sys/class/net/<interface>/device/reset when reset is in progress try to get coalesce settings using ethtool: # ethtool -c <interface> BUG: kernel NULL pointer dereference, address: 0000000000000020 PGD 0 P4D 0 Oops: Oops: 0000 [#1] PREEMPT SMP PTI CPU: 11 PID: 19713 Comm: ethtool Tainted: G S 6.10.0-rc7+ #7 RIP: 0010:ice_get_q_coalesce+0x2e/0xa0 [ice] RSP: 0018:ffffbab1e9bcf6a8 EFLAGS: 00010206 RAX:
000000000000000c RBX: ffff94512305b028 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff9451c3f2e588 RDI: ffff9451c3f2e588 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10:
ffff9451c3f2e580 R11: 000000000000001f R12: ffff945121fa9000 R13: ffffbab1e9bcf760 R14: 0000000000000013 R15: ffffffff9e65dd40 FS: 00007faee5fbe740(0000) GS:ffff94546fd80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000020 CR3: 0000000106c2e005 CR4: 00000000001706f0 Call Trace: <TASK> ice_get_coalesce+0x17/0x30 [ice] coalesce_prepare_data+0x61/0x80 ethnl_default_doit+0xde/0x340 genl_family_rcv_msg_doit+0xf2/0x150 genl_rcv_msg+0x1b3/0x2c0 netlink_rcv_skb+0x5b/0x110 genl_rcv+0x28/0x40 netlink_unicast+0x19c/0x290 netlink_sendmsg+0x222/0x490
__sys_sendto+0x1df/0x1f0 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x82/0x160 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7faee60d8e27 Calling netif_device_detach() before reset makes the net core not call the driver when ethtool command is issued, the attempt to execute an ethtool command during reset will result in the following message: netlink error: No such device instead of NULL pointer dereference. Once reset is done and ice_rebuild() is executing, the netif_device_attach() is called to allow for ethtool operations to occur again in a safe manner. (CVE-2024-46770)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46770
https://security-tracker.debian.org/tracker/CVE-2024-46770
https://ubuntu.com/security/CVE-2024-46770

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46770

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228733 - Linux Distros Unpatched Vulnerability : CVE-2024-46771
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- can: bcm: Remove proc entry when dev is unregistered. syzkaller reported a warning in bcm_connect() below.
[0] The repro calls connect() to vxcan1, removes vxcan1, and calls connect() with ifindex == 0. Calling connect() for a BCM socket allocates a proc entry. Then, bcm_sk(sk)->bound is set to 1 to prevent further connect(). However, removing the bound device resets bcm_sk(sk)->bound to 0 in bcm_notify(). The 2nd connect() tries to allocate a proc entry with the same name and sets NULL to bcm_sk(sk)->bcm_proc_read, leaking the original proc entry. Since the proc entry is available only for connect()ed sockets, let's clean up the entry when the bound netdev is unregistered. [0]: proc_dir_entry 'can-bcm/2456' already registered WARNING: CPU: 1 PID: 394 at fs/proc/generic.c:376 proc_register+0x645/0x8f0 fs/proc/generic.c:375 Modules linked in: CPU: 1 PID: 394 Comm: syz-executor403 Not tainted 6.10.0-rc7-g852e42cc2dd4 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:proc_register+0x645/0x8f0 fs/proc/generic.c:375 Code: 00 00 00 00 00 48 85 ed 0f 85 97 02 00 00 4d 85 f6 0f 85 9f 02 00 00 48 c7 c7 9b cb cf 87 48 89 de 4c 89 fa e8 1c 6f eb fe 90 <0f> 0b 90 90 48 c7 c7 98 37 99 89 e8 cb 7e 22 05 bb 00 00 00 10 48 RSP: 0018:ffa0000000cd7c30 EFLAGS: 00010246 RAX: 9e129be1950f0200 RBX: ff1100011b51582c RCX:
ff1100011857cd80 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 RBP: 0000000000000000 R08: ffd400000000000f R09: ff1100013e78cac0 R10: ffac800000cd7980 R11: ff1100013e12b1f0 R12:
0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ff1100011a99a2ec FS:
00007fbd7086f740(0000) GS:ff1100013fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 CR2: 00000000200071c0 CR3: 0000000118556004 CR4: 0000000000771ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7:
0000000000000400 PKRU: 55555554 Call Trace: <TASK> proc_create_net_single+0x144/0x210 fs/proc/proc_net.c:220 bcm_connect+0x472/0x840 net/can/bcm.c:1673 __sys_connect_file net/socket.c:2049 [inline] __sys_connect+0x5d2/0x690 net/socket.c:2066 __do_sys_connect net/socket.c:2076 [inline]
__se_sys_connect net/socket.c:2073 [inline] __x64_sys_connect+0x8f/0x100 net/socket.c:2073 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd9/0x1c0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7fbd708b0e5d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48 RSP: 002b:00007fff8cd33f08 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fbd708b0e5d RDX:
0000000000000010 RSI: 0000000020000040 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000040 R09: 0000000000000040 R10: 0000000000000040 R11: 0000000000000246 R12: 00007fff8cd34098 R13:
0000000000401280 R14: 0000000000406de8 R15: 00007fbd70ab9000 </TASK> remove_proc_entry: removing non-empty directory 'net/can-bcm', leaking at least '2456' (CVE-2024-46771)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46771
https://ubuntu.com/security/CVE-2024-46771

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46771

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228572 - Linux Distros Unpatched Vulnerability : CVE-2024-46777
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- udf: Avoid excessive partition lengths Avoid mounting filesystems where the partition would overflow the 32-bits used for block number. Also refuse to mount filesystems where the partition length is so large we cannot safely index bits in a block bitmap. (CVE-2024-46777)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46777
https://ubuntu.com/security/CVE-2024-46777

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46777

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228851 - Linux Distros Unpatched Vulnerability : CVE-2024-46784
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup Currently napi_disable() gets called during rxq and txq cleanup, even before napi is enabled and hrtimer is initialized. It causes kernel panic. ? page_fault_oops+0x136/0x2b0 ? page_counter_cancel+0x2e/0x80 ? do_user_addr_fault+0x2f2/0x640 ? refill_obj_stock+0xc4/0x110 ? exc_page_fault+0x71/0x160 ? asm_exc_page_fault+0x27/0x30 ? __mmdrop+0x10/0x180 ? __mmdrop+0xec/0x180 ? hrtimer_active+0xd/0x50 hrtimer_try_to_cancel+0x2c/0xf0 hrtimer_cancel+0x15/0x30 napi_disable+0x65/0x90 mana_destroy_rxq+0x4c/0x2f0 mana_create_rxq.isra.0+0x56c/0x6d0 ? mana_uncfg_vport+0x50/0x50 mana_alloc_queues+0x21b/0x320 ? skb_dequeue+0x5f/0x80 (CVE-2024-46784)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46784
https://ubuntu.com/security/CVE-2024-46784

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46784

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245788 - Linux Distros Unpatched Vulnerability : CVE-2024-46788
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Use a cpumask to know what threads are kthreads The start_kthread() and stop_thread() code was not always called with the interface_lock held. This means that the kthread variable could be unexpectedly changed causing the kthread_stop() to be called on it when it should not have been, leading to: while true; do rtla timerlat top -u -q & PID=$!; sleep 5; kill -INT $PID; sleep 0.001; kill -TERM $PID; wait $PID; done Causing the following OOPS: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002:
0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 5 UID: 0 PID: 885 Comm: timerlatu/5 Not tainted 6.11.0-rc4-test-00002-gbc754cc76d1b-dirty #125 a533010b71dab205ad2f507188ce8c82203b0254 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:hrtimer_active+0x58/0x300 Code: 48 c1 ee 03 41 54 48 01 d1 48 01 d6 55 53 48 83 ec 20 80 39 00 0f 85 30 02 00 00 49 8b 6f 30 4c 8d 75 10 4c 89 f0 48 c1 e8 03 <0f> b6 3c 10 4c 89 f0 83 e0 07 83 c0 03 40 38 f8 7c 09 40 84 ff 0f RSP: 0018:ffff88811d97f940 EFLAGS: 00010202 RAX:
0000000000000002 RBX: ffff88823c6b5b28 RCX: ffffed10478d6b6b RDX: dffffc0000000000 RSI: ffffed10478d6b6c RDI: ffff88823c6b5b28 RBP: 0000000000000000 R08: ffff88823c6b5b58 R09: ffff88823c6b5b60 R10:
ffff88811d97f957 R11: 0000000000000010 R12: 00000000000a801d R13: ffff88810d8b35d8 R14: 0000000000000010 R15: ffff88823c6b5b28 FS: 0000000000000000(0000) GS:ffff88823c680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561858ad7258 CR3: 000000007729e001 CR4: 0000000000170ef0 Call Trace: <TASK> ? die_addr+0x40/0xa0 ? exc_general_protection+0x154/0x230 ? asm_exc_general_protection+0x26/0x30 ? hrtimer_active+0x58/0x300 ? __pfx_mutex_lock+0x10/0x10 ?
__pfx_locks_remove_file+0x10/0x10 hrtimer_cancel+0x15/0x40 timerlat_fd_release+0x8e/0x1f0 ? security_file_release+0x43/0x80 __fput+0x372/0xb10 task_work_run+0x11e/0x1f0 ? _raw_spin_lock+0x85/0xe0 ?
__pfx_task_work_run+0x10/0x10 ? poison_slab_object+0x109/0x170 ? do_exit+0x7a0/0x24b0 do_exit+0x7bd/0x24b0 ? __pfx_migrate_enable+0x10/0x10 ? __pfx_do_exit+0x10/0x10 ? __pfx_read_tsc+0x10/0x10 ? ktime_get+0x64/0x140 ? _raw_spin_lock_irq+0x86/0xe0 do_group_exit+0xb0/0x220 get_signal+0x17ba/0x1b50 ? vfs_read+0x179/0xa40 ? timerlat_fd_read+0x30b/0x9d0 ? __pfx_get_signal+0x10/0x10 ?
__pfx_timerlat_fd_read+0x10/0x10 arch_do_signal_or_restart+0x8c/0x570 ?
__pfx_arch_do_signal_or_restart+0x10/0x10 ? vfs_read+0x179/0xa40 ? ksys_read+0xfe/0x1d0 ?
__pfx_ksys_read+0x10/0x10 syscall_exit_to_user_mode+0xbc/0x130 do_syscall_64+0x74/0x110 ?
__pfx___rseq_handle_notify_resume+0x10/0x10 ? __pfx_ksys_read+0x10/0x10 ? fpregs_restore_userregs+0xdb/0x1e0 ? fpregs_restore_userregs+0xdb/0x1e0 ? syscall_exit_to_user_mode+0x116/0x130 ? do_syscall_64+0x74/0x110 ? do_syscall_64+0x74/0x110 ? do_syscall_64+0x74/0x110 entry_SYSCALL_64_after_hwframe+0x71/0x79 RIP: 0033:0x7ff0070eca9c Code: Unable to access opcode bytes at 0x7ff0070eca72. RSP: 002b:00007ff006dff8c0 EFLAGS: 00000246 ORIG_RAX:
0000000000000000 RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007ff0070eca9c RDX: 0000000000000400 RSI: 00007ff006dff9a0 RDI: 0000000000000003 RBP: 00007ff006dffde0 R08: 0000000000000000 R09:
00007ff000000ba0 R10: 00007ff007004b08 R11: 0000000000000246 R12: 0000000000000003 R13: 00007ff006dff9a0 R14: 0000000000000007 R15: 0000000000000008 </TASK> Modules linked in: snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hwdep snd_hda_core ---[ end trace 0000000000000000 ]--- This is because it would mistakenly call kthread_stop() on a user space thread making it exit before it actually exits. Since kthread ---truncated--- (CVE-2024-46788)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46788
https://ubuntu.com/security/CVE-2024-46788

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-46788

Plugin Information
Published: 2025/08/08, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228715 - Linux Distros Unpatched Vulnerability : CVE-2024-46791
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open The mcp251x_hw_wake() function is called with the mpc_lock mutex held and disables the interrupt handler so that no interrupts can be processed while waking the device. If an interrupt has already occurred then waiting for the interrupt handler to complete will deadlock because it will be trying to acquire the same mutex. CPU0 CPU1 ---- ---- mcp251x_open() mutex_lock(&priv->mcp_lock) request_threaded_irq() <interrupt> mcp251x_can_ist() mutex_lock(&priv->mcp_lock) mcp251x_hw_wake() disable_irq() <-- deadlock Use disable_irq_nosync() instead because the interrupt handler does everything while holding the mutex so it doesn't matter if it's still running. (CVE-2024-46791)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46791
https://ubuntu.com/security/CVE-2024-46791

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46791

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228646 - Linux Distros Unpatched Vulnerability : CVE-2024-46793
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards harder Since commit 13f58267cda3 (ASoC: soc.h: don't create dummy Component via COMP_DUMMY()) dummy codecs declared like this: SND_SOC_DAILINK_DEF(dummy, DAILINK_COMP_ARRAY(COMP_DUMMY())); expand to: static struct snd_soc_dai_link_component dummy[] = { };
Which means that dummy is a zero sized array and thus dais[i].codecs should not be dereferenced *at all* since it points to the address of the next variable stored in the data section as the dummy variable has an address but no size, so even dereferencing dais[0] is already an out of bounds array reference. Which means that the if (dais[i].codecs->name) check added in commit 7d99a70b6595 (ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards) relies on that the part of the next variable which the name member maps to just happens to be NULL. Which apparently so far it usually is, except when it isn't and then it results in crashes like this one: [ 28.795659] BUG: unable to handle page fault for address:
0000000000030011 ... [ 28.795780] Call Trace: [ 28.795787] <TASK> ... [ 28.795862] ? strcmp+0x18/0x40 [ 28.795872] 0xffffffffc150c605 [ 28.795887] platform_probe+0x40/0xa0 ... [ 28.795979] ?
__pfx_init_module+0x10/0x10 [snd_soc_sst_bytcr_wm5102] Really fix things this time around by checking dais.num_codecs != 0. (CVE-2024-46793)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46793
https://ubuntu.com/security/CVE-2024-46793

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-46793

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246796 - Linux Distros Unpatched Vulnerability : CVE-2024-46797
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: powerpc/qspinlock: Fix deadlock in MCS queue If an interrupt occurs in queued_spin_lock_slowpath() after we increment qnodesp->count and before node->lock is initialized, another CPU might see stale lock values in get_tail_qnode(). If the stale lock value happens to match the lock on that CPU, then we write to the next pointer of the wrong qnode. This causes a deadlock as the former CPU, once it becomes the head of the MCS queue, will spin indefinitely until it's next pointer is set by its successor in the queue. Running stress-ng on a 16 core (16EC/16VP) shared LPAR, results in occasional lockups similar to the following: $ stress-ng --all 128 --vm-bytes 80%
--aggressive \ --maximize --oomable --verify --syslog \ --metrics --times --timeout 5m watchdog: CPU 15 Hard LOCKUP ...... NIP [c0000000000b78f4] queued_spin_lock_slowpath+0x1184/0x1490 LR [c000000001037c5c]
_raw_spin_lock+0x6c/0x90 Call Trace: 0xc000002cfffa3bf0 (unreliable) _raw_spin_lock+0x6c/0x90 raw_spin_rq_lock_nested.part.135+0x4c/0xd0 sched_ttwu_pending+0x60/0x1f0
__flush_smp_call_function_queue+0x1dc/0x670 smp_ipi_demux_relaxed+0xa4/0x100 xive_muxed_ipi_action+0x20/0x40 __handle_irq_event_percpu+0x80/0x240 handle_irq_event_percpu+0x2c/0x80 handle_percpu_irq+0x84/0xd0 generic_handle_irq+0x54/0x80 __do_irq+0xac/0x210 __do_IRQ+0x74/0xd0 0x0 do_IRQ+0x8c/0x170 hardware_interrupt_common_virt+0x29c/0x2a0 --- interrupt: 500 at queued_spin_lock_slowpath+0x4b8/0x1490 ...... NIP [c0000000000b6c28] queued_spin_lock_slowpath+0x4b8/0x1490 LR [c000000001037c5c] _raw_spin_lock+0x6c/0x90 --- interrupt: 500 0xc0000029c1a41d00 (unreliable) _raw_spin_lock+0x6c/0x90 futex_wake+0x100/0x260 do_futex+0x21c/0x2a0 sys_futex+0x98/0x270 system_call_exception+0x14c/0x2f0 system_call_vectored_common+0x15c/0x2ec The following code flow illustrates how the deadlock occurs. For the sake of brevity, assume that both locks (A and B) are contended and we call the queued_spin_lock_slowpath() function. CPU0 CPU1 ---- ---- spin_lock_irqsave(A) | spin_unlock_irqrestore(A) | spin_lock(B) | | | | id = qnodesp->count++; | (Note that nodes[0].lock == A) | | | | Interrupt | (happens before nodes[0].lock = B) | | | | spin_lock_irqsave(A) | | | | id = qnodesp->count++ | nodes[1].lock = A | | | | Tail of MCS queue | | spin_lock_irqsave(A) | Head of MCS queue | CPU0 is previous tail | Spin indefinitely (until nodes[1].next != NULL) prev = get_tail_qnode(A, CPU0) | prev == &qnodes[CPU0].nodes[0] (as qnodes
---truncated--- (CVE-2024-46797)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46797
https://ubuntu.com/security/CVE-2024-46797

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-46797

Plugin Information
Published: 2025/08/09, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229323 - Linux Distros Unpatched Vulnerability : CVE-2024-46823
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- kunit/overflow: Fix UB in overflow_allocation_test The 'device_name' array doesn't exist out of the 'overflow_allocation_test' function scope. However, it is being used as a driver name when calling 'kunit_driver_create' from 'kunit_device_register'. It produces the kernel panic with KASAN enabled. Since this variable is used in one place only, remove it and pass the device name into kunit_device_register directly as an ascii string. (CVE-2024-46823)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46823
https://security-tracker.debian.org/tracker/CVE-2024-46823
https://ubuntu.com/security/CVE-2024-46823

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46823

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228648 - Linux Distros Unpatched Vulnerability : CVE-2024-46825
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: iwlwifi: mvm: use IWL_FW_CHECK for link ID check The lookup function iwl_mvm_rcu_fw_link_id_to_link_conf() is normally called with input from the firmware, so it should use IWL_FW_CHECK() instead of WARN_ON(). (CVE-2024-46825)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46825
https://security-tracker.debian.org/tracker/CVE-2024-46825
https://ubuntu.com/security/CVE-2024-46825

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-46825

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229197 - Linux Distros Unpatched Vulnerability : CVE-2024-46830
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS Grab kvm->srcu when processing KVM_SET_VCPU_EVENTS, as KVM will forcibly leave nested VMX/SVM if SMM mode is being toggled, and leaving nested VMX reads guest memory. Note, kvm_vcpu_ioctl_x86_set_vcpu_events() can also be called from KVM_RUN via sync_regs(), which already holds SRCU. I.e. trying to precisely use kvm_vcpu_srcu_read_lock() around the problematic SMM code would cause problems. Acquiring SRCU isn't all that expensive, so for simplicity, grab it unconditionally for KVM_SET_VCPU_EVENTS. ============================= WARNING: suspicious RCU usage 6.10.0-rc7-332d2c1d713e-next-vm #552 Not tainted ----------------------------- include/linux/kvm_host.h:1027 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by repro/1071: #0: ffff88811e424430 (&vcpu->mutex){+.+.}-{3:3}, at: kvm_vcpu_ioctl+0x7d/0x970 [kvm] stack backtrace: CPU: 15 PID: 1071 Comm:
repro Not tainted 6.10.0-rc7-332d2c1d713e-next-vm #552 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl+0x7f/0x90 lockdep_rcu_suspicious+0x13f/0x1a0 kvm_vcpu_gfn_to_memslot+0x168/0x190 [kvm] kvm_vcpu_read_guest+0x3e/0x90 [kvm] nested_vmx_load_msr+0x6b/0x1d0 [kvm_intel] load_vmcs12_host_state+0x432/0xb40 [kvm_intel] vmx_leave_nested+0x30/0x40 [kvm_intel] kvm_vcpu_ioctl_x86_set_vcpu_events+0x15d/0x2b0 [kvm] kvm_arch_vcpu_ioctl+0x1107/0x1750 [kvm] ? mark_held_locks+0x49/0x70 ? kvm_vcpu_ioctl+0x7d/0x970 [kvm] ? kvm_vcpu_ioctl+0x497/0x970 [kvm] kvm_vcpu_ioctl+0x497/0x970 [kvm] ? lock_acquire+0xba/0x2d0 ? find_held_lock+0x2b/0x80 ? do_user_addr_fault+0x40c/0x6f0 ? lock_release+0xb7/0x270
__x64_sys_ioctl+0x82/0xb0 do_syscall_64+0x6c/0x170 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP:
0033:0x7ff11eb1b539 </TASK> (CVE-2024-46830)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46830
https://security-tracker.debian.org/tracker/CVE-2024-46830
https://ubuntu.com/security/CVE-2024-46830

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46830

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228703 - Linux Distros Unpatched Vulnerability : CVE-2024-46834
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ethtool: fail closed if we can't get max channel used in indirection tables Commit 0d1b7d6c9274 (bnxt:
fix crashes when reducing ring count with active RSS contexts) proves that allowing indirection table to contain channels with out of bounds IDs may lead to crashes. Currently the max channel check in the core gets skipped if driver can't fetch the indirection table or when we can't allocate memory. Both of those conditions should be extremely rare but if they do happen we should try to be safe and fail the channel change. (CVE-2024-46834)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46834
https://security-tracker.debian.org/tracker/CVE-2024-46834
https://ubuntu.com/security/CVE-2024-46834

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46834

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229448 - Linux Distros Unpatched Vulnerability : CVE-2024-46842
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info The MBX_TIMEOUT return code is not handled in lpfc_get_sfp_info and the routine unconditionally frees submitted mailbox commands regardless of return status. The issue is that for MBX_TIMEOUT cases, when firmware returns SFP information at a later time, that same mailbox memory region references previously freed memory in its cmpl routine. Fix by adding checks for the MBX_TIMEOUT return code. During mailbox resource cleanup, check the mbox flag to make sure that the wait did not timeout. If the MBOX_WAKE flag is not set, then do not free the resources because it will be freed when firmware completes the mailbox at a later time in its cmpl routine. Also, increase the timeout from 30 to 60 seconds to accommodate boot scripts requiring longer timeouts. (CVE-2024-46842)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46842
https://security-tracker.debian.org/tracker/CVE-2024-46842
https://ubuntu.com/security/CVE-2024-46842

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46842

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229129 - Linux Distros Unpatched Vulnerability : CVE-2024-46855
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfilter: nft_socket: fix sk refcount leaks We must put 'sk' reference before returning. (CVE-2024-46855)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46855
https://ubuntu.com/security/CVE-2024-46855

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46855

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228914 - Linux Distros Unpatched Vulnerability : CVE-2024-46857
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mlx5: Fix bridge mode operations when there are no VFs Currently, trying to set the bridge mode attribute when numvfs=0 leads to a crash: bridge link set dev eth2 hwmode vepa [ 168.967392] BUG: kernel NULL pointer dereference, address: 0000000000000030 [...] [ 168.969989] RIP:
0010:mlx5_add_flow_rules+0x1f/0x300 [mlx5_core] [...] [ 168.976037] Call Trace: [ 168.976188] <TASK> [ 168.978620] _mlx5_eswitch_set_vepa_locked+0x113/0x230 [mlx5_core] [ 168.979074] mlx5_eswitch_set_vepa+0x7f/0xa0 [mlx5_core] [ 168.979471] rtnl_bridge_setlink+0xe9/0x1f0 [ 168.979714] rtnetlink_rcv_msg+0x159/0x400 [ 168.980451] netlink_rcv_skb+0x54/0x100 [ 168.980675] netlink_unicast+0x241/0x360 [ 168.980918] netlink_sendmsg+0x1f6/0x430 [ 168.981162]
____sys_sendmsg+0x3bb/0x3f0 [ 168.982155] ___sys_sendmsg+0x88/0xd0 [ 168.985036] __sys_sendmsg+0x59/0xa0 [ 168.985477] do_syscall_64+0x79/0x150 [ 168.987273] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 168.987773] RIP: 0033:0x7f8f7950f917 (esw->fdb_table.legacy.vepa_fdb is null) The bridge mode is only relevant when there are multiple functions per port. Therefore, prevent setting and getting this setting when there are no VFs. Note that after this change, there are no settings to change on the PF interface using `bridge link` when there are no VFs, so the interface no longer appears in the `bridge link` output.
(CVE-2024-46857)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46857
https://security-tracker.debian.org/tracker/CVE-2024-46857
https://ubuntu.com/security/CVE-2024-46857

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:H/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46857

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228978 - Linux Distros Unpatched Vulnerability : CVE-2024-46860
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change When disabling wifi mt7921_ipv6_addr_change() is called as a notifier. At this point mvif->phy is already NULL so we cannot use it here. (CVE-2024-46860)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46860
https://security-tracker.debian.org/tracker/CVE-2024-46860
https://ubuntu.com/security/CVE-2024-46860

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46860

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228457 - Linux Distros Unpatched Vulnerability : CVE-2024-46861
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usbnet: ipheth: do not stop RX on failing RX callback RX callbacks can fail for multiple reasons: * Payload too short * Payload formatted incorrecly (e.g. bad NCM framing) * Lack of memory None of these should cause the driver to seize up. Make such failures non-critical and continue processing further incoming URBs. (CVE-2024-46861)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46861
https://ubuntu.com/security/CVE-2024-46861

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-46861

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229305 - Linux Distros Unpatched Vulnerability : CVE-2024-46862
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: soc-acpi-intel-mtl-match:
add missing empty item There is no links_num in struct snd_soc_acpi_mach {}, and we test !link->num_adr as a condition to end the loop in hda_sdw_machine_select(). So an empty item in struct snd_soc_acpi_link_adr array is required. (CVE-2024-46862)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46862
https://ubuntu.com/security/CVE-2024-46862

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-46862

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229021 - Linux Distros Unpatched Vulnerability : CVE-2024-46863
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: soc-acpi-intel-lnl-match:
add missing empty item There is no links_num in struct snd_soc_acpi_mach {}, and we test !link->num_adr as a condition to end the loop in hda_sdw_machine_select(). So an empty item in struct snd_soc_acpi_link_adr array is required. (CVE-2024-46863)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46863
https://ubuntu.com/security/CVE-2024-46863

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-46863

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228936 - Linux Distros Unpatched Vulnerability : CVE-2024-4693
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in the QEMU Virtio PCI Bindings (hw/virtio/virtio-pci.c). An improper release and use of the irqfd for vector 0 during the boot process leads to a guest triggerable crash via vhost_net_stop().
This flaw allows a malicious guest to crash the QEMU process on the host. (CVE-2024-4693)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-4693

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0009
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-4693

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- qemu-guest-agent
228882 - Linux Distros Unpatched Vulnerability : CVE-2024-46955
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. There is an out-of-bounds read when reading color in Indexed color space. (CVE-2024-46955)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46955

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-46955

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- ghostscript
- ghostscript-tools-fonts
- ghostscript-tools-printing
- libgs
229425 - Linux Distros Unpatched Vulnerability : CVE-2024-47143
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dma-debug: fix a possible deadlock on radix_lock radix_lock() shouldn't be held while holding dma_hash_entry[idx].lock otherwise, there's a possible deadlock scenario when dma debug API is called holding rq_lock(): CPU0 CPU1 CPU2 dma_free_attrs() check_unmap() add_dma_entry() __schedule() //out (A) rq_lock() get_hash_bucket() (A) dma_entry_hash check_sync() (A) radix_lock() (W) dma_entry_hash dma_entry_free() (W) radix_lock() // CPU2's one (W) rq_lock() CPU1 situation can happen when it extending radix tree and it tries to wake up kswapd via wake_all_kswapd(). CPU2 situation can happen while perf_event_task_sched_out() (i.e. dma sync operation is called while deleting perf_event using etm and etr tmc which are Arm Coresight hwtracing driver backends). To remove this possible situation, call dma_entry_free() after put_hash_bucket() in check_unmap(). (CVE-2024-47143)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-47143
https://ubuntu.com/security/CVE-2024-47143

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-47143

Plugin Information
Published: 2025/03/05, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228527 - Linux Distros Unpatched Vulnerability : CVE-2024-47408
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/smc: check smcd_v2_ext_offset when receiving proposal msg When receiving proposal msg in server, the field smcd_v2_ext_offset in proposal msg is from the remote client and can not be fully trusted. Once the value of smcd_v2_ext_offset exceed the max value, there has the chance to access wrong address, and crash may happen. This patch checks the value of smcd_v2_ext_offset before using it. (CVE-2024-47408)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-47408
https://security-tracker.debian.org/tracker/CVE-2024-47408
https://ubuntu.com/security/CVE-2024-47408

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-47408

Plugin Information
Published: 2025/03/05, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229540 - Linux Distros Unpatched Vulnerability : CVE-2024-47671
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: USB: usbtmc: prevent kernel-usb- infoleak The syzbot reported a kernel-usb-infoleak in usbtmc_write, we need to clear the structure before filling fields. (CVE-2024-47671)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-47671
https://ubuntu.com/security/CVE-2024-47671

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-47671

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229042 - Linux Distros Unpatched Vulnerability : CVE-2024-47672
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead There is a WARNING in iwl_trans_wait_tx_queues_empty() (that was recently converted from just a message), that can be hit if we wait for TX queues to become empty after firmware died. Clearly, we can't expect anything from the firmware after it's declared dead. Don't call iwl_trans_wait_tx_queues_empty() in this case. While it could be a good idea to stop the flow earlier, the flush functions do some maintenance work that is not related to the firmware, so keep that part of the code running even when the firmware is not running.
[edit commit message] (CVE-2024-47672)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-47672
https://ubuntu.com/security/CVE-2024-47672

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-47672

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229562 - Linux Distros Unpatched Vulnerability : CVE-2024-47673
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: iwlwifi: mvm: pause TCM when the firmware is stopped Not doing so will make us send a host command to the transport while the firmware is not alive, which will trigger a WARNING. bad state = 0 WARNING:
CPU: 2 PID: 17434 at drivers/net/wireless/intel/iwlwifi/iwl-trans.c:115 iwl_trans_send_cmd+0x1cb/0x1e0 [iwlwifi] RIP: 0010:iwl_trans_send_cmd+0x1cb/0x1e0 [iwlwifi] Call Trace: <TASK> iwl_mvm_send_cmd+0x40/0xc0 [iwlmvm] iwl_mvm_config_scan+0x198/0x260 [iwlmvm] iwl_mvm_recalc_tcm+0x730/0x11d0 [iwlmvm] iwl_mvm_tcm_work+0x1d/0x30 [iwlmvm] process_one_work+0x29e/0x640 worker_thread+0x2df/0x690 ? rescuer_thread+0x540/0x540 kthread+0x192/0x1e0 ? set_kthread_struct+0x90/0x90 ret_from_fork+0x22/0x30 (CVE-2024-47673)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-47673
https://security-tracker.debian.org/tracker/CVE-2024-47673
https://ubuntu.com/security/CVE-2024-47673

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-47673

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228489 - Linux Distros Unpatched Vulnerability : CVE-2024-47674
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm: avoid leaving partial pfn mappings around in error case As Jann points out, PFN mappings are special, because unlike normal memory mappings, there is no lifetime information associated with the mapping - it is just a raw mapping of PFNs with no reference counting of a 'struct page'. That's all very much intentional, but it does mean that it's easy to mess up the cleanup in case of errors. Yes, a failed mmap() will always eventually clean up any partial mappings, but without any explicit lifetime in the page table mapping itself, it's very easy to do the error handling in the wrong order. In particular, it's easy to mistakenly free the physical backing store before the page tables are actually cleaned up and (temporarily) have stale dangling PTE entries. To make this situation less error-prone, just make sure that any partial pfn mapping is torn down early, before any other error handling. (CVE-2024-47674)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-47674
https://ubuntu.com/security/CVE-2024-47674

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.4 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2024-47674

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228762 - Linux Distros Unpatched Vulnerability : CVE-2024-47684
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tcp: check skb is non-NULL in tcp_rto_delta_us() We have some machines running stock Ubuntu 20.04.6 which is their 5.4.0-174-generic kernel that are running ceph and recently hit a null ptr dereference in tcp_rearm_rto(). Initially hitting it from the TLP path, but then later we also saw it getting hit from the RACK case as well. Here are examples of the oops messages we saw in each of those cases: Jul 26 15:05:02 rx [11061395.780353] BUG: kernel NULL pointer dereference, address: 0000000000000020 Jul 26 15:05:02 rx [11061395.787572] #PF: supervisor read access in kernel mode Jul 26 15:05:02 rx [11061395.792971] #PF: error_code(0x0000) - not-present page Jul 26 15:05:02 rx [11061395.798362] PGD 0 P4D 0 Jul 26 15:05:02 rx [11061395.801164] Oops: 0000 [#1] SMP NOPTI Jul 26 15:05:02 rx [11061395.805091] CPU: 0 PID: 9180 Comm: msgr-worker-1 Tainted: G W 5.4.0-174-generic #193-Ubuntu Jul 26 15:05:02 rx [11061395.814996] Hardware name: Supermicro SMC 2x26 os-gen8 64C NVME-Y 256G/H12SSW-NTR, BIOS 2.5.V1.2U.NVMe.UEFI 05/09/2023 Jul 26 15:05:02 rx [11061395.825952] RIP: 0010:tcp_rearm_rto+0xe4/0x160 Jul 26 15:05:02 rx [11061395.830656] Code: 87 ca 04 00 00 00 5b 41 5c 41 5d 5d c3 c3 49 8b bc 24 40 06 00 00 eb 8d 48 bb cf f7 53 e3 a5 9b c4 20 4c 89 ef e8 0c fe 0e 00 <48> 8b 78 20 48 c1 ef 03 48 89 f8 41 8b bc 24 80 04 00 00 48 f7 e3 Jul 26 15:05:02 rx [11061395.849665] RSP: 0018:ffffb75d40003e08 EFLAGS: 00010246 Jul 26 15:05:02 rx [11061395.855149] RAX: 0000000000000000 RBX: 20c49ba5e353f7cf RCX: 0000000000000000 Jul 26 15:05:02 rx [11061395.862542] RDX: 0000000062177c30 RSI: 000000000000231c RDI: ffff9874ad283a60 Jul 26 15:05:02 rx [11061395.869933] RBP: ffffb75d40003e20 R08: 0000000000000000 R09: ffff987605e20aa8 Jul 26 15:05:02 rx [11061395.877318] R10: ffffb75d40003f00 R11: ffffb75d4460f740 R12: ffff9874ad283900 Jul 26 15:05:02 rx [11061395.884710] R13: ffff9874ad283a60 R14: ffff9874ad283980 R15: ffff9874ad283d30 Jul 26 15:05:02 rx [11061395.892095] FS: 00007f1ef4a2e700(0000) GS:ffff987605e00000(0000) knlGS:0000000000000000 Jul 26 15:05:02 rx [11061395.900438] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Jul 26 15:05:02 rx [11061395.906435] CR2: 0000000000000020 CR3: 0000003e450ba003 CR4: 0000000000760ef0 Jul 26 15:05:02 rx [11061395.913822] PKRU: 55555554 Jul 26 15:05:02 rx [11061395.916786] Call Trace: Jul 26 15:05:02 rx [11061395.919488] Jul 26 15:05:02 rx [11061395.921765] ? show_regs.cold+0x1a/0x1f Jul 26 15:05:02 rx [11061395.925859] ? __die+0x90/0xd9 Jul 26 15:05:02 rx [11061395.929169] ? no_context+0x196/0x380 Jul 26 15:05:02 rx [11061395.933088] ? ip6_protocol_deliver_rcu+0x4e0/0x4e0 Jul 26 15:05:02 rx [11061395.938216] ? ip6_sublist_rcv_finish+0x3d/0x50 Jul 26 15:05:02 rx [11061395.943000] ?
__bad_area_nosemaphore+0x50/0x1a0 Jul 26 15:05:02 rx [11061395.947873] ? bad_area_nosemaphore+0x16/0x20 Jul 26 15:05:02 rx [11061395.952486] ? do_user_addr_fault+0x267/0x450 Jul 26 15:05:02 rx [11061395.957104] ? ipv6_list_rcv+0x112/0x140 Jul 26 15:05:02 rx [11061395.961279] ? __do_page_fault+0x58/0x90 Jul 26 15:05:02 rx [11061395.965458] ? do_page_fault+0x2c/0xe0 Jul 26 15:05:02 rx [11061395.969465] ? page_fault+0x34/0x40 Jul 26 15:05:02 rx [11061395.973217] ? tcp_rearm_rto+0xe4/0x160 Jul 26 15:05:02 rx [11061395.977313] ? tcp_rearm_rto+0xe4/0x160 Jul 26 15:05:02 rx [11061395.981408] tcp_send_loss_probe+0x10b/0x220 Jul 26 15:05:02 rx [11061395.985937] tcp_write_timer_handler+0x1b4/0x240 Jul 26 15:05:02 rx [11061395.990809] tcp_write_timer+0x9e/0xe0 Jul 26 15:05:02 rx [11061395.994814] ? tcp_write_timer_handler+0x240/0x240 Jul 26 15:05:02 rx [11061395.999866] call_timer_fn+0x32/0x130 Jul 26 15:05:02 rx [11061396.003782] __run_timers.part.0+0x180/0x280 Jul 26 15:05:02 rx [11061396.008309] ? recalibrate_cpu_khz+0x10/0x10 Jul 26 15:05:02 rx [11061396.012841] ? native_x2apic_icr_write+0x30/0x30 Jul 26 15:05:02 rx [11061396.017718] ? lapic_next_even ---truncated--- (CVE-2024-47684)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-47684
https://ubuntu.com/security/CVE-2024-47684

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-47684

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228548 - Linux Distros Unpatched Vulnerability : CVE-2024-47693
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- IB/core: Fix ib_cache_setup_one error flow cleanup When ib_cache_update return an error, we exit ib_cache_setup_one instantly with no proper cleanup, even though before this we had already successfully done gid_table_setup_one, that results in the kernel WARN below. Do proper cleanup using gid_table_cleanup_one before returning the err in order to fix the issue. WARNING: CPU: 4 PID: 922 at drivers/infiniband/core/cache.c:806 gid_table_release_one+0x181/0x1a0 Modules linked in: CPU: 4 UID: 0 PID: 922 Comm: c_repro Not tainted 6.11.0-rc1+ #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:gid_table_release_one+0x181/0x1a0 Code: 44 8b 38 75 0c e8 2f cb 34 ff 4d 8b b5 28 05 00 00 e8 23 cb 34 ff 44 89 f9 89 da 4c 89 f6 48 c7 c7 d0 58 14 83 e8 4f de 21 ff <0f> 0b 4c 8b 75 30 e9 54 ff ff ff 48 8 3 c4 10 5b 5d 41 5c 41 5d 41 RSP:
0018:ffffc90002b835b0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff811c8527 RDX: 0000000000000000 RSI: ffffffff811c8534 RDI: 0000000000000001 RBP: ffff8881011b3d00 R08:
ffff88810b3abe00 R09: 205d303839303631 R10: 666572207972746e R11: 72746e6520444947 R12: 0000000000000001 R13: ffff888106390000 R14: ffff8881011f2110 R15: 0000000000000001 FS: 00007fecc3b70800(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
0000000020000340 CR3: 000000010435a001 CR4: 00000000003706b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK>
? show_regs+0x94/0xa0 ? __warn+0x9e/0x1c0 ? gid_table_release_one+0x181/0x1a0 ? report_bug+0x1f9/0x340 ? gid_table_release_one+0x181/0x1a0 ? handle_bug+0xa2/0x110 ? exc_invalid_op+0x31/0xa0 ? asm_exc_invalid_op+0x16/0x20 ? __warn_printk+0xc7/0x180 ? __warn_printk+0xd4/0x180 ? gid_table_release_one+0x181/0x1a0 ib_device_release+0x71/0xe0 ? __pfx_ib_device_release+0x10/0x10 device_release+0x44/0xd0 kobject_put+0x135/0x3d0 put_device+0x20/0x30 rxe_net_add+0x7d/0xa0 rxe_newlink+0xd7/0x190 nldev_newlink+0x1b0/0x2a0 ? __pfx_nldev_newlink+0x10/0x10 rdma_nl_rcv_msg+0x1ad/0x2e0 rdma_nl_rcv_skb.constprop.0+0x176/0x210 netlink_unicast+0x2de/0x400 netlink_sendmsg+0x306/0x660 __sock_sendmsg+0x110/0x120 ____sys_sendmsg+0x30e/0x390
___sys_sendmsg+0x9b/0xf0 ? kstrtouint+0x6e/0xa0 ? kstrtouint_from_user+0x7c/0xb0 ? get_pid_task+0xb0/0xd0 ? proc_fail_nth_write+0x5b/0x140 ? __fget_light+0x9a/0x200 ? preempt_count_add+0x47/0xa0
__sys_sendmsg+0x61/0xd0 do_syscall_64+0x50/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e (CVE-2024-47693)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-47693
https://security-tracker.debian.org/tracker/CVE-2024-47693
https://ubuntu.com/security/CVE-2024-47693

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0024
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-47693

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229237 - Linux Distros Unpatched Vulnerability : CVE-2024-47702
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf: Fail verification for sign- extension of packet data/data_end/data_meta syzbot reported a kernel crash due to commit 1f1e864b6555 (bpf: Handle sign-extenstin ctx member accesses). The reason is due to sign-extension of 32-bit load for packet data/data_end/data_meta uapi field. The original code looks like: r2 = *(s32 *)(r1 + 76) /* load
__sk_buff->data */ r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */ r0 = r2 r0 += 8 if r3 > r0 goto +1 ... Note that __sk_buff->data load has 32-bit sign extension. After verification and convert_ctx_accesses(), the final asm code looks like: r2 = *(u64 *)(r1 +208) r2 = (s32)r2 r3 = *(u64
*)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 ... Note that 'r2 = (s32)r2' may make the kernel
__sk_buff->data address invalid which may cause runtime failure. Currently, in C code, typically we have void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; ... and it will generate r2 = *(u64 *)(r1 +208) r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 If we allow sign-extension, void *data = (void *)(long)(int)skb->data; void *data_end = (void *)(long)skb->data_end;
... the generated code looks like r2 = *(u64 *)(r1 +208) r2 <<= 32 r2 s>>= 32 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 and this will cause verification failure since r2 <<= 32 is not allowed as r2 is a packet pointer. To fix this issue for case r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ this patch added additional checking in is_valid_access() callback function for packet data/data_end/data_meta access. If those accesses are with sign-extenstion, the verification will fail.
[1] https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/ (CVE-2024-47702)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-47702
https://ubuntu.com/security/CVE-2024-47702

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-47702

Plugin Information
Published: 2025/03/05, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228470 - Linux Distros Unpatched Vulnerability : CVE-2024-47707
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev() Blamed commit accidentally removed a check for rt->rt6i_idev being NULL, as spotted by syzbot: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 UID: 0 PID: 10998 Comm: syz-executor Not tainted 6.11.0-rc6-syzkaller-00208-g625403177711 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:rt6_uncached_list_flush_dev net/ipv6/route.c:177 [inline] RIP:
0010:rt6_disable_ip+0x33e/0x7e0 net/ipv6/route.c:4914 Code: 41 80 3c 04 00 74 0a e8 90 d0 9b f7 48 8b 7c 24 08 48 8b 07 48 89 44 24 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 64 d0 9b f7 48 8b 44 24 18 49 39 06 RSP: 0018:ffffc900047374e0 EFLAGS: 00010246 RAX:
0000000000000000 RBX: 1ffff1100fdf8f33 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88807efc78c0 RBP: ffffc900047375d0 R08: 0000000000000003 R09: fffff520008e6e8c R10:
dffffc0000000000 R11: fffff520008e6e8c R12: 1ffff1100fdf8f18 R13: ffff88807efc7998 R14: 0000000000000000 R15: ffff88807efc7930 FS: 0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020002a80 CR3: 0000000022f62000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6:
00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> addrconf_ifdown+0x15d/0x1bd0 net/ipv6/addrconf.c:3856 addrconf_notify+0x3cb/0x1020 notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93 call_netdevice_notifiers_extack net/core/dev.c:2032 [inline] call_netdevice_notifiers net/core/dev.c:2046 [inline] unregister_netdevice_many_notify+0xd81/0x1c40 net/core/dev.c:11352 unregister_netdevice_many net/core/dev.c:11414 [inline] unregister_netdevice_queue+0x303/0x370 net/core/dev.c:11289 unregister_netdevice include/linux/netdevice.h:3129 [inline] __tun_detach+0x6b9/0x1600 drivers/net/tun.c:685 tun_detach drivers/net/tun.c:701 [inline] tun_chr_close+0x108/0x1b0 drivers/net/tun.c:3510 __fput+0x24a/0x8a0 fs/file_table.c:422 task_work_run+0x24f/0x310 kernel/task_work.c:228 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x27f0 kernel/exit.c:882 do_group_exit+0x207/0x2c0 kernel/exit.c:1031 __do_sys_exit_group kernel/exit.c:1042 [inline] __se_sys_exit_group kernel/exit.c:1040 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1040 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1acc77def9 Code: Unable to access opcode bytes at 0x7f1acc77decf. RSP: 002b:00007ffeb26fa738 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX:
ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1acc77def9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000043 RBP: 00007f1acc7dd508 R08: 00007ffeb26f84d7 R09: 0000000000000003 R10:
0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 0000000000000003 R14: 00000000ffffffff R15: 00007ffeb26fa8e0 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP:
0010:rt6_uncached_list_flush_dev net/ipv6/route.c:177 [inline] RIP: 0010:rt6_disable_ip+0x33e/0x7e0 net/ipv6/route.c:4914 Code: 41 80 3c 04 00 74 0a e8 90 d0 9b f7 48 8b 7c 24 08 48 8b 07 48 89 44 24 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 64 d0 9b f7 48 8b 44 24 18 49 39 06 RSP: 0018:ffffc900047374e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 1ffff1100fdf8f33 RCX:
dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88807efc78c0 R ---truncated--- (CVE-2024-47707)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-47707
https://ubuntu.com/security/CVE-2024-47707

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-47707

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228695 - Linux Distros Unpatched Vulnerability : CVE-2024-47728
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error For all non-tracing helpers which formerly had ARG_PTR_TO_{LONG,INT} as input arguments, zero the value for the case of an error as otherwise it could leak memory. For tracing, it is not needed given CAP_PERFMON can already read all kernel memory anyway hence bpf_get_func_arg() and bpf_get_func_ret() is skipped in here. Also, the MTU helpers mtu_len pointer value is being written but also read. Technically, the MEM_UNINIT should not be there in order to always force init. Removing MEM_UNINIT needs more verifier rework though: MEM_UNINIT right now implies two things actually: i) write into memory, ii) memory does not have to be initialized. If we lift MEM_UNINIT, it then becomes: i) read into memory, ii) memory must be initialized. This means that for bpf_*_check_mtu() we're readding the issue we're trying to fix, that is, it would then be able to write back into things like .rodata BPF maps. Follow-up work will rework the MEM_UNINIT semantics such that the intent can be better expressed. For now just clear the *mtu_len on error path which can be lifted later again. (CVE-2024-47728)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-47728
https://security-tracker.debian.org/tracker/CVE-2024-47728
https://ubuntu.com/security/CVE-2024-47728

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-47728

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229206 - Linux Distros Unpatched Vulnerability : CVE-2024-47734
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bonding: Fix unnecessary warnings and logs from bond_xdp_get_xmit_slave() syzbot reported a WARNING in bond_xdp_get_xmit_slave. To reproduce this[1], one bond device (bond1) has xdpdrv, which increases bpf_master_redirect_enabled_key. Another bond device (bond0) which is unsupported by XDP but its slave (veth3) has xdpgeneric that returns XDP_TX. This triggers WARN_ON_ONCE() from the xdp_master_redirect(). To reduce unnecessary warnings and improve log management, we need to delete the WARN_ON_ONCE() and add ratelimit to the netdev_err(). [1] Steps to reproduce: # Needs tx_xdp with return XDP_TX; ip l add veth0 type veth peer veth1 ip l add veth3 type veth peer veth4 ip l add bond0 type bond mode 6 # BOND_MODE_ALB, unsupported by XDP ip l add bond1 type bond # BOND_MODE_ROUNDROBIN by default ip l set veth0 master bond1 ip l set bond1 up # Increases bpf_master_redirect_enabled_key ip l set dev bond1 xdpdrv object tx_xdp.o section xdp_tx ip l set veth3 master bond0 ip l set bond0 up ip l set veth4 up # Triggers WARN_ON_ONCE() from the xdp_master_redirect() ip l set veth3 xdpgeneric object tx_xdp.o section xdp_tx (CVE-2024-47734)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-47734
https://ubuntu.com/security/CVE-2024-47734

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
9.4 (CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
8.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-47734

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228744 - Linux Distros Unpatched Vulnerability : CVE-2024-47749
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA/cxgb4: Added NULL check for lookup_atid The lookup_atid() function can return NULL if the ATID is invalid or does not exist in the identifier table, which could lead to dereferencing a null pointer without a check in the `act_establish()` and `act_open_rpl()` functions. Add a NULL check to prevent null pointer dereferencing. Found by Linux Verification Center (linuxtesting.org) with SVACE. (CVE-2024-47749)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-47749
https://ubuntu.com/security/CVE-2024-47749

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-47749

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229108 - Linux Distros Unpatched Vulnerability : CVE-2024-47794
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Prevent tailcall infinite loop caused by freplace There is a potential infinite loop issue that can occur when using a combination of tail calls and freplace. In an upcoming selftest, the attach target for entry_freplace of tailcall_freplace.c is subprog_tc of tc_bpf2bpf.c, while the tail call in entry_freplace leads to entry_tc. This results in an infinite loop: entry_tc -> subprog_tc -> entry_freplace --tailcall->
entry_tc. The problem arises because the tail_call_cnt in entry_freplace resets to zero each time entry_freplace is executed, causing the tail call mechanism to never terminate, eventually leading to a kernel panic. To fix this issue, the solution is twofold: 1. Prevent updating a program extended by an freplace program to a prog_array map. 2. Prevent extending a program that is already part of a prog_array map with an freplace program. This ensures that: * If a program or its subprogram has been extended by an freplace program, it can no longer be updated to a prog_array map. * If a program has been added to a prog_array map, neither it nor its subprograms can be extended by an freplace program. Moreover, an extension program should not be tailcalled. As such, return -EINVAL if the program has a type of BPF_PROG_TYPE_EXT when adding it to a prog_array map. Additionally, fix a minor code style issue by replacing eight spaces with a tab for proper formatting. (CVE-2024-47794)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-47794
https://security-tracker.debian.org/tracker/CVE-2024-47794
https://ubuntu.com/security/CVE-2024-47794

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-47794

Plugin Information
Published: 2025/03/05, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228434 - Linux Distros Unpatched Vulnerability : CVE-2024-47809
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dlm: fix possible lkb_resource null dereference This patch fixes a possible null pointer dereference when this function is called from request_lock() as lkb->lkb_resource is not assigned yet, only after validate_lock_args() by calling attach_lkb(). Another issue is that a resource name could be a non printable bytearray and we cannot assume to be ASCII coded. The log functionality is probably never being hit when DLM is used in normal way and no debug logging is enabled. The null pointer dereference can only occur on a new created lkb that does not have the resource assigned yet, it probably never hits the null pointer dereference but we should be sure that other changes might not change this behaviour and we actually can hit the mentioned null pointer dereference. In this patch we just drop the printout of the resource name, the lkb id is enough to make a possible connection to a resource name if this exists.
(CVE-2024-47809)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-47809
https://security-tracker.debian.org/tracker/CVE-2024-47809
https://ubuntu.com/security/CVE-2024-47809

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-47809

Plugin Information
Published: 2025/03/05, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
228449 - Linux Distros Unpatched Vulnerability : CVE-2024-47814
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vim is an open source, command line text editor. A use-after-free was found in Vim < 9.1.0764. When closing a buffer (visible in a window) a BufWinLeave auto command can cause an use-after-free if this auto command happens to re-open the same buffer in a new split window. Impact is low since the user must have intentionally set up such a strange auto command and run some buffer unload commands. However this may lead to a crash. This issue has been addressed in version 9.1.0764 and all users are advised to upgrade.
There are no known workarounds for this vulnerability. (CVE-2024-47814)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-47814

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0006
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-47814

Plugin Information
Published: 2025/03/05, Modified: 2025/11/07
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
260198 - Linux Distros Unpatched Vulnerability : CVE-2024-48869
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Improper restriction of software interfaces to hardware features for some Intel(R) Xeon(R) 6 processor with E-cores when using Intel(R) Trust Domain Extensions (Intel(R) TDX) or Intel(R) Software Guard Extensions (Intel(R) SGX) may allow a privileged user to potentially enable escalation of privilege via local access. (CVE-2024-48869)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-48869

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N)
CVSS v3.0 Temporal Score
5.3 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.1
EPSS Score
0.0001
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-48869

Plugin Information
Published: 2025/09/01, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- microcode_ctl
230612 - Linux Distros Unpatched Vulnerability : CVE-2024-48876
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: stackdepot: fix stack_depot_save_flags() in NMI context Per documentation, stack_depot_save_flags() was meant to be usable from NMI context if STACK_DEPOT_FLAG_CAN_ALLOC is unset. However, it still would try to take the pool_lock in an attempt to save a stack trace in the current pool (if space is available). This could result in deadlock if an NMI is handled while pool_lock is already held. To avoid deadlock, only try to take the lock in NMI context and give up if unsuccessful. The documentation is fixed to clearly convey this.
(CVE-2024-48876)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-48876
https://ubuntu.com/security/CVE-2024-48876

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-48876

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231837 - Linux Distros Unpatched Vulnerability : CVE-2024-49568
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg When receiving proposal msg in server, the fields v2_ext_offset/ eid_cnt/ism_gid_cnt in proposal msg are from the remote client and can not be fully trusted. Especially the field v2_ext_offset, once exceed the max value, there has the chance to access wrong address, and crash may happen. This patch checks the fields v2_ext_offset/eid_cnt/ism_gid_cnt before using them. (CVE-2024-49568)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-49568
https://security-tracker.debian.org/tracker/CVE-2024-49568
https://ubuntu.com/security/CVE-2024-49568

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-49568

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230481 - Linux Distros Unpatched Vulnerability : CVE-2024-49571
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg When receiving proposal msg in server, the field iparea_offset and the field ipv6_prefixes_cnt in proposal msg are from the remote client and can not be fully trusted. Especially the field iparea_offset, once exceed the max value, there has the chance to access wrong address, and crash may happen. This patch checks iparea_offset and ipv6_prefixes_cnt before using them. (CVE-2024-49571)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-49571
https://ubuntu.com/security/CVE-2024-49571

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-49571

Plugin Information
Published: 2025/03/06, Modified: 2025/12/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230425 - Linux Distros Unpatched Vulnerability : CVE-2024-49866
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tracing/timerlat: Fix a race during cpuhp processing There is another found exception that the timerlat/1 thread was scheduled on CPU0, and lead to timer corruption finally: ``` ODEBUG: init active (active state 0) object: ffff888237c2e108 object type: hrtimer hint: timerlat_irq+0x0/0x220 WARNING: CPU: 0 PID: 426 at lib/debugobjects.c:518 debug_print_object+0x7d/0xb0 Modules linked in: CPU: 0 UID: 0 PID: 426 Comm: timerlat/1 Not tainted 6.11.0-rc7+ #45 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:debug_print_object+0x7d/0xb0 ... Call Trace: <TASK> ? __warn+0x7c/0x110 ? debug_print_object+0x7d/0xb0 ? report_bug+0xf1/0x1d0 ? prb_read_valid+0x17/0x20 ? handle_bug+0x3f/0x70 ? exc_invalid_op+0x13/0x60 ? asm_exc_invalid_op+0x16/0x20 ? debug_print_object+0x7d/0xb0 ? debug_print_object+0x7d/0xb0 ? __pfx_timerlat_irq+0x10/0x10 __debug_object_init+0x110/0x150 hrtimer_init+0x1d/0x60 timerlat_main+0xab/0x2d0 ? __pfx_timerlat_main+0x10/0x10 kthread+0xb7/0xe0 ?
__pfx_kthread+0x10/0x10 ret_from_fork+0x2d/0x40 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> ``` After tracing the scheduling event, it was discovered that the migration of the timerlat/1 thread was performed during thread creation. Further analysis confirmed that it is because the CPU online processing for osnoise is implemented through workers, which is asynchronous with the offline processing.
When the worker was scheduled to create a thread, the CPU may has already been removed from the cpu_online_mask during the offline process, resulting in the inability to select the right CPU: T1 | T2 [CPUHP_ONLINE] | cpu_device_down() osnoise_hotplug_workfn() | | cpus_write_lock() | takedown_cpu(1) | cpus_write_unlock() [CPUHP_OFFLINE] | cpus_read_lock() | start_kthread(1) | cpus_read_unlock() | To fix this, skip online processing if the CPU is already offline. (CVE-2024-49866)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-49866
https://ubuntu.com/security/CVE-2024-49866

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-49866

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231206 - Linux Distros Unpatched Vulnerability : CVE-2024-49891
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths When the HBA is undergoing a reset or is handling an errata event, NULL ptr dereference crashes may occur in routines such as lpfc_sli_flush_io_rings(), lpfc_dev_loss_tmo_callbk(), or lpfc_abort_handler(). Add NULL ptr checks before dereferencing hdwq pointers that may have been freed due to operations colliding with a reset or errata event handler. (CVE-2024-49891)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-49891
https://security-tracker.debian.org/tracker/CVE-2024-49891
https://ubuntu.com/security/CVE-2024-49891

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-49891

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230426 - Linux Distros Unpatched Vulnerability : CVE-2024-49925
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fbdev: efifb: Register sysfs groups through driver core The driver core can register and cleanup sysfs groups already. Make use of that functionality to simplify the error handling and cleanup. Also avoid a UAF race during unregistering where the sysctl attributes were usable after the info struct was freed.
(CVE-2024-49925)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-49925
https://security-tracker.debian.org/tracker/CVE-2024-49925
https://ubuntu.com/security/CVE-2024-49925

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-49925

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231820 - Linux Distros Unpatched Vulnerability : CVE-2024-49940
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- l2tp: prevent possible tunnel refcount underflow When a session is created, it sets a backpointer to its tunnel. When the session refcount drops to 0, l2tp_session_free drops the tunnel refcount if session->tunnel is non-NULL. However, session->tunnel is set in l2tp_session_create, before the tunnel refcount is incremented by l2tp_session_register, which leaves a small window where session->tunnel is non-NULL when the tunnel refcount hasn't been bumped. Moving the assignment to l2tp_session_register is trivial but l2tp_session_create calls l2tp_session_set_header_len which uses session->tunnel to get the tunnel's encap. Add an encap arg to l2tp_session_set_header_len to avoid using session->tunnel. If l2tpv3 sessions have colliding IDs, it is possible for l2tp_v3_session_get to race with l2tp_session_register and fetch a session which doesn't yet have session->tunnel set. Add a check for this case. (CVE-2024-49940)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-49940
https://security-tracker.debian.org/tracker/CVE-2024-49940
https://ubuntu.com/security/CVE-2024-49940

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.9 (CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-49940

Plugin Information
Published: 2025/03/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230700 - Linux Distros Unpatched Vulnerability : CVE-2024-49944
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start In sctp_listen_start() invoked by sctp_inet_listen(), it should set the sk_state back to CLOSED if sctp_autobind() fails due to whatever reason. Otherwise, next time when calling sctp_inet_listen(), if sctp_sk(sk)->reuse is already set via setsockopt(SCTP_REUSE_PORT), sctp_sk(sk)->bind_hash will be dereferenced as sk_state is LISTENING, which causes a crash as bind_hash is NULL. KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:sctp_inet_listen+0x7f0/0xa20 net/sctp/socket.c:8617 Call Trace: <TASK> __sys_listen_socket net/socket.c:1883 [inline] __sys_listen+0x1b7/0x230 net/socket.c:1894
__do_sys_listen net/socket.c:1902 [inline] (CVE-2024-49944)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-49944
https://ubuntu.com/security/CVE-2024-49944

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-49944

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231578 - Linux Distros Unpatched Vulnerability : CVE-2024-49952
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: prevent nf_skb_duplicated corruption syzbot found that nf_dup_ipv4() or nf_dup_ipv6() could write per-cpu variable nf_skb_duplicated in an unsafe way [1]. Disabling preemption as hinted by the splat is not enough, we have to disable soft interrupts as well. [1] BUG: using __this_cpu_write() in preemptible [00000000] code:
syz.4.282/6316 caller is nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87 CPU: 0 UID: 0 PID:
6316 Comm: syz.4.282 Not tainted 6.11.0-rc7-syzkaller-00104-g7052622fccb1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 check_preemption_disabled+0x10e/0x120 lib/smp_processor_id.c:49 nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87 nft_dup_ipv4_eval+0x1db/0x300 net/ipv4/netfilter/nft_dup_ipv4.c:30 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x4ad/0x1da0 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x202/0x320 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626 nf_hook+0x2c4/0x450 include/linux/netfilter.h:269 NF_HOOK_COND include/linux/netfilter.h:302 [inline] ip_output+0x185/0x230 net/ipv4/ip_output.c:433 ip_local_out net/ipv4/ip_output.c:129 [inline] ip_send_skb+0x74/0x100 net/ipv4/ip_output.c:1495 udp_send_skb+0xacf/0x1650 net/ipv4/udp.c:981 udp_sendmsg+0x1c21/0x2a60 net/ipv4/udp.c:1269 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745
____sys_sendmsg+0x525/0x7d0 net/socket.c:2597 ___sys_sendmsg net/socket.c:2651 [inline]
__sys_sendmmsg+0x3b2/0x740 net/socket.c:2737 __do_sys_sendmmsg net/socket.c:2766 [inline]
__se_sys_sendmmsg net/socket.c:2763 [inline] __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2763 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f4ce4f7def9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f4ce5d4a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007f4ce5135f80 RCX: 00007f4ce4f7def9 RDX:
0000000000000001 RSI: 0000000020005d40 RDI: 0000000000000006 RBP: 00007f4ce4ff0b76 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13:
0000000000000000 R14: 00007f4ce5135f80 R15: 00007ffd4cbc6d68 </TASK> (CVE-2024-49952)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-49952
https://ubuntu.com/security/CVE-2024-49952

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-49952

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231400 - Linux Distros Unpatched Vulnerability : CVE-2024-49953
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix crash caused by calling
__xfrm_state_delete() twice The km.state is not checked in driver's delayed work. When xfrm_state_check_expire() is called, the state can be reset to XFRM_STATE_EXPIRED, even if it is XFRM_STATE_DEAD already. This happens when xfrm state is deleted, but not freed yet. As
__xfrm_state_delete() is called again in xfrm timer, the following crash occurs. To fix this issue, skip xfrm_state_check_expire() if km.state is not XFRM_STATE_VALID. Oops: general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] SMP CPU: 5 UID: 0 PID: 7448 Comm: kworker/u102:2 Not tainted 6.11.0-rc2+ #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: mlx5e_ipsec: eth%d mlx5e_ipsec_handle_sw_limits [mlx5_core] RIP: 0010:__xfrm_state_delete+0x3d/0x1b0 Code: 0f 84 8b 01 00 00 48 89 fd c6 87 c8 00 00 00 05 48 8d bb 40 10 00 00 e8 11 04 1a 00 48 8b 95 b8 00 00 00 48 8b 85 c0 00 00 00 <48> 89 42 08 48 89 10 48 8b 55 10 48 b8 00 01 00 00 00 00 ad de 48 RSP: 0018:ffff88885f945ec8 EFLAGS:
00010246 RAX: dead000000000122 RBX: ffffffff82afa940 RCX: 0000000000000036 RDX: dead000000000100 RSI:
0000000000000000 RDI: ffffffff82afb980 RBP: ffff888109a20340 R08: ffff88885f945ea0 R09: 0000000000000000 R10: 0000000000000000 R11: ffff88885f945ff8 R12: 0000000000000246 R13: ffff888109a20340 R14:
ffff88885f95f420 R15: ffff88885f95f400 FS: 0000000000000000(0000) GS:ffff88885f940000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2163102430 CR3:
00000001128d6001 CR4: 0000000000370eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> ? die_addr+0x33/0x90 ? exc_general_protection+0x1a2/0x390 ? asm_exc_general_protection+0x22/0x30 ? __xfrm_state_delete+0x3d/0x1b0 ? __xfrm_state_delete+0x2f/0x1b0 xfrm_timer_handler+0x174/0x350 ? __xfrm_state_delete+0x1b0/0x1b0
__hrtimer_run_queues+0x121/0x270 hrtimer_run_softirq+0x88/0xd0 handle_softirqs+0xcc/0x270 do_softirq+0x3c/0x50 </IRQ> <TASK> __local_bh_enable_ip+0x47/0x50 mlx5e_ipsec_handle_sw_limits+0x7d/0x90 [mlx5_core] process_one_work+0x137/0x2d0 worker_thread+0x28d/0x3a0 ? rescuer_thread+0x480/0x480 kthread+0xb8/0xe0 ? kthread_park+0x80/0x80 ret_from_fork+0x2d/0x50 ? kthread_park+0x80/0x80 ret_from_fork_asm+0x11/0x20 </TASK> (CVE-2024-49953)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-49953
https://ubuntu.com/security/CVE-2024-49953

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-49953

Plugin Information
Published: 2025/03/06, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230978 - Linux Distros Unpatched Vulnerability : CVE-2024-49955
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ACPI: battery: Fix possible crash when unregistering a battery hook When a battery hook returns an error when adding a new battery, then the battery hook is automatically unregistered. However the battery hook provider cannot know that, so it will later call battery_hook_unregister() on the already unregistered battery hook, resulting in a crash. Fix this by using the list head to mark already unregistered battery hooks as already being unregistered so that they can be ignored by battery_hook_unregister(). (CVE-2024-49955)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-49955
https://ubuntu.com/security/CVE-2024-49955

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-49955

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230556 - Linux Distros Unpatched Vulnerability : CVE-2024-49976
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tracing/timerlat: Drop interface_lock in stop_kthread() stop_kthread() is the offline callback for trace/osnoise:online, since commit 5bfbcd1ee57b (tracing/timerlat: Add interface_lock around clearing of kthread in stop_kthread()), the following ABBA deadlock scenario is introduced: T1 | T2 [BP] | T3 [AP] osnoise_hotplug_workfn() | work_for_cpu_fn() | cpuhp_thread_fun() | _cpu_down() | osnoise_cpu_die() mutex_lock(&interface_lock) | | stop_kthread() | cpus_write_lock() | mutex_lock(&interface_lock) cpus_read_lock() | cpuhp_kick_ap() | As the interface_lock here in just for protecting the kthread field of the osn_var, use xchg() instead to fix this issue. Also use for_each_online_cpu() back in stop_per_cpu_kthreads() as it can take cpu_read_lock() again. (CVE-2024-49976)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-49976
https://ubuntu.com/security/CVE-2024-49976

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-49976

Plugin Information
Published: 2025/03/06, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230600 - Linux Distros Unpatched Vulnerability : CVE-2024-49978
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- gso: fix udp gso fraglist segmentation after pull from frag_list Detect gso fraglist skbs with corrupted geometry (see below) and pass these to skb_segment instead of skb_segment_list, as the first can segment them correctly. Valid SKB_GSO_FRAGLIST skbs - consist of two or more segments - the head_skb holds the protocol headers plus first gso_size - one or more frag_list skbs hold exactly one segment - all but the last must be gso_size Optional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can modify these skbs, breaking these invariants. In extreme cases they pull all data into skb linear. For UDP, this causes a NULL ptr deref in __udpv4_gso_segment_list_csum at udp_hdr(seg->next)->dest. Detect invalid geometry due to pull, by checking head_skb size. Don't just drop, as this may blackhole a destination. Convert to be able to pass to regular skb_segment. (CVE-2024-49978)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-49978
https://security-tracker.debian.org/tracker/CVE-2024-49978
https://ubuntu.com/security/CVE-2024-49978

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-49978

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231094 - Linux Distros Unpatched Vulnerability : CVE-2024-50000
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc() In mlx5e_tir_builder_alloc() kvzalloc() may return NULL which is dereferenced on the next line in a reference to the modify field. Found by Linux Verification Center (linuxtesting.org) with SVACE. (CVE-2024-50000)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50000
https://ubuntu.com/security/CVE-2024-50000

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50000

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231575 - Linux Distros Unpatched Vulnerability : CVE-2024-50001
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix error path in multi- packet WQE transmit Remove the erroneous unmap in case no DMA mapping was established The multi-packet WQE transmit code attempts to obtain a DMA mapping for the skb. This could fail, e.g. under memory pressure, when the IOMMU driver just can't allocate more memory for page tables. While the code tries to handle this in the path below the err_unmap label it erroneously unmaps one entry from the sq's FIFO list of active mappings. Since the current map attempt failed this unmap is removing some random DMA mapping that might still be required. If the PCI function now presents that IOVA, the IOMMU may assumes a rogue DMA access and e.g. on s390 puts the PCI function in error state. The erroneous behavior was seen in a stress-test environment that created memory pressure. (CVE-2024-50001)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50001
https://ubuntu.com/security/CVE-2024-50001

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50001

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231024 - Linux Distros Unpatched Vulnerability : CVE-2024-50010
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: exec: don't WARN for racy path_noexec check Both i_mode and noexec checks wrapped in WARN_ON stem from an artifact of the previous implementation. They used to legitimately check for the condition, but that got moved up in two commits:
633fb6ac3980 (exec: move S_ISREG() check earlier) 0fd338b2d2cd (exec: move path_noexec() check earlier) Instead of being removed said checks are WARN_ON'ed instead, which has some debug value.
However, the spurious path_noexec check is racy, resulting in unwarranted warnings should someone race with setting the noexec flag. One can note there is more to perm-checking whether execve is allowed and none of the conditions are guaranteed to still hold after they were tested for. Additionally this does not validate whether the code path did any perm checking to begin with -- it will pass if the inode happens to be regular. Keep the redundant path_noexec() check even though it's mindless nonsense checking for guarantee that isn't given so drop the WARN. Reword the commentary and do small tidy ups while here.
[brauner: keep redundant path_noexec() check] (CVE-2024-50010)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50010
https://ubuntu.com/security/CVE-2024-50010

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:M/Au:N/C:C/I:P/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50010

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231893 - Linux Distros Unpatched Vulnerability : CVE-2024-50012
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cpufreq: Avoid a bad reference count on CPU node In the parse_perf_domain function, if the call to of_parse_phandle_with_args returns an error, then the reference to the CPU device node that was acquired at the start of the function would not be properly decremented. Address this by declaring the variable with the __free(device_node) cleanup attribute. (CVE-2024-50012)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50012
https://ubuntu.com/security/CVE-2024-50012

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50012

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230486 - Linux Distros Unpatched Vulnerability : CVE-2024-50020
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ice: Fix improper handling of refcount in ice_sriov_set_msix_vec_count() This patch addresses an issue with improper reference count handling in the ice_sriov_set_msix_vec_count() function. First, the function calls ice_get_vf_by_id(), which increments the reference count of the vf pointer. If the subsequent call to ice_get_vf_vsi() fails, the function currently returns an error without decrementing the reference count of the vf pointer, leading to a reference count leak. The correct behavior, as implemented in this patch, is to decrement the reference count using ice_put_vf(vf) before returning an error when vsi is NULL. Second, the function calls ice_sriov_get_irqs(), which sets vf->first_vector_idx. If this call returns a negative value, indicating an error, the function returns an error without decrementing the reference count of the vf pointer, resulting in another reference count leak. The patch addresses this by adding a call to ice_put_vf(vf) before returning an error when vf->first_vector_idx < 0. This bug was identified by an experimental static analysis tool developed by our team. The tool specializes in analyzing reference count operations and identifying potential mismanagement of reference counts. In this case, the tool flagged the missing decrement operation as a potential issue, leading to this patch. (CVE-2024-50020)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50020
https://ubuntu.com/security/CVE-2024-50020

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50020

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230796 - Linux Distros Unpatched Vulnerability : CVE-2024-50021
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ice: Fix improper handling of refcount in ice_dpll_init_rclk_pins() This patch addresses a reference count handling issue in the ice_dpll_init_rclk_pins() function. The function calls ice_dpll_get_pins(), which increments the reference count of the relevant resources. However, if the condition WARN_ON((!vsi || !vsi->netdev)) is met, the function currently returns an error without properly releasing the resources acquired by ice_dpll_get_pins(), leading to a reference count leak. To resolve this, the check has been moved to the top of the function. This ensures that the function verifies the state before any resources are acquired, avoiding the need for additional resource management in the error path. This bug was identified by an experimental static analysis tool developed by our team. The tool specializes in analyzing reference count operations and detecting potential issues where resources are not properly managed. In this case, the tool flagged the missing release operation as a potential problem, which led to the development of this patch.
(CVE-2024-50021)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50021
https://ubuntu.com/security/CVE-2024-50021

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50021

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230749 - Linux Distros Unpatched Vulnerability : CVE-2024-50040
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: igb: Do not bring the device up after non-fatal error Commit 004d25060c78 (igb: Fix igb_down hung on surprise removal) changed igb_io_error_detected() to ignore non-fatal pcie errors in order to avoid hung task that can happen when igb_down() is called multiple times. This caused an issue when processing transient non-fatal errors.
igb_io_resume(), which is called after igb_io_error_detected(), assumes that device is brought down by igb_io_error_detected() if the interface is up. This resulted in panic with stacktrace below. [ T3256] igb 0000:09:00.0 haeth0: igb: haeth0 NIC Link is Down [ T292] pcieport 0000:00:1c.5: AER: Uncorrected (Non- Fatal) error received: 0000:09:00.0 [ T292] igb 0000:09:00.0: PCIe Bus Error: severity=Uncorrected (Non- Fatal), type=Transaction Layer, (Requester ID) [ T292] igb 0000:09:00.0: device [8086:1537] error status/mask=00004000/00000000 [ T292] igb 0000:09:00.0: [14] CmpltTO [ 200.105524,009][ T292] igb 0000:09:00.0: AER: TLP Header: 00000000 00000000 00000000 00000000 [ T292] pcieport 0000:00:1c.5: AER:
broadcast error_detected message [ T292] igb 0000:09:00.0: Non-correctable non-fatal error reported. [ T292] pcieport 0000:00:1c.5: AER: broadcast mmio_enabled message [ T292] pcieport 0000:00:1c.5: AER:
broadcast resume message [ T292] ------------[ cut here ]------------ [ T292] kernel BUG at net/core/dev.c:6539! [ T292] invalid opcode: 0000 [#1] PREEMPT SMP [ T292] RIP: 0010:napi_enable+0x37/0x40 [ T292] Call Trace: [ T292] <TASK> [ T292] ? die+0x33/0x90 [ T292] ? do_trap+0xdc/0x110 [ T292] ? napi_enable+0x37/0x40 [ T292] ? do_error_trap+0x70/0xb0 [ T292] ? napi_enable+0x37/0x40 [ T292] ? napi_enable+0x37/0x40 [ T292] ? exc_invalid_op+0x4e/0x70 [ T292] ? napi_enable+0x37/0x40 [ T292] ? asm_exc_invalid_op+0x16/0x20 [ T292] ? napi_enable+0x37/0x40 [ T292] igb_up+0x41/0x150 [ T292] igb_io_resume+0x25/0x70 [ T292] report_resume+0x54/0x70 [ T292] ? report_frozen_detected+0x20/0x20 [ T292] pci_walk_bus+0x6c/0x90 [ T292] ? aer_print_port_info+0xa0/0xa0 [ T292] pcie_do_recovery+0x22f/0x380 [ T292] aer_process_err_devices+0x110/0x160 [ T292] aer_isr+0x1c1/0x1e0 [ T292] ? disable_irq_nosync+0x10/0x10 [ T292] irq_thread_fn+0x1a/0x60 [ T292] irq_thread+0xe3/0x1a0 [ T292] ? irq_set_affinity_notifier+0x120/0x120 [ T292] ? irq_affinity_notify+0x100/0x100 [ T292] kthread+0xe2/0x110 [ T292] ? kthread_complete_and_exit+0x20/0x20 [ T292] ret_from_fork+0x2d/0x50 [ T292] ? kthread_complete_and_exit+0x20/0x20 [ T292] ret_from_fork_asm+0x11/0x20 [ T292] </TASK> To fix this issue igb_io_resume() checks if the interface is running and the device is not down this means igb_io_error_detected() did not bring the device down and there is no need to bring it up.
(CVE-2024-50040)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50040
https://ubuntu.com/security/CVE-2024-50040

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50040

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231762 - Linux Distros Unpatched Vulnerability : CVE-2024-50041
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: i40e: Fix macvlan leak by synchronizing access to mac_filter_hash This patch addresses a macvlan leak issue in the i40e driver caused by concurrent access to vsi->mac_filter_hash. The leak occurs when multiple threads attempt to modify the mac_filter_hash simultaneously, leading to inconsistent state and potential memory leaks. To fix this, we now wrap the calls to i40e_del_mac_filter() and zeroing vf->default_lan_addr.addr with spin_lock/unlock_bh(&vsi->mac_filter_hash_lock), ensuring atomic operations and preventing concurrent access. Additionally, we add lockdep_assert_held(&vsi->mac_filter_hash_lock) in i40e_add_mac_filter() to help catch similar issues in the future. Reproduction steps: 1. Spawn VFs and configure port vlan on them.
2. Trigger concurrent macvlan operations (e.g., adding and deleting portvlan and/or mac filters). 3.
Observe the potential memory leak and inconsistent state in the mac_filter_hash. This synchronization ensures the integrity of the mac_filter_hash and prevents the described leak. (CVE-2024-50041)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50041
https://ubuntu.com/security/CVE-2024-50041

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50041

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231415 - Linux Distros Unpatched Vulnerability : CVE-2024-50045
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfilter: br_netfilter: fix panic with metadata_dst skb Fix a kernel panic in the br_netfilter module when sending untagged traffic via a VxLAN device. This happens during the check for fragmentation in br_nf_dev_queue_xmit. It is dependent on: 1) the br_netfilter module being loaded; 2) net.bridge.bridge- nf-call-iptables set to 1; 3) a bridge with a VxLAN (single-vxlan-device) netdevice as a bridge port; 4) untagged frames with size higher than the VxLAN MTU forwarded/flooded When forwarding the untagged packet to the VxLAN bridge port, before the netfilter hooks are called, br_handle_egress_vlan_tunnel is called and changes the skb_dst to the tunnel dst. The tunnel_dst is a metadata type of dst, i.e., skb_valid_dst(skb) is false, and metadata->dst.dev is NULL. Then in the br_netfilter hooks, in br_nf_dev_queue_xmit, there's a check for frames that needs to be fragmented: frames with higher MTU than the VxLAN device end up calling br_nf_ip_fragment, which in turns call ip_skb_dst_mtu. The ip_dst_mtu tries to use the skb_dst(skb) as if it was a valid dst with valid dst->dev, thus the crash. This case was never supported in the first place, so drop the packet instead. PING 10.0.0.2 (10.0.0.2) from 0.0.0.0 h1-eth0: 2000(2028) bytes of data. [ 176.291791] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000110 [ 176.292101] Mem abort info: [ 176.292184] ESR = 0x0000000096000004 [ 176.292322] EC = 0x25: DABT (current EL), IL = 32 bits [ 176.292530] SET = 0, FnV = 0 [ 176.292709] EA = 0, S1PTW = 0 [ 176.292862] FSC = 0x04: level 0 translation fault [ 176.293013] Data abort info: [ 176.293104] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 176.293488] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 176.293787] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 176.293995] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000043ef5000 [ 176.294166] [0000000000000110] pgd=0000000000000000, p4d=0000000000000000 [ 176.294827] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 176.295252] Modules linked in: vxlan ip6_udp_tunnel udp_tunnel veth br_netfilter bridge stp llc ipv6 crct10dif_ce [ 176.295923] CPU: 0 PID: 188 Comm: ping Not tainted 6.8.0-rc3-g5b3fbd61b9d1 #2 [ 176.296314] Hardware name: linux,dummy-virt (DT) [ 176.296535] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 176.296808] pc :
br_nf_dev_queue_xmit+0x390/0x4ec [br_netfilter] [ 176.297382] lr : br_nf_dev_queue_xmit+0x2ac/0x4ec [br_netfilter] [ 176.297636] sp : ffff800080003630 [ 176.297743] x29: ffff800080003630 x28:
0000000000000008 x27: ffff6828c49ad9f8 [ 176.298093] x26: ffff6828c49ad000 x25: 0000000000000000 x24:
00000000000003e8 [ 176.298430] x23: 0000000000000000 x22: ffff6828c4960b40 x21: ffff6828c3b16d28 [ 176.298652] x20: ffff6828c3167048 x19: ffff6828c3b16d00 x18: 0000000000000014 [ 176.298926] x17:
ffffb0476322f000 x16: ffffb7e164023730 x15: 0000000095744632 [ 176.299296] x14: ffff6828c3f1c880 x13:
0000000000000002 x12: ffffb7e137926a70 [ 176.299574] x11: 0000000000000001 x10: ffff6828c3f1c898 x9 :
0000000000000000 [ 176.300049] x8 : ffff6828c49bf070 x7 : 0008460f18d5f20e x6 : f20e0100bebafeca [ 176.300302] x5 : ffff6828c7f918fe x4 : ffff6828c49bf070 x3 : 0000000000000000 [ 176.300586] x2 :
0000000000000000 x1 : ffff6828c3c7ad00 x0 : ffff6828c7f918f0 [ 176.300889] Call trace: [ 176.301123] br_nf_dev_queue_xmit+0x390/0x4ec [br_netfilter] [ 176.301411] br_nf_post_routing+0x2a8/0x3e4 [br_netfilter] [ 176.301703] nf_hook_slow+0x48/0x124 [ 176.302060] br_forward_finish+0xc8/0xe8 [bridge] [ 176.302371] br_nf_hook_thresh+0x124/0x134 [br_netfilter] [ 176.302605] br_nf_forward_finish+0x118/0x22c [br_netfilter] [ 176.302824] br_nf_forward_ip.part.0+0x264/0x290 [br_netfilter] [ 176.303136] br_nf_forward+0x2b8/0x4e0 [br_netfilter] [ 176.303359] nf_hook_slow+0x48/0x124 [ 176.303 ---truncated--- (CVE-2024-50045)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50045
https://ubuntu.com/security/CVE-2024-50045

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50045

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230397 - Linux Distros Unpatched Vulnerability : CVE-2024-50048
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fbcon: Fix a NULL pointer dereference issue in fbcon_putcs syzbot has found a NULL pointer dereference bug in fbcon. Here is the simplified C reproducer: struct param { uint8_t type; struct tiocl_selection ts; };
int main() { struct fb_con2fbmap con2fb; struct param param; int fd = open(/dev/fb1, 0, 0);
con2fb.console = 0x19; con2fb.framebuffer = 0; ioctl(fd, FBIOPUT_CON2FBMAP, &con2fb); param.type = 2;
param.ts.xs = 0; param.ts.ys = 0; param.ts.xe = 0; param.ts.ye = 0; param.ts.sel_mode = 0; int fd1 = open(/dev/tty1, O_RDWR, 0); ioctl(fd1, TIOCLINUX, m); con2fb.console = 1; con2fb.framebuffer = 0;
ioctl(fd, FBIOPUT_CON2FBMAP, &con2fb); return 0; } After calling ioctl(fd1, TIOCLINUX, m), the subsequent ioctl(fd, FBIOPUT_CON2FBMAP, &con2fb) causes the kernel to follow a different execution path:
set_con2fb_map -> con2fb_init_display -> fbcon_set_disp -> redraw_screen -> hide_cursor -> clear_selection
-> highlight -> invert_screen -> do_update_region -> fbcon_putcs -> ops->putcs Since ops->putcs is a NULL pointer, this leads to a kernel panic. To prevent this, we need to call set_blitting_type() within set_con2fb_map() to properly initialize ops->putcs. (CVE-2024-50048)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50048
https://ubuntu.com/security/CVE-2024-50048

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50048

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230522 - Linux Distros Unpatched Vulnerability : CVE-2024-50076
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: vt: prevent kernel-infoleak in con_font_get() font.data may not initialize all memory spaces depending on the implementation of vc->vc_sw->con_font_get. This may cause info-leak, so to prevent this, it is safest to modify it to initialize the allocated memory space to 0, and it generally does not affect the overall performance of the system. (CVE-2024-50076)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50076
https://ubuntu.com/security/CVE-2024-50076

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0014
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50076

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230864 - Linux Distros Unpatched Vulnerability : CVE-2024-50095
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA/mad: Improve handling of timed out WRs of mad agent Current timeout handler of mad agent acquires/releases mad_agent_priv lock for every timed out WRs. This causes heavy locking contention when higher no. of WRs are to be handled inside timeout handler. This leads to softlockup with below trace in some use cases where rdma-cm path is used to establish connection between peer nodes Trace: ----- BUG:
soft lockup - CPU#4 stuck for 26s! [kworker/u128:3:19767] CPU: 4 PID: 19767 Comm: kworker/u128:3 Kdump:
loaded Tainted: G OE ------- --- 5.14.0-427.13.1.el9_4.x86_64 #1 Hardware name: Dell Inc. PowerEdge R740/01YM03, BIOS 2.4.8 11/26/2019 Workqueue: ib_mad1 timeout_sends [ib_core] RIP:
0010:__do_softirq+0x78/0x2ac RSP: 0018:ffffb253449e4f98 EFLAGS: 00000246 RAX: 00000000ffffffff RBX:
0000000000000000 RCX: 000000000000001f RDX: 000000000000001d RSI: 000000003d1879ab RDI: fff363b66fd3a86b RBP: ffffb253604cbcd8 R08: 0000009065635f3b R09: 0000000000000000 R10: 0000000000000040 R11:
ffffb253449e4ff8 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000040 FS: 0000000000000000(0000) GS:ffff8caa1fc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd9ec9db900 CR3: 0000000891934006 CR4: 00000000007706e0 DR0:
0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <IRQ> ? show_trace_log_lvl+0x1c4/0x2df ? show_trace_log_lvl+0x1c4/0x2df ? __irq_exit_rcu+0xa1/0xc0 ? watchdog_timer_fn+0x1b2/0x210 ?
__pfx_watchdog_timer_fn+0x10/0x10 ? __hrtimer_run_queues+0x127/0x2c0 ? hrtimer_interrupt+0xfc/0x210 ?
__sysvec_apic_timer_interrupt+0x5c/0x110 ? sysvec_apic_timer_interrupt+0x37/0x90 ? asm_sysvec_apic_timer_interrupt+0x16/0x20 ? __do_softirq+0x78/0x2ac ? __do_softirq+0x60/0x2ac
__irq_exit_rcu+0xa1/0xc0 sysvec_call_function_single+0x72/0x90 </IRQ> <TASK>
asm_sysvec_call_function_single+0x16/0x20 RIP: 0010:_raw_spin_unlock_irq+0x14/0x30 RSP:
0018:ffffb253604cbd88 EFLAGS: 00000247 RAX: 000000000001960d RBX: 0000000000000002 RCX: ffff8cad2a064800 RDX: 000000008020001b RSI: 0000000000000001 RDI: ffff8cad5d39f66c RBP: ffff8cad5d39f600 R08:
0000000000000001 R09: 0000000000000000 R10: ffff8caa443e0c00 R11: ffffb253604cbcd8 R12: ffff8cacb8682538 R13: 0000000000000005 R14: ffffb253604cbd90 R15: ffff8cad5d39f66c cm_process_send_error+0x122/0x1d0 [ib_cm] timeout_sends+0x1dd/0x270 [ib_core] process_one_work+0x1e2/0x3b0 ? __pfx_worker_thread+0x10/0x10 worker_thread+0x50/0x3a0 ? __pfx_worker_thread+0x10/0x10 kthread+0xdd/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x29/0x50 </TASK> Simplified timeout handler by creating local list of timed out WRs and invoke send handler post creating the list. The new method acquires/ releases lock once to fetch the list and hence helps to reduce locking contetiong when processing higher no. of WRs (CVE-2024-50095)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50095
https://ubuntu.com/security/CVE-2024-50095

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50095

Plugin Information
Published: 2025/03/06, Modified: 2025/12/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231595 - Linux Distros Unpatched Vulnerability : CVE-2024-50135
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nvme-pci: fix race condition between reset and nvme_dev_disable() nvme_dev_disable() modifies the dev->online_queues field, therefore nvme_pci_update_nr_queues() should avoid racing against it, otherwise we could end up passing invalid values to blk_mq_update_nr_hw_queues(). WARNING: CPU: 39 PID: 61303 at drivers/pci/msi/api.c:347 pci_irq_get_affinity+0x187/0x210 Workqueue: nvme-reset-wq nvme_reset_work [nvme] RIP: 0010:pci_irq_get_affinity+0x187/0x210 Call Trace: <TASK> ? blk_mq_pci_map_queues+0x87/0x3c0 ? pci_irq_get_affinity+0x187/0x210 blk_mq_pci_map_queues+0x87/0x3c0 nvme_pci_map_queues+0x189/0x460 [nvme] blk_mq_update_nr_hw_queues+0x2a/0x40 nvme_reset_work+0x1be/0x2a0 [nvme] Fix the bug by locking the shutdown_lock mutex before using dev->online_queues. Give up if nvme_dev_disable() is running or if it has been executed already. (CVE-2024-50135)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50135
https://security-tracker.debian.org/tracker/CVE-2024-50135
https://ubuntu.com/security/CVE-2024-50135

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:H/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50135

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230606 - Linux Distros Unpatched Vulnerability : CVE-2024-50136
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Unregister notifier on eswitch init failure It otherwise remains registered and a subsequent attempt at eswitch enabling might trigger warnings of the sort: [ 682.589148] ------------[ cut here ]------------ [ 682.590204] notifier callback eswitch_vport_event [mlx5_core] already registered [ 682.590256] WARNING: CPU: 13 PID: 2660 at kernel/notifier.c:31 notifier_chain_register+0x3e/0x90 [...snipped] [ 682.610052] Call Trace: [ 682.610369] <TASK> [ 682.610663] ? __warn+0x7c/0x110 [ 682.611050] ? notifier_chain_register+0x3e/0x90 [ 682.611556] ? report_bug+0x148/0x170 [ 682.611977] ? handle_bug+0x36/0x70 [ 682.612384] ? exc_invalid_op+0x13/0x60 [ 682.612817] ? asm_exc_invalid_op+0x16/0x20 [ 682.613284] ? notifier_chain_register+0x3e/0x90 [ 682.613789] atomic_notifier_chain_register+0x25/0x40 [ 682.614322] mlx5_eswitch_enable_locked+0x1d4/0x3b0 [mlx5_core] [ 682.614965] mlx5_eswitch_enable+0xc9/0x100 [mlx5_core] [ 682.615551] mlx5_device_enable_sriov+0x25/0x340 [mlx5_core] [ 682.616170] mlx5_core_sriov_configure+0x50/0x170 [mlx5_core] [ 682.616789] sriov_numvfs_store+0xb0/0x1b0 [ 682.617248] kernfs_fop_write_iter+0x117/0x1a0 [ 682.617734] vfs_write+0x231/0x3f0 [ 682.618138] ksys_write+0x63/0xe0 [ 682.618536] do_syscall_64+0x4c/0x100 [ 682.618958] entry_SYSCALL_64_after_hwframe+0x4b/0x53 (CVE-2024-50136)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50136
https://ubuntu.com/security/CVE-2024-50136

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50136

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231310 - Linux Distros Unpatched Vulnerability : CVE-2024-50138
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Use raw_spinlock_t in ringbuf The function __bpf_ringbuf_reserve is invoked from a tracepoint, which disables preemption. Using spinlock_t in this context can lead to a sleep in atomic warning in the RT variant. This issue is illustrated in the example below: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 556208, name: test_progs preempt_count: 1, expected: 0 RCU nest depth: 1, expected: 1 INFO: lockdep is turned off.
Preemption disabled at: [<ffffd33a5c88ea44>] migrate_enable+0xc0/0x39c CPU: 7 PID: 556208 Comm: test_progs Tainted: G Hardware name: Qualcomm SA8775P Ride (DT) Call trace: dump_backtrace+0xac/0x130 show_stack+0x1c/0x30 dump_stack_lvl+0xac/0xe8 dump_stack+0x18/0x30 __might_resched+0x3bc/0x4fc rt_spin_lock+0x8c/0x1a4 __bpf_ringbuf_reserve+0xc4/0x254 bpf_ringbuf_reserve_dynptr+0x5c/0xdc bpf_prog_ac3d15160d62622a_test_read_write+0x104/0x238 trace_call_bpf+0x238/0x774 perf_call_bpf_enter.isra.0+0x104/0x194 perf_syscall_enter+0x2f8/0x510 trace_sys_enter+0x39c/0x564 syscall_trace_enter+0x220/0x3c0 do_el0_svc+0x138/0x1dc el0_svc+0x54/0x130 el0t_64_sync_handler+0x134/0x150 el0t_64_sync+0x17c/0x180 Switch the spinlock to raw_spinlock_t to avoid this error. (CVE-2024-50138)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50138
https://security-tracker.debian.org/tracker/CVE-2024-50138
https://ubuntu.com/security/CVE-2024-50138

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50138

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231139 - Linux Distros Unpatched Vulnerability : CVE-2024-50139
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix shift-out-of-bounds bug Fix a shift-out-of-bounds bug reported by UBSAN when running VM with MTE enabled host kernel. UBSAN:
shift-out-of-bounds in arch/arm64/kvm/sys_regs.c:1988:14 shift exponent 33 is too large for 32-bit type 'int' CPU: 26 UID: 0 PID: 7629 Comm: qemu-kvm Not tainted 6.12.0-rc2 #34 Hardware name: IEI NF5280R7/Mitchell MB, BIOS 00.00. 2024-10-12 09:28:54 10/14/2024 Call trace: dump_backtrace+0xa0/0x128 show_stack+0x20/0x38 dump_stack_lvl+0x74/0x90 dump_stack+0x18/0x28
__ubsan_handle_shift_out_of_bounds+0xf8/0x1e0 reset_clidr+0x10c/0x1c8 kvm_reset_sys_regs+0x50/0x1c8 kvm_reset_vcpu+0xec/0x2b0 __kvm_vcpu_set_target+0x84/0x158 kvm_vcpu_set_target+0x138/0x168 kvm_arch_vcpu_ioctl_vcpu_init+0x40/0x2b0 kvm_arch_vcpu_ioctl+0x28c/0x4b8 kvm_vcpu_ioctl+0x4bc/0x7a8
__arm64_sys_ioctl+0xb4/0x100 invoke_syscall+0x70/0x100 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x3c/0x158 el0t_64_sync_handler+0x120/0x130 el0t_64_sync+0x194/0x198 (CVE-2024-50139)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50139
https://ubuntu.com/security/CVE-2024-50139

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50139

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230679 - Linux Distros Unpatched Vulnerability : CVE-2024-50145
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx() build_skb() returns NULL in case of a memory allocation failure so handle it inside __octep_oq_process_rx() to avoid NULL pointer dereference. __octep_oq_process_rx() is called during NAPI polling by the driver. If skb allocation fails, keep on pulling packets out of the Rx DMA queue: we shouldn't break the polling immediately and thus falsely indicate to the octep_napi_poll() that the Rx pressure is going down. As there is no associated skb in this case, don't process the packets and don't push them up the network stack - they are skipped. Helper function is implemented to unmmap/flush all the fragment buffers used by the dropped packet. 'alloc_failures' counter is incremented to mark the skb allocation error in driver statistics. Found by Linux Verification Center (linuxtesting.org) with SVACE. (CVE-2024-50145)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50145
https://ubuntu.com/security/CVE-2024-50145

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50145

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231690 - Linux Distros Unpatched Vulnerability : CVE-2024-50146
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mlx5e: Don't call cleanup on profile rollback failure When profile rollback fails in mlx5e_netdev_change_profile, the netdev profile var is left set to NULL. Avoid a crash when unloading the driver by not calling profile->cleanup in such a case. This was encountered while testing, with the original trigger that the wq rescuer thread creation got interrupted (presumably due to Ctrl+C-ing modprobe), which gets converted to ENOMEM (-12) by mlx5e_priv_init, the profile rollback also fails for the same reason (signal still active) so the profile is left as NULL, leading to a crash later in
_mlx5e_remove. [ 732.473932] mlx5_core 0000:08:00.1: E-Switch: Unload vfs: mode(OFFLOADS), nvfs(2), necvfs(0), active vports(2) [ 734.525513] workqueue: Failed to create a rescuer kthread for wq mlx5e:
-EINTR [ 734.557372] mlx5_core 0000:08:00.1: mlx5e_netdev_init_profile:6235:(pid 6086): mlx5e_priv_init failed, err=-12 [ 734.559187] mlx5_core 0000:08:00.1 eth3: mlx5e_netdev_change_profile: new profile init failed, -12 [ 734.560153] workqueue: Failed to create a rescuer kthread for wq mlx5e: -EINTR [ 734.589378] mlx5_core 0000:08:00.1: mlx5e_netdev_init_profile:6235:(pid 6086): mlx5e_priv_init failed, err=-12 [ 734.591136] mlx5_core 0000:08:00.1 eth3: mlx5e_netdev_change_profile: failed to rollback to orig profile, -12 [ 745.537492] BUG: kernel NULL pointer dereference, address: 0000000000000008 [ 745.538222] #PF: supervisor read access in kernel mode <snipped> [ 745.551290] Call Trace: [ 745.551590] <TASK> [ 745.551866] ? __die+0x20/0x60 [ 745.552218] ? page_fault_oops+0x150/0x400 [ 745.555307] ? exc_page_fault+0x79/0x240 [ 745.555729] ? asm_exc_page_fault+0x22/0x30 [ 745.556166] ? mlx5e_remove+0x6b/0xb0 [mlx5_core] [ 745.556698] auxiliary_bus_remove+0x18/0x30 [ 745.557134] device_release_driver_internal+0x1df/0x240 [ 745.557654] bus_remove_device+0xd7/0x140 [ 745.558075] device_del+0x15b/0x3c0 [ 745.558456] mlx5_rescan_drivers_locked.part.0+0xb1/0x2f0 [mlx5_core] [ 745.559112] mlx5_unregister_device+0x34/0x50 [mlx5_core] [ 745.559686] mlx5_uninit_one+0x46/0xf0 [mlx5_core] [ 745.560203] remove_one+0x4e/0xd0 [mlx5_core] [ 745.560694] pci_device_remove+0x39/0xa0 [ 745.561112] device_release_driver_internal+0x1df/0x240 [ 745.561631] driver_detach+0x47/0x90 [ 745.562022] bus_remove_driver+0x84/0x100 [ 745.562444] pci_unregister_driver+0x3b/0x90 [ 745.562890] mlx5_cleanup+0xc/0x1b [mlx5_core] [ 745.563415] __x64_sys_delete_module+0x14d/0x2f0 [ 745.563886] ? kmem_cache_free+0x1b0/0x460 [ 745.564313] ? lockdep_hardirqs_on_prepare+0xe2/0x190 [ 745.564825] do_syscall_64+0x6d/0x140 [ 745.565223] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 745.565725] RIP:
0033:0x7f1579b1288b (CVE-2024-50146)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50146
https://ubuntu.com/security/CVE-2024-50146

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50146

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231236 - Linux Distros Unpatched Vulnerability : CVE-2024-50147
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix command bitmask initialization Command bitmask have a dedicated bit for MANAGE_PAGES command, this bit isn't Initialize during command bitmask Initialization, only during MANAGE_PAGES. In addition, mlx5_cmd_trigger_completions() is trying to trigger completion for MANAGE_PAGES command as well. Hence, in case health error occurred before any MANAGE_PAGES command have been invoke (for example, during mlx5_enable_hca()), mlx5_cmd_trigger_completions() will try to trigger completion for MANAGE_PAGES command, which will result in null-ptr-deref error.[1] Fix it by Initialize command bitmask correctly.
While at it, re-write the code for better understanding. [1] BUG: KASAN: null-ptr-deref in mlx5_cmd_trigger_completions+0x1db/0x600 [mlx5_core] Write of size 4 at addr 0000000000000214 by task kworker/u96:2/12078 CPU: 10 PID: 12078 Comm: kworker/u96:2 Not tainted 6.9.0-rc2_for_upstream_debug_2024_04_07_19_01 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: mlx5_health0000:08:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core] Call Trace: <TASK> dump_stack_lvl+0x7e/0xc0 kasan_report+0xb9/0xf0 kasan_check_range+0xec/0x190 mlx5_cmd_trigger_completions+0x1db/0x600 [mlx5_core] mlx5_cmd_flush+0x94/0x240 [mlx5_core] enter_error_state+0x6c/0xd0 [mlx5_core] mlx5_fw_fatal_reporter_err_work+0xf3/0x480 [mlx5_core] process_one_work+0x787/0x1490 ? lockdep_hardirqs_on_prepare+0x400/0x400 ? pwq_dec_nr_in_flight+0xda0/0xda0 ? assign_work+0x168/0x240 worker_thread+0x586/0xd30 ? rescuer_thread+0xae0/0xae0 kthread+0x2df/0x3b0 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x2d/0x70 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork_asm+0x11/0x20 </TASK> (CVE-2024-50147)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50147
https://ubuntu.com/security/CVE-2024-50147

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50147

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231904 - Linux Distros Unpatched Vulnerability : CVE-2024-50157
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Avoid CPU lockups due fifo occupancy check loop Driver waits indefinitely for the fifo occupancy to go below a threshold as soon as the pacing interrupt is received. This can cause soft lockup on one of the processors, if the rate of DB is very high. Add a loop count for FPGA and exit the __wait_for_fifo_occupancy_below_th if the loop is taking more time. Pacing will be continuing until the occupancy is below the threshold. This is ensured by the checks in bnxt_re_pacing_timer_exp and further scheduling the work for pacing based on the fifo occupancy. (CVE-2024-50157)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50157
https://ubuntu.com/security/CVE-2024-50157

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50157

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231543 - Linux Distros Unpatched Vulnerability : CVE-2024-50160
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs8409: Fix possible NULL dereference If snd_hda_gen_add_kctl fails to allocate memory and returns NULL, then NULL pointer dereference will occur in the next line. Since dolphin_fixups function is a hda_fixup function which is not supposed to return any errors, add simple check before dereference, ignore the fail. Found by Linux Verification Center (linuxtesting.org) with SVACE. (CVE-2024-50160)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50160
https://ubuntu.com/security/CVE-2024-50160

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50160

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230889 - Linux Distros Unpatched Vulnerability : CVE-2024-50165
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve param->string when parsing mount options In bpf_parse_param(), keep the value of param->string intact so it can be freed later. Otherwise, the kmalloc area pointed to by param->string will be leaked as shown below: unreferenced object 0xffff888118c46d20 (size 8): comm new_name, pid 12109, jiffies 4295580214 hex dump (first 8 bytes): 61 6e 79 00 38 c9 5c 7e any.8.\~ backtrace (crc e1b7f876): [<00000000c6848ac7>] kmemleak_alloc+0x4b/0x80 [<00000000de9f7d00>] __kmalloc_node_track_caller_noprof+0x36e/0x4a0 [<000000003e29b886>] memdup_user+0x32/0xa0 [<0000000007248326>] strndup_user+0x46/0x60 [<0000000035b3dd29>] __x64_sys_fsconfig+0x368/0x3d0 [<0000000018657927>] x64_sys_call+0xff/0x9f0 [<00000000c0cabc95>] do_syscall_64+0x3b/0xc0 [<000000002f331597>] entry_SYSCALL_64_after_hwframe+0x4b/0x53 (CVE-2024-50165)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50165
https://ubuntu.com/security/CVE-2024-50165

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-50165

Plugin Information
Published: 2025/03/06, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230948 - Linux Distros Unpatched Vulnerability : CVE-2024-50167
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: be2net: fix potential memory leak in be_xmit() The be_xmit() returns NETDEV_TX_OK without freeing skb in case of be_xmit_enqueue() fails, add dev_kfree_skb_any() to fix it. (CVE-2024-50167)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50167
https://ubuntu.com/security/CVE-2024-50167

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50167

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231773 - Linux Distros Unpatched Vulnerability : CVE-2024-50172
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix a possible memory leak In bnxt_re_setup_chip_ctx() when bnxt_qplib_map_db_bar() fails driver is not freeing the memory allocated for rdev->chip_ctx. (CVE-2024-50172)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50172
https://ubuntu.com/security/CVE-2024-50172

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50172

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230485 - Linux Distros Unpatched Vulnerability : CVE-2024-50179
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ceph: remove the incorrect Fw reference check when dirtying pages When doing the direct-io reads it will also try to mark pages dirty, but for the read path it won't hold the Fw caps and there is case will it get the Fw reference.
(CVE-2024-50179)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50179
https://ubuntu.com/security/CVE-2024-50179

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50179

Plugin Information
Published: 2025/03/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231264 - Linux Distros Unpatched Vulnerability : CVE-2024-50183
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance Deleting an NPIV instance requires all fabric ndlps to be released before an NPIV's resources can be torn down. Failure to release fabric ndlps beforehand opens kref imbalance race conditions. Fix by forcing the DA_ID to complete synchronously with usage of wait_queue. (CVE-2024-50183)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50183
https://security-tracker.debian.org/tracker/CVE-2024-50183
https://ubuntu.com/security/CVE-2024-50183

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50183

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230961 - Linux Distros Unpatched Vulnerability : CVE-2024-50185
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mptcp: handle consistently DSS corruption Bugged peer implementation can send corrupted DSS options, consistently hitting a few warning in the data path. Use DEBUG_NET assertions, to avoid the splat on some builds and handle consistently the error, dumping related MIBs and performing fallback and/or reset according to the subflow type.
(CVE-2024-50185)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50185
https://ubuntu.com/security/CVE-2024-50185

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50185

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230985 - Linux Distros Unpatched Vulnerability : CVE-2024-50194
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- arm64: probes: Fix uprobes for big-endian kernels The arm64 uprobes code is broken for big-endian kernels as it doesn't convert the in-memory instruction encoding (which is always little-endian) into the kernel's native endianness before analyzing and simulating instructions. This may result in a few distinct problems: * The kernel may may erroneously reject probing an instruction which can safely be probed. * The kernel may erroneously erroneously permit stepping an instruction out-of-line when that instruction cannot be stepped out-of-line safely. * The kernel may erroneously simulate instruction incorrectly dur to interpretting the byte-swapped encoding. The endianness mismatch isn't caught by the compiler or sparse because: * The arch_uprobe::{insn,ixol} fields are encoded as arrays of u8, so the compiler and sparse have no idea these contain a little-endian 32-bit value. The core uprobes code populates these with a memcpy() which similarly does not handle endianness. * While the uprobe_opcode_t type is an alias for
__le32, both arch_uprobe_analyze_insn() and arch_uprobe_skip_sstep() cast from u8[] to the similarly-named probe_opcode_t, which is an alias for u32. Hence there is no endianness conversion warning. Fix this by changing the arch_uprobe::{insn,ixol} fields to __le32 and adding the appropriate __le32_to_cpu() conversions prior to consuming the instruction encoding. The core uprobes copies these fields as opaque ranges of bytes, and so is unaffected by this change. At the same time, remove MAX_UINSN_BYTES and consistently use AARCH64_INSN_SIZE for clarity. Tested with the following: | #include <stdio.h> | #include <stdbool.h> | | #define noinline __attribute__((noinline)) | | static noinline void *adrp_self(void) | { | void *addr; | | asm volatile( | adrp %x0, adrp_self | add %x0, %x0, :lo12:adrp_self | : =r (addr)); | } | | | int main(int argc, char *argv) | { | void *ptr = adrp_self(); | bool equal = (ptr == adrp_self); | | printf(adrp_self => %p | adrp_self() => %p | %s , | adrp_self, ptr, equal ? EQUAL : NOT EQUAL); | | return 0; | } .... where the adrp_self() function was compiled to: | 00000000004007e0 <adrp_self>: | 4007e0: 90000000 adrp x0, 400000 <__ehdr_start> | 4007e4: 911f8000 add x0, x0, #0x7e0 | 4007e8: d65f03c0 ret Before this patch, the ADRP is not recognized, and is assumed to be steppable, resulting in corruption of the result: | # ./adrp-self | adrp_self => 0x4007e0 | adrp_self() =>
0x4007e0 | EQUAL | # echo 'p /root/adrp-self:0x007e0' > /sys/kernel/tracing/uprobe_events | # echo 1 >
/sys/kernel/tracing/events/uprobes/enable | # ./adrp-self | adrp_self => 0x4007e0 | adrp_self() =>
0xffffffffff7e0 | NOT EQUAL After this patch, the ADRP is correctly recognized and simulated: | # ./adrp- self | adrp_self => 0x4007e0 | adrp_self() => 0x4007e0 | EQUAL | # | # echo 'p /root/adrp-self:0x007e0' >
/sys/kernel/tracing/uprobe_events | # echo 1 > /sys/kernel/tracing/events/uprobes/enable | # ./adrp-self | adrp_self => 0x4007e0 | adrp_self() => 0x4007e0 | EQUAL (CVE-2024-50194)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50194
https://ubuntu.com/security/CVE-2024-50194

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50194

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231097 - Linux Distros Unpatched Vulnerability : CVE-2024-50207
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix reader locking when changing the sub buffer order The function ring_buffer_subbuf_order_set() updates each ring_buffer_per_cpu and installs new sub buffers that match the requested page order. This operation may be invoked concurrently with readers that rely on some of the modified data, such as the head bit (RB_PAGE_HEAD), or the ring_buffer_per_cpu.pages and reader_page pointers. However, no exclusive access is acquired by ring_buffer_subbuf_order_set(). Modifying the mentioned data while a reader also operates on them can then result in incorrect memory access and various crashes. Fix the problem by taking the reader_lock when updating a specific ring_buffer_per_cpu in ring_buffer_subbuf_order_set(). (CVE-2024-50207)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50207
https://ubuntu.com/security/CVE-2024-50207

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50207

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230814 - Linux Distros Unpatched Vulnerability : CVE-2024-50258
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: fix crash when config small gso_max_size/gso_ipv4_max_size Config a small gso_max_size/gso_ipv4_max_size will lead to an underflow in sk_dst_gso_max_size(), which may trigger a BUG_ON crash, because sk->sk_gso_max_size would be much bigger than device limits. Call Trace:
tcp_write_xmit tso_segs = tcp_init_tso_segs(skb, mss_now); tcp_set_skb_tso_segs tcp_skb_pcount_set // skb->len = 524288, mss_now = 8 // u16 tso_segs = 524288/8 = 65535 -> 0 tso_segs = DIV_ROUND_UP(skb->len, mss_now) BUG_ON(!tso_segs) Add check for the minimum value of gso_max_size and gso_ipv4_max_size.
(CVE-2024-50258)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50258
https://security-tracker.debian.org/tracker/CVE-2024-50258
https://ubuntu.com/security/CVE-2024-50258

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50258

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231937 - Linux Distros Unpatched Vulnerability : CVE-2024-50259
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write() This was found by a static analyzer. We should not forget the trailing zero after copy_from_user() if we will further do some string operations, sscanf() in this case. Adding a trailing zero will ensure that the function performs properly.
(CVE-2024-50259)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50259
https://ubuntu.com/security/CVE-2024-50259

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50259

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230527 - Linux Distros Unpatched Vulnerability : CVE-2024-50277
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dm: fix a crash if blk_alloc_disk fails If blk_alloc_disk fails, the variable md->disk is set to an error value. cleanup_mapped_device will see that md->disk is non-NULL and it will attempt to access it, causing a crash on this statement md->disk->private_data = NULL;. (CVE-2024-50277)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50277
https://security-tracker.debian.org/tracker/CVE-2024-50277
https://ubuntu.com/security/CVE-2024-50277

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50277

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230730 - Linux Distros Unpatched Vulnerability : CVE-2024-50303
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: resource,kexec:
walk_system_ram_res_rev must retain resource flags walk_system_ram_res_rev() erroneously discards resource flags when passing the information to the callback. This causes systems with IORESOURCE_SYSRAM_DRIVER_MANAGED memory to have these resources selected during kexec to store kexec buffers if that memory happens to be at placed above normal system ram. This leads to undefined behavior after reboot. If the kexec buffer is never touched, nothing happens. If the kexec buffer is touched, it could lead to a crash (like below) or undefined behavior. Tested on a system with CXL memory expanders with driver managed memory, TPM enabled, and CONFIG_IMA_KEXEC=y. Adding printk's showed the flags were being discarded and as a result the check for IORESOURCE_SYSRAM_DRIVER_MANAGED passes.
find_next_iomem_res: name(System RAM (kmem)) start(10000000000) end(1034fffffff) flags(83000200) locate_mem_hole_top_down: start(10000000000) end(1034fffffff) flags(0) [.] BUG: unable to handle page fault for address: ffff89834ffff000 [.] #PF: supervisor read access in kernel mode [.] #PF:
error_code(0x0000) - not-present page [.] PGD c04c8bf067 P4D c04c8bf067 PUD c04c8be067 PMD 0 [.] Oops:
0000 [#1] SMP [.] RIP: 0010:ima_restore_measurement_list+0x95/0x4b0 [.] RSP: 0018:ffffc900000d3a80 EFLAGS:
00010286 [.] RAX: 0000000000001000 RBX: 0000000000000000 RCX: ffff89834ffff000 [.] RDX: 0000000000000018 RSI: ffff89834ffff000 RDI: ffff89834ffff018 [.] RBP: ffffc900000d3ba0 R08: 0000000000000020 R09:
ffff888132b8a900 [.] R10: 4000000000000000 R11: 000000003a616d69 R12: 0000000000000000 [.] R13:
ffffffff8404ac28 R14: 0000000000000000 R15: ffff89834ffff000 [.] FS: 0000000000000000(0000) GS:ffff893d44640000(0000) knlGS:0000000000000000 [.] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [.] ata5: SATA link down (SStatus 0 SControl 300) [.] CR2: ffff89834ffff000 CR3: 000001034d00f001 CR4:
0000000000770ef0 [.] PKRU: 55555554 [.] Call Trace: [.] <TASK> [.] ? __die+0x78/0xc0 [.] ? page_fault_oops+0x2a8/0x3a0 [.] ? exc_page_fault+0x84/0x130 [.] ? asm_exc_page_fault+0x22/0x30 [.] ? ima_restore_measurement_list+0x95/0x4b0 [.] ? template_desc_init_fields+0x317/0x410 [.] ? crypto_alloc_tfm_node+0x9c/0xc0 [.] ? init_ima_lsm+0x30/0x30 [.] ima_load_kexec_buffer+0x72/0xa0 [.] ima_init+0x44/0xa0 [.] __initstub__kmod_ima__373_1201_init_ima7+0x1e/0xb0 [.] ? init_ima_lsm+0x30/0x30 [.] do_one_initcall+0xad/0x200 [.] ? idr_alloc_cyclic+0xaa/0x110 [.] ? new_slab+0x12c/0x420 [.] ? new_slab+0x12c/0x420 [.] ? number+0x12a/0x430 [.] ? sysvec_apic_timer_interrupt+0xa/0x80 [.] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [.] ? parse_args+0xd4/0x380 [.] ? parse_args+0x14b/0x380 [.] kernel_init_freeable+0x1c1/0x2b0 [.] ? rest_init+0xb0/0xb0 [.] kernel_init+0x16/0x1a0 [.] ret_from_fork+0x2f/0x40 [.] ? rest_init+0xb0/0xb0 [.] ret_from_fork_asm+0x11/0x20 [.] </TASK>
(CVE-2024-50303)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50303
https://ubuntu.com/security/CVE-2024-50303

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50303

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231414 - Linux Distros Unpatched Vulnerability : CVE-2024-50613
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close. (CVE-2024-50613)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50613
https://security-tracker.debian.org/tracker/CVE-2024-50613
https://ubuntu.com/security/CVE-2024-50613

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0008
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2024-50613

Plugin Information
Published: 2025/03/06, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libsndfile
230939 - Linux Distros Unpatched Vulnerability : CVE-2024-53045
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: fix bounds checker error in dapm_widget_list_create The widgets array in the snd_soc_dapm_widget_list has a __counted_by attribute attached to it, which points to the num_widgets variable. This attribute is used in bounds checking, and if it is not set before the array is filled, then the bounds sanitizer will issue a warning or a kernel panic if CONFIG_UBSAN_TRAP is set. This patch sets the size of the widgets list calculated with list_for_each as the initial value for num_widgets as it is used for allocating memory for the array. It is updated with the actual number of added elements after the array is filled. (CVE-2024-53045)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53045
https://ubuntu.com/security/CVE-2024-53045

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53045

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231787 - Linux Distros Unpatched Vulnerability : CVE-2024-53048
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ice: fix crash on probe for DPLL enabled E810 LOM The E810 Lan On Motherboard (LOM) design is vendor specific. Intel provides the reference design, but it is up to vendor on the final product design. For some cases, like Linux DPLL support, the static values defined in the driver does not reflect the actual LOM design. Current implementation of dpll pins is causing the crash on probe of the ice driver for such DPLL enabled E810 LOM designs: WARNING:
(...) at drivers/dpll/dpll_core.c:495 dpll_pin_get+0x2c4/0x330 ... Call Trace: <TASK> ? __warn+0x83/0x130 ? dpll_pin_get+0x2c4/0x330 ? report_bug+0x1b7/0x1d0 ? handle_bug+0x42/0x70 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? dpll_pin_get+0x117/0x330 ? dpll_pin_get+0x2c4/0x330 ? dpll_pin_get+0x117/0x330 ice_dpll_get_pins.isra.0+0x52/0xe0 [ice] ... The number of dpll pins enabled by LOM vendor is greater than expected and defined in the driver for Intel designed NICs, which causes the crash. Prevent the crash and allow generic pin initialization within Linux DPLL subsystem for DPLL enabled E810 LOM designs. Newly designed solution for described issue will be based on per HW design pin initialization. It requires pin information dynamically acquired from the firmware and is already in progress, planned for next-tree only. (CVE-2024-53048)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53048
https://ubuntu.com/security/CVE-2024-53048

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53048

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231786 - Linux Distros Unpatched Vulnerability : CVE-2024-53064
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- idpf: fix idpf_vc_core_init error path In an event where the platform running the device control plane is rebooted, reset is detected on the driver. It releases all the resources and waits for the reset to complete. Once the reset is done, it tries to build the resources back. At this time if the device control plane is not yet started, then the driver timeouts on the virtchnl message and retries to establish the mailbox again. In the retry flow, mailbox is deinitialized but the mailbox workqueue is still alive and polling for the mailbox message. This results in accessing the released control queue leading to null-ptr- deref. Fix it by unrolling the work queue cancellation and mailbox deinitialization in the reverse order which they got initialized. (CVE-2024-53064)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53064
https://ubuntu.com/security/CVE-2024-53064

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53064

Plugin Information
Published: 2025/03/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230554 - Linux Distros Unpatched Vulnerability : CVE-2024-53066
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nfs: Fix KMSAN warning in decode_getfattr_attrs() Fix the following KMSAN warning: CPU: 1 UID: 0 PID: 7651 Comm: cp Tainted: G B Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009) ===================================================== ===================================================== BUG: KMSAN: uninit-value in decode_getfattr_attrs+0x2d6d/0x2f90 decode_getfattr_attrs+0x2d6d/0x2f90 decode_getfattr_generic+0x806/0xb00 nfs4_xdr_dec_getattr+0x1de/0x240 rpcauth_unwrap_resp_decode+0xab/0x100 rpcauth_unwrap_resp+0x95/0xc0 call_decode+0x4ff/0xb50 __rpc_execute+0x57b/0x19d0 rpc_execute+0x368/0x5e0 rpc_run_task+0xcfe/0xee0 nfs4_proc_getattr+0x5b5/0x990 __nfs_revalidate_inode+0x477/0xd00 nfs_access_get_cached+0x1021/0x1cc0 nfs_do_access+0x9f/0xae0 nfs_permission+0x1e4/0x8c0 inode_permission+0x356/0x6c0 link_path_walk+0x958/0x1330 path_lookupat+0xce/0x6b0 filename_lookup+0x23e/0x770 vfs_statx+0xe7/0x970 vfs_fstatat+0x1f2/0x2c0 __se_sys_newfstatat+0x67/0x880
__x64_sys_newfstatat+0xbd/0x120 x64_sys_call+0x1826/0x3cf0 do_syscall_64+0xd0/0x1b0 entry_SYSCALL_64_after_hwframe+0x77/0x7f The KMSAN warning is triggered in decode_getfattr_attrs(), when calling decode_attr_mdsthreshold(). It appears that fattr->mdsthreshold is not initialized. Fix the issue by initializing fattr->mdsthreshold to NULL in nfs_fattr_init(). (CVE-2024-53066)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53066
https://ubuntu.com/security/CVE-2024-53066

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53066

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231110 - Linux Distros Unpatched Vulnerability : CVE-2024-53073
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NFSD: Never decrement pending_async_copies on error The error flow in nfsd4_copy() calls cleanup_async_copy(), which already decrements nn->pending_async_copies. (CVE-2024-53073)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53073
https://ubuntu.com/security/CVE-2024-53073

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53073

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231397 - Linux Distros Unpatched Vulnerability : CVE-2024-53079
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm/thp: fix deferred split unqueue naming and locking Recent changes are putting more pressure on THP deferred split queues: under load revealing long-standing races, causing list_del corruptions, Bad page states and worse (I keep BUGs in both of those, so usually don't get to see how badly they end up without). The relevant recent changes being 6.8's mTHP, 6.10's mTHP swapout, and 6.12's mTHP swapin, improved swap allocation, and underused THP splitting. Before fixing locking: rename misleading folio_undo_large_rmappable(), which does not undo large_rmappable, to folio_unqueue_deferred_split(), which is what it does. But that and its out-of-line __callee are mm internals of very limited usability:
add comment and WARN_ON_ONCEs to check usage; and return a bool to say if a deferred split was unqueued, which can then be used in WARN_ON_ONCEs around safety checks (sparing callers the arcane conditionals in
__folio_unqueue_deferred_split()). Just omit the folio_unqueue_deferred_split() from free_unref_folios(), all of whose callers now call it beforehand (and if any forget then bad_page() will tell) - except for its caller put_pages_list(), which itself no longer has any callers (and will be deleted separately). Swapout:
mem_cgroup_swapout() has been resetting folio->memcg_data 0 without checking and unqueueing a THP folio from deferred split list; which is unfortunate, since the split_queue_lock depends on the memcg (when memcg is enabled); so swapout has been unqueueing such THPs later, when freeing the folio, using the pgdat's lock instead: potentially corrupting the memcg's list. __remove_mapping() has frozen refcount to 0 here, so no problem with calling folio_unqueue_deferred_split() before resetting memcg_data. That goes back to 5.4 commit 87eaceb3faa5 (mm: thp: make deferred split shrinker memcg aware): which included a check on swapcache before adding to deferred queue, but no check on deferred queue before adding THP to swapcache. That worked fine with the usual sequence of events in reclaim (though there were a couple of rare ways in which a THP on deferred queue could have been swapped out), but 6.12 commit dafff3f4c850 (mm: split underused THPs) avoids splitting underused THPs in reclaim, which makes swapcache THPs on deferred queue commonplace. Keep the check on swapcache before adding to deferred queue? Yes: it is no longer essential, but preserves the existing behaviour, and is likely to be a worthwhile optimization (vmstat showed much more traffic on the queue under swapping load if the check was removed); update its comment. Memcg-v1 move (deprecated): mem_cgroup_move_account() has been changing folio->memcg_data without checking and unqueueing a THP folio from the deferred list, sometimes corrupting from memcg's list, like swapout. Refcount is non-zero here, so folio_unqueue_deferred_split() can only be used in a WARN_ON_ONCE to validate the fix, which must be done earlier: mem_cgroup_move_charge_pte_range() first try to split the THP (splitting of course unqueues), or skip it if that fails. Not ideal, but moving charge has been requested, and khugepaged should repair the THP later: nobody wants new custom unqueueing code just for this deprecated case. The 87eaceb3faa5 commit did have the code to move from one deferred list to another (but was not conscious of its unsafety while refcount non-0); but that was removed by 5.6 commit fac0516b5534 (mm: thp: don't need care deferred split queue in memcg charge move path), which argued that the existence of a PMD mapping guarantees that the THP cannot be on a deferred list. As above, false in rare cases, and now commonly false. Backport to 6.11 should be straightforward. Earlier backports must take care that other _deferred_list fixes and dependencies are included. There is not a strong case for backports, but they can fix cornercases. (CVE-2024-53079)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53079
https://security-tracker.debian.org/tracker/CVE-2024-53079
https://ubuntu.com/security/CVE-2024-53079

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53079

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230774 - Linux Distros Unpatched Vulnerability : CVE-2024-53094
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES While running ISER over SIW, the initiator machine encounters a warning from skb_splice_from_iter() indicating that a slab page is being used in send_page. To address this, it is better to add a sendpage_ok() check within the driver itself, and if it returns 0, then MSG_SPLICE_PAGES flag should be disabled before entering the network stack. A similar issue has been discussed for NVMe in this thread:
https://lore.kernel.org/all/20240530142417.146696-1-ofir.gal@volumez.com/ WARNING: CPU: 0 PID: 5342 at net/core/skbuff.c:7140 skb_splice_from_iter+0x173/0x320 Call Trace: tcp_sendmsg_locked+0x368/0xe40 siw_tx_hdt+0x695/0xa40 [siw] siw_qp_sq_process+0x102/0xb00 [siw] siw_sq_resume+0x39/0x110 [siw] siw_run_sq+0x74/0x160 [siw] kthread+0xd2/0x100 ret_from_fork+0x34/0x40 ret_from_fork_asm+0x1a/0x30 (CVE-2024-53094)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53094
https://security-tracker.debian.org/tracker/CVE-2024-53094
https://ubuntu.com/security/CVE-2024-53094

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53094

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230560 - Linux Distros Unpatched Vulnerability : CVE-2024-53100
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nvme: tcp: avoid race between queue_lock lock and destroy Commit 76d54bf20cdc (nvme-tcp: don't access released socket during error recovery) added a mutex_lock() call for the queue->queue_lock in nvme_tcp_get_address(). However, the mutex_lock() races with mutex_destroy() in nvme_tcp_free_queue(), and causes the WARN below. DEBUG_LOCKS_WARN_ON(lock->magic != lock) WARNING: CPU: 3 PID: 34077 at kernel/locking/mutex.c:587 __mutex_lock+0xcf0/0x1220 Modules linked in: nvmet_tcp nvmet nvme_tcp nvme_fabrics iw_cm ib_cm ib_core pktcdvd nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables qrtr sunrpc ppdev 9pnet_virtio 9pnet pcspkr netfs parport_pc parport e1000 i2c_piix4 i2c_smbus loop fuse nfnetlink zram bochs drm_vram_helper drm_ttm_helper ttm drm_kms_helper xfs drm sym53c8xx floppy nvme scsi_transport_spi nvme_core nvme_auth serio_raw ata_generic pata_acpi dm_multipath qemu_fw_cfg [last unloaded: ib_uverbs] CPU: 3 UID: 0 PID: 34077 Comm: udisksd Not tainted 6.11.0-rc7 #319 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 RIP:
0010:__mutex_lock+0xcf0/0x1220 Code: 08 84 d2 0f 85 c8 04 00 00 8b 15 ef b6 c8 01 85 d2 0f 85 78 f4 ff ff 48 c7 c6 20 93 ee af 48 c7 c7 60 91 ee af e8 f0 a7 6d fd <0f> 0b e9 5e f4 ff ff 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 RSP: 0018:ffff88811305f760 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff88812c652058 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 RBP:
ffff88811305f8b0 R08: 0000000000000001 R09: ffffed1075c36341 R10: ffff8883ae1b1a0b R11: 0000000000010498 R12: 0000000000000000 R13: 0000000000000000 R14: dffffc0000000000 R15: ffff88812c652058 FS:
00007f9713ae4980(0000) GS:ffff8883ae180000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 CR2: 00007fcd78483c7c CR3: 0000000122c38000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400 Call Trace: <TASK> ? __warn.cold+0x5b/0x1af ? __mutex_lock+0xcf0/0x1220 ? report_bug+0x1ec/0x390 ? handle_bug+0x3c/0x80 ? exc_invalid_op+0x13/0x40 ? asm_exc_invalid_op+0x16/0x20 ?
__mutex_lock+0xcf0/0x1220 ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp] ? __pfx___mutex_lock+0x10/0x10 ?
__lock_acquire+0xd6a/0x59e0 ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp] nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp] ? __pfx_nvme_tcp_get_address+0x10/0x10 [nvme_tcp] nvme_sysfs_show_address+0x81/0xc0 [nvme_core] dev_attr_show+0x42/0x80 ? __asan_memset+0x1f/0x40 sysfs_kf_seq_show+0x1f0/0x370 seq_read_iter+0x2cb/0x1130 ? rw_verify_area+0x3b1/0x590 ? __mutex_lock+0x433/0x1220 vfs_read+0x6a6/0xa20 ? lockdep_hardirqs_on+0x78/0x100 ? __pfx_vfs_read+0x10/0x10 ksys_read+0xf7/0x1d0 ? __pfx_ksys_read+0x10/0x10 ? __x64_sys_openat+0x105/0x1d0 do_syscall_64+0x93/0x180 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ?
__pfx_ksys_read+0x10/0x10 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? do_syscall_64+0x9f/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f9713f55cfa Code: 55 48 89 e5 48 83 ec 20 48 89 55 e8 48 89 75 f0 89 7d f8 e8 e8 74 f8 ff 48 8b 55 e8 48 8b 75 f0 4 ---truncated--- (CVE-2024-53100)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53100
https://security-tracker.debian.org/tracker/CVE-2024-53100
https://ubuntu.com/security/CVE-2024-53100

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53100

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231907 - Linux Distros Unpatched Vulnerability : CVE-2024-53109
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: nommu: pass NULL argument to vma_iter_prealloc() When deleting a vma entry from a maple tree, it has to pass NULL to vma_iter_prealloc() in order to calculate internal state of the tree, but it passed a wrong argument. As a result, nommu kernels crashed upon accessing a vma iterator, such as acct_collect() reading the size of vma entries after do_munmap(). This commit fixes this issue by passing a right argument to the preallocation call. (CVE-2024-53109)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53109
https://ubuntu.com/security/CVE-2024-53109

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53109

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231376 - Linux Distros Unpatched Vulnerability : CVE-2024-53114
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client A number of Zen4 client SoCs advertise the ability to use virtualized VMLOAD/VMSAVE, but using these instructions is reported to be a cause of a random host reboot. These instructions aren't intended to be advertised on Zen4 client so clear the capability. (CVE-2024-53114)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53114
https://security-tracker.debian.org/tracker/CVE-2024-53114
https://ubuntu.com/security/CVE-2024-53114

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53114

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231182 - Linux Distros Unpatched Vulnerability : CVE-2024-53125
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf: sync_linked_regs() must preserve subreg_def Range propagation must not affect subreg_def marks, otherwise the following example is rewritten by verifier incorrectly when BPF_F_TEST_RND_HI32 flag is set: 0: call bpf_ktime_get_ns call bpf_ktime_get_ns 1: r0 &= 0x7fffffff after verifier r0 &= 0x7fffffff 2: w1 = w0 rewrites w1 = w0 3: if w0 < 10 goto +0 --------------> r11 = 0x2f5674a6 (r) 4: r1 >>= 32 r11 <<= 32 (r) 5: r0 = r1 r1 |= r11 (r) 6:
exit; if w0 < 0xa goto pc+0 r1 >>= 32 r0 = r1 exit (or zero extension of w1 at (2) is missing for architectures that require zero extension for upper register half). The following happens w/o this patch:
- r0 is marked as not a subreg at (0); - w1 is marked as subreg at (2); - w1 subreg_def is overridden at (3) by copy_register_state(); - w1 is read at (5) but mark_insn_zext() does not mark (2) for zero extension, because w1 subreg_def is not set; - because of BPF_F_TEST_RND_HI32 flag verifier inserts random value for hi32 bits of (2) (marked (r)); - this random value is read at (5). (CVE-2024-53125)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53125
https://ubuntu.com/security/CVE-2024-53125

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53125

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231880 - Linux Distros Unpatched Vulnerability : CVE-2024-53138
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: kTLS, Fix incorrect page refcounting The kTLS tx handling code is using a mix of get_page() and page_ref_inc() APIs to increment the page reference. But on the release path (mlx5e_ktls_tx_handle_resync_dump_comp()), only put_page() is used. This is an issue when using pages from large folios: the get_page() references are stored on the folio page while the page_ref_inc() references are stored directly in the given page. On release the folio page will be dereferenced too many times. This was found while doing kTLS testing with sendfile() + ZC when the served file was read from NFS on a kernel with NFS large folios support (commit 49b29a573da8 (nfs: add support for large folios)). (CVE-2024-53138)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53138
https://ubuntu.com/security/CVE-2024-53138

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53138

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231623 - Linux Distros Unpatched Vulnerability : CVE-2024-53140
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: netlink: terminate outstanding dump on socket close Netlink supports iterative dumping of data. It provides the families the following ops: - start - (optional) kicks off the dumping process - dump - actual dump helper, keeps getting called until it returns 0 - done - (optional) pairs with .start, can be used for cleanup The whole process is asynchronous and the repeated calls to .dump don't actually happen in a tight loop, but rather are triggered in response to recvmsg() on the socket. This gives the user full control over the dump, but also means that the user can close the socket without getting to the end of the dump. To make sure .start is always paired with .done we check if there is an ongoing dump before freeing the socket, and if so call .done. The complication is that sockets can get freed from BH and .done is allowed to sleep. So we use a workqueue to defer the call, when needed. Unfortunately this does not work correctly. What we defer is not the cleanup but rather releasing a reference on the socket. We have no guarantee that we own the last reference, if someone else holds the socket they may release it in BH and we're back to square one. The whole dance, however, appears to be unnecessary. Only the user can interact with dumps, so we can clean up when socket is closed. And close always happens in process context. Some async code may still access the socket after close, queue notification skbs to it etc. but no dumps can start, end or otherwise make progress. Delete the workqueue and flush the dump state directly from the release handler. Note that further cleanup is possible in -next, for instance we now always call .done before releasing the main module reference, so dump doesn't have to take a reference of its own. (CVE-2024-53140)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53140
https://ubuntu.com/security/CVE-2024-53140

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53140

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230616 - Linux Distros Unpatched Vulnerability : CVE-2024-53144
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE This aligned BR/EDR JUST_WORKS method with LE which since 92516cd97fd4 (Bluetooth: Always request for user confirmation for Just Works) always request user confirmation with confirm_hint set since the likes of bluetoothd have dedicated policy around JUST_WORKS method (e.g. main.conf:JustWorksRepairing). CVE: CVE-2024-8805 (CVE-2024-53144)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53144
https://ubuntu.com/security/CVE-2024-53144

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
6.8 (CVSS2#AV:A/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53144

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231615 - Linux Distros Unpatched Vulnerability : CVE-2024-53151
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: svcrdma: Address an integer overflow Dan Carpenter reports: > Commit 78147ca8b4a9 (svcrdma: Add a parsed chunk list data > structure) from Jun 22, 2020 (linux-next), leads to the following > Smatch static checker warning: > >
net/sunrpc/xprtrdma/svc_rdma_recvfrom.c:498 xdr_check_write_chunk() > warn: potential user controlled sizeof overflow 'segcount * 4 * 4' > > net/sunrpc/xprtrdma/svc_rdma_recvfrom.c > 488 static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt *rctxt) > 489 { > 490 u32 segcount; > 491 __be32 *p; > 492 > 493 if (xdr_stream_decode_u32(&rctxt->rc_stream, &segcount)) > ^^^^^^^^ > > 494 return false; > 495 >
496 /* A bogus segcount causes this buffer overflow check to fail. */ > 497 p = xdr_inline_decode(&rctxt->rc_stream, > --> 498 segcount * rpcrdma_segment_maxsz * sizeof(*p)); > > >
segcount is an untrusted u32. On 32bit systems anything >= SIZE_MAX / 16 will > have an integer overflow and some those values will be accepted by > xdr_inline_decode(). (CVE-2024-53151)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53151
https://ubuntu.com/security/CVE-2024-53151

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53151

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231571 - Linux Distros Unpatched Vulnerability : CVE-2024-53157
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- firmware: arm_scpi: Check the DVFS OPP count returned by the firmware Fix a kernel crash with the below call trace when the SCPI firmware returns OPP count of zero. dvfs_info.opp_count may be zero on some platforms during the reboot test, and the kernel will crash after dereferencing the pointer to kcalloc(info->count, sizeof(*opp), GFP_KERNEL). | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 | Mem abort info: | ESR = 0x96000004 | Exception class = DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | Data abort info: | ISV = 0, ISS = 0x00000004 | CM = 0, WnR = 0 | user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000faefa08c | [0000000000000028] pgd=0000000000000000 | Internal error: Oops: 96000004 [#1] SMP | scpi-hwmon: probe of PHYT000D:00 failed with error -110 | Process systemd-udevd (pid: 1701, stack limit = 0x00000000aaede86c) | CPU: 2 PID: 1701 Comm: systemd-udevd Not tainted 4.19.90+ #1 | Hardware name: PHYTIUM LTD Phytium FT2000/4/Phytium FT2000/4, BIOS | pstate: 60000005 (nZCv daif -PAN -UAO) | pc : scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi] | lr : clk_register+0x438/0x720 | Call trace: | scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi] | devm_clk_hw_register+0x50/0xa0 | scpi_clk_ops_init.isra.2+0xa0/0x138 [clk_scpi] | scpi_clocks_probe+0x528/0x70c [clk_scpi] | platform_drv_probe+0x58/0xa8 | really_probe+0x260/0x3d0 | driver_probe_device+0x12c/0x148 | device_driver_attach+0x74/0x98 | __driver_attach+0xb4/0xe8 | bus_for_each_dev+0x88/0xe0 | driver_attach+0x30/0x40 | bus_add_driver+0x178/0x2b0 | driver_register+0x64/0x118 | __platform_driver_register+0x54/0x60 | scpi_clocks_driver_init+0x24/0x1000 [clk_scpi] | do_one_initcall+0x54/0x220 | do_init_module+0x54/0x1c8 | load_module+0x14a4/0x1668 |
__se_sys_finit_module+0xf8/0x110 | __arm64_sys_finit_module+0x24/0x30 | el0_svc_common+0x78/0x170 | el0_svc_handler+0x38/0x78 | el0_svc+0x8/0x340 | Code: 937d7c00 a94153f3 a8c27bfd f9400421 (b8606820) |
---[ end trace 06feb22469d89fa8 ]--- | Kernel panic - not syncing: Fatal exception | SMP: stopping secondary CPUs | Kernel Offset: disabled | CPU features: 0x10,a0002008 | Memory Limit: none (CVE-2024-53157)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53157
https://ubuntu.com/security/CVE-2024-53157

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53157

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231472 - Linux Distros Unpatched Vulnerability : CVE-2024-53167
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: nfs/blocklayout: Don't attempt unregister for invalid block device Since commit d869da91cccb (nfs/blocklayout: Fix premature PR key unregistration) an unmount of a pNFS SCSI layout-enabled NFS may dereference a NULL block_device in:
bl_unregister_scsi+0x16/0xe0 [blocklayoutdriver] bl_free_device+0x70/0x80 [blocklayoutdriver] bl_free_deviceid_node+0x12/0x30 [blocklayoutdriver] nfs4_put_deviceid_node+0x60/0xc0 [nfsv4] nfs4_deviceid_purge_client+0x132/0x190 [nfsv4] unset_pnfs_layoutdriver+0x59/0x60 [nfsv4] nfs4_destroy_server+0x36/0x70 [nfsv4] nfs_free_server+0x23/0xe0 [nfs] deactivate_locked_super+0x30/0xb0 cleanup_mnt+0xba/0x150 task_work_run+0x59/0x90 syscall_exit_to_user_mode+0x217/0x220 do_syscall_64+0x8e/0x160 This happens because even though we were able to create the nfs4_deviceid_node, the lookup for the device was unable to attach the block device to the pnfs_block_dev. If we never found a block device to register, we can avoid this case with the PNFS_BDEV_REGISTERED flag. Move the deref behind the test for the flag. (CVE-2024-53167)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53167
https://ubuntu.com/security/CVE-2024-53167

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-53167

Plugin Information
Published: 2025/03/06, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230304 - Linux Distros Unpatched Vulnerability : CVE-2024-53169
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: nvme-fabrics: fix kernel crash while shutting down controller The nvme keep-alive operation, which executes at a periodic interval, could potentially sneak in while shutting down a fabric controller. This may lead to a race between the fabric controller admin queue destroy code path (invoked while shutting down controller) and hw/hctx queue dispatcher called from the nvme keep-alive async request queuing operation. This race could lead to the kernel crash shown below: Call Trace: autoremove_wake_function+0x0/0xbc (unreliable)
__blk_mq_sched_dispatch_requests+0x114/0x24c blk_mq_sched_dispatch_requests+0x44/0x84 blk_mq_run_hw_queue+0x140/0x220 nvme_keep_alive_work+0xc8/0x19c [nvme_core] process_one_work+0x200/0x4e0 worker_thread+0x340/0x504 kthread+0x138/0x140 start_kernel_thread+0x14/0x18 While shutting down fabric controller, if nvme keep-alive request sneaks in then it would be flushed off. The nvme_keep_alive_end_io function is then invoked to handle the end of the keep-alive operation which decrements the admin->q_usage_counter and assuming this is the last/only request in the admin queue then the admin->q_usage_counter becomes zero. If that happens then blk-mq destroy queue operation (blk_mq_destroy_ queue()) which could be potentially running simultaneously on another cpu (as this is the controller shutdown code path) would forward progress and deletes the admin queue. So, now from this point onward we are not supposed to access the admin queue resources. However the issue here's that the nvme keep-alive thread running hw/hctx queue dispatch operation hasn't yet finished its work and so it could still potentially access the admin queue resource while the admin queue had been already deleted and that causes the above crash. The above kernel crash is regression caused due to changes implemented in commit a54a93d0e359 (nvme: move stopping keep-alive into nvme_uninit_ctrl()). Ideally we should stop keep-alive before destroyin g the admin queue and freeing the admin tagset so that it wouldn't sneak in during the shutdown operation. However we removed the keep alive stop operation from the beginning of the controller shutdown code path in commit a54a93d0e359 (nvme: move stopping keep-alive into nvme_uninit_ctrl()) and added it under nvme_uninit_ctrl() which executes very late in the shutdown code path after the admin queue is destroyed and its tagset is removed. So this change created the possibility of keep-alive sneaking in and interfering with the shutdown operation and causing observed kernel crash. To fix the observed crash, we decided to move nvme_stop_keep_alive() from nvme_uninit_ctrl() to nvme_remove_admin_tag_set(). This change would ensure that we don't forward progress and delete the admin queue until the keep- alive operation is finished (if it's in-flight) or cancelled and that would help contain the race condition explained above and hence avoid the crash. Moving nvme_stop_keep_alive() to nvme_remove_admin_tag_set() instead of adding nvme_stop_keep_alive() to the beginning of the controller shutdown code path in nvme_stop_ctrl(), as was the case earlier before commit a54a93d0e359 (nvme: move stopping keep-alive into nvme_uninit_ctrl()), would help save one callsite of nvme_stop_keep_alive(). (CVE-2024-53169)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53169
https://ubuntu.com/security/CVE-2024-53169

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.4 (CVSS2#AV:L/AC:M/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53169

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231864 - Linux Distros Unpatched Vulnerability : CVE-2024-53172
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ubi: fastmap: Fix duplicate slab cache names while attaching Since commit 4c39529663b9 (slab: Warn on duplicate cache names when DEBUG_VM=y), the duplicate slab cache names can be detected and a kernel WARNING is thrown out. In UBI fast attaching process, alloc_ai() could be invoked twice with the same slab cache name 'ubi_aeb_slab_cache', which will trigger following warning messages: kmem_cache of name 'ubi_aeb_slab_cache' already exists WARNING: CPU: 0 PID: 7519 at mm/slab_common.c:107
__kmem_cache_create_args+0x100/0x5f0 Modules linked in: ubi(+) nandsim [last unloaded: nandsim] CPU: 0 UID: 0 PID: 7519 Comm: modprobe Tainted: G 6.12.0-rc2 RIP: 0010:__kmem_cache_create_args+0x100/0x5f0 Call Trace: __kmem_cache_create_args+0x100/0x5f0 alloc_ai+0x295/0x3f0 [ubi] ubi_attach+0x3c3/0xcc0 [ubi] ubi_attach_mtd_dev+0x17cf/0x3fa0 [ubi] ubi_init+0x3fb/0x800 [ubi] do_init_module+0x265/0x7d0
__x64_sys_finit_module+0x7a/0xc0 The problem could be easily reproduced by loading UBI device by fastmap with CONFIG_DEBUG_VM=y. Fix it by using different slab names for alloc_ai() callers. (CVE-2024-53172)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53172
https://ubuntu.com/security/CVE-2024-53172

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
References

CVE | CVE-2024-53172

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231873 - Linux Distros Unpatched Vulnerability : CVE-2024-53175
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipc: fix memleak if msg_init_ns failed in create_ipc_ns Percpu memory allocation may failed during create_ipc_ns however this fail is not handled properly since ipc sysctls and mq sysctls is not released properly. Fix this by release these two resource when failure. Here is the kmemleak stack when percpu failed: unreferenced object 0xffff88819de2a600 (size 512): comm shmem_2nstest, pid 120711, jiffies 4300542254 hex dump (first 32 bytes): 60 aa 9d 84 ff ff ff ff fc 18 48 b2 84 88 ff ff `.........H..... 04 00 00 00 a4 01 00 00 20 e4 56 81 ff ff ff ff ........ .V..... backtrace (crc be7cba35):
[<ffffffff81b43f83>] __kmalloc_node_track_caller_noprof+0x333/0x420 [<ffffffff81a52e56>] kmemdup_noprof+0x26/0x50 [<ffffffff821b2f37>] setup_mq_sysctls+0x57/0x1d0 [<ffffffff821b29cc>] copy_ipcs+0x29c/0x3b0 [<ffffffff815d6a10>] create_new_namespaces+0x1d0/0x920 [<ffffffff815d7449>] copy_namespaces+0x2e9/0x3e0 [<ffffffff815458f3>] copy_process+0x29f3/0x7ff0 [<ffffffff8154b080>] kernel_clone+0xc0/0x650 [<ffffffff8154b6b1>] __do_sys_clone+0xa1/0xe0 [<ffffffff843df8ff>] do_syscall_64+0xbf/0x1c0 [<ffffffff846000b0>] entry_SYSCALL_64_after_hwframe+0x4b/0x53 (CVE-2024-53175)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53175
https://ubuntu.com/security/CVE-2024-53175

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53175

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231771 - Linux Distros Unpatched Vulnerability : CVE-2024-53178
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smb: Don't leak cfid when reconnect races with open_cached_dir open_cached_dir() may either race with the tcon reconnection even before compound_send_recv() or directly trigger a reconnection via SMB2_open_init() or SMB_query_info_init(). The reconnection process invokes invalidate_all_cached_dirs() via cifs_mark_open_files_invalid(), which removes all cfids from the cfids->entries list but doesn't drop a ref if has_lease isn't true. This results in the currently-being-constructed cfid not being on the list, but still having a refcount of 2. It leaks if returned from open_cached_dir(). Fix this by setting cfid->has_lease when the ref is actually taken; the cfid will not be used by other threads until it has a valid time. Addresses these kmemleaks: unreferenced object 0xffff8881090c4000 (size 1024): comm bash, pid 1860, jiffies 4295126592 hex dump (first 32 bytes): 00 01 00 00 00 00 ad de 22 01 00 00 00 00 ad de ............... 00 ca 45 22 81 88 ff ff f8 dc 4f 04 81 88 ff ff ..E......O..... backtrace (crc 6f58c20f): [<ffffffff8b895a1e>] __kmalloc_cache_noprof+0x2be/0x350 [<ffffffff8bda06e3>] open_cached_dir+0x993/0x1fb0 [<ffffffff8bdaa750>] cifs_readdir+0x15a0/0x1d50 [<ffffffff8b9a853f>] iterate_dir+0x28f/0x4b0 [<ffffffff8b9a9aed>] __x64_sys_getdents64+0xfd/0x200 [<ffffffff8cf6da05>] do_syscall_64+0x95/0x1a0 [<ffffffff8d00012f>] entry_SYSCALL_64_after_hwframe+0x76/0x7e unreferenced object 0xffff8881044fdcf8 (size 8): comm bash, pid 1860, jiffies 4295126592 hex dump (first 8 bytes): 00 cc cc cc cc cc cc cc ........ backtrace (crc 10c106a9): [<ffffffff8b89a3d3>]
__kmalloc_node_track_caller_noprof+0x363/0x480 [<ffffffff8b7d7256>] kstrdup+0x36/0x60 [<ffffffff8bda0700>] open_cached_dir+0x9b0/0x1fb0 [<ffffffff8bdaa750>] cifs_readdir+0x15a0/0x1d50 [<ffffffff8b9a853f>] iterate_dir+0x28f/0x4b0 [<ffffffff8b9a9aed>] __x64_sys_getdents64+0xfd/0x200 [<ffffffff8cf6da05>] do_syscall_64+0x95/0x1a0 [<ffffffff8d00012f>] entry_SYSCALL_64_after_hwframe+0x76/0x7e And addresses these BUG splats when unmounting the SMB filesystem: BUG: Dentry ffff888140590ba0{i=1000000000080,n=/} still in use (2) [unmount of cifs cifs] WARNING: CPU: 3 PID: 3433 at fs/dcache.c:1536 umount_check+0xd0/0x100 Modules linked in: CPU: 3 UID: 0 PID: 3433 Comm: bash Not tainted 6.12.0-rc4-g850925a8133c-dirty #49 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 RIP: 0010:umount_check+0xd0/0x100 Code: 8d 7c 24 40 e8 31 5a f4 ff 49 8b 54 24 40 41 56 49 89 e9 45 89 e8 48 89 d9 41 57 48 89 de 48 c7 c7 80 e7 db ac e8 f0 72 9a ff <0f> 0b 58 31 c0 5a 5b 5d 41 5c 41 5d 41 5e 41 5f e9 2b e5 5d 01 41 RSP: 0018:ffff88811cc27978 EFLAGS: 00010286 RAX: 0000000000000000 RBX:
ffff888140590ba0 RCX: ffffffffaaf20bae RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff8881f6fb6f40 RBP: ffff8881462ec000 R08: 0000000000000001 R09: ffffed1023984ee3 R10: ffff88811cc2771f R11:
00000000016cfcc0 R12: ffff888134383e08 R13: 0000000000000002 R14: ffff8881462ec668 R15: ffffffffaceab4c0 FS: 00007f23bfa98740(0000) GS:ffff8881f6f80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000556de4a6f808 CR3: 0000000123c80000 CR4: 0000000000350ef0 Call Trace: <TASK>
d_walk+0x6a/0x530 shrink_dcache_for_umount+0x6a/0x200 generic_shutdown_super+0x52/0x2a0 kill_anon_super+0x22/0x40 cifs_kill_sb+0x159/0x1e0 deactivate_locked_super+0x66/0xe0 cleanup_mnt+0x140/0x210 task_work_run+0xfb/0x170 syscall_exit_to_user_mode+0x29f/0x2b0 do_syscall_64+0xa1/0x1a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f23bfb93ae7 Code: ff ff ff ff c3 66 0f 1f 44 00 00 48 8b 0d 11 93 0d 00 f7 d8 64 89 01 b8 ff ff ff ff eb bf 0f 1f 44 00 00 b8 50 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e9 92 0d 00 f7 d8 64 89 ---truncated--- (CVE-2024-53178)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53178
https://security-tracker.debian.org/tracker/CVE-2024-53178
https://ubuntu.com/security/CVE-2024-53178

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53178

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230529 - Linux Distros Unpatched Vulnerability : CVE-2024-53180
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: pcm: Add sanity NULL check for the default mmap fault handler A driver might allow the mmap access before initializing its runtime->dma_area properly. Add a proper NULL check before passing to virt_to_page() for avoiding a panic. (CVE-2024-53180)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53180
https://security-tracker.debian.org/tracker/CVE-2024-53180
https://ubuntu.com/security/CVE-2024-53180

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53180

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231819 - Linux Distros Unpatched Vulnerability : CVE-2024-53185
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: smb: client: fix NULL ptr deref in crypto_aead_setkey() Neither SMB3.0 or SMB3.02 supports encryption negotiate context, so when SMB2_GLOBAL_CAP_ENCRYPTION flag is set in the negotiate response, the client uses AES-128-CCM as the default cipher. See MS-SMB2 3.3.5.4. Commit b0abcd65ec54 (smb: client: fix UAF in async decryption) added a @server->cipher_type check to conditionally call smb3_crypto_aead_allocate(), but that check would always be false as @server->cipher_type is unset for SMB3.02. Fix the following KASAN splat by setting @server->cipher_type for SMB3.02 as well. mount.cifs //srv/share /mnt -o vers=3.02,seal,... BUG: KASAN:
null-ptr-deref in crypto_aead_setkey+0x2c/0x130 Read of size 8 at addr 0000000000000020 by task mount.cifs/1095 CPU: 1 UID: 0 PID: 1095 Comm: mount.cifs Not tainted 6.12.0 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-3.fc41 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 ? crypto_aead_setkey+0x2c/0x130 kasan_report+0xda/0x110 ? crypto_aead_setkey+0x2c/0x130 crypto_aead_setkey+0x2c/0x130 crypt_message+0x258/0xec0 [cifs] ? __asan_memset+0x23/0x50 ?
__pfx_crypt_message+0x10/0x10 [cifs] ? mark_lock+0xb0/0x6a0 ? hlock_class+0x32/0xb0 ? mark_lock+0xb0/0x6a0 smb3_init_transform_rq+0x352/0x3f0 [cifs] ? lock_acquire.part.0+0xf4/0x2a0 smb_send_rqst+0x144/0x230 [cifs] ? __pfx_smb_send_rqst+0x10/0x10 [cifs] ? hlock_class+0x32/0xb0 ? smb2_setup_request+0x225/0x3a0 [cifs] ? __pfx_cifs_compound_last_callback+0x10/0x10 [cifs] compound_send_recv+0x59b/0x1140 [cifs] ?
__pfx_compound_send_recv+0x10/0x10 [cifs] ? __create_object+0x5e/0x90 ? hlock_class+0x32/0xb0 ? do_raw_spin_unlock+0x9a/0xf0 cifs_send_recv+0x23/0x30 [cifs] SMB2_tcon+0x3ec/0xb30 [cifs] ?
__pfx_SMB2_tcon+0x10/0x10 [cifs] ? lock_acquire.part.0+0xf4/0x2a0 ? __pfx_lock_release+0x10/0x10 ? do_raw_spin_trylock+0xc6/0x120 ? lock_acquire+0x3f/0x90 ? _get_xid+0x16/0xd0 [cifs] ?
__pfx_SMB2_tcon+0x10/0x10 [cifs] ? cifs_get_smb_ses+0xcdd/0x10a0 [cifs] cifs_get_smb_ses+0xcdd/0x10a0 [cifs] ? __pfx_cifs_get_smb_ses+0x10/0x10 [cifs] ? cifs_get_tcp_session+0xaa0/0xca0 [cifs] cifs_mount_get_session+0x8a/0x210 [cifs] dfs_mount_share+0x1b0/0x11d0 [cifs] ?
__pfx___lock_acquire+0x10/0x10 ? __pfx_dfs_mount_share+0x10/0x10 [cifs] ? lock_acquire.part.0+0xf4/0x2a0 ? find_held_lock+0x8a/0xa0 ? hlock_class+0x32/0xb0 ? lock_release+0x203/0x5d0 cifs_mount+0xb3/0x3d0 [cifs] ? do_raw_spin_trylock+0xc6/0x120 ? __pfx_cifs_mount+0x10/0x10 [cifs] ? lock_acquire+0x3f/0x90 ? find_nls+0x16/0xa0 ? smb3_update_mnt_flags+0x372/0x3b0 [cifs] cifs_smb3_do_mount+0x1e2/0xc80 [cifs] ?
__pfx_vfs_parse_fs_string+0x10/0x10 ? __pfx_cifs_smb3_do_mount+0x10/0x10 [cifs] smb3_get_tree+0x1bf/0x330 [cifs] vfs_get_tree+0x4a/0x160 path_mount+0x3c1/0xfb0 ? kasan_quarantine_put+0xc7/0x1d0 ?
__pfx_path_mount+0x10/0x10 ? kmem_cache_free+0x118/0x3e0 ? user_path_at+0x74/0xa0
__x64_sys_mount+0x1a6/0x1e0 ? __pfx___x64_sys_mount+0x10/0x10 ? mark_held_locks+0x1a/0x90 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f (CVE-2024-53185)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53185
https://ubuntu.com/security/CVE-2024-53185

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
References

CVE | CVE-2024-53185

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231570 - Linux Distros Unpatched Vulnerability : CVE-2024-53189
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan The channels array in the cfg80211_scan_request has a __counted_by attribute attached to it, which points to the n_channels variable. This attribute is used in bounds checking, and if it is not set before the array is filled, then the bounds sanitizer will issue a warning or a kernel panic if CONFIG_UBSAN_TRAP is set. This patch sets the size of allocated memory as the initial value for n_channels. It is updated with the actual number of added elements after the array is filled.
(CVE-2024-53189)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53189
https://ubuntu.com/security/CVE-2024-53189

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-53189

Plugin Information
Published: 2025/03/06, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230379 - Linux Distros Unpatched Vulnerability : CVE-2024-53195
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- KVM: arm64: Get rid of userspace_irqchip_in_use Improper use of userspace_irqchip_in_use led to syzbot hitting the following WARN_ON() in kvm_timer_update_irq(): WARNING: CPU: 0 PID: 3281 at arch/arm64/kvm/arch_timer.c:459 kvm_timer_update_irq+0x21c/0x394 Call trace:
kvm_timer_update_irq+0x21c/0x394 arch/arm64/kvm/arch_timer.c:459 kvm_timer_vcpu_reset+0x158/0x684 arch/arm64/kvm/arch_timer.c:968 kvm_reset_vcpu+0x3b4/0x560 arch/arm64/kvm/reset.c:264 kvm_vcpu_set_target arch/arm64/kvm/arm.c:1553 [inline] kvm_arch_vcpu_ioctl_vcpu_init arch/arm64/kvm/arm.c:1573 [inline] kvm_arch_vcpu_ioctl+0x112c/0x1b3c arch/arm64/kvm/arm.c:1695 kvm_vcpu_ioctl+0x4ec/0xf74 virt/kvm/kvm_main.c:4658 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl fs/ioctl.c:893 [inline] __arm64_sys_ioctl+0x108/0x184 fs/ioctl.c:893 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x78/0x1b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xe8/0x1b0 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x40/0x50 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x14c arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 The following sequence led to the scenario: - Userspace creates a VM and a vCPU. - The vCPU is initialized with KVM_ARM_VCPU_PMU_V3 during KVM_ARM_VCPU_INIT. - Without any other setup, such as vGIC or vPMU, userspace issues KVM_RUN on the vCPU. Since the vPMU is requested, but not setup, kvm_arm_pmu_v3_enable() fails in kvm_arch_vcpu_run_pid_change(). As a result, KVM_RUN returns after enabling the timer, but before incrementing 'userspace_irqchip_in_use': kvm_arch_vcpu_run_pid_change() ret = kvm_arm_pmu_v3_enable() if (!vcpu->arch.pmu.created) return -EINVAL; if (ret) return ret; [...] if (!irqchip_in_kernel(kvm)) static_branch_inc(&userspace_irqchip_in_use); - Userspace ignores the error and issues KVM_ARM_VCPU_INIT again. Since the timer is already enabled, control moves through the following flow, ultimately hitting the WARN_ON(): kvm_timer_vcpu_reset() if (timer->enabled) kvm_timer_update_irq() if (!userspace_irqchip()) ret = kvm_vgic_inject_irq() ret = vgic_lazy_init() if (unlikely(!vgic_initialized(kvm))) if (kvm->arch.vgic.vgic_model != KVM_DEV_TYPE_ARM_VGIC_V2) return
-EBUSY; WARN_ON(ret); Theoretically, since userspace_irqchip_in_use's functionality can be simply replaced by '!irqchip_in_kernel()', get rid of the static key to avoid the mismanagement, which also helps with the syzbot issue. (CVE-2024-53195)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53195
https://security-tracker.debian.org/tracker/CVE-2024-53195
https://ubuntu.com/security/CVE-2024-53195

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:M/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53195

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230840 - Linux Distros Unpatched Vulnerability : CVE-2024-53196
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- KVM: arm64: Don't retire aborted MMIO instruction Returning an abort to the guest for an unsupported MMIO access is a documented feature of the KVM UAPI. Nevertheless, it's clear that this plumbing has seen limited testing, since userspace can trivially cause a WARN in the MMIO return: WARNING: CPU: 0 PID: 30558 at arch/arm64/include/asm/kvm_emulate.h:536 kvm_handle_mmio_return+0x46c/0x5c4 arch/arm64/include/asm/kvm_emulate.h:536 Call trace: kvm_handle_mmio_return+0x46c/0x5c4 arch/arm64/include/asm/kvm_emulate.h:536 kvm_arch_vcpu_ioctl_run+0x98/0x15b4 arch/arm64/kvm/arm.c:1133 kvm_vcpu_ioctl+0x75c/0xa78 virt/kvm/kvm_main.c:4487 __do_sys_ioctl fs/ioctl.c:51 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:893 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x1e0/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x38/0x68 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x90/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 The splat is complaining that KVM is advancing PC while an exception is pending, i.e. that KVM is retiring the MMIO instruction despite a pending synchronous external abort. Womp womp. Fix the glaring UAPI bug by skipping over all the MMIO emulation in case there is a pending synchronous exception. Note that while userspace is capable of pending an asynchronous exception (SError, IRQ, or FIQ), it is still safe to retire the MMIO instruction in this case as (1) they are by definition asynchronous, and (2) KVM relies on hardware support for pending/delivering these exceptions instead of the software state machine for advancing PC. (CVE-2024-53196)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53196
https://security-tracker.debian.org/tracker/CVE-2024-53196
https://ubuntu.com/security/CVE-2024-53196

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53196

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230553 - Linux Distros Unpatched Vulnerability : CVE-2024-53198
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xen: Fix the issue of resource not being properly released in xenbus_dev_probe() This patch fixes an issue in the function xenbus_dev_probe(). In the xenbus_dev_probe() function, within the if (err) branch at line 313, the program incorrectly returns err directly without releasing the resources allocated by err = drv->probe(dev, id). As the return value is non-zero, the upper layers assume the processing logic has failed. However, the probe operation was performed earlier without a corresponding remove operation. Since the probe actually allocates resources, failing to perform the remove operation could lead to problems. To fix this issue, we followed the resource release logic of the xenbus_dev_remove() function by adding a new block fail_remove before the fail_put block. After entering the branch if (err) at line 313, the function will use a goto statement to jump to the fail_remove block, ensuring that the previously acquired resources are correctly released, thus preventing the reference count leak. This bug was identified by an experimental static analysis tool developed by our team. The tool specializes in analyzing reference count operations and detecting potential issues where resources are not properly managed. In this case, the tool flagged the missing release operation as a potential problem, which led to the development of this patch.
(CVE-2024-53198)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53198
https://ubuntu.com/security/CVE-2024-53198

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53198

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230771 - Linux Distros Unpatched Vulnerability : CVE-2024-53202
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Fix possible resource leak in fw_log_firmware_info() The alg instance should be released under the exception path, otherwise there may be resource leak here. To mitigate this, free the alg instance with crypto_free_shash when kmalloc fails. (CVE-2024-53202)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53202
https://ubuntu.com/security/CVE-2024-53202

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53202

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231027 - Linux Distros Unpatched Vulnerability : CVE-2024-53207
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: MGMT: Fix possible deadlocks This fixes possible deadlocks like the following caused by hci_cmd_sync_dequeue causing the destroy function to run: INFO: task kworker/u19:0:143 blocked for more than 120 seconds. Tainted: G W O 6.8.0-2024-03-19-intel-next-iLS-24ww14 #1 echo 0 >
/proc/sys/kernel/hung_task_timeout_secs disables this message. task:kworker/u19:0 state:D stack:0 pid:143 tgid:143 ppid:2 flags:0x00004000 Workqueue: hci0 hci_cmd_sync_work [bluetooth] Call Trace: <TASK>
__schedule+0x374/0xaf0 schedule+0x3c/0xf0 schedule_preempt_disabled+0x1c/0x30
__mutex_lock.constprop.0+0x3ef/0x7a0 __mutex_lock_slowpath+0x13/0x20 mutex_lock+0x3c/0x50 mgmt_set_connectable_complete+0xa4/0x150 [bluetooth] ? kfree+0x211/0x2a0 hci_cmd_sync_dequeue+0xae/0x130 [bluetooth] ? __pfx_cmd_complete_rsp+0x10/0x10 [bluetooth] cmd_complete_rsp+0x26/0x80 [bluetooth] mgmt_pending_foreach+0x4d/0x70 [bluetooth] __mgmt_power_off+0x8d/0x180 [bluetooth] ?
_raw_spin_unlock_irq+0x23/0x40 hci_dev_close_sync+0x445/0x5b0 [bluetooth] hci_set_powered_sync+0x149/0x250 [bluetooth] set_powered_sync+0x24/0x60 [bluetooth] hci_cmd_sync_work+0x90/0x150 [bluetooth] process_one_work+0x13e/0x300 worker_thread+0x2f7/0x420 ? __pfx_worker_thread+0x10/0x10 kthread+0x107/0x140 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x3d/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> (CVE-2024-53207)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53207
https://ubuntu.com/security/CVE-2024-53207

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.5 (CVSS2#AV:A/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53207

Plugin Information
Published: 2025/03/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230842 - Linux Distros Unpatched Vulnerability : CVE-2024-53209
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix receive ring space parameters when XDP is active The MTU setting at the time an XDP multi-buffer is attached determines whether the aggregation ring will be used and the rx_skb_func handler. This is done in bnxt_set_rx_skb_mode(). If the MTU is later changed, the aggregation ring setting may need to be changed and it may become out-of-sync with the settings initially done in bnxt_set_rx_skb_mode(). This may result in random memory corruption and crashes as the HW may DMA data larger than the allocated buffer size, such as: BUG: kernel NULL pointer dereference, address: 00000000000003c0 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 17 PID: 0 Comm: swapper/17 Kdump: loaded Tainted: G S OE 6.1.0-226bf9805506 #1 Hardware name: Wiwynn Delta Lake PVT BZA.02601.0150/Delta Lake-Class1, BIOS F0E_3A12 08/26/2021 RIP:
0010:bnxt_rx_pkt+0xe97/0x1ae0 [bnxt_en] Code: 8b 95 70 ff ff ff 4c 8b 9d 48 ff ff ff 66 41 89 87 b4 00 00 00 e9 0b f7 ff ff 0f b7 43 0a 49 8b 95 a8 04 00 00 25 ff 0f 00 00 <0f> b7 14 42 48 c1 e2 06 49 03 95 a0 04 00 00 0f b6 42 33f RSP: 0018:ffffa19f40cc0d18 EFLAGS: 00010202 RAX: 00000000000001e0 RBX: ffff8e2c805c6100 RCX: 00000000000007ff RDX: 0000000000000000 RSI: ffff8e2c271ab990 RDI: ffff8e2c84f12380 RBP:
ffffa19f40cc0e48 R08: 000000000001000d R09: 974ea2fcddfa4cbf R10: 0000000000000000 R11: ffffa19f40cc0ff8 R12: ffff8e2c94b58980 R13: ffff8e2c952d6600 R14: 0000000000000016 R15: ffff8e2c271ab990 FS:
0000000000000000(0000) GS:ffff8e3b3f840000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 CR2: 00000000000003c0 CR3: 0000000e8580a004 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400 PKRU: 55555554 Call Trace: <IRQ> __bnxt_poll_work+0x1c2/0x3e0 [bnxt_en] To address the issue, we now call bnxt_set_rx_skb_mode() within bnxt_change_mtu() to properly set the AGG rings configuration and update rx_skb_func based on the new MTU value. Additionally, BNXT_FLAG_NO_AGG_RINGS is cleared at the beginning of bnxt_set_rx_skb_mode() to make sure it gets set or cleared based on the current MTU. (CVE-2024-53209)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53209
https://ubuntu.com/security/CVE-2024-53209

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53209

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230825 - Linux Distros Unpatched Vulnerability : CVE-2024-53210
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() Passing MSG_PEEK flag to skb_recv_datagram() increments skb refcount (skb->users) and iucv_sock_recvmsg() does not decrement skb refcount at exit. This results in skb memory leak in skb_queue_purge() and WARN_ON in iucv_sock_destruct() during socket close. To fix this decrease skb refcount by one if MSG_PEEK is set in order to prevent memory leak and WARN_ON. WARNING: CPU: 2 PID: 6292 at net/iucv/af_iucv.c:286 iucv_sock_destruct+0x144/0x1a0 [af_iucv] CPU: 2 PID: 6292 Comm: afiucv_test_msg Kdump: loaded Tainted: G W 6.10.0-rc7 #1 Hardware name: IBM 3931 A01 704 (z/VM 7.3.0) Call Trace: [<001587c682c4aa98>] iucv_sock_destruct+0x148/0x1a0 [af_iucv] [<001587c682c4a9d0>] iucv_sock_destruct+0x80/0x1a0 [af_iucv] [<001587c704117a32>] __sk_destruct+0x52/0x550 [<001587c704104a54>] __sock_release+0xa4/0x230 [<001587c704104c0c>] sock_close+0x2c/0x40 [<001587c702c5f5a8>] __fput+0x2e8/0x970 [<001587c7024148c4>] task_work_run+0x1c4/0x2c0 [<001587c7023b0716>] do_exit+0x996/0x1050 [<001587c7023b13aa>] do_group_exit+0x13a/0x360 [<001587c7023b1626>] __s390x_sys_exit_group+0x56/0x60 [<001587c7022bccca>] do_syscall+0x27a/0x380 [<001587c7049a6a0c>] __do_syscall+0x9c/0x160 [<001587c7049ce8a8>] system_call+0x70/0x98 Last Breaking-Event-Address: [<001587c682c4a9d4>] iucv_sock_destruct+0x84/0x1a0 [af_iucv] (CVE-2024-53210)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53210
https://security-tracker.debian.org/tracker/CVE-2024-53210
https://ubuntu.com/security/CVE-2024-53210

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53210

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231488 - Linux Distros Unpatched Vulnerability : CVE-2024-53215
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() There's issue as follows: RPC: Registered rdma transport module.
RPC: Registered rdma backchannel transport module. RPC: Unregistered rdma transport module. RPC:
Unregistered rdma backchannel transport module. BUG: unable to handle page fault for address:
fffffbfff80c609a PGD 123fee067 P4D 123fee067 PUD 123fea067 PMD 10c624067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI RIP: 0010:percpu_counter_destroy_many+0xf7/0x2a0 Call Trace: <TASK>
__die+0x1f/0x70 page_fault_oops+0x2cd/0x860 spurious_kernel_fault+0x36/0x450 do_kern_addr_fault+0xca/0x100 exc_page_fault+0x128/0x150 asm_exc_page_fault+0x26/0x30 percpu_counter_destroy_many+0xf7/0x2a0 mmdrop+0x209/0x350 finish_task_switch.isra.0+0x481/0x840 schedule_tail+0xe/0xd0 ret_from_fork+0x23/0x80 ret_from_fork_asm+0x1a/0x30 </TASK> If register_sysctl() return NULL, then svc_rdma_proc_cleanup() will not destroy the percpu counters which init in svc_rdma_proc_init(). If CONFIG_HOTPLUG_CPU is enabled, residual nodes may be in the 'percpu_counters' list. The above issue may occur once the module is removed.
If the CONFIG_HOTPLUG_CPU configuration is not enabled, memory leakage occurs. To solve above issue just destroy all percpu counters when register_sysctl() return NULL. (CVE-2024-53215)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53215
https://ubuntu.com/security/CVE-2024-53215

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53215

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231276 - Linux Distros Unpatched Vulnerability : CVE-2024-53217
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NFSD: Prevent NULL dereference in nfsd4_process_cb_update() @ses is initialized to NULL. If
__nfsd4_find_backchannel() finds no available backchannel session, setup_callback_client() will try to dereference @ses and segfault. (CVE-2024-53217)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53217
https://ubuntu.com/security/CVE-2024-53217

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53217

Plugin Information
Published: 2025/03/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231381 - Linux Distros Unpatched Vulnerability : CVE-2024-53219
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- virtiofs: use pages instead of pointer for kernel direct IO When trying to insert a 10MB kernel module kept in a virtio-fs with cache disabled, the following warning was reported: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 404 at mm/page_alloc.c:4551 ...... Modules linked in: CPU: 1 PID: 404 Comm: insmod Not tainted 6.9.0-rc5+ #123 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... RIP:
0010:__alloc_pages+0x2bf/0x380 ...... Call Trace: <TASK> ? __warn+0x8e/0x150 ? __alloc_pages+0x2bf/0x380
__kmalloc_large_node+0x86/0x160 __kmalloc+0x33c/0x480 virtio_fs_enqueue_req+0x240/0x6d0 virtio_fs_wake_pending_and_unlock+0x7f/0x190 queue_request_and_unlock+0x55/0x60 fuse_simple_request+0x152/0x2b0 fuse_direct_io+0x5d2/0x8c0 fuse_file_read_iter+0x121/0x160
__kernel_read+0x151/0x2d0 kernel_read+0x45/0x50 kernel_read_file+0x1a9/0x2a0 init_module_from_file+0x6a/0xe0 idempotent_init_module+0x175/0x230 __x64_sys_finit_module+0x5d/0xb0 x64_sys_call+0x1c3/0x9e0 do_syscall_64+0x3d/0xc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ...... </TASK>
---[ end trace 0000000000000000 ]--- The warning is triggered as follows: 1) syscall finit_module() handles the module insertion and it invokes kernel_read_file() to read the content of the module first. 2) kernel_read_file() allocates a 10MB buffer by using vmalloc() and passes it to kernel_read().
kernel_read() constructs a kvec iter by using iov_iter_kvec() and passes it to fuse_file_read_iter(). 3) virtio-fs disables the cache, so fuse_file_read_iter() invokes fuse_direct_io(). As for now, the maximal read size for kvec iter is only limited by fc->max_read. For virtio-fs, max_read is UINT_MAX, so fuse_direct_io() doesn't split the 10MB buffer. It saves the address and the size of the 10MB-sized buffer in out_args[0] of a fuse request and passes the fuse request to virtio_fs_wake_pending_and_unlock(). 4) virtio_fs_wake_pending_and_unlock() uses virtio_fs_enqueue_req() to queue the request. Because virtiofs need DMA-able address, so virtio_fs_enqueue_req() uses kmalloc() to allocate a bounce buffer for all fuse args, copies these args into the bounce buffer and passed the physical address of the bounce buffer to virtiofsd. The total length of these fuse args for the passed fuse request is about 10MB, so copy_args_to_argbuf() invokes kmalloc() with a 10MB size parameter and it triggers the warning in
__alloc_pages(): if (WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp)) return NULL; 5) virtio_fs_enqueue_req() will retry the memory allocation in a kworker, but it won't help, because kmalloc() will always return NULL due to the abnormal size and finit_module() will hang forever. A feasible solution is to limit the value of max_read for virtio-fs, so the length passed to kmalloc() will be limited. However it will affect the maximal read size for normal read. And for virtio-fs write initiated from kernel, it has the similar problem but now there is no way to limit fc->max_write in kernel. So instead of limiting both the values of max_read and max_write in kernel, introducing use_pages_for_kvec_io in fuse_conn and setting it as true in virtiofs. When use_pages_for_kvec_io is enabled, fuse will use pages instead of pointer to pass the KVEC_IO data. After switching to pages for KVEC_IO data, these pages will be used for DMA through virtio-fs. If these pages are backed by vmalloc(), {flush|invalidate}_kernel_vmap_range() are necessary to flush or invalidate the cache before the DMA operation. So add two new fields in fuse_args_pages to record the base address of vmalloc area and the condition indicating whether invalidation is needed. Perform the flush in fuse_get_user_pages() for write operations and the invalidation in fuse_release_user_pages() for read operations. It may seem necessary to introduce another fie ---truncated--- (CVE-2024-53219)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53219
https://security-tracker.debian.org/tracker/CVE-2024-53219
https://ubuntu.com/security/CVE-2024-53219

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53219

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
232001 - Linux Distros Unpatched Vulnerability : CVE-2024-53230
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cpufreq: CPPC: Fix possible null-ptr- deref for cppc_get_cpu_cost() cpufreq_cpu_get_raw() may return NULL if the cpu is not in policy->cpus cpu mask and it will cause null pointer dereference, so check NULL for cppc_get_cpu_cost(). (CVE-2024-53230)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53230
https://ubuntu.com/security/CVE-2024-53230

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53230

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231240 - Linux Distros Unpatched Vulnerability : CVE-2024-53231
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cpufreq: CPPC: Fix possible null-ptr- deref for cpufreq_cpu_get_raw() cpufreq_cpu_get_raw() may return NULL if the cpu is not in policy->cpus cpu mask and it will cause null pointer dereference. (CVE-2024-53231)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53231
https://ubuntu.com/security/CVE-2024-53231

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53231

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230597 - Linux Distros Unpatched Vulnerability : CVE-2024-53236
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: xsk: Free skb when TX metadata options are invalid When a new skb is allocated for transmitting an xsk descriptor, i.e., for every non-multibuf descriptor or the first frag of a multibuf descriptor, but the descriptor is later found to have invalid options set for the TX metadata, the new skb is never freed. This can leak skbs until the send buffer is full which makes sending more packets impossible. Fix this by freeing the skb in the error path if we are currently dealing with the first frag, i.e., an skb allocated in this iteration of xsk_build_skb.
(CVE-2024-53236)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53236
https://ubuntu.com/security/CVE-2024-53236

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53236

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230592 - Linux Distros Unpatched Vulnerability : CVE-2024-53238
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: adjust the position to init iso data anchor MediaTek iso data anchor init should be moved to where MediaTek claims iso data interface. If there is an unexpected BT usb disconnect during setup flow, it will cause a NULL pointer crash issue when releasing iso anchor since the anchor wasn't been init yet. Adjust the position to do iso data anchor init. [ 17.137991] pc : usb_kill_anchored_urbs+0x60/0x168 [ 17.137998] lr :
usb_kill_anchored_urbs+0x44/0x168 [ 17.137999] sp : ffffffc0890cb5f0 [ 17.138000] x29: ffffffc0890cb5f0 x28: ffffff80bb6c2e80 [ 17.144081] gpio gpiochip0: registered chardev handle for 1 lines [ 17.148421] x27:
0000000000000000 [ 17.148422] x26: ffffffd301ff4298 x25: 0000000000000003 x24: 00000000000000f0 [ 17.148424] x23: 0000000000000000 x22: 00000000ffffffff x21: 0000000000000001 [ 17.148425] x20:
ffffffffffffffd8 x19: ffffff80c0f25560 x18: 0000000000000000 [ 17.148427] x17: ffffffd33864e408 x16:
ffffffd33808f7c8 x15: 0000000000200000 [ 17.232789] x14: e0cd73cf80ffffff x13: 50f2137c0a0338c9 x12:
0000000000000001 [ 17.239912] x11: 0000000080150011 x10: 0000000000000002 x9 : 0000000000000001 [ 17.247035] x8 : 0000000000000000 x7 : 0000000000008080 x6 : 8080000000000000 [ 17.254158] x5 :
ffffffd33808ebc0 x4 : fffffffe033dcf20 x3 : 0000000080150011 [ 17.261281] x2 : ffffff8087a91400 x1 :
0000000000000000 x0 : ffffff80c0f25588 [ 17.268404] Call trace: [ 17.270841] usb_kill_anchored_urbs+0x60/0x168 [ 17.275274] btusb_mtk_release_iso_intf+0x2c/0xd8 [btusb (HASH:5afe 6)] [ 17.284226] btusb_mtk_disconnect+0x14/0x28 [btusb (HASH:5afe 6)] [ 17.292652] btusb_disconnect+0x70/0x140 [btusb (HASH:5afe 6)] [ 17.300818] usb_unbind_interface+0xc4/0x240 [ 17.305079] device_release_driver_internal+0x18c/0x258 [ 17.310296] device_release_driver+0x1c/0x30 [ 17.314557] bus_remove_device+0x140/0x160 [ 17.318643] device_del+0x1c0/0x330 [ 17.322121] usb_disable_device+0x80/0x180 [ 17.326207] usb_disconnect+0xec/0x300 [ 17.329948] hub_quiesce+0x80/0xd0 [ 17.333339] hub_disconnect+0x44/0x190 [ 17.337078] usb_unbind_interface+0xc4/0x240 [ 17.341337] device_release_driver_internal+0x18c/0x258 [ 17.346551] device_release_driver+0x1c/0x30 [ 17.350810] usb_driver_release_interface+0x70/0x88 [ 17.355677] proc_ioctl+0x13c/0x228 [ 17.359157] proc_ioctl_default+0x50/0x80 [ 17.363155] usbdev_ioctl+0x830/0xd08 [ 17.366808]
__arm64_sys_ioctl+0x94/0xd0 [ 17.370723] invoke_syscall+0x6c/0xf8 [ 17.374377] el0_svc_common+0x84/0xe0 [ 17.378030] do_el0_svc+0x20/0x30 [ 17.381334] el0_svc+0x34/0x60 [ 17.384382] el0t_64_sync_handler+0x88/0xf0 [ 17.388554] el0t_64_sync+0x180/0x188 [ 17.392208] Code: f9400677 f100a2f4 54fffea0 d503201f (b8350288) [ 17.398289] ---[ end trace 0000000000000000 ]--- (CVE-2024-53238)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53238
https://ubuntu.com/security/CVE-2024-53238

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53238

Plugin Information
Published: 2025/03/06, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231069 - Linux Distros Unpatched Vulnerability : CVE-2024-53240
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xen/netfront: fix crash when removing device When removing a netfront device directly after a suspend/resume cycle it might happen that the queues have not been setup again, causing a crash during the attempt to stop the queues another time. Fix that by checking the queues are existing before trying to stop them. This is XSA-465 / CVE-2024-53240. (CVE-2024-53240)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53240
https://ubuntu.com/security/CVE-2024-53240

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.7 (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53240

Plugin Information
Published: 2025/03/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230960 - Linux Distros Unpatched Vulnerability : CVE-2024-53685
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ceph: give up on paths longer than PATH_MAX If the full path to be built by ceph_mdsc_build_path() happens to be longer than PATH_MAX, then this function will enter an endless (retry) loop, effectively blocking the whole task. Most of the machine becomes unusable, making this a very simple and effective DoS vulnerability. I cannot imagine why this retry was ever implemented, but it seems rather useless and harmful to me. Let's remove it and fail with ENAMETOOLONG instead. (CVE-2024-53685)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-53685
https://ubuntu.com/security/CVE-2024-53685

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-53685

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230726 - Linux Distros Unpatched Vulnerability : CVE-2024-54683
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfilter: IDLETIMER: Fix for possible ABBA deadlock Deletion of the last rule referencing a given idletimer may happen at the same time as a read of its file in sysfs: | ====================================================== | WARNING: possible circular locking dependency detected | 6.12.0-rc7-01692-g5e9a28f41134-dirty #594 Not tainted |
------------------------------------------------------ | iptables/3303 is trying to acquire lock: | ffff8881057e04b8 (kn->active#48){++++}-{0:0}, at: __kernfs_remove+0x20 | | but task is already holding lock: | ffffffffa0249068 (list_mutex){+.+.}-{3:3}, at: idletimer_tg_destroy_v] | | which lock already depends on the new lock. A simple reproducer is: | #!/bin/bash | | while true; do | iptables -A INPUT -i foo -j IDLETIMER --timeout 10 --label testme | iptables -D INPUT -i foo -j IDLETIMER --timeout 10
--label testme | done & | while true; do | cat /sys/class/xt_idletimer/timers/testme >/dev/null | done Avoid this by freeing list_mutex right after deleting the element from the list, then continuing with the teardown. (CVE-2024-54683)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-54683
https://security-tracker.debian.org/tracker/CVE-2024-54683
https://ubuntu.com/security/CVE-2024-54683

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-54683

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231241 - Linux Distros Unpatched Vulnerability : CVE-2024-55642
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: block: Prevent potential deadlocks in zone write plug error recovery Zone write plugging for handling writes to zones of a zoned block device always execute a zone report whenever a write BIO to a zone fails. The intent of this is to ensure that the tracking of a zone write pointer is always correct to ensure that the alignment to a zone write pointer of write BIOs can be checked on submission and that we can always correctly emulate zone append operations using regular write BIOs. However, this error recovery scheme introduces a potential deadlock if a device queue freeze is initiated while BIOs are still plugged in a zone write plug and one of these write operation fails. In such case, the disk zone write plug error recovery work is scheduled and executes a report zone. This in turn can result in a request allocation in the underlying driver to issue the report zones command to the device. But with the device queue freeze already started, this allocation will block, preventing the report zone execution and the continuation of the processing of the plugged BIOs. As plugged BIOs hold a queue usage reference, the queue freeze itself will never complete, resulting in a deadlock. Avoid this problem by completely removing from the zone write plugging code the use of report zones operations after a failed write operation, instead relying on the device user to either execute a report zones, reset the zone, finish the zone, or give up writing to the device (which is a fairly common pattern for file systems which degrade to read-only after write failures). This is not an unreasonnable requirement as all well-behaved applications, FSes and device mapper already use report zones to recover from write errors whenever possible by comparing the current position of a zone write pointer with what their assumption about the position is. The changes to remove the automatic error recovery are as follows: - Completely remove the error recovery work and its associated resources (zone write plug list head, disk error list, and disk zone_wplugs_work work struct). This also removes the functions disk_zone_wplug_set_error() and disk_zone_wplug_clear_error(). - Change the BLK_ZONE_WPLUG_ERROR zone write plug flag into BLK_ZONE_WPLUG_NEED_WP_UPDATE. This new flag is set for a zone write plug whenever a write opration targetting the zone of the zone write plug fails. This flag indicates that the zone write pointer offset is not reliable and that it must be updated when the next report zone, reset zone, finish zone or disk revalidation is executed. - Modify blk_zone_write_plug_bio_endio() to set the BLK_ZONE_WPLUG_NEED_WP_UPDATE flag for the target zone of a failed write BIO. - Modify the function disk_zone_wplug_set_wp_offset() to clear this new flag, thus implementing recovery of a correct write pointer offset with the reset (all) zone and finish zone operations. - Modify blkdev_report_zones() to always use the disk_report_zones_cb() callback so that disk_zone_wplug_sync_wp_offset() can be called for any zone marked with the BLK_ZONE_WPLUG_NEED_WP_UPDATE flag. This implements recovery of a correct write pointer offset for zone write plugs marked with BLK_ZONE_WPLUG_NEED_WP_UPDATE and within the range of the report zones operation executed by the user. - Modify blk_revalidate_seq_zone() to call disk_zone_wplug_sync_wp_offset() for all sequential write required zones when a zoned block device is revalidated, thus always resolving any inconsistency between the write pointer offset of zone write plugs and the actual write pointer position of sequential zones. (CVE-2024-55642)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-55642
https://ubuntu.com/security/CVE-2024-55642

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.0 (CVSS2#AV:L/AC:M/Au:S/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-55642

Plugin Information
Published: 2025/03/06, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231273 - Linux Distros Unpatched Vulnerability : CVE-2024-55881
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Play nice with protected guests in complete_hypercall_exit() Use is_64_bit_hypercall() instead of is_64_bit_mode() to detect a 64-bit hypercall when completing said hypercall. For guests with protected state, e.g. SEV-ES and SEV-SNP, KVM must assume the hypercall was made in 64-bit mode as the vCPU state needed to detect 64-bit mode is unavailable. Hacking the sev_smoke_test selftest to generate a KVM_HC_MAP_GPA_RANGE hypercall via VMGEXIT trips the WARN: ------------[ cut here ]------------ WARNING: CPU: 273 PID: 326626 at arch/x86/kvm/x86.h:180 complete_hypercall_exit+0x44/0xe0 [kvm] Modules linked in: kvm_amd kvm ... [last unloaded: kvm] CPU: 273 UID: 0 PID: 326626 Comm: sev_smoke_test Not tainted 6.12.0-smp--392e932fa0f3-feat #470 Hardware name: Google Astoria/astoria, BIOS 0.20240617.0-0 06/17/2024 RIP:
0010:complete_hypercall_exit+0x44/0xe0 [kvm] Call Trace: <TASK> kvm_arch_vcpu_ioctl_run+0x2400/0x2720 [kvm] kvm_vcpu_ioctl+0x54f/0x630 [kvm] __se_sys_ioctl+0x6b/0xc0 do_syscall_64+0x83/0x160 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> ---[ end trace 0000000000000000 ]--- (CVE-2024-55881)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-55881
https://ubuntu.com/security/CVE-2024-55881

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-55881

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230331 - Linux Distros Unpatched Vulnerability : CVE-2024-56332
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is vulnerable to a Denial of Service (DoS) attack that allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution. This vulnerability can also be used as a Denial of Wallet (DoW) attack when deployed in providers billing by response times. (Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low during that time.).
Deployments without any protection against long running Server Action invocations are especially vulnerable. Hosting providers like Vercel or Netlify set a default maximum duration on function execution to reduce the risk of excessive billing. This is the same issue as if the incoming HTTP request has an invalid `Content-Length` header or never closes. If the host has no other mitigations to those then this vulnerability is novel. This vulnerability affects only Next.js deployments using Server Actions. The issue was resolved in Next.js 13.5.8, 14.2.21, and 15.1.2. We recommend that users upgrade to a safe version. There are no official workarounds. (CVE-2024-56332)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56332

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0011
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56332

Plugin Information
Published: 2025/03/06, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
231399 - Linux Distros Unpatched Vulnerability : CVE-2024-56369
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() drm_mode_vrefresh() is trying to avoid divide by zero by checking whether htotal or vtotal are zero. But we may still end up with a div-by-zero of vtotal*htotal*... (CVE-2024-56369)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56369
https://security-tracker.debian.org/tracker/CVE-2024-56369
https://ubuntu.com/security/CVE-2024-56369

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56369

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231988 - Linux Distros Unpatched Vulnerability : CVE-2024-56372
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: tun: fix tun_napi_alloc_frags() syzbot reported the following crash [1] Issue came with the blamed commit. Instead of going through all the iov components, we keep using the first one and end up with a malformed skb. [1] kernel BUG at net/core/skbuff.c:2849 ! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 6230 Comm: syz-executor132 Not tainted 6.13.0-rc1-syzkaller-00407-g96b6fcc0ee41 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024 RIP: 0010:__pskb_pull_tail+0x1568/0x1570 net/core/skbuff.c:2848 Code: 38 c1 0f 8c 32 f1 ff ff 4c 89 f7 e8 92 96 74 f8 e9 25 f1 ff ff e8 e8 ae 09 f8 48 8b 5c 24 08 e9 eb fb ff ff e8 d9 ae 09 f8 90 <0f> 0b 66 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffc90004cbef30 EFLAGS: 00010293 RAX: ffffffff8995c347 RBX: 00000000fffffff2 RCX:
ffff88802cf45a00 RDX: 0000000000000000 RSI: 00000000fffffff2 RDI: 0000000000000000 RBP: ffff88807df0c06a R08: ffffffff8995b084 R09: 1ffff1100fbe185c R10: dffffc0000000000 R11: ffffed100fbe185d R12:
ffff888076e85d50 R13: ffff888076e85c80 R14: ffff888076e85cf4 R15: ffff888076e85c80 FS:
00007f0dca6ea6c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 CR2: 00007f0dca6ead58 CR3: 00000000119da000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400 Call Trace: <TASK> skb_cow_data+0x2da/0xcb0 net/core/skbuff.c:5284 tipc_aead_decrypt net/tipc/crypto.c:894 [inline] tipc_crypto_rcv+0x402/0x24e0 net/tipc/crypto.c:1844 tipc_rcv+0x57e/0x12a0 net/tipc/node.c:2109 tipc_l2_rcv_msg+0x2bd/0x450 net/tipc/bearer.c:668 __netif_receive_skb_list_ptype net/core/dev.c:5720 [inline] __netif_receive_skb_list_core+0x8b7/0x980 net/core/dev.c:5762
__netif_receive_skb_list net/core/dev.c:5814 [inline] netif_receive_skb_list_internal+0xa51/0xe30 net/core/dev.c:5905 gro_normal_list include/net/gro.h:515 [inline] napi_complete_done+0x2b5/0x870 net/core/dev.c:6256 napi_complete include/linux/netdevice.h:567 [inline] tun_get_user+0x2ea0/0x4890 drivers/net/tun.c:1982 tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2057 do_iter_readv_writev+0x600/0x880 vfs_writev+0x376/0xba0 fs/read_write.c:1050 do_writev+0x1b6/0x360 fs/read_write.c:1096 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f (CVE-2024-56372)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56372
https://ubuntu.com/security/CVE-2024-56372

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56372

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230431 - Linux Distros Unpatched Vulnerability : CVE-2024-56378
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc. (CVE-2024-56378)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56378

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
3.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
2.2
EPSS Score
0.001
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-56378

Plugin Information
Published: 2025/03/06, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- poppler
- poppler-cpp
- poppler-glib
- poppler-utils
231519 - Linux Distros Unpatched Vulnerability : CVE-2024-56531
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: caiaq: Use snd_card_free_when_closed() at disconnection The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at disconnection, but this waits for the close of all used fds, hence it can take long. It eventually blocks the upper layer USB ioctls, which may trigger a soft lockup. An easy workaround is to replace snd_card_free() with snd_card_free_when_closed(). This variant returns immediately while the release of resources is done asynchronously by the card device release at the last close. This patch also splits the code to the disconnect and the free phases; the former is called immediately at the USB disconnect callback while the latter is called from the card destructor. (CVE-2024-56531)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56531
https://ubuntu.com/security/CVE-2024-56531

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56531

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230473 - Linux Distros Unpatched Vulnerability : CVE-2024-56532
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: us122l: Use snd_card_free_when_closed() at disconnection The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at disconnection, but this waits for the close of all used fds, hence it can take long. It eventually blocks the upper layer USB ioctls, which may trigger a soft lockup. An easy workaround is to replace snd_card_free() with snd_card_free_when_closed(). This variant returns immediately while the release of resources is done asynchronously by the card device release at the last close. The loop of us122l->mmap_count check is dropped as well. The check is useless for the asynchronous operation with *_when_closed().
(CVE-2024-56532)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56532
https://ubuntu.com/security/CVE-2024-56532

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56532

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231765 - Linux Distros Unpatched Vulnerability : CVE-2024-56533
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: usx2y: Use snd_card_free_when_closed() at disconnection The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at disconnection, but this waits for the close of all used fds, hence it can take long. It eventually blocks the upper layer USB ioctls, which may trigger a soft lockup. An easy workaround is to replace snd_card_free() with snd_card_free_when_closed(). This variant returns immediately while the release of resources is done asynchronously by the card device release at the last close. (CVE-2024-56533)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56533
https://ubuntu.com/security/CVE-2024-56533

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56533

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230389 - Linux Distros Unpatched Vulnerability : CVE-2024-56545
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: streamline driver probe to avoid devres issues It was found that unloading 'hid_hyperv' module results in a devres complaint: ...
hv_vmbus: unregistering driver hid_hyperv ------------[ cut here ]------------ WARNING: CPU: 2 PID: 3983 at drivers/base/devres.c:691 devres_release_group+0x1f2/0x2c0 ... Call Trace: <TASK> ? devres_release_group+0x1f2/0x2c0 ? __warn+0xd1/0x1c0 ? devres_release_group+0x1f2/0x2c0 ? report_bug+0x32a/0x3c0 ? handle_bug+0x53/0xa0 ? exc_invalid_op+0x18/0x50 ? asm_exc_invalid_op+0x1a/0x20 ? devres_release_group+0x1f2/0x2c0 ? devres_release_group+0x90/0x2c0 ? rcu_is_watching+0x15/0xb0 ?
__pfx_devres_release_group+0x10/0x10 hid_device_remove+0xf5/0x220 device_release_driver_internal+0x371/0x540 ? klist_put+0xf3/0x170 bus_remove_device+0x1f1/0x3f0 device_del+0x33f/0x8c0 ? __pfx_device_del+0x10/0x10 ? cleanup_srcu_struct+0x337/0x500 hid_destroy_device+0xc8/0x130 mousevsc_remove+0xd2/0x1d0 [hid_hyperv] device_release_driver_internal+0x371/0x540 driver_detach+0xc5/0x180 bus_remove_driver+0x11e/0x2a0 ?
__mutex_unlock_slowpath+0x160/0x5e0 vmbus_driver_unregister+0x62/0x2b0 [hv_vmbus] ... And the issue seems to be that the corresponding devres group is not allocated. Normally, devres_open_group() is called from
__hid_device_probe() but Hyper-V HID driver overrides 'hid_dev->driver' with 'mousevsc_hid_driver' stub and basically re-implements __hid_device_probe() by calling hid_parse() and hid_hw_start() but not devres_open_group(). hid_device_probe() does not call __hid_device_probe() for it. Later, when the driver is removed, hid_device_remove() calls devres_release_group() as it doesn't check whether hdev->driver was initially overridden or not. The issue seems to be related to the commit 62c68e7cee33 (HID: ensure timely release of driver-allocated resources) but the commit itself seems to be correct. Fix the issue by dropping the 'hid_dev->driver' override and using hid_register_driver()/hid_unregister_driver() instead.
Alternatively, it would have been possible to rely on the default handling but HID_CONNECT_DEFAULT implies HID_CONNECT_HIDRAW and it doesn't seem to work for mousevsc as-is. (CVE-2024-56545)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56545
https://ubuntu.com/security/CVE-2024-56545

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56545

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231693 - Linux Distros Unpatched Vulnerability : CVE-2024-56549
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix NULL pointer dereference in object->file At present, the object->file has the NULL pointer dereference problem in ondemand-mode. The root cause is that the allocated fd and object->file lifetime are inconsistent, and the user-space invocation to anon_fd uses object->file. Following is the process that triggers the issue:
[write fd] [umount] cachefiles_ondemand_fd_write_iter fscache_cookie_state_machine cachefiles_withdraw_cookie if (!file) return -ENOBUFS cachefiles_clean_up_object cachefiles_unmark_inode_in_use fput(object->file) object->file = NULL // file NULL pointer dereference!
__cachefiles_write(..., file, ...) Fix this issue by add an additional reference count to the object->file before write/llseek, and decrement after it finished. (CVE-2024-56549)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56549
https://ubuntu.com/security/CVE-2024-56549

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56549

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231729 - Linux Distros Unpatched Vulnerability : CVE-2024-56568
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- iommu/arm-smmu: Defer probe of clients after smmu device bound Null pointer dereference occurs due to a race between smmu driver probe and client driver probe, when of_dma_configure() for client is called after the iommu_device_register() for smmu driver probe has executed but before the driver_bound() for smmu driver has been called. Following is how the race occurs: T1:Smmu device probe T2: Client device probe really_probe() arm_smmu_device_probe() iommu_device_register() really_probe() platform_dma_configure() of_dma_configure() of_dma_configure_id() of_iommu_configure() iommu_probe_device() iommu_init_device() arm_smmu_probe_device() arm_smmu_get_by_fwnode() driver_find_device_by_fwnode() driver_find_device() next_device() klist_next() /* null ptr assigned to smmu */ /* null ptr dereference while smmu->streamid_mask */ driver_bound() klist_add_tail() When this null smmu pointer is dereferenced later in arm_smmu_probe_device, the device crashes. Fix this by deferring the probe of the client device until the smmu device has bound to the arm smmu driver. [will: Add comment] (CVE-2024-56568)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56568
https://ubuntu.com/security/CVE-2024-56568

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56568

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230502 - Linux Distros Unpatched Vulnerability : CVE-2024-56569
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ftrace: Fix regression with module command in stack_trace_filter When executing the following command: # echo write*:mod:ext3 > /sys/kernel/tracing/stack_trace_filter The current mod command causes a null pointer dereference. While commit 0f17976568b3f (ftrace: Fix regression with module command in stack_trace_filter) has addressed part of the issue, it left a corner case unhandled, which still results in a kernel crash. (CVE-2024-56569)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56569
https://ubuntu.com/security/CVE-2024-56569

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56569

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230822 - Linux Distros Unpatched Vulnerability : CVE-2024-56583
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sched/deadline: Fix warning in migrate_enable for boosted tasks When running the following command: while true; do stress-ng --cyclic 30 --timeout 30s --minimize --quiet done a warning is eventually triggered:
WARNING: CPU: 43 PID: 2848 at kernel/sched/deadline.c:794 setup_new_dl_entity+0x13e/0x180 ... Call Trace:
<TASK> ? show_trace_log_lvl+0x1c4/0x2df ? enqueue_dl_entity+0x631/0x6e0 ? setup_new_dl_entity+0x13e/0x180 ? __warn+0x7e/0xd0 ? report_bug+0x11a/0x1a0 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 enqueue_dl_entity+0x631/0x6e0 enqueue_task_dl+0x7d/0x120
__do_set_cpus_allowed+0xe3/0x280 __set_cpus_allowed_ptr_locked+0x140/0x1d0
__set_cpus_allowed_ptr+0x54/0xa0 migrate_enable+0x7e/0x150 rt_spin_unlock+0x1c/0x90 group_send_sig_info+0xf7/0x1a0 ? kill_pid_info+0x1f/0x1d0 kill_pid_info+0x78/0x1d0 kill_proc_info+0x5b/0x110 __x64_sys_kill+0x93/0xc0 do_syscall_64+0x5c/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 RIP: 0033:0x7f0dab31f92b This warning occurs because set_cpus_allowed dequeues and enqueues tasks with the ENQUEUE_RESTORE flag set. If the task is boosted, the warning is triggered. A boosted task already had its parameters set by rt_mutex_setprio, and a new call to setup_new_dl_entity is unnecessary, hence the WARN_ON call. Check if we are requeueing a boosted task and avoid calling setup_new_dl_entity if that's the case. (CVE-2024-56583)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56583
https://security-tracker.debian.org/tracker/CVE-2024-56583
https://ubuntu.com/security/CVE-2024-56583

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56583

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231188 - Linux Distros Unpatched Vulnerability : CVE-2024-56584
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- io_uring/tctx: work around xa_store() allocation error issue syzbot triggered the following WARN_ON:
WARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:51 which is the WARN_ON_ONCE(!xa_empty(&tctx->xa)); sanity check in __io_uring_free() when a io_uring_task is going through its final put. The syzbot test case includes injecting memory allocation failures, and it very much looks like xa_store() can fail one of its memory allocations and end up with ->head being non-NULL even though no entries exist in the xarray. Until this issue gets sorted out, work around it by attempting to iterate entries in our xarray, and WARN_ON_ONCE() if one is found. (CVE-2024-56584)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56584
https://security-tracker.debian.org/tracker/CVE-2024-56584
https://ubuntu.com/security/CVE-2024-56584

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56584

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231637 - Linux Distros Unpatched Vulnerability : CVE-2024-56587
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- leds: class: Protect brightness_show() with led_cdev->led_access mutex There is NULL pointer issue observed if from Process A where hid device being added which results in adding a led_cdev addition and later a another call to access of led_cdev attribute from Process B can result in NULL pointer issue. Use mutex led_cdev->led_access to protect access to led->cdev and its attribute inside brightness_show() and max_brightness_show() and also update the comment for mutex that it should be used to protect the led class device fields. Process A Process B kthread+0x114 worker_thread+0x244 process_scheduled_works+0x248 uhid_device_add_worker+0x24 hid_add_device+0x120 device_add+0x268 bus_probe_device+0x94 device_initial_probe+0x14 __device_attach+0xfc bus_for_each_drv+0x10c __device_attach_driver+0x14c driver_probe_device+0x3c __driver_probe_device+0xa0 really_probe+0x190 hid_device_probe+0x130 ps_probe+0x990 ps_led_register+0x94 devm_led_classdev_register_ext+0x58 led_classdev_register_ext+0x1f8 device_create_with_groups+0x48 device_create_groups_vargs+0xc8 device_add+0x244 kobject_uevent+0x14 kobject_uevent_env[jt]+0x224 mutex_unlock[jt]+0xc4 __mutex_unlock_slowpath+0xd4 wake_up_q+0x70 try_to_wake_up[jt]+0x48c preempt_schedule_common+0x28 __schedule+0x628 __switch_to+0x174 el0t_64_sync+0x1a8/0x1ac el0t_64_sync_handler+0x68/0xbc el0_svc+0x38/0x68 do_el0_svc+0x1c/0x28 el0_svc_common+0x80/0xe0 invoke_syscall+0x58/0x114 __arm64_sys_read+0x1c/0x2c ksys_read+0x78/0xe8 vfs_read+0x1e0/0x2c8 kernfs_fop_read_iter+0x68/0x1b4 seq_read_iter+0x158/0x4ec kernfs_seq_show+0x44/0x54 sysfs_kf_seq_show+0xb4/0x130 dev_attr_show+0x38/0x74 brightness_show+0x20/0x4c dualshock4_led_get_brightness+0xc/0x74 [ 3313.874295][ T4013] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060 [ 3313.874301][ T4013] Mem abort info: [ 3313.874303][ T4013] ESR = 0x0000000096000006 [ 3313.874305][ T4013] EC = 0x25: DABT (current EL), IL = 32 bits [ 3313.874307][ T4013] SET = 0, FnV = 0 [ 3313.874309][ T4013] EA = 0, S1PTW = 0 [ 3313.874311][ T4013] FSC = 0x06: level 2 translation fault [ 3313.874313][ T4013] Data abort info: [ 3313.874314][ T4013] ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 [ 3313.874316][ T4013] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 3313.874318][ T4013] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 3313.874320][ T4013] user pgtable: 4k pages, 39-bit VAs, pgdp=00000008f2b0a000 .. [ 3313.874332][ T4013] Dumping ftrace buffer: [ 3313.874334][ T4013] (ftrace buffer empty) .. .. [ dd3313.874639][ T4013] CPU: 6 PID: 4013 Comm: InputReader [ 3313.874648][ T4013] pc : dualshock4_led_get_brightness+0xc/0x74 [ 3313.874653][ T4013] lr :
led_update_brightness+0x38/0x60 [ 3313.874656][ T4013] sp : ffffffc0b910bbd0 .. .. [ 3313.874685][ T4013] Call trace: [ 3313.874687][ T4013] dualshock4_led_get_brightness+0xc/0x74 [ 3313.874690][ T4013] brightness_show+0x20/0x4c [ 3313.874692][ T4013] dev_attr_show+0x38/0x74 [ 3313.874696][ T4013] sysfs_kf_seq_show+0xb4/0x130 [ 3313.874700][ T4013] kernfs_seq_show+0x44/0x54 [ 3313.874703][ T4013] seq_read_iter+0x158/0x4ec [ 3313.874705][ T4013] kernfs_fop_read_iter+0x68/0x1b4 [ 3313.874708][ T4013] vfs_read+0x1e0/0x2c8 [ 3313.874711][ T4013] ksys_read+0x78/0xe8 [ 3313.874714][ T4013]
__arm64_sys_read+0x1c/0x2c [ 3313.874718][ T4013] invoke_syscall+0x58/0x114 [ 3313.874721][ T4013] el0_svc_common+0x80/0xe0 [ 3313.874724][ T4013] do_el0_svc+0x1c/0x28 [ 3313.874727][ T4013] el0_svc+0x38/0x68 [ 3313.874730][ T4013] el0t_64_sync_handler+0x68/0xbc [ 3313.874732][ T4013] el0t_64_sync+0x1a8/0x1ac (CVE-2024-56587)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56587
https://ubuntu.com/security/CVE-2024-56587

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56587

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230803 - Linux Distros Unpatched Vulnerability : CVE-2024-56588
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: hisi_sas: Create all dump files during debugfs initialization For the current debugfs of hisi_sas, after user triggers dump, the driver allocate memory space to save the register information and create debugfs files to display the saved information. In this process, the debugfs files created after each dump. Therefore, when the dump is triggered while the driver is unbind, the following hang occurs:
[67840.853907] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a0 [67840.862947] Mem abort info: [67840.865855] ESR = 0x0000000096000004 [67840.869713] EC = 0x25: DABT (current EL), IL = 32 bits [67840.875125] SET = 0, FnV = 0 [67840.878291] EA = 0, S1PTW = 0 [67840.881545] FSC = 0x04: level 0 translation fault [67840.886528] Data abort info: [67840.889524] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [67840.895117] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [67840.900284] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [67840.905709] user pgtable: 4k pages, 48-bit VAs, pgdp=0000002803a1f000 [67840.912263] [00000000000000a0] pgd=0000000000000000, p4d=0000000000000000 [67840.919177] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [67840.996435] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [67841.003628] pc : down_write+0x30/0x98 [67841.007546] lr : start_creating.part.0+0x60/0x198 [67841.012495] sp : ffff8000b979ba20 [67841.016046] x29:
ffff8000b979ba20 x28: 0000000000000010 x27: 0000000000024b40 [67841.023412] x26: 0000000000000012 x25:
ffff20202b355ae8 x24: ffff20202b35a8c8 [67841.030779] x23: ffffa36877928208 x22: ffffa368b4972240 x21:
ffff8000b979bb18 [67841.038147] x20: ffff00281dc1e3c0 x19: fffffffffffffffe x18: 0000000000000020 [67841.045515] x17: 0000000000000000 x16: ffffa368b128a530 x15: ffffffffffffffff [67841.052888] x14:
ffff8000b979bc18 x13: ffffffffffffffff x12: ffff8000b979bb18 [67841.060263] x11: 0000000000000000 x10:
0000000000000000 x9 : ffffa368b1289b18 [67841.067640] x8 : 0000000000000012 x7 : 0000000000000000 x6 :
00000000000003a9 [67841.075014] x5 : 0000000000000000 x4 : ffff002818c5cb00 x3 : 0000000000000001 [67841.082388] x2 : 0000000000000000 x1 : ffff002818c5cb00 x0 : 00000000000000a0 [67841.089759] Call trace: [67841.092456] down_write+0x30/0x98 [67841.096017] start_creating.part.0+0x60/0x198 [67841.100613] debugfs_create_dir+0x48/0x1f8 [67841.104950] debugfs_create_files_v3_hw+0x88/0x348 [hisi_sas_v3_hw] [67841.111447] debugfs_snapshot_regs_v3_hw+0x708/0x798 [hisi_sas_v3_hw] [67841.118111] debugfs_trigger_dump_v3_hw_write+0x9c/0x120 [hisi_sas_v3_hw] [67841.125115] full_proxy_write+0x68/0xc8 [67841.129175] vfs_write+0xd8/0x3f0 [67841.132708] ksys_write+0x70/0x108 [67841.136317]
__arm64_sys_write+0x24/0x38 [67841.140440] invoke_syscall+0x50/0x128 [67841.144385] el0_svc_common.constprop.0+0xc8/0xf0 [67841.149273] do_el0_svc+0x24/0x38 [67841.152773] el0_svc+0x38/0xd8 [67841.156009] el0t_64_sync_handler+0xc0/0xc8 [67841.160361] el0t_64_sync+0x1a4/0x1a8 [67841.164189] Code:
b9000882 d2800002 d2800023 f9800011 (c85ffc05) [67841.170443] ---[ end trace 0000000000000000 ]--- To fix this issue, create all directories and files during debugfs initialization. In this way, the driver only needs to allocate memory space to save information each time the user triggers dumping. (CVE-2024-56588)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56588
https://security-tracker.debian.org/tracker/CVE-2024-56588
https://ubuntu.com/security/CVE-2024-56588

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56588

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230643 - Linux Distros Unpatched Vulnerability : CVE-2024-56589
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: hisi_sas: Add cond_resched() for no forced preemption model For no forced preemption model kernel, in the scenario where the expander is connected to 12 high performance SAS SSDs, the following call trace may occur: [ 214.409199][ C240] watchdog: BUG: soft lockup - CPU#240 stuck for 22s! [irq/149-hisi_sa:3211] [ 214.568533][ C240] pstate: 60400009 (nZCv daif +PAN -UAO -TCO BTYPE=--) [ 214.575224][ C240] pc :
fput_many+0x8c/0xdc [ 214.579480][ C240] lr : fput+0x1c/0xf0 [ 214.583302][ C240] sp : ffff80002de2b900 [ 214.587298][ C240] x29: ffff80002de2b900 x28: ffff1082aa412000 [ 214.593291][ C240] x27: ffff3062a0348c08 x26: ffff80003a9f6000 [ 214.599284][ C240] x25: ffff1062bbac5c40 x24: 0000000000001000 [ 214.605277][ C240] x23: 000000000000000a x22: 0000000000000001 [ 214.611270][ C240] x21: 0000000000001000 x20:
0000000000000000 [ 214.617262][ C240] x19: ffff3062a41ae580 x18: 0000000000010000 [ 214.623255][ C240] x17: 0000000000000001 x16: ffffdb3a6efe5fc0 [ 214.629248][ C240] x15: ffffffffffffffff x14:
0000000003ffffff [ 214.635241][ C240] x13: 000000000000ffff x12: 000000000000029c [ 214.641234][ C240] x11: 0000000000000006 x10: ffff80003a9f7fd0 [ 214.647226][ C240] x9 : ffffdb3a6f0482fc x8 :
0000000000000001 [ 214.653219][ C240] x7 : 0000000000000002 x6 : 0000000000000080 [ 214.659212][ C240] x5 : ffff55480ee9b000 x4 : fffffde7f94c6554 [ 214.665205][ C240] x3 : 0000000000000002 x2 : 0000000000000020 [ 214.671198][ C240] x1 : 0000000000000021 x0 : ffff3062a41ae5b8 [ 214.677191][ C240] Call trace: [ 214.680320][ C240] fput_many+0x8c/0xdc [ 214.684230][ C240] fput+0x1c/0xf0 [ 214.687707][ C240] aio_complete_rw+0xd8/0x1fc [ 214.692225][ C240] blkdev_bio_end_io+0x98/0x140 [ 214.696917][ C240] bio_endio+0x160/0x1bc [ 214.701001][ C240] blk_update_request+0x1c8/0x3bc [ 214.705867][ C240] scsi_end_request+0x3c/0x1f0 [ 214.710471][ C240] scsi_io_completion+0x7c/0x1a0 [ 214.715249][ C240] scsi_finish_command+0x104/0x140 [ 214.720200][ C240] scsi_softirq_done+0x90/0x180 [ 214.724892][ C240] blk_mq_complete_request+0x5c/0x70 [ 214.730016][ C240] scsi_mq_done+0x48/0xac [ 214.734194][ C240] sas_scsi_task_done+0xbc/0x16c [libsas] [ 214.739758][ C240] slot_complete_v3_hw+0x260/0x760 [hisi_sas_v3_hw] [ 214.746185][ C240] cq_thread_v3_hw+0xbc/0x190 [hisi_sas_v3_hw] [ 214.752179][ C240] irq_thread_fn+0x34/0xa4 [ 214.756435][ C240] irq_thread+0xc4/0x130 [ 214.760520][ C240] kthread+0x108/0x13c [ 214.764430][ C240] ret_from_fork+0x10/0x18 This is because in the hisi_sas driver, both the hardware interrupt handler and the interrupt thread are executed on the same CPU. In the performance test scenario, function irq_wait_for_interrupt() will always return 0 if lots of interrupts occurs and the CPU will be continuously consumed. As a result, the CPU cannot run the watchdog thread.
When the watchdog time exceeds the specified time, call trace occurs. To fix it, add cond_resched() to execute the watchdog thread. (CVE-2024-56589)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56589
https://ubuntu.com/security/CVE-2024-56589

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56589

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231573 - Linux Distros Unpatched Vulnerability : CVE-2024-56592
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Call free_htab_elem() after htab_unlock_bucket() For htab of maps, when the map is removed from the htab, it may hold the last reference of the map. bpf_map_fd_put_ptr() will invoke bpf_map_free_id() to free the id of the removed map element. However, bpf_map_fd_put_ptr() is invoked while holding a bucket lock (raw_spin_lock_t), and bpf_map_free_id() attempts to acquire map_idr_lock (spinlock_t), triggering the following lockdep warning: ============================= [ BUG: Invalid wait context ] 6.11.0-rc4+ #49 Not tainted ----------------------------- test_maps/4881 is trying to lock: ffffffff84884578 (map_idr_lock){+...}-{3:3}, at: bpf_map_free_id.part.0+0x21/0x70 other info that might help us debug this:
context-{5:5} 2 locks held by test_maps/4881: #0: ffffffff846caf60 (rcu_read_lock){....}-{1:3}, at:
bpf_fd_htab_map_update_elem+0xf9/0x270 #1: ffff888149ced148 (&htab->lockdep_key#2){....}-{2:2}, at:
htab_map_update_elem+0x178/0xa80 stack backtrace: CPU: 0 UID: 0 PID: 4881 Comm: test_maps Not tainted 6.11.0-rc4+ #49 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), ... Call Trace: <TASK>
dump_stack_lvl+0x6e/0xb0 dump_stack+0x10/0x20 __lock_acquire+0x73e/0x36c0 lock_acquire+0x182/0x450
_raw_spin_lock_irqsave+0x43/0x70 bpf_map_free_id.part.0+0x21/0x70 bpf_map_put+0xcf/0x110 bpf_map_fd_put_ptr+0x9a/0xb0 free_htab_elem+0x69/0xe0 htab_map_update_elem+0x50f/0xa80 bpf_fd_htab_map_update_elem+0x131/0x270 htab_map_update_elem+0x50f/0xa80 bpf_fd_htab_map_update_elem+0x131/0x270 bpf_map_update_value+0x266/0x380 __sys_bpf+0x21bb/0x36b0
__x64_sys_bpf+0x45/0x60 x64_sys_call+0x1b2a/0x20d0 do_syscall_64+0x5d/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e One way to fix the lockdep warning is using raw_spinlock_t for map_idr_lock as well. However, bpf_map_alloc_id() invokes idr_alloc_cyclic() after acquiring map_idr_lock, it will trigger a similar lockdep warning because the slab's lock (s->cpu_slab->lock) is still a spinlock.
Instead of changing map_idr_lock's type, fix the issue by invoking htab_put_fd_value() after htab_unlock_bucket(). However, only deferring the invocation of htab_put_fd_value() is not enough, because the old map pointers in htab of maps can not be saved during batched deletion. Therefore, also defer the invocation of free_htab_elem(), so these to-be-freed elements could be linked together similar to lru map.
There are four callers for ->map_fd_put_ptr: (1) alloc_htab_elem() (through htab_put_fd_value()) It invokes ->map_fd_put_ptr() under a raw_spinlock_t. The invocation of htab_put_fd_value() can not simply move after htab_unlock_bucket(), because the old element has already been stashed in htab->extra_elems. It may be reused immediately after htab_unlock_bucket() and the invocation of htab_put_fd_value() after htab_unlock_bucket() may release the newly-added element incorrectly. Therefore, saving the map pointer of the old element for htab of maps before unlocking the bucket and releasing the map_ptr after unlock.
Beside the map pointer in the old element, should do the same thing for the special fields in the old element as well. (2) free_htab_elem() (through htab_put_fd_value()) Its caller includes
__htab_map_lookup_and_delete_elem(), htab_map_delete_elem() and __htab_map_lookup_and_delete_batch(). For htab_map_delete_elem(), simply invoke free_htab_elem() after htab_unlock_bucket(). For
__htab_map_lookup_and_delete_batch(), just like lru map, linking the to-be-freed element into node_to_free list and invoking free_htab_elem() for these element after unlock. It is safe to reuse batch_flink as the link for node_to_free, because these elements have been removed from the hash llist. Because htab of maps doesn't support lookup_and_delete operation, __htab_map_lookup_and_delete_elem() doesn't have the problem, so kept it as ---truncated--- (CVE-2024-56592)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56592
https://security-tracker.debian.org/tracker/CVE-2024-56592
https://ubuntu.com/security/CVE-2024-56592

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56592

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230307 - Linux Distros Unpatched Vulnerability : CVE-2024-56593
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() This patch fixes a NULL pointer dereference bug in brcmfmac that occurs when a high 'sd_sgentry_align' value applies (e.g.
512) and a lot of queued SKBs are sent from the pkt queue. The problem is the number of entries in the pre-allocated sgtable, it is nents = max(rxglom_size, txglom_size) + max(rxglom_size, txglom_size) >> 4 + 1. Given the default [rt]xglom_size=32 it's actually 35 which is too small. Worst case, the pkt queue can end up with 64 SKBs. This occurs when a new SKB is added for each original SKB if tailroom isn't enough to hold tail_pad. At least one sg entry is needed for each SKB. So, eventually the skb_queue_walk loop in brcmf_sdiod_sglist_rw may run out of sg entries. This makes sg_next return NULL and this causes the oops.
The patch sets nents to max(rxglom_size, txglom_size) * 2 to be able handle the worst-case. Btw. this requires only 64-35=29 * 16 (or 20 if CONFIG_NEED_SG_DMA_LENGTH) = 464 additional bytes of memory.
(CVE-2024-56593)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56593
https://ubuntu.com/security/CVE-2024-56593

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56593

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230576 - Linux Distros Unpatched Vulnerability : CVE-2024-56594
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/amdgpu: set the right AMDGPU sg segment limitation The driver needs to set the correct max_segment_size; otherwise debug_dma_map_sg() will complain about the over-mapping of the AMDGPU sg length as following: WARNING: CPU: 6 PID: 1964 at kernel/dma/debug.c:1178 debug_dma_map_sg+0x2dc/0x370 [ 364.049444] Modules linked in: veth amdgpu(OE) amdxcp drm_exec gpu_sched drm_buddy drm_ttm_helper ttm(OE) drm_suballoc_helper drm_display_helper drm_kms_helper i2c_algo_bit rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs lockd grace netfs xt_conntrack xt_MASQUERADE nf_conntrack_netlink xfrm_user xfrm_algo iptable_nat xt_addrtype iptable_filter br_netfilter nvme_fabrics overlay nfnetlink_cttimeout nfnetlink openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c bridge stp llc amd_atl intel_rapl_msr intel_rapl_common sunrpc sch_fq_codel snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg edac_mce_amd binfmt_misc snd_hda_codec snd_pci_acp6x snd_hda_core snd_acp_config snd_hwdep snd_soc_acpi kvm_amd snd_pcm kvm snd_seq_midi snd_seq_midi_event crct10dif_pclmul ghash_clmulni_intel sha512_ssse3 snd_rawmidi sha256_ssse3 sha1_ssse3 aesni_intel snd_seq nls_iso8859_1 crypto_simd snd_seq_device cryptd snd_timer rapl input_leds snd [ 364.049532] ipmi_devintf wmi_bmof ccp serio_raw k10temp sp5100_tco soundcore ipmi_msghandler cm32181 industrialio mac_hid msr parport_pc ppdev lp parport drm efi_pstore ip_tables x_tables pci_stub crc32_pclmul nvme ahci libahci i2c_piix4 r8169 nvme_core i2c_designware_pci realtek i2c_ccgx_ucsi video wmi hid_generic cdc_ether usbnet usbhid hid r8152 mii [ 364.049576] CPU: 6 PID: 1964 Comm: rocminfo Tainted: G OE 6.10.0-custom #492 [ 364.049579] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS RMJ1009A 06/13/2021 [ 364.049582] RIP: 0010:debug_dma_map_sg+0x2dc/0x370 [ 364.049585] Code: 89 4d b8 e8 36 b1 86 00 8b 4d b8 48 8b 55 b0 44 8b 45 a8 4c 8b 4d a0 48 89 c6 48 c7 c7 00 4b 74 bc 4c 89 4d b8 e8 b4 73 f3 ff <0f> 0b 4c 8b 4d b8 8b 15 c8 2c b8 01 85 d2 0f 85 ee fd ff ff 8b 05 [ 364.049588] RSP:
0018:ffff9ca600b57ac0 EFLAGS: 00010286 [ 364.049590] RAX: 0000000000000000 RBX: ffff88b7c132b0c8 RCX:
0000000000000027 [ 364.049592] RDX: ffff88bb0f521688 RSI: 0000000000000001 RDI: ffff88bb0f521680 [ 364.049594] RBP: ffff9ca600b57b20 R08: 000000000000006f R09: ffff9ca600b57930 [ 364.049596] R10:
ffff9ca600b57928 R11: ffffffffbcb46328 R12: 0000000000000000 [ 364.049597] R13: 0000000000000001 R14:
ffff88b7c19c0700 R15: ffff88b7c9059800 [ 364.049599] FS: 00007fb2d3516e80(0000) GS:ffff88bb0f500000(0000) knlGS:0000000000000000 [ 364.049601] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 364.049603] CR2:
000055610bd03598 CR3: 00000001049f6000 CR4: 0000000000350ef0 [ 364.049605] Call Trace: [ 364.049607] <TASK> [ 364.049609] ? show_regs+0x6d/0x80 [ 364.049614] ? __warn+0x8c/0x140 [ 364.049618] ? debug_dma_map_sg+0x2dc/0x370 [ 364.049621] ? report_bug+0x193/0x1a0 [ 364.049627] ? handle_bug+0x46/0x80 [ 364.049631] ? exc_invalid_op+0x1d/0x80 [ 364.049635] ? asm_exc_invalid_op+0x1f/0x30 [ 364.049642] ? debug_dma_map_sg+0x2dc/0x370 [ 364.049647] __dma_map_sg_attrs+0x90/0xe0 [ 364.049651] dma_map_sgtable+0x25/0x40 [ 364.049654] amdgpu_bo_move+0x59a/0x850 [amdgpu] [ 364.049935] ? srso_return_thunk+0x5/0x5f [ 364.049939] ? amdgpu_ttm_tt_populate+0x5d/0xc0 [amdgpu] [ 364.050095] ttm_bo_handle_move_mem+0xc3/0x180 [ttm] [ 364.050103] ttm_bo_validate+0xc1/0x160 [ttm] [ 364.050108] ? amdgpu_ttm_tt_get_user_pages+0xe5/0x1b0 [amdgpu] [ 364.050263] amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0xa12/0xc90 [amdgpu] [ 364.050473] kfd_ioctl_alloc_memory_of_gpu+0x16b/0x3b0 [amdgpu] [ 364.050680] kfd_ioctl+0x3c2/0x530 [amdgpu] [ 364.050866] ? __pfx_kfd_ioctl_alloc_memory_of_gpu+0x10/0x10 [amdgpu] [ 364.05105 ---truncated--- (CVE-2024-56594)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56594
https://ubuntu.com/security/CVE-2024-56594

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56594

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230519 - Linux Distros Unpatched Vulnerability : CVE-2024-56613
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: sched/numa: fix memory leak due to the overwritten vma->numab_state [Problem Description] When running the hackbench program of LTP, the following memory leak is reported by kmemleak. # /opt/ltp/testcases/bin/hackbench 20 thread 1000 Running with 20*40 (== 800) tasks. # dmesg | grep kmemleak ... kmemleak: 480 new suspected memory leaks (see /sys/kernel/debug/kmemleak) kmemleak: 665 new suspected memory leaks (see /sys/kernel/debug/kmemleak) # cat /sys/kernel/debug/kmemleak unreferenced object 0xffff888cd8ca2c40 (size 64): comm hackbench, pid 17142, jiffies 4299780315 hex dump (first 32 bytes): ac 74 49 00 01 00 00 00 4c 84 49 00 01 00 00 00 .tI.....L.I..... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc bff18fd4): [<ffffffff81419a89>] __kmalloc_cache_noprof+0x2f9/0x3f0 [<ffffffff8113f715>] task_numa_work+0x725/0xa00 [<ffffffff8110f878>] task_work_run+0x58/0x90 [<ffffffff81ddd9f8>] syscall_exit_to_user_mode+0x1c8/0x1e0 [<ffffffff81dd78d5>] do_syscall_64+0x85/0x150 [<ffffffff81e0012b>] entry_SYSCALL_64_after_hwframe+0x76/0x7e ... This issue can be consistently reproduced on three different servers: * a 448-core server * a 256-core server * a 192-core server [Root Cause] Since multiple threads are created by the hackbench program (along with the command argument 'thread'), a shared vma might be accessed by two or more cores simultaneously. When two or more cores observe that vma->numab_state is NULL at the same time, vma->numab_state will be overwritten. Although current code ensures that only one thread scans the VMAs in a single 'numa_scan_period', there might be a chance for another thread to enter in the next 'numa_scan_period' while we have not gotten till numab_state allocation [1]. Note that the command `/opt/ltp/testcases/bin/hackbench 50 process 1000` cannot the reproduce the issue. It is verified with 200+ test runs. [Solution] Use the cmpxchg atomic operation to ensure that only one thread executes the vma->numab_state assignment. [1] https://lore.kernel.org/lkml/1794be3c-358c-4cdc-a43d-a1f841d91ef7@amd.com/ (CVE-2024-56613)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56613
https://ubuntu.com/security/CVE-2024-56613

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56613

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231748 - Linux Distros Unpatched Vulnerability : CVE-2024-56617
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cacheinfo: Allocate memory during CPU hotplug if not done from the primary CPU Commit 5944ce092b97 (arch_topology: Build cacheinfo from primary CPU) adds functionality that architectures can use to optionally allocate and build cacheinfo early during boot. Commit 6539cffa9495 (cacheinfo: Add arch specific early level initializer) lets secondary CPUs correct (and reallocate memory) cacheinfo data if needed. If the early build functionality is not used and cacheinfo does not need correction, memory for cacheinfo is never allocated. x86 does not use the early build functionality. Consequently, during the cacheinfo CPU hotplug callback, last_level_cache_is_valid() attempts to dereference a NULL pointer: BUG:
kernel NULL pointer dereference, address: 0000000000000100 #PF: supervisor read access in kernel mode #PF:
error_code(0x0000) - not present page PGD 0 P4D 0 Oops: 0000 [#1] PREEPMT SMP NOPTI CPU: 0 PID 19 Comm:
cpuhp/0 Not tainted 6.4.0-rc2 #1 RIP: 0010: last_level_cache_is_valid+0x95/0xe0a Allocate memory for cacheinfo during the cacheinfo CPU hotplug callback if not done earlier. Moreover, before determining the validity of the last-level cache info, ensure that it has been allocated. Simply checking for non-zero cache_leaves() is not sufficient, as some architectures (e.g., Intel processors) have non-zero cache_leaves() before allocation. Dereferencing NULL cacheinfo can occur in update_per_cpu_data_slice_size(). This function iterates over all online CPUs. However, a CPU may have come online recently, but its cacheinfo may not have been allocated yet. While here, remove an unnecessary indentation in allocate_cache_info(). [ bp: Massage. ] (CVE-2024-56617)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56617
https://ubuntu.com/security/CVE-2024-56617

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56617

Plugin Information
Published: 2025/03/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230867 - Linux Distros Unpatched Vulnerability : CVE-2024-56624
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix out_fput in iommufd_fault_alloc() As fput() calls the file->f_op->release op, where fault obj and ictx are getting released, there is no need to release these two after fput() one more time, which would result in imbalanced refcounts: refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 48 PID: 2369 at lib/refcount.c:31 refcount_warn_saturate+0x60/0x230 Call trace: refcount_warn_saturate+0x60/0x230 (P) refcount_warn_saturate+0x60/0x230 (L) iommufd_fault_fops_release+0x9c/0xe0 [iommufd] ... VFS: Close: file count is 0 (f_op=iommufd_fops [iommufd]) WARNING: CPU: 48 PID: 2369 at fs/open.c:1507 filp_flush+0x3c/0xf0 Call trace: filp_flush+0x3c/0xf0 (P) filp_flush+0x3c/0xf0 (L) __arm64_sys_close+0x34/0x98 ... imbalanced put on file reference count WARNING: CPU: 48 PID: 2369 at fs/file.c:74 __file_ref_put+0x100/0x138 Call trace: __file_ref_put+0x100/0x138 (P) __file_ref_put+0x100/0x138 (L) __fput_sync+0x4c/0xd0 Drop those two lines to fix the warnings above. (CVE-2024-56624)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56624
https://ubuntu.com/security/CVE-2024-56624

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-56624

Plugin Information
Published: 2025/03/06, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230927 - Linux Distros Unpatched Vulnerability : CVE-2024-56625
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: can: dev: can_set_termination(): allow sleeping GPIOs In commit 6e86a1543c37 (can: dev: provide optional GPIO based termination support) GPIO based termination support was added. For no particular reason that patch uses gpiod_set_value() to set the GPIO. This leads to the following warning, if the systems uses a sleeping GPIO, i.e. behind an I2C port expander: | WARNING: CPU: 0 PID: 379 at /drivers/gpio/gpiolib.c:3496 gpiod_set_value+0x50/0x6c | CPU: 0 UID: 0 PID: 379 Comm: ip Not tainted 6.11.0-20241016-1 #1 823affae360cc91126e4d316d7a614a8bf86236c Replace gpiod_set_value() by gpiod_set_value_cansleep() to allow the use of sleeping GPIOs. (CVE-2024-56625)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56625
https://ubuntu.com/security/CVE-2024-56625

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56625

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231178 - Linux Distros Unpatched Vulnerability : CVE-2024-56629
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- HID: wacom: fix when get product name maybe null pointer Due to incorrect dev->product reporting by certain devices, null pointer dereferences occur when dev->product is empty, leading to potential system crashes. This issue was found on EXCELSIOR DL37-D05 device with Loongson-LS3A6000-7A2000-DL37 motherboard.
Kernel logs: [ 56.470885] usb 4-3: new full-speed USB device number 4 using ohci-pci [ 56.671638] usb 4-3:
string descriptor 0 read error: -22 [ 56.671644] usb 4-3: New USB device found, idVendor=056a, idProduct=0374, bcdDevice= 1.07 [ 56.671647] usb 4-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 56.678839] hid-generic 0003:056A:0374.0004: hiddev0,hidraw3: USB HID v1.10 Device [HID 056a:0374] on usb-0000:00:05.0-3/input0 [ 56.697719] CPU 2 Unable to handle kernel paging request at virtual address 0000000000000000, era == 90000000066e35c8, ra == ffff800004f98a80 [ 56.697732] Oops[#1]: [ 56.697734] CPU: 2 PID: 2742 Comm: (udev-worker) Tainted: G OE 6.6.0-loong64-desktop #25.00.2000.015 [ 56.697737] Hardware name: Inspur CE520L2/C09901N000000000, BIOS 2.09.00 10/11/2024 [ 56.697739] pc 90000000066e35c8 ra ffff800004f98a80 tp 9000000125478000 sp 900000012547b8a0 [ 56.697741] a0 0000000000000000 a1 ffff800004818b28 a2 0000000000000000 a3 0000000000000000 [ 56.697743] a4 900000012547b8f0 a5 0000000000000000 a6 0000000000000000 a7 0000000000000000 [ 56.697745] t0 ffff800004818b2d t1 0000000000000000 t2 0000000000000003 t3 0000000000000005 [ 56.697747] t4 0000000000000000 t5 0000000000000000 t6 0000000000000000 t7 0000000000000000 [ 56.697748] t8 0000000000000000 u0 0000000000000000 s9 0000000000000000 s0 900000011aa48028 [ 56.697750] s1 0000000000000000 s2 0000000000000000 s3 ffff800004818e80 s4 ffff800004810000 [ 56.697751] s5 90000001000b98d0 s6 ffff800004811f88 s7 ffff800005470440 s8 0000000000000000 [ 56.697753] ra:
ffff800004f98a80 wacom_update_name+0xe0/0x300 [wacom] [ 56.697802] ERA: 90000000066e35c8 strstr+0x28/0x120 [ 56.697806] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) [ 56.697816] PRMD: 0000000c (PPLV0 +PIE +PWE) [ 56.697821] EUEN: 00000000 (-FPE -SXE -ASXE -BTE) [ 56.697827] ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7) [ 56.697831] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0) [ 56.697835] BADV: 0000000000000000 [ 56.697836] PRID: 0014d000 (Loongson-64bit, Loongson-3A6000) [ 56.697838] Modules linked in: wacom(+) bnep bluetooth rfkill qrtr nls_iso8859_1 nls_cp437 snd_hda_codec_conexant snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_timer snd soundcore input_leds mousedev led_class joydev deepin_netmonitor(OE) fuse nfnetlink dmi_sysfs ip_tables x_tables overlay amdgpu amdxcp drm_exec gpu_sched drm_buddy radeon drm_suballoc_helper i2c_algo_bit drm_ttm_helper r8169 ttm drm_display_helper spi_loongson_pci xhci_pci cec xhci_pci_renesas spi_loongson_core hid_generic realtek gpio_loongson_64bit [ 56.697887] Process (udev-worker) (pid: 2742, threadinfo=00000000aee0d8b4, task=00000000a9eff1f3) [ 56.697890] Stack : 0000000000000000 ffff800004817e00 0000000000000000 0000251c00000000 [ 56.697896] 0000000000000000 00000011fffffffd 0000000000000000 0000000000000000 [ 56.697901] 0000000000000000 1b67a968695184b9 0000000000000000 90000001000b98d0 [ 56.697906] 90000001000bb8d0 900000011aa48028 0000000000000000 ffff800004f9d74c [ 56.697911] 90000001000ba000 ffff800004f9ce58 0000000000000000 ffff800005470440 [ 56.697916] ffff800004811f88 90000001000b98d0 9000000100da2aa8 90000001000bb8d0 [ 56.697921] 0000000000000000 90000001000ba000 900000011aa48028 ffff800004f9d74c [ 56.697926] ffff8000054704e8 90000001000bb8b8 90000001000ba000 0000000000000000 [ 56.697931] 90000001000bb8d0 ---truncated--- (CVE-2024-56629)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56629
https://ubuntu.com/security/CVE-2024-56629

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56629

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230599 - Linux Distros Unpatched Vulnerability : CVE-2024-56632
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix the memleak while create new ctrl failed Now while we create new ctrl failed, we have not free the tagset occupied by admin_q, here try to fix it. (CVE-2024-56632)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56632
https://ubuntu.com/security/CVE-2024-56632

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56632

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230644 - Linux Distros Unpatched Vulnerability : CVE-2024-56636
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- geneve: do not assume mac header is set in geneve_xmit_skb() We should not assume mac header is set in output path. Use skb_eth_hdr() instead of eth_hdr() to fix the issue. sysbot reported the following :
WARNING: CPU: 0 PID: 11635 at include/linux/skbuff.h:3052 skb_mac_header include/linux/skbuff.h:3052 [inline] WARNING: CPU: 0 PID: 11635 at include/linux/skbuff.h:3052 eth_hdr include/linux/if_ether.h:24 [inline] WARNING: CPU: 0 PID: 11635 at include/linux/skbuff.h:3052 geneve_xmit_skb drivers/net/geneve.c:898 [inline] WARNING: CPU: 0 PID: 11635 at include/linux/skbuff.h:3052 geneve_xmit+0x4c38/0x5730 drivers/net/geneve.c:1039 Modules linked in: CPU: 0 UID: 0 PID: 11635 Comm:
syz.4.1423 Not tainted 6.12.0-syzkaller-10296-gaaf20f870da0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:skb_mac_header include/linux/skbuff.h:3052 [inline] RIP: 0010:eth_hdr include/linux/if_ether.h:24 [inline] RIP: 0010:geneve_xmit_skb drivers/net/geneve.c:898 [inline] RIP: 0010:geneve_xmit+0x4c38/0x5730 drivers/net/geneve.c:1039 Code: 21 c6 02 e9 35 d4 ff ff e8 a5 48 4c fb 90 0f 0b 90 e9 fd f5 ff ff e8 97 48 4c fb 90 0f 0b 90 e9 d8 f5 ff ff e8 89 48 4c fb 90 <0f> 0b 90 e9 41 e4 ff ff e8 7b 48 4c fb 90 0f 0b 90 e9 cd e7 ff ff RSP:
0018:ffffc90003b2f870 EFLAGS: 00010283 RAX: 000000000000037a RBX: 000000000000ffff RCX: ffffc9000dc3d000 RDX: 0000000000080000 RSI: ffffffff86428417 RDI: 0000000000000003 RBP: ffffc90003b2f9f0 R08:
0000000000000003 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000002 R12: ffff88806603c000 R13: 0000000000000000 R14: ffff8880685b2780 R15: 0000000000000e23 FS: 00007fdc2deed6c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
0000001b30a1dff8 CR3: 0000000056b8c000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK>
__netdev_start_xmit include/linux/netdevice.h:5002 [inline] netdev_start_xmit include/linux/netdevice.h:5011 [inline] __dev_direct_xmit+0x58a/0x720 net/core/dev.c:4490 dev_direct_xmit include/linux/netdevice.h:3181 [inline] packet_xmit+0x1e4/0x360 net/packet/af_packet.c:285 packet_snd net/packet/af_packet.c:3146 [inline] packet_sendmsg+0x2700/0x5660 net/packet/af_packet.c:3178 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg net/socket.c:726 [inline]
__sys_sendto+0x488/0x4f0 net/socket.c:2197 __do_sys_sendto net/socket.c:2204 [inline] __se_sys_sendto net/socket.c:2200 [inline] __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2200 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f (CVE-2024-56636)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56636
https://ubuntu.com/security/CVE-2024-56636

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56636

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231004 - Linux Distros Unpatched Vulnerability : CVE-2024-56637
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfilter: ipset: Hold module reference while requesting a module User space may unload ip_set.ko while it is itself requesting a set type backend module, leading to a kernel crash. The race condition may be provoked by inserting an mdelay() right after the nfnl_unlock() call. (CVE-2024-56637)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56637
https://ubuntu.com/security/CVE-2024-56637

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56637

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231457 - Linux Distros Unpatched Vulnerability : CVE-2024-56641
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/smc: initialize close_work early to avoid warning We encountered a warning that close_work was canceled before initialization. WARNING: CPU: 7 PID: 111103 at kernel/workqueue.c:3047
__flush_work+0x19e/0x1b0 Workqueue: events smc_lgr_terminate_work [smc] RIP: 0010:__flush_work+0x19e/0x1b0 Call Trace: ? __wake_up_common+0x7a/0x190 ? work_busy+0x80/0x80 __cancel_work_timer+0xe3/0x160 smc_close_cancel_work+0x1a/0x70 [smc] smc_close_active_abort+0x207/0x360 [smc]
__smc_lgr_terminate.part.38+0xc8/0x180 [smc] process_one_work+0x19e/0x340 worker_thread+0x30/0x370 ? process_one_work+0x340/0x340 kthread+0x117/0x130 ? __kthread_cancel_work+0x50/0x50 ret_from_fork+0x22/0x30 This is because when smc_close_cancel_work is triggered, e.g. the RDMA driver is rmmod and the LGR is terminated, the conn->close_work is flushed before initialization, resulting in WARN_ON(!work->func).
__smc_lgr_terminate | smc_connect_{rdma|ism} ------------------------------------------------------------- | smc_conn_create | \- smc_lgr_register_conn for conn in lgr->conns_all | \- smc_conn_kill | \- smc_close_active_abort | \- smc_close_cancel_work | \- cancel_work_sync | \- __flush_work | (close_work) | | smc_close_init | \- INIT_WORK(&close_work) So fix this by initializing close_work before establishing the connection. (CVE-2024-56641)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56641
https://security-tracker.debian.org/tracker/CVE-2024-56641
https://ubuntu.com/security/CVE-2024-56641

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56641

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231251 - Linux Distros Unpatched Vulnerability : CVE-2024-56648
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: hsr: avoid potential out-of-bound access in fill_frame_info() syzbot is able to feed a packet with 14 bytes, pretending it is a vlan one.
Since fill_frame_info() is relying on skb->mac_len already, extend the check to cover this case. BUG:
KMSAN: uninit-value in fill_frame_info net/hsr/hsr_forward.c:709 [inline] BUG: KMSAN: uninit-value in hsr_forward_skb+0x9ee/0x3b10 net/hsr/hsr_forward.c:724 fill_frame_info net/hsr/hsr_forward.c:709 [inline] hsr_forward_skb+0x9ee/0x3b10 net/hsr/hsr_forward.c:724 hsr_dev_xmit+0x2f0/0x350 net/hsr/hsr_device.c:235
__netdev_start_xmit include/linux/netdevice.h:5002 [inline] netdev_start_xmit include/linux/netdevice.h:5011 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3606 __dev_queue_xmit+0x366a/0x57d0 net/core/dev.c:4434 dev_queue_xmit include/linux/netdevice.h:3168 [inline] packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3146 [inline] packet_sendmsg+0x91ae/0xa6f0 net/packet/af_packet.c:3178 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:726
__sys_sendto+0x594/0x750 net/socket.c:2197 __do_sys_sendto net/socket.c:2204 [inline] __se_sys_sendto net/socket.c:2200 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2200 x64_sys_call+0x346a/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:4091 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4186 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587
__alloc_skb+0x363/0x7b0 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1323 [inline] alloc_skb_with_frags+0xc8/0xd00 net/core/skbuff.c:6612 sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2881 packet_alloc_skb net/packet/af_packet.c:2995 [inline] packet_snd net/packet/af_packet.c:3089 [inline] packet_sendmsg+0x74c6/0xa6f0 net/packet/af_packet.c:3178 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:726
__sys_sendto+0x594/0x750 net/socket.c:2197 __do_sys_sendto net/socket.c:2204 [inline] __se_sys_sendto net/socket.c:2200 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2200 x64_sys_call+0x346a/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f (CVE-2024-56648)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56648
https://ubuntu.com/security/CVE-2024-56648

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56648

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231744 - Linux Distros Unpatched Vulnerability : CVE-2024-56657
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: control: Avoid WARN() for symlink errors Using WARN() for showing the error of symlink creations don't give more information than telling that something goes wrong, since the usual code path is a lregister callback from each control element creation. More badly, the use of WARN() rather confuses fuzzer as if it were serious issues. This patch downgrades the warning messages to use the normal dev_err() instead of WARN(). For making it clearer, add the function name to the prefix, too.
(CVE-2024-56657)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56657
https://security-tracker.debian.org/tracker/CVE-2024-56657
https://ubuntu.com/security/CVE-2024-56657

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56657

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231356 - Linux Distros Unpatched Vulnerability : CVE-2024-56659
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: lapb: increase LAPB_HEADER_LEN It is unclear if net/lapb code is supposed to be ready for 8021q. We can at least avoid crashes like the following : skbuff: skb_under_panic: text:ffffffff8aabe1f6 len:24 put:20 head:ffff88802824a400 data:ffff88802824a3fe tail:0x16 end:0x140 dev:nr0.2 ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:206 ! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 UID: 0 PID: 5508 Comm: dhcpcd Not tainted 6.12.0-rc7-syzkaller-00144-g66418447d27b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 RIP: 0010:skb_panic net/core/skbuff.c:206 [inline] RIP: 0010:skb_under_panic+0x14b/0x150 net/core/skbuff.c:216 Code: 0d 8d 48 c7 c6 2e 9e 29 8e 48 8b 54 24 08 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 41 54 41 57 41 56 e8 1a 6f 37 02 48 83 c4 20 90 <0f> 0b 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 RSP: 0018:ffffc90002ddf638 EFLAGS: 00010282 RAX: 0000000000000086 RBX: dffffc0000000000 RCX: 7a24750e538ff600 RDX: 0000000000000000 RSI: 0000000000000201 RDI: 0000000000000000 RBP: ffff888034a86650 R08: ffffffff8174b13c R09:
1ffff920005bbe60 R10: dffffc0000000000 R11: fffff520005bbe61 R12: 0000000000000140 R13: ffff88802824a400 R14: ffff88802824a3fe R15: 0000000000000016 FS: 00007f2a5990d740(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c2631fd CR3:
0000000029504000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> skb_push+0xe5/0x100 net/core/skbuff.c:2636 nr_header+0x36/0x320 net/netrom/nr_dev.c:69 dev_hard_header include/linux/netdevice.h:3148 [inline] vlan_dev_hard_header+0x359/0x480 net/8021q/vlan_dev.c:83 dev_hard_header include/linux/netdevice.h:3148 [inline] lapbeth_data_transmit+0x1f6/0x2a0 drivers/net/wan/lapbether.c:257 lapb_data_transmit+0x91/0xb0 net/lapb/lapb_iface.c:447 lapb_transmit_buffer+0x168/0x1f0 net/lapb/lapb_out.c:149 lapb_establish_data_link+0x84/0xd0 lapb_device_event+0x4e0/0x670 notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93
__dev_notify_flags+0x207/0x400 dev_change_flags+0xf0/0x1a0 net/core/dev.c:8922 devinet_ioctl+0xa4e/0x1aa0 net/ipv4/devinet.c:1188 inet_ioctl+0x3d7/0x4f0 net/ipv4/af_inet.c:1003 sock_do_ioctl+0x158/0x460 net/socket.c:1227 sock_ioctl+0x626/0x8e0 net/socket.c:1346 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 (CVE-2024-56659)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56659
https://ubuntu.com/security/CVE-2024-56659

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56659

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245384 - Linux Distros Unpatched Vulnerability : CVE-2024-56668
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix qi_batch NULL pointer with nested parent domain The qi_batch is allocated when assigning cache tag for a domain. While for nested parent domain, it is missed. Hence, when trying to map pages to the nested parent, NULL dereference occurred. Also, there is potential memleak since there is no lock around domain->qi_batch allocation. To solve it, add a helper for qi_batch allocation, and call it in both the __cache_tag_assign_domain() and
__cache_tag_assign_parent_domain(). BUG: kernel NULL pointer dereference, address: 0000000000000200 #PF:
supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 8104795067 P4D 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 223 UID: 0 PID: 4357 Comm: qemu-system-x86 Not tainted 6.13.0-rc1-00028-g4b50c3c3b998-dirty #2632 Call Trace: ? __die+0x24/0x70 ? page_fault_oops+0x80/0x150 ? do_user_addr_fault+0x63/0x7b0 ? exc_page_fault+0x7c/0x220 ? asm_exc_page_fault+0x26/0x30 ? cache_tag_flush_range_np+0x13c/0x260 intel_iommu_iotlb_sync_map+0x1a/0x30 iommu_map+0x61/0xf0 batch_to_domain+0x188/0x250 iopt_area_fill_domains+0x125/0x320 ? rcu_is_watching+0x11/0x50 iopt_map_pages+0x63/0x100 iopt_map_common.isra.0+0xa7/0x190 iopt_map_user_pages+0x6a/0x80 iommufd_ioas_map+0xcd/0x1d0 iommufd_fops_ioctl+0x118/0x1c0 __x64_sys_ioctl+0x93/0xc0 do_syscall_64+0x71/0x140 entry_SYSCALL_64_after_hwframe+0x76/0x7e (CVE-2024-56668)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56668
https://ubuntu.com/security/CVE-2024-56668

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-56668

Plugin Information
Published: 2025/08/07, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230946 - Linux Distros Unpatched Vulnerability : CVE-2024-56677
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init() During early init CMA_MIN_ALIGNMENT_BYTES can be PAGE_SIZE, since pageblock_order is still zero and it gets initialized later during initmem_init() e.g. setup_arch() -> initmem_init() -> sparse_init() -> set_pageblock_order() One such use case where this causes issue is - early_setup() -> early_init_devtree() ->
fadump_reserve_mem() -> fadump_cma_init() This causes CMA memory alignment check to be bypassed in cma_init_reserved_mem(). Then later cma_activate_area() can hit a VM_BUG_ON_PAGE(pfn & ((1 << order) - 1)) if the reserved memory area was not pageblock_order aligned. Fix it by moving the fadump_cma_init() after initmem_init(), where other such cma reservations also gets called. <stack trace> ============== page:
refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10010 flags:
0x13ffff800000000(node=1|zone=0|lastcpupid=0x7ffff) CMA raw: 013ffff800000000 5deadbeef0000100 5deadbeef0000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: VM_BUG_ON_PAGE(pfn & ((1 << order) - 1)) ------------[ cut here ]------------ kernel BUG at mm/page_alloc.c:778! Call Trace: __free_one_page+0x57c/0x7b0 (unreliable) free_pcppages_bulk+0x1a8/0x2c8 free_unref_page_commit+0x3d4/0x4e4 free_unref_page+0x458/0x6d0 init_cma_reserved_pageblock+0x114/0x198 cma_init_reserved_areas+0x270/0x3e0 do_one_initcall+0x80/0x2f8 kernel_init_freeable+0x33c/0x530 kernel_init+0x34/0x26c ret_from_kernel_user_thread+0x14/0x1c (CVE-2024-56677)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56677
https://ubuntu.com/security/CVE-2024-56677

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56677

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230754 - Linux Distros Unpatched Vulnerability : CVE-2024-56679
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c Add error pointer check after calling otx2_mbox_get_rsp(). (CVE-2024-56679)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56679
https://ubuntu.com/security/CVE-2024-56679

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56679

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231448 - Linux Distros Unpatched Vulnerability : CVE-2024-56681
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- crypto: bcm - add error check in the ahash_hmac_init function The ahash_init functions may return fails.
The ahash_hmac_init should not return ok when ahash_init returns error. For an example, ahash_init will return -ENOMEM when allocation memory is error. (CVE-2024-56681)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56681
https://ubuntu.com/security/CVE-2024-56681

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56681

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230489 - Linux Distros Unpatched Vulnerability : CVE-2024-56696
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ALSA: core: Fix possible NULL dereference caused by kunit_kzalloc() kunit_kzalloc() may return a NULL pointer, dereferencing it without NULL check may lead to NULL dereference. Add NULL checks for all the kunit_kzalloc() in sound_kunit.c (CVE-2024-56696)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56696
https://ubuntu.com/security/CVE-2024-56696

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-56696

Plugin Information
Published: 2025/03/06, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231983 - Linux Distros Unpatched Vulnerability : CVE-2024-56698
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: dwc3: gadget: Fix looping of queued SG entries The dwc3_request->num_queued_sgs is decremented on completion. If a partially completed request is handled, then the dwc3_request->num_queued_sgs no longer reflects the total number of num_queued_sgs (it would be cleared). Correctly check the number of request SG entries remained to be prepare and queued. Failure to do this may cause null pointer dereference when accessing non-existent SG entry. (CVE-2024-56698)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56698
https://ubuntu.com/security/CVE-2024-56698

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56698

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230906 - Linux Distros Unpatched Vulnerability : CVE-2024-56701
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore The dtl_access_lock needs to be a rw_sempahore, a sleeping lock, because the code calls kmalloc() while holding it, which can sleep: # echo 1 >
/proc/powerpc/vcpudispatch_stats BUG: sleeping function called from invalid context at include/linux/sched/mm.h:337 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 199, name: sh preempt_count: 1, expected: 0 3 locks held by sh/199: #0: c00000000a0743f8 (sb_writers#3){.+.+}-{0:0}, at:
vfs_write+0x324/0x438 #1: c0000000028c7058 (dtl_enable_mutex){+.+.}-{3:3}, at:
vcpudispatch_stats_write+0xd4/0x5f4 #2: c0000000028c70b8 (dtl_access_lock){+.+.}-{2:2}, at:
vcpudispatch_stats_write+0x220/0x5f4 CPU: 0 PID: 199 Comm: sh Not tainted 6.10.0-rc4 #152 Hardware name:
IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1202 0xf000005 of:SLOF,HEAD hv:linux,kvm pSeries Call Trace: dump_stack_lvl+0x130/0x148 (unreliable) __might_resched+0x174/0x410 kmem_cache_alloc_noprof+0x340/0x3d0 alloc_dtl_buffers+0x124/0x1ac vcpudispatch_stats_write+0x2a8/0x5f4 proc_reg_write+0xf4/0x150 vfs_write+0xfc/0x438 ksys_write+0x88/0x148 system_call_exception+0x1c4/0x5a0 system_call_common+0xf4/0x258 (CVE-2024-56701)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56701
https://ubuntu.com/security/CVE-2024-56701

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56701

Plugin Information
Published: 2025/03/06, Modified: 2025/12/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230902 - Linux Distros Unpatched Vulnerability : CVE-2024-56702
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Mark raw_tp arguments with PTR_MAYBE_NULL Arguments to a raw tracepoint are tagged as trusted, which carries the semantics that the pointer will be non-NULL. However, in certain cases, a raw tracepoint argument may end up being NULL. More context about this issue is available in [0]. Thus, there is a discrepancy between the reality, that raw_tp arguments can actually be NULL, and the verifier's knowledge, that they are never NULL, causing explicit NULL checks to be deleted, and accesses to such pointers potentially crashing the kernel. To fix this, mark raw_tp arguments as PTR_MAYBE_NULL, and then special case the dereference and pointer arithmetic to permit it, and allow passing them into helpers/kfuncs;
these exceptions are made for raw_tp programs only. Ensure that we don't do this when ref_obj_id > 0, as in that case this is an acquired object and doesn't need such adjustment. The reason we do mask_raw_tp_trusted_reg logic is because other will recheck in places whether the register is a trusted_reg, and then consider our register as untrusted when detecting the presence of the PTR_MAYBE_NULL flag. To allow safe dereference, we enable PROBE_MEM marking when we see loads into trusted pointers with PTR_MAYBE_NULL. While trusted raw_tp arguments can also be passed into helpers or kfuncs where such broken assumption may cause issues, a future patch set will tackle their case separately, as PTR_TO_BTF_ID (without PTR_TRUSTED) can already be passed into helpers and causes similar problems. Thus, they are left alone for now. It is possible that these checks also permit passing non-raw_tp args that are trusted PTR_TO_BTF_ID with null marking. In such a case, allowing dereference when pointer is NULL expands allowed behavior, so won't regress existing programs, and the case of passing these into helpers is the same as above and will be dealt with later. Also update the failure case in tp_btf_nullable selftest to capture the new behavior, as the verifier will no longer cause an error when directly dereference a raw tracepoint argument marked as __nullable. [0]: https://lore.kernel.org/bpf/ZrCZS6nisraEqehw@jlelli- thinkpadt14gen4.remote.csb (CVE-2024-56702)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56702
https://ubuntu.com/security/CVE-2024-56702

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56702

Plugin Information
Published: 2025/03/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230470 - Linux Distros Unpatched Vulnerability : CVE-2024-56703
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipv6: Fix soft lockups in fib6_select_path under high next hop churn Soft lockups have been observed on a cluster of Linux-based edge routers located in a highly dynamic environment. Using the `bird` service, these routers continuously update BGP-advertised routes due to frequently changing nexthop destinations, while also managing significant IPv6 traffic. The lockups occur during the traversal of the multipath circular linked-list in the `fib6_select_path` function, particularly while iterating through the siblings in the list. The issue typically arises when the nodes of the linked list are unexpectedly deleted concurrently on a different coreindicated by their 'next' and 'previous' elements pointing back to the node itself and their reference count dropping to zero. This results in an infinite loop, leading to a soft lockup that triggers a system panic via the watchdog timer. Apply RCU primitives in the problematic code sections to resolve the issue. Where necessary, update the references to fib6_siblings to annotate or use the RCU APIs. Include a test script that reproduces the issue. The script periodically updates the routing table while generating a heavy load of outgoing IPv6 traffic through multiple iperf3 clients. It consistently induces infinite soft lockups within a couple of minutes. Kernel log: 0 [ffffbd13003e8d30] machine_kexec at ffffffff8ceaf3eb 1 [ffffbd13003e8d90] __crash_kexec at ffffffff8d0120e3 2 [ffffbd13003e8e58] panic at ffffffff8cef65d4 3 [ffffbd13003e8ed8] watchdog_timer_fn at ffffffff8d05cb03 4 [ffffbd13003e8f08] __hrtimer_run_queues at ffffffff8cfec62f 5 [ffffbd13003e8f70] hrtimer_interrupt at ffffffff8cfed756 6 [ffffbd13003e8fd0] __sysvec_apic_timer_interrupt at ffffffff8cea01af 7 [ffffbd13003e8ff0] sysvec_apic_timer_interrupt at ffffffff8df1b83d -- <IRQ stack> -- 8 [ffffbd13003d3708] asm_sysvec_apic_timer_interrupt at ffffffff8e000ecb [exception RIP: fib6_select_path+299] RIP:
ffffffff8ddafe7b RSP: ffffbd13003d37b8 RFLAGS: 00000287 RAX: ffff975850b43600 RBX: ffff975850b40200 RCX:
0000000000000000 RDX: 000000003fffffff RSI: 0000000051d383e4 RDI: ffff975850b43618 RBP: ffffbd13003d3800 R8: 0000000000000000 R9: ffff975850b40200 R10: 0000000000000000 R11: 0000000000000000 R12:
ffffbd13003d3830 R13: ffff975850b436a8 R14: ffff975850b43600 R15: 0000000000000007 ORIG_RAX:
ffffffffffffffff CS: 0010 SS: 0018 9 [ffffbd13003d3808] ip6_pol_route at ffffffff8ddb030c 10 [ffffbd13003d3888] ip6_pol_route_input at ffffffff8ddb068c 11 [ffffbd13003d3898] fib6_rule_lookup at ffffffff8ddf02b5 12 [ffffbd13003d3928] ip6_route_input at ffffffff8ddb0f47 13 [ffffbd13003d3a18] ip6_rcv_finish_core.constprop.0 at ffffffff8dd950d0 14 [ffffbd13003d3a30] ip6_list_rcv_finish.constprop.0 at ffffffff8dd96274 15 [ffffbd13003d3a98] ip6_sublist_rcv at ffffffff8dd96474 16 [ffffbd13003d3af8] ipv6_list_rcv at ffffffff8dd96615 17 [ffffbd13003d3b60] __netif_receive_skb_list_core at ffffffff8dc16fec 18 [ffffbd13003d3be0] netif_receive_skb_list_internal at ffffffff8dc176b3 19 [ffffbd13003d3c50] napi_gro_receive at ffffffff8dc565b9 20 [ffffbd13003d3c80] ice_receive_skb at ffffffffc087e4f5 [ice] 21 [ffffbd13003d3c90] ice_clean_rx_irq at ffffffffc0881b80 [ice] 22 [ffffbd13003d3d20] ice_napi_poll at ffffffffc088232f [ice] 23 [ffffbd13003d3d80] __napi_poll at ffffffff8dc18000 24 [ffffbd13003d3db8] net_rx_action at ffffffff8dc18581 25 [ffffbd13003d3e40] __do_softirq at ffffffff8df352e9 26 [ffffbd13003d3eb0] run_ksoftirqd at ffffffff8ceffe47 27 [ffffbd13003d3ec0] smpboot_thread_fn at ffffffff8cf36a30 28 [ffffbd13003d3ee8] kthread at ffffffff8cf2b39f 29 [ffffbd13003d3f28] ret_from_fork at ffffffff8ce5fa64 30 [ffffbd13003d3f50] ret_from_fork_asm at ffffffff8ce03cbb (CVE-2024-56703)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56703
https://security-tracker.debian.org/tracker/CVE-2024-56703
https://ubuntu.com/security/CVE-2024-56703

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56703

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230588 - Linux Distros Unpatched Vulnerability : CVE-2024-56707
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c Add error pointer checks after calling otx2_mbox_get_rsp(). (CVE-2024-56707)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56707
https://ubuntu.com/security/CVE-2024-56707

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56707

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231605 - Linux Distros Unpatched Vulnerability : CVE-2024-56710
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ceph: fix memory leak in ceph_direct_read_write() The bvecs array which is allocated in iter_get_bvecs_alloc() is leaked and pages remain pinned if ceph_alloc_sparse_ext_map() fails. There is no need to delay the allocation of sparse_ext map until after the bvecs array is set up, so fix this by moving sparse_ext allocation a bit earlier.
Also, make a similar adjustment in __ceph_sync_read() for consistency (a leak of the same kind in
__ceph_sync_read() has been addressed differently). (CVE-2024-56710)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56710
https://ubuntu.com/security/CVE-2024-56710

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56710

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231207 - Linux Distros Unpatched Vulnerability : CVE-2024-56712
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- udmabuf: fix memory leak on last export_udmabuf() error path In export_udmabuf(), if dma_buf_fd() fails because the FD table is full, a dma_buf owning the udmabuf has already been created; but the error handling in udmabuf_create() will tear down the udmabuf without doing anything about the containing dma_buf. This leaves a dma_buf in memory that contains a dangling pointer; though that doesn't seem to lead to anything bad except a memory leak. Fix it by moving the dma_buf_fd() call out of export_udmabuf() so that we can give it different error handling. Note that the shape of this code changed a lot in commit 5e72b2b41a21 (udmabuf: convert udmabuf driver to use folios); but the memory leak seems to have existed since the introduction of udmabuf. (CVE-2024-56712)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56712
https://security-tracker.debian.org/tracker/CVE-2024-56712
https://ubuntu.com/security/CVE-2024-56712

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56712

Plugin Information
Published: 2025/03/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231851 - Linux Distros Unpatched Vulnerability : CVE-2024-56714
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ionic: no double destroy workqueue There are some FW error handling paths that can cause us to try to destroy the workqueue more than once, so let's be sure we're checking for that. The case where this popped up was in an AER event where the handlers got called in such a way that ionic_reset_prepare() and thus ionic_dev_teardown() got called twice in a row. The second time through the workqueue was already destroyed, and destroy_workqueue() choked on the bad wq pointer. We didn't hit this in AER handler testing before because at that time we weren't using a private workqueue. Later we replaced the use of the system workqueue with our own private workqueue but hadn't rerun the AER handler testing since then. (CVE-2024-56714)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56714
https://ubuntu.com/security/CVE-2024-56714

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-56714

Plugin Information
Published: 2025/03/06, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231480 - Linux Distros Unpatched Vulnerability : CVE-2024-56715
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ionic: Fix netdev notifier unregister on failure If register_netdev() fails, then the driver leaks the netdev notifier. Fix this by calling ionic_lif_unregister() on register_netdev() failure. This will also call ionic_lif_unregister_phc() if it has already been registered. (CVE-2024-56715)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56715
https://security-tracker.debian.org/tracker/CVE-2024-56715
https://ubuntu.com/security/CVE-2024-56715

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56715

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231560 - Linux Distros Unpatched Vulnerability : CVE-2024-56716
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: netdevsim: prevent bad user input in nsim_dev_health_break_write() If either a zero count or a large one is provided, kernel can crash.
(CVE-2024-56716)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56716
https://ubuntu.com/security/CVE-2024-56716

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56716

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231196 - Linux Distros Unpatched Vulnerability : CVE-2024-56718
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/smc: protect link down work from execute after lgr freed link down work may be scheduled before lgr freed but execute after lgr freed, which may result in crash. So it is need to hold a reference before shedule link down work, and put the reference after work executed or canceled. The relevant crash call stack as follows: list_del corruption. prev->next should be ffffb638c9c0fe20, but was 0000000000000000
------------[ cut here ]------------ kernel BUG at lib/list_debug.c:51! invalid opcode: 0000 [#1] SMP NOPTI CPU: 6 PID: 978112 Comm: kworker/6:119 Kdump: loaded Tainted: G #1 Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 2221b89 04/01/2014 Workqueue: events smc_link_down_work [smc] RIP:
0010:__list_del_entry_valid.cold+0x31/0x47 RSP: 0018:ffffb638c9c0fdd8 EFLAGS: 00010086 RAX:
0000000000000054 RBX: ffff942fb75e5128 RCX: 0000000000000000 RDX: ffff943520930aa0 RSI: ffff94352091fc80 RDI: ffff94352091fc80 RBP: 0000000000000000 R08: 0000000000000000 R09: ffffb638c9c0fc38 R10:
ffffb638c9c0fc30 R11: ffffffffa015eb28 R12: 0000000000000002 R13: ffffb638c9c0fe20 R14: 0000000000000001 R15: ffff942f9cd051c0 FS: 0000000000000000(0000) GS:ffff943520900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4f25214000 CR3: 000000025fbae004 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6:
00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: rwsem_down_write_slowpath+0x17e/0x470 smc_link_down_work+0x3c/0x60 [smc] process_one_work+0x1ac/0x350 worker_thread+0x49/0x2f0 ? rescuer_thread+0x360/0x360 kthread+0x118/0x140 ? __kthread_bind_mask+0x60/0x60 ret_from_fork+0x1f/0x30 (CVE-2024-56718)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56718
https://security-tracker.debian.org/tracker/CVE-2024-56718
https://ubuntu.com/security/CVE-2024-56718

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56718

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231722 - Linux Distros Unpatched Vulnerability : CVE-2024-56720
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Several fixes to bpf_msg_pop_data Several fixes to bpf_msg_pop_data, 1. In sk_msg_shift_left, we should put_page 2. if (len == 0), return early is better 3. pop the entire sk_msg (last == msg->sg.size) should be supported 4. Fix for the value of variable a 5. In sk_msg_shift_left, after shifting, i has already pointed to the next element. Addtional sk_msg_iter_var_next may result in BUG. (CVE-2024-56720)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56720
https://ubuntu.com/security/CVE-2024-56720

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56720

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231460 - Linux Distros Unpatched Vulnerability : CVE-2024-56725
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c Add error pointer check after calling otx2_mbox_get_rsp(). (CVE-2024-56725)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56725
https://ubuntu.com/security/CVE-2024-56725

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56725

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231454 - Linux Distros Unpatched Vulnerability : CVE-2024-56726
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c Add error pointer check after calling otx2_mbox_get_rsp(). (CVE-2024-56726)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56726
https://ubuntu.com/security/CVE-2024-56726

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56726

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231535 - Linux Distros Unpatched Vulnerability : CVE-2024-56727
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c Adding error pointer check after calling otx2_mbox_get_rsp(). (CVE-2024-56727)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56727
https://ubuntu.com/security/CVE-2024-56727

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56727

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230755 - Linux Distros Unpatched Vulnerability : CVE-2024-56728
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c Add error pointer check after calling otx2_mbox_get_rsp(). (CVE-2024-56728)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56728
https://ubuntu.com/security/CVE-2024-56728

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56728

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231890 - Linux Distros Unpatched Vulnerability : CVE-2024-56738
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks. (CVE-2024-56738)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56738
https://security-tracker.debian.org/tracker/CVE-2024-56738
https://ubuntu.com/security/CVE-2024-56738

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56738

Plugin Information
Published: 2025/03/06, Modified: 2025/10/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- grub2-common
- grub2-efi-x64
- grub2-tools
- grub2-tools-minimal
231682 - Linux Distros Unpatched Vulnerability : CVE-2024-56742
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() Fix an unwind issue in mlx5vf_add_migration_pages(). If a set of pages is allocated but fails to be added to the SG table, they need to be freed to prevent a memory leak. Any pages successfully added to the SG table will be freed as part of mlx5vf_free_data_buffer(). (CVE-2024-56742)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56742
https://security-tracker.debian.org/tracker/CVE-2024-56742
https://ubuntu.com/security/CVE-2024-56742

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56742

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231949 - Linux Distros Unpatched Vulnerability : CVE-2024-56745
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: PCI: Fix reset_method_store() memory leak In reset_method_store(), a string is allocated via kstrndup() and assigned to the local options.
options is then used in with strsep() to find spaces: while ((name = strsep(&options, )) != NULL) { If there are no remaining spaces, then options is set to NULL by strsep(), so the subsequent kfree(options) doesn't free the memory allocated via kstrndup(). Fix by using a separate tmp_options to iterate with strsep() so options is preserved. (CVE-2024-56745)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56745
https://ubuntu.com/security/CVE-2024-56745

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56745

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230770 - Linux Distros Unpatched Vulnerability : CVE-2024-56747
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() Hook qedi_ops->common->sb_init = qed_sb_init does not release the DMA memory sb_virt when it fails. Add dma_free_coherent() to free it.
This is the same way as qedr_alloc_mem_sb() and qede_alloc_mem_sb(). (CVE-2024-56747)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56747
https://ubuntu.com/security/CVE-2024-56747

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56747

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230799 - Linux Distros Unpatched Vulnerability : CVE-2024-56748
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() Hook qed_ops->common->sb_init = qed_sb_init does not release the DMA memory sb_virt when it fails. Add dma_free_coherent() to free it. This is the same way as qedr_alloc_mem_sb() and qede_alloc_mem_sb(). (CVE-2024-56748)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56748
https://ubuntu.com/security/CVE-2024-56748

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56748

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231063 - Linux Distros Unpatched Vulnerability : CVE-2024-56751
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipv6: release nexthop on device removal The CI is hitting some aperiodic hangup at device removal time in the pmtu.sh self-test: unregister_netdevice: waiting for veth_A-R1 to become free. Usage count = 6 ref_tracker: veth_A-R1@ffff888013df15d8 has 1/5 users at dst_init+0x84/0x4a0 dst_alloc+0x97/0x150 ip6_dst_alloc+0x23/0x90 ip6_rt_pcpu_alloc+0x1e6/0x520 ip6_pol_route+0x56f/0x840 fib6_rule_lookup+0x334/0x630 ip6_route_output_flags+0x259/0x480 ip6_dst_lookup_tail.constprop.0+0x5c2/0x940 ip6_dst_lookup_flow+0x88/0x190 udp_tunnel6_dst_lookup+0x2a7/0x4c0 vxlan_xmit_one+0xbde/0x4a50 [vxlan] vxlan_xmit+0x9ad/0xf20 [vxlan] dev_hard_start_xmit+0x10e/0x360 __dev_queue_xmit+0xf95/0x18c0 arp_solicit+0x4a2/0xe00 neigh_probe+0xaa/0xf0 While the first suspect is the dst_cache, explicitly tracking the dst owing the last device reference via probes proved such dst is held by the nexthop in the originating fib6_info. Similar to commit f5b51fe804ec (ipv6: route: purge exception on removal), we need to explicitly release the originating fib info when disconnecting a to-be-removed device from a live ipv6 dst: move the fib6_info cleanup into ip6_dst_ifdown(). Tested running: ./pmtu.sh cleanup_ipv6_exception in a tight loop for more than 400 iterations with no spat, running an unpatched kernel I observed a splat every ~10 iterations.
(CVE-2024-56751)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56751
https://ubuntu.com/security/CVE-2024-56751

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56751

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230635 - Linux Distros Unpatched Vulnerability : CVE-2024-56752
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/gr/gf100: Fix missing unlock in gf100_gr_chan_new() When the call to gf100_grctx_generate() fails, unlock gr->fecs.mutex before returning the error. Fixes smatch warning: drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c:480 gf100_gr_chan_new() warn: inconsistent returns '&gr->fecs.mutex'. (CVE-2024-56752)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56752
https://ubuntu.com/security/CVE-2024-56752

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56752

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230801 - Linux Distros Unpatched Vulnerability : CVE-2024-56756
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nvme-pci: fix freeing of the HMB descriptor table The HMB descriptor table is sized to the maximum number of descriptors that could be used for a given device, but __nvme_alloc_host_mem could break out of the loop earlier on memory allocation failure and end up using less descriptors than planned for, which leads to an incorrect size passed to dma_free_coherent. In practice this was not showing up because the number of descriptors tends to be low and the dma coherent allocator always allocates and frees at least a page.
(CVE-2024-56756)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56756
https://ubuntu.com/security/CVE-2024-56756

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56756

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231529 - Linux Distros Unpatched Vulnerability : CVE-2024-56763
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tracing: Prevent bad count for tracing_cpumask_write If a large count is provided, it will trigger a warning in bitmap_parse_user. Also check zero for it. (CVE-2024-56763)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56763
https://ubuntu.com/security/CVE-2024-56763

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56763

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231984 - Linux Distros Unpatched Vulnerability : CVE-2024-56770
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/sched: netem: account for backlog updates from child qdisc In general, 'qlen' of any classful qdisc should keep track of the number of packets that the qdisc itself and all of its children holds. In case of netem, 'qlen' only accounts for the packets in its internal tfifo. When netem is used with a child qdisc, the child qdisc can use 'qdisc_tree_reduce_backlog' to inform its parent, netem, about created or dropped SKBs. This function updates 'qlen' and the backlog statistics of netem, but netem does not account for changes made by a child qdisc. 'qlen' then indicates the wrong number of packets in the tfifo. If a child qdisc creates new SKBs during enqueue and informs its parent about this, netem's 'qlen' value is increased. When netem dequeues the newly created SKBs from the child, the 'qlen' in netem is not updated.
If 'qlen' reaches the configured sch->limit, the enqueue function stops working, even though the tfifo is not full. Reproduce the bug: Ensure that the sender machine has GSO enabled. Configure netem as root qdisc and tbf as its child on the outgoing interface of the machine as follows: $ tc qdisc add dev <oif> root handle 1: netem delay 100ms limit 100 $ tc qdisc add dev <oif> parent 1:0 tbf rate 50Mbit burst 1542 latency 50ms Send bulk TCP traffic out via this interface, e.g., by running an iPerf3 client on the machine. Check the qdisc statistics: $ tc -s qdisc show dev <oif> Statistics after 10s of iPerf3 TCP test before the fix (note that netem's backlog > limit, netem stopped accepting packets): qdisc netem 1: root refcnt 2 limit 1000 delay 100ms Sent 2767766 bytes 1848 pkt (dropped 652, overlimits 0 requeues 0) backlog 4294528236b 1155p requeues 0 qdisc tbf 10: parent 1:1 rate 50Mbit burst 1537b lat 50ms Sent 2767766 bytes 1848 pkt (dropped 327, overlimits 7601 requeues 0) backlog 0b 0p requeues 0 Statistics after the fix:
qdisc netem 1: root refcnt 2 limit 1000 delay 100ms Sent 37766372 bytes 24974 pkt (dropped 9, overlimits 0 requeues 0) backlog 0b 0p requeues 0 qdisc tbf 10: parent 1:1 rate 50Mbit burst 1537b lat 50ms Sent 37766372 bytes 24974 pkt (dropped 327, overlimits 96017 requeues 0) backlog 0b 0p requeues 0 tbf segments the GSO SKBs (tbf_segment) and updates the netem's 'qlen'. The interface fully stops transferring packets and locks. In this case, the child qdisc and tfifo are empty, but 'qlen' indicates the tfifo is at its limit and no more packets are accepted. This patch adds a counter for the entries in the tfifo. Netem's 'qlen' is only decreased when a packet is returned by its dequeue function, and not during enqueuing into the child qdisc. External updates to 'qlen' are thus accounted for and only the behavior of the backlog statistics changes. As in other qdiscs, 'qlen' then keeps track of how many packets are held in netem and all of its children. As before, sch->limit remains as the maximum number of packets in the tfifo. The same applies to netem's backlog statistics. (CVE-2024-56770)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56770
https://ubuntu.com/security/CVE-2024-56770

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56770

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231155 - Linux Distros Unpatched Vulnerability : CVE-2024-56773
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: kunit: Fix potential null dereference in kunit_device_driver_test() kunit_kzalloc() may return a NULL pointer, dereferencing it without NULL check may lead to NULL dereference. Add a NULL check for test_state. (CVE-2024-56773)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56773
https://ubuntu.com/security/CVE-2024-56773

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56773

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230503 - Linux Distros Unpatched Vulnerability : CVE-2024-56781
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- powerpc/prom_init: Fixup missing powermac #size-cells On some powermacs `escc` nodes are missing `#size- cells` properties, which is deprecated and now triggers a warning at boot since commit 045b14ca5c36 (of:
WARN on deprecated #address-cells/#size-cells handling). For example: Missing '#size-cells' in /pci@f2000000/mac-io@c/escc@13000 WARNING: CPU: 0 PID: 0 at drivers/of/base.c:133 of_bus_n_size_cells+0x98/0x108 Hardware name: PowerMac3,1 7400 0xc0209 PowerMac ... Call Trace:
of_bus_n_size_cells+0x98/0x108 (unreliable) of_bus_default_count_cells+0x40/0x60
__of_get_address+0xc8/0x21c __of_address_to_resource+0x5c/0x228 pmz_init_port+0x5c/0x2ec pmz_probe.isra.0+0x144/0x1e4 pmz_console_init+0x10/0x48 console_init+0xcc/0x138 start_kernel+0x5c4/0x694 As powermacs boot via prom_init it's possible to add the missing properties to the device tree during boot, avoiding the warning. Note that `escc-legacy` nodes are also missing `#size-cells` properties, but they are skipped by the macio driver, so leave them alone. Depends-on: 045b14ca5c36 (of: WARN on deprecated #address-cells/#size-cells handling) (CVE-2024-56781)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56781
https://security-tracker.debian.org/tracker/CVE-2024-56781
https://ubuntu.com/security/CVE-2024-56781

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56781

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230363 - Linux Distros Unpatched Vulnerability : CVE-2024-56782
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ACPI: x86: Add adev NULL check to acpi_quirk_skip_serdev_enumeration() acpi_dev_hid_match() does not check for adev == NULL, dereferencing it unconditional. Add a check for adev being NULL before calling acpi_dev_hid_match(). At the moment acpi_quirk_skip_serdev_enumeration() is never called with a controller_parent without an ACPI companion, but better safe than sorry. (CVE-2024-56782)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56782
https://security-tracker.debian.org/tracker/CVE-2024-56782
https://ubuntu.com/security/CVE-2024-56782

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56782

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230299 - Linux Distros Unpatched Vulnerability : CVE-2024-56787
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- soc: imx8m: Probe the SoC driver as platform driver With driver_async_probe=* on kernel command line, the following trace is produced because on i.MX8M Plus hardware because the soc-imx8m.c driver calls of_clk_get_by_name() which returns -EPROBE_DEFER because the clock driver is not yet probed. This was not detected during regular testing without driver_async_probe. Convert the SoC code to platform driver and instantiate a platform device in its current device_initcall() to probe the platform driver. Rework .soc_revision callback to always return valid error code and return SoC revision via parameter. This way, if anything in the .soc_revision callback return -EPROBE_DEFER, it gets propagated to .probe and the .probe will get retried later. ------------[ cut here ]------------ WARNING: CPU: 1 PID: 1 at drivers/soc/imx/soc-imx8m.c:115 imx8mm_soc_revision+0xdc/0x180 CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.11.0-next-20240924-00002-g2062bb554dea #603 Hardware name: DH electronics i.MX8M Plus DHCOM Premium Developer Kit (3) (DT) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc :
imx8mm_soc_revision+0xdc/0x180 lr : imx8mm_soc_revision+0xd0/0x180 sp : ffff8000821fbcc0 x29:
ffff8000821fbce0 x28: 0000000000000000 x27: ffff800081810120 x26: ffff8000818a9970 x25: 0000000000000006 x24: 0000000000824311 x23: ffff8000817f42c8 x22: ffff0000df8be210 x21: fffffffffffffdfb x20:
ffff800082780000 x19: 0000000000000001 x18: ffffffffffffffff x17: ffff800081fff418 x16: ffff8000823e1000 x15: ffff0000c03b65e8 x14: ffff0000c00051b0 x13: ffff800082790000 x12: 0000000000000801 x11:
ffff80008278ffff x10: ffff80008209d3a6 x9 : ffff80008062e95c x8 : ffff8000821fb9a0 x7 : 0000000000000000 x6 : 00000000000080e3 x5 : ffff0000df8c03d8 x4 : 0000000000000000 x3 : 0000000000000000 x2 :
0000000000000000 x1 : fffffffffffffdfb x0 : fffffffffffffdfb Call trace: imx8mm_soc_revision+0xdc/0x180 imx8_soc_init+0xb0/0x1e0 do_one_initcall+0x94/0x1a8 kernel_init_freeable+0x240/0x2a8 kernel_init+0x28/0x140 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]--- SoC: i.MX8MP revision 1.1 (CVE-2024-56787)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-56787
https://security-tracker.debian.org/tracker/CVE-2024-56787
https://ubuntu.com/security/CVE-2024-56787

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-56787

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230382 - Linux Distros Unpatched Vulnerability : CVE-2024-57360
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. The type of exploitation is: local. The component is: `nm --without-symbol-version` function. (CVE-2024-57360)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57360
https://security-tracker.debian.org/tracker/CVE-2024-57360

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57360

Plugin Information
Published: 2025/03/06, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-13-binutils
- gcc-toolset-13-binutils-devel
- gcc-toolset-13-binutils-gold
- gcc-toolset-13-gdb
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
231947 - Linux Distros Unpatched Vulnerability : CVE-2024-57793
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors In CoCo VMs it is possible for the untrusted host to cause set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. Leak the decrypted memory when set_memory_decrypted() fails, and don't need to print an error since set_memory_decrypted() will call WARN_ONCE(). (CVE-2024-57793)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57793
https://ubuntu.com/security/CVE-2024-57793

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57793

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231138 - Linux Distros Unpatched Vulnerability : CVE-2024-57804
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs The driver, through the SAS transport, exposes a sysfs interface to enable/disable PHYs in a controller/expander setup. When multiple PHYs are disabled and enabled in rapid succession, the persistent and current config pages related to SAS IO unit/SAS Expander pages could get corrupted. Use separate memory for each config request.
(CVE-2024-57804)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57804
https://security-tracker.debian.org/tracker/CVE-2024-57804
https://ubuntu.com/security/CVE-2024-57804

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57804

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230339 - Linux Distros Unpatched Vulnerability : CVE-2024-57807
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: megaraid_sas: Fix for a potential deadlock This fixes a 'possible circular locking dependency detected' warning CPU0 CPU1 ---- ---- lock(&instance->reset_mutex); lock(&shost->scan_mutex);
lock(&instance->reset_mutex); lock(&shost->scan_mutex); Fix this by temporarily releasing the reset_mutex.
(CVE-2024-57807)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57807
https://ubuntu.com/security/CVE-2024-57807

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57807

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231053 - Linux Distros Unpatched Vulnerability : CVE-2024-57874
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL Currently tagged_addr_ctrl_set() doesn't initialize the temporary 'ctrl'
variable, and a SETREGSET call with a length of zero will leave this uninitialized. Consequently tagged_addr_ctrl_set() will consume an arbitrary value, potentially leaking up to 64 bits of memory from the kernel stack. The read is limited to a specific slot on the stack, and the issue does not provide a write mechanism. As set_tagged_addr_ctrl() only accepts values where bits [63:4] zero and rejects other values, a partial SETREGSET attempt will randomly succeed or fail depending on the value of the uninitialized value, and the exposure is significantly limited. Fix this by initializing the temporary value before copying the regset from userspace, as for other regsets (e.g. NT_PRSTATUS, NT_PRFPREG, NT_ARM_SYSTEM_CALL). In the case of a zero-length write, the existing value of the tagged address ctrl will be retained. The NT_ARM_TAGGED_ADDR_CTRL regset is only visible in the user_aarch64_view used by a native AArch64 task to manipulate another native AArch64 task. As get_tagged_addr_ctrl() only returns an error value when called for a compat task, tagged_addr_ctrl_get() and tagged_addr_ctrl_set() should never observe an error value from get_tagged_addr_ctrl(). Add a WARN_ON_ONCE() to both to indicate that such an error would be unexpected, and error handlnig is not missing in either case. (CVE-2024-57874)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57874
https://ubuntu.com/security/CVE-2024-57874

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)
CVSS v3.0 Temporal Score
5.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.0
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57874

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230653 - Linux Distros Unpatched Vulnerability : CVE-2024-57875
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- block: RCU protect disk->conv_zones_bitmap Ensure that a disk revalidation changing the conventional zones bitmap of a disk does not cause invalid memory references when using the disk_zone_is_conv() helper by RCU protecting the disk->conv_zones_bitmap pointer. disk_zone_is_conv() is modified to operate under the RCU read lock and the function disk_set_conv_zones_bitmap() is added to update a disk conv_zones_bitmap pointer using rcu_replace_pointer() with the disk zone_wplugs_lock spinlock held.
disk_free_zone_resources() is modified to call disk_update_zone_resources() with a NULL bitmap pointer to free the disk conv_zones_bitmap. disk_set_conv_zones_bitmap() is also used in disk_update_zone_resources() to set the new (revalidated) bitmap and free the old one. (CVE-2024-57875)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57875
https://security-tracker.debian.org/tracker/CVE-2024-57875
https://ubuntu.com/security/CVE-2024-57875

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57875

Plugin Information
Published: 2025/03/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230823 - Linux Distros Unpatched Vulnerability : CVE-2024-57878
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR Currently fpmr_set() doesn't initialize the temporary 'fpmr' variable, and a SETREGSET call with a length of zero will leave this uninitialized. Consequently an arbitrary value will be written back to target->thread.uw.fpmr, potentially leaking up to 64 bits of memory from the kernel stack. The read is limited to a specific slot on the stack, and the issue does not provide a write mechanism. Fix this by initializing the temporary value before copying the regset from userspace, as for other regsets (e.g. NT_PRSTATUS, NT_PRFPREG, NT_ARM_SYSTEM_CALL). In the case of a zero-length write, the existing contents of FPMR will be retained. Before this patch: | # ./fpmr-test | Attempting to write NT_ARM_FPMR::fpmr = 0x900d900d900d900d | SETREGSET(nt=0x40e, len=8) wrote 8 bytes | | Attempting to read NT_ARM_FPMR::fpmr | GETREGSET(nt=0x40e, len=8) read 8 bytes | Read NT_ARM_FPMR::fpmr = 0x900d900d900d900d | | Attempting to write NT_ARM_FPMR (zero length) | SETREGSET(nt=0x40e, len=0) wrote 0 bytes | | Attempting to read NT_ARM_FPMR::fpmr | GETREGSET(nt=0x40e, len=8) read 8 bytes | Read NT_ARM_FPMR::fpmr = 0xffff800083963d50 After this patch: | # ./fpmr-test | Attempting to write NT_ARM_FPMR::fpmr = 0x900d900d900d900d | SETREGSET(nt=0x40e, len=8) wrote 8 bytes | | Attempting to read NT_ARM_FPMR::fpmr | GETREGSET(nt=0x40e, len=8) read 8 bytes | Read NT_ARM_FPMR::fpmr = 0x900d900d900d900d | | Attempting to write NT_ARM_FPMR (zero length) | SETREGSET(nt=0x40e, len=0) wrote 0 bytes | | Attempting to read NT_ARM_FPMR::fpmr | GETREGSET(nt=0x40e, len=8) read 8 bytes | Read NT_ARM_FPMR::fpmr = 0x900d900d900d900d (CVE-2024-57878)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57878
https://ubuntu.com/security/CVE-2024-57878

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)
CVSS v3.0 Temporal Score
5.3 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.0
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-57878

Plugin Information
Published: 2025/03/06, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230370 - Linux Distros Unpatched Vulnerability : CVE-2024-57882
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mptcp: fix TCP options overflow.
Syzbot reported the following splat: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 UID: 0 PID: 5836 Comm: sshd Not tainted 6.13.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024 RIP: 0010:_compound_head include/linux/page-flags.h:242 [inline] RIP: 0010:put_page+0x23/0x260 include/linux/mm.h:1552 Code: 90 90 90 90 90 90 90 55 41 57 41 56 53 49 89 fe 48 bd 00 00 00 00 00 fc ff df e8 f8 5e 12 f8 49 8d 5e 08 48 89 d8 48 c1 e8 03 <80> 3c 28 00 74 08 48 89 df e8 8f c7 78 f8 48 8b 1b 48 89 de 48 83 RSP: 0000:ffffc90003916c90 EFLAGS: 00010202 RAX: 0000000000000001 RBX: 0000000000000008 RCX:
ffff888030458000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 RBP: dffffc0000000000 R08: ffffffff898ca81d R09: 1ffff110054414ac R10: dffffc0000000000 R11: ffffed10054414ad R12:
0000000000000007 R13: ffff88802a20a542 R14: 0000000000000000 R15: 0000000000000000 FS:
00007f34f496e800(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 CR2: 00007f9d6ec9ec28 CR3: 000000004d260000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400 Call Trace: <TASK> skb_page_unref include/linux/skbuff_ref.h:43 [inline] __skb_frag_unref include/linux/skbuff_ref.h:56 [inline] skb_release_data+0x483/0x8a0 net/core/skbuff.c:1119 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb+0x55/0x70 net/core/skbuff.c:1204 tcp_clean_rtx_queue net/ipv4/tcp_input.c:3436 [inline] tcp_ack+0x2442/0x6bc0 net/ipv4/tcp_input.c:4032 tcp_rcv_state_process+0x8eb/0x44e0 net/ipv4/tcp_input.c:6805 tcp_v4_do_rcv+0x77d/0xc70 net/ipv4/tcp_ipv4.c:1939 tcp_v4_rcv+0x2dc0/0x37f0 net/ipv4/tcp_ipv4.c:2351 ip_protocol_deliver_rcu+0x22e/0x440 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x341/0x5f0 net/ipv4/ip_input.c:233 NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314 NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314 __netif_receive_skb_one_core net/core/dev.c:5672 [inline]
__netif_receive_skb+0x2bf/0x650 net/core/dev.c:5785 process_backlog+0x662/0x15b0 net/core/dev.c:6117
__napi_poll+0xcb/0x490 net/core/dev.c:6883 napi_poll net/core/dev.c:6952 [inline] net_rx_action+0x89b/0x1240 net/core/dev.c:7074 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
__do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0x57/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0033:0x7f34f4519ad5 Code: 85 d2 74 0d 0f 10 02 48 8d 54 24 20 0f 11 44 24 20 64 8b 04 25 18 00 00 00 85 c0 75 27 41 b8 08 00 00 00 b8 0f 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 75 48 8b 15 24 73 0d 00 f7 d8 64 89 02 48 83 RSP:
002b:00007ffec5b32ce0 EFLAGS: 00000246 RAX: 0000000000000001 RBX: 00000000000668a0 RCX: 00007f34f4519ad5 RDX: 00007ffec5b32d00 RSI: 0000000000000004 RDI: 0000564f4bc6cae0 RBP: 0000564f4bc6b5a0 R08:
0000000000000008 R09: 0000000000000000 R10: 00007ffec5b32de8 R11: 0000000000000246 R12: 0000564f48ea8aa4 R13: 0000000000000001 R14: 0000564f48ea93e8 R15: 00007ffec5b32d68 </TASK> Eric noted a probable shinfo->nr_frags corruption, which indeed occurs. The root cause is a buggy MPTCP option len computation in some circumstances: the ADD_ADDR option should be mutually exclusive with DSS since the blamed commit.
Still, mptcp_established_options_add_addr() tries to set the relevant info in mptcp_out_options, if
---truncated--- (CVE-2024-57882)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57882
https://ubuntu.com/security/CVE-2024-57882

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57882

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231022 - Linux Distros Unpatched Vulnerability : CVE-2024-57883
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm: hugetlb: independent PMD page table shared count The folio refcount may be increased unexpectly through try_get_folio() by caller such as split_huge_pages. In huge_pmd_unshare(), we use refcount to check whether a pmd page table is shared. The check is incorrect if the refcount is increased by the above caller, and this can cause the page table leaked: BUG: Bad page state in process sh pfn:109324 page:
refcount:0 mapcount:0 mapping:0000000000000000 index:0x66 pfn:0x109324 flags:
0x17ffff800000000(node=0|zone=2|lastcpupid=0xfffff) page_type: f2(table) raw: 017ffff800000000 0000000000000000 0000000000000000 0000000000000000 raw: 0000000000000066 0000000000000000 00000000f2000000 0000000000000000 page dumped because: nonzero mapcount ... CPU: 31 UID: 0 PID: 7515 Comm: sh Kdump: loaded Tainted: G B 6.13.0-rc2master+ #7 Tainted: [B]=BAD_PAGE Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 Call trace: show_stack+0x20/0x38 (C) dump_stack_lvl+0x80/0xf8 dump_stack+0x18/0x28 bad_page+0x8c/0x130 free_page_is_bad_report+0xa4/0xb0 free_unref_page+0x3cc/0x620 __folio_put+0xf4/0x158 split_huge_pages_all+0x1e0/0x3e8 split_huge_pages_write+0x25c/0x2d8 full_proxy_write+0x64/0xd8 vfs_write+0xcc/0x280 ksys_write+0x70/0x110 __arm64_sys_write+0x24/0x38 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0xc8/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x34/0x128 el0t_64_sync_handler+0xc8/0xd0 el0t_64_sync+0x190/0x198 The issue may be triggered by damon, offline_page, page_idle, etc, which will increase the refcount of page table. 1. The page table itself will be discarded after reporting the nonzero mapcount. 2. The HugeTLB page mapped by the page table miss freeing since we treat the page table as shared and a shared page table will not be unmapped. Fix it by introducing independent PMD page table shared count. As described by comment, pt_index/pt_mm/pt_frag_refcount are used for s390 gmap, x86 pgds and powerpc, pt_share_count is used for x86/arm64/riscv pmds, so we can reuse the field as pt_share_count. (CVE-2024-57883)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57883
https://ubuntu.com/security/CVE-2024-57883

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57883

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
253031 - Linux Distros Unpatched Vulnerability : CVE-2024-57914
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpci: fix NULL pointer issue on shared irq case The tcpci_irq() may meet below NULL pointer dereference issue: [ 2.641851] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 [ 2.641951] status 0x1, 0x37f [ 2.650659] Mem abort info: [ 2.656490] ESR = 0x0000000096000004 [ 2.660230] EC = 0x25: DABT (current EL), IL = 32 bits [ 2.665532] SET = 0, FnV = 0 [ 2.668579] EA = 0, S1PTW = 0 [ 2.671715] FSC = 0x04: level 0 translation fault [ 2.676584] Data abort info: [ 2.679459] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 2.684936] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 2.689980] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 2.695284] [0000000000000010] user address but active_mm is swapper [ 2.701632] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 2.707883] Modules linked in: [ 2.710936] CPU: 1 UID: 0 PID: 87 Comm: irq/111-2-0051 Not tainted 6.12.0-rc6-06316-g7f63786ad3d1-dirty #4 [ 2.720570] Hardware name: NXP i.MX93 11X11 EVK board (DT) [ 2.726040] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 2.732989] pc : tcpci_irq+0x38/0x318 [ 2.736647] lr : _tcpci_irq+0x14/0x20 [ 2.740295] sp :
ffff80008324bd30 [ 2.743597] x29: ffff80008324bd70 x28: ffff800080107894 x27: ffff800082198f70 [ 2.750721] x26: ffff0000050e6680 x25: ffff000004d172ac x24: ffff0000050f0000 [ 2.757845] x23: ffff000004d17200 x22:
0000000000000001 x21: ffff0000050f0000 [ 2.764969] x20: ffff000004d17200 x19: 0000000000000000 x18:
0000000000000001 [ 2.772093] x17: 0000000000000000 x16: ffff80008183d8a0 x15: ffff00007fbab040 [ 2.779217] x14: ffff00007fb918c0 x13: 0000000000000000 x12: 000000000000017a [ 2.786341] x11: 0000000000000001 x10:
0000000000000a90 x9 : ffff80008324bd00 [ 2.793465] x8 : ffff0000050f0af0 x7 : ffff00007fbaa840 x6 :
0000000000000031 [ 2.800589] x5 : 000000000000017a x4 : 0000000000000002 x3 : 0000000000000002 [ 2.807713] x2 : ffff80008324bd3a x1 : 0000000000000010 x0 : 0000000000000000 [ 2.814838] Call trace: [ 2.817273] tcpci_irq+0x38/0x318 [ 2.820583] _tcpci_irq+0x14/0x20 [ 2.823885] irq_thread_fn+0x2c/0xa8 [ 2.827456] irq_thread+0x16c/0x2f4 [ 2.830940] kthread+0x110/0x114 [ 2.834164] ret_from_fork+0x10/0x20 [ 2.837738] Code: f9426420 f9001fe0 d2800000 52800201 (f9400a60) This may happen on shared irq case. Such as two Type-C ports share one irq. After the first port finished tcpci_register_port(), it may trigger interrupt.
However, if the interrupt comes by chance the 2nd port finishes devm_request_threaded_irq(), the 2nd port interrupt handler will run at first. Then the above issue happens due to tcpci is still a NULL pointer in tcpci_irq() when dereference to regmap. devm_request_threaded_irq() <-- port1 irq comes disable_irq(client->irq); tcpci_register_port() This will restore the logic to the state before commit (77e85107a771 usb: typec: tcpci: support edge irq). However, moving tcpci_register_port() earlier creates a problem when use edge irq because tcpci_init() will be called before devm_request_threaded_irq(). The tcpci_init() writes the ALERT_MASK to the hardware to tell it to start generating interrupts but we're not ready to deal with them yet, then the ALERT events may be missed and ALERT line will not recover to high level forever. To avoid the issue, this will also set ALERT_MASK register after devm_request_threaded_irq() return. (CVE-2024-57914)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57914
https://ubuntu.com/security/CVE-2024-57914

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57914

Plugin Information
Published: 2025/08/20, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231076 - Linux Distros Unpatched Vulnerability : CVE-2024-57924
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fs: relax assertions on failure to encode file handles Encoding file handles is usually performed by a filesystem >encode_fh() method that may fail for various reasons. The legacy users of exportfs_encode_fh(), namely, nfsd and name_to_handle_at(2) syscall are ready to cope with the possibility of failure to encode a file handle. There are a few other users of exportfs_encode_{fh,fid}() that currently have a WARN_ON() assertion when ->encode_fh() fails. Relax those assertions because they are wrong. The second linked bug report states commit 16aac5ad1fa9 (ovl: support encoding non-decodable file handles) in v6.6 as the regressing commit, but this is not accurate. The aforementioned commit only increases the chances of the assertion and allows triggering the assertion with the reproducer using overlayfs, inotify and drop_caches. Triggering this assertion was always possible with other filesystems and other reasons of ->encode_fh() failures and more particularly, it was also possible with the exact same reproducer using overlayfs that is mounted with options index=on,nfs_export=on also on kernels <
v6.6. Therefore, I am not listing the aforementioned commit as a Fixes commit. Backport hint: this patch will have a trivial conflict applying to v6.6.y, and other trivial conflicts applying to stable kernels <
v6.6. (CVE-2024-57924)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57924
https://security-tracker.debian.org/tracker/CVE-2024-57924
https://ubuntu.com/security/CVE-2024-57924

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57924

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231730 - Linux Distros Unpatched Vulnerability : CVE-2024-57932
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: gve: guard XDP xmit NDO on existence of xdp queues In GVE, dedicated XDP queues only exist when an XDP program is installed and the interface is up. As such, the NDO XDP XMIT callback should return early if either of these conditions are false. In the case of no loaded XDP program, priv->num_xdp_queues=0 which can cause a divide-by-zero error, and in the case of interface down, num_xdp_queues remains untouched to persist XDP queue count for the next interface up, but the TX pointer itself would be NULL. The XDP xmit callback also needs to synchronize with a device transitioning from open to close. This synchronization will happen via the GVE_PRIV_FLAGS_NAPI_ENABLED bit along with a synchronize_net() call, which waits for any RCU critical sections at call-time to complete. (CVE-2024-57932)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57932
https://ubuntu.com/security/CVE-2024-57932

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57932

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231090 - Linux Distros Unpatched Vulnerability : CVE-2024-57933
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: gve: guard XSK operations on the existence of queues This patch predicates the enabling and disabling of XSK pools on the existence of queues. As it stands, if the interface is down, disabling or enabling XSK pools would result in a crash, as the RX queue pointer would be NULL. XSK pool registration will occur as part of the next interface up.
Similarly, xsk_wakeup needs be guarded against queues disappearing while the function is executing, so a check against the GVE_PRIV_FLAGS_NAPI_ENABLED flag is added to synchronize with the disabling of the bit and the synchronize_net() in gve_turndown. (CVE-2024-57933)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57933
https://ubuntu.com/security/CVE-2024-57933

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57933

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230311 - Linux Distros Unpatched Vulnerability : CVE-2024-57936
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix max SGEs for the Work Request Gen P7 supports up to 13 SGEs for now. WQE software structure can hold only 6 now. Since the max send sge is reported as 13, the stack can give requests up to 13 SGEs. This is causing traffic failures and system crashes. Use the define for max SGE supported for variable size. This will work for both static and variable WQEs. (CVE-2024-57936)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57936
https://ubuntu.com/security/CVE-2024-57936

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-57936

Plugin Information
Published: 2025/03/06, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231217 - Linux Distros Unpatched Vulnerability : CVE-2024-57938
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/sctp: Prevent autoclose integer overflow in sctp_association_init() While by default max_autoclose equals to INT_MAX / HZ, one may set net.sctp.max_autoclose to UINT_MAX. There is code in sctp_association_init() that can consequently trigger overflow. (CVE-2024-57938)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57938
https://ubuntu.com/security/CVE-2024-57938

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57938

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230413 - Linux Distros Unpatched Vulnerability : CVE-2024-57946
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- virtio-blk: don't keep queue frozen during system suspend Commit 4ce6e2db00de (virtio-blk: Ensure no requests in virtqueues before deleting vqs.) replaces queue quiesce with queue freeze in virtio-blk's PM callbacks. And the motivation is to drain inflight IOs before suspending. block layer's queue freeze looks very handy, but it is also easy to cause deadlock, such as, any attempt to call into bio_queue_enter() may run into deadlock if the queue is frozen in current context. There are all kinds of ->suspend() called in suspend context, so keeping queue frozen in the whole suspend context isn't one good idea. And Marek reported lockdep warning[1] caused by virtio-blk's freeze queue in virtblk_freeze(). [1] https://lore.kernel.org/linux-block/ca16370e-d646-4eee-b9cc-87277c89c43c@samsung.com/ Given the motivation is to drain in-flight IOs, it can be done by calling freeze & unfreeze, meantime restore to previous behavior by keeping queue quiesced during suspend. (CVE-2024-57946)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57946
https://ubuntu.com/security/CVE-2024-57946

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57946

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230535 - Linux Distros Unpatched Vulnerability : CVE-2024-57948
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mac802154: check local interfaces before deleting sdata list syzkaller reported a corrupted list in ieee802154_if_remove. [1] Remove an IEEE 802.15.4 network interface after unregister an IEEE 802.15.4 hardware device from the system. CPU0 CPU1 ==== ==== genl_family_rcv_msg_doit ieee802154_unregister_hw ieee802154_del_iface ieee802154_remove_interfaces rdev_del_virtual_intf_deprecated list_del(&sdata->list) ieee802154_if_remove list_del_rcu The net device has been unregistered, since the rcu grace period, unregistration must be run before ieee802154_if_remove. To avoid this issue, add a check for local->interfaces before deleting sdata list. [1] kernel BUG at lib/list_debug.c:58! Oops: invalid opcode:
0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 6277 Comm: syz-executor157 Not tainted 6.12.0-rc6-syzkaller-00005-g557329bcecc2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:__list_del_entry_valid_or_report+0xf4/0x140 lib/list_debug.c:56 Code: e8 a1 7e 00 07 90 0f 0b 48 c7 c7 e0 37 60 8c 4c 89 fe e8 8f 7e 00 07 90 0f 0b 48 c7 c7 40 38 60 8c 4c 89 fe e8 7d 7e 00 07 90 <0f> 0b 48 c7 c7 a0 38 60 8c 4c 89 fe e8 6b 7e 00 07 90 0f 0b 48 c7 RSP:
0018:ffffc9000490f3d0 EFLAGS: 00010246 RAX: 000000000000004e RBX: dead000000000122 RCX: d211eee56bb28d00 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffff88805b278dd8 R08:
ffffffff8174a12c R09: 1ffffffff2852f0d R10: dffffc0000000000 R11: fffffbfff2852f0e R12: dffffc0000000000 R13: dffffc0000000000 R14: dead000000000100 R15: ffff88805b278cc0 FS: 0000555572f94380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
000056262e4a3000 CR3: 0000000078496000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK>
__list_del_entry_valid include/linux/list.h:124 [inline] __list_del_entry include/linux/list.h:215 [inline] list_del_rcu include/linux/rculist.h:157 [inline] ieee802154_if_remove+0x86/0x1e0 net/mac802154/iface.c:687 rdev_del_virtual_intf_deprecated net/ieee802154/rdev-ops.h:24 [inline] ieee802154_del_iface+0x2c0/0x5c0 net/ieee802154/nl-phy.c:323 genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0xb14/0xec0 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2551 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1357 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1901 sock_sendmsg_nosec net/socket.c:729 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:744 ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2607 ___sys_sendmsg net/socket.c:2661 [inline] __sys_sendmsg+0x292/0x380 net/socket.c:2690 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f (CVE-2024-57948)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57948
https://ubuntu.com/security/CVE-2024-57948

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0008
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57948

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230423 - Linux Distros Unpatched Vulnerability : CVE-2024-57952
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Revert libfs: fix infinite directory reads for offset dir The current directory offset allocator (based on mtree_alloc_cyclic) stores the next offset value to return in octx->next_offset. This mechanism typically returns values that increase monotonically over time. Eventually, though, the newly allocated offset value wraps back to a low number (say, 2) which is smaller than other already- allocated offset values. Yu Kuai <yukuai3@huawei.com> reports that, after commit 64a7ce76fb90 (libfs: fix infinite directory reads for offset dir), if a directory's offset allocator wraps, existing entries are no longer visible via readdir/getdents because offset_readdir() stops listing entries once an entry's offset is larger than octx->next_offset. These entries vanish persistently -- they can be looked up, but will never again appear in readdir(3) output. The reason for this is that the commit treats directory offsets as monotonically increasing integer values rather than opaque cookies, and introduces this comparison: if (dentry2offset(dentry) >= last_index) { On 64-bit platforms, the directory offset value upper bound is 2^63 - 1. Directory offsets will monotonically increase for millions of years without wrapping. On 32-bit platforms, however, LONG_MAX is 2^31 - 1. The allocator can wrap after only a few weeks (at worst). Revert commit 64a7ce76fb90 (libfs: fix infinite directory reads for offset dir) to prepare for a fix that can work properly on 32-bit systems and might apply to recent LTS kernels where shmem employs the simple_offset mechanism. (CVE-2024-57952)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57952
https://ubuntu.com/security/CVE-2024-57952

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57952

Plugin Information
Published: 2025/03/06, Modified: 2025/12/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230618 - Linux Distros Unpatched Vulnerability : CVE-2024-57973
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- rdma/cxgb4: Prevent potential integer overflow on 32bit The gl->tot_len variable is controlled by the user. It comes from process_responses(). On 32bit systems, the gl->tot_len + sizeof(struct cpl_pass_accept_req) + sizeof(struct rss_header) addition could have an integer wrapping bug. Use size_add() to prevent this. (CVE-2024-57973)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57973
https://ubuntu.com/security/CVE-2024-57973

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57973

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231842 - Linux Distros Unpatched Vulnerability : CVE-2024-57974
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- udp: Deal with race between UDP socket address change and rehash If a UDP socket changes its local address while it's receiving datagrams, as a result of connect(), there is a period during which a lookup operation might fail to find it, after the address is changed but before the secondary hash (port and address) and the four-tuple hash (local and remote ports and addresses) are updated. Secondary hash chains were introduced by commit 30fff9231fad (udp: bind() optimisation) and, as a result, a rehash operation became needed to make a bound socket reachable again after a connect(). This operation was introduced by commit 719f835853a9 (udp: add rehash on connect()) which isn't however a complete fix: the socket will be found once the rehashing completes, but not while it's pending. This is noticeable with a socat(1) server in UDP4-LISTEN mode, and a client sending datagrams to it. After the server receives the first datagram (cf. _xioopen_ipdgram_listen()), it issues a connect() to the address of the sender, in order to set up a directed flow. Now, if the client, running on a different CPU thread, happens to send a (subsequent) datagram while the server's socket changes its address, but is not rehashed yet, this will result in a failed lookup and a port unreachable error delivered to the client, as apparent from the following reproducer: LEN=$(($(cat /proc/sys/net/core/wmem_default) / 4)) dd if=/dev/urandom bs=1 count=${LEN} of=tmp.in while :; do taskset -c 1 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc & sleep 0.1 || sleep 1 taskset -c 2 socat OPEN:tmp.in UDP4:localhost:1337,shut-null wait done where the client will eventually get ECONNREFUSED on a write() (typically the second or third one of a given iteration): 2024/11/13 21:28:23 socat[46901] E write(6, 0x556db2e3c000, 8192): Connection refused This issue was first observed as a seldom failure in Podman's tests checking UDP functionality while using pasta(1) to connect the container's network namespace, which leads us to a reproducer with the lookup error resulting in an ICMP packet on a tap device: LOCAL_ADDR=$(ip -j -4 addr show|jq -rM '.[] | .addr_info[0] | select(.scope == global).local') while :; do ./pasta --config-net -p pasta.pcap -u 1337 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc & sleep 0.2 || sleep 1 socat OPEN:tmp.in UDP4:${LOCAL_ADDR}:1337,shut-null wait cmp tmp.in tmp.out done Once this fails: tmp.in tmp.out differ:
char 8193, line 29 we can finally have a look at what's going on: $ tshark -r pasta.pcap 1 0.000000 :: ? ff02::16 ICMPv6 110 Multicast Listener Report Message v2 2 0.168690 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 3 0.168767 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 4 0.168806 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 5 0.168827 c6:47:05:8d:dc:04 ? Broadcast ARP 42 Who has 88.198.0.161? Tell 88.198.0.164 6 0.168851 9a:55:9a:55:9a:55 ? c6:47:05:8d:dc:04 ARP 42 88.198.0.161 is at 9a:55:9a:55:9a:55 7 0.168875 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 8 0.168896 88.198.0.164 ? 88.198.0.161 ICMP 590 Destination unreachable (Port unreachable) 9 0.168926 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 10 0.168959 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 11 0.168989 88.198.0.161 ? 88.198.0.164 UDP 4138 60260 ? 1337 Len=4096 12 0.169010 88.198.0.161 ? 88.198.0.164 UDP 42 60260 ? 1337 Len=0 On the third datagram received, the network namespace of the container initiates an ARP lookup to deliver the ICMP message. In another variant of this reproducer, starting the client with: strace -f pasta --config-net -u 1337 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,tru ---truncated--- (CVE-2024-57974)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57974
https://security-tracker.debian.org/tracker/CVE-2024-57974
https://ubuntu.com/security/CVE-2024-57974

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57974

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231697 - Linux Distros Unpatched Vulnerability : CVE-2024-57977
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- memcg: fix soft lockup in the OOM process A soft lockup issue was found in the product with about 56,000 tasks were in the OOM cgroup, it was traversing them when the soft lockup was triggered. watchdog: BUG:
soft lockup - CPU#2 stuck for 23s! [VM Thread:1503066] CPU: 2 PID: 1503066 Comm: VM Thread Kdump: loaded Tainted: G Hardware name: Huawei Cloud OpenStack Nova, BIOS RIP: 0010:console_unlock+0x343/0x540 RSP:
0000:ffffb751447db9a0 EFLAGS: 00000247 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000001 RBX:
0000000000000000 RCX: 00000000ffffffff RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000247 RBP: ffffffffafc71f90 R08: 0000000000000000 R09: 0000000000000040 R10: 0000000000000080 R11:
0000000000000000 R12: ffffffffafc74bd0 R13: ffffffffaf60a220 R14: 0000000000000247 R15: 0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2fe6ad91f0 CR3: 00000004b2076003 CR4:
0000000000360ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: vprintk_emit+0x193/0x280 printk+0x52/0x6e dump_task+0x114/0x130 mem_cgroup_scan_tasks+0x76/0x100 dump_header+0x1fe/0x210 oom_kill_process+0xd1/0x100 out_of_memory+0x125/0x570 mem_cgroup_out_of_memory+0xb5/0xd0 try_charge+0x720/0x770 mem_cgroup_try_charge+0x86/0x180 mem_cgroup_try_charge_delay+0x1c/0x40 do_anonymous_page+0xb5/0x390 handle_mm_fault+0xc4/0x1f0 This is because thousands of processes are in the OOM cgroup, it takes a long time to traverse all of them. As a result, this lead to soft lockup in the OOM process. To fix this issue, call 'cond_resched' in the 'mem_cgroup_scan_tasks' function per 1000 iterations. For global OOM, call 'touch_softlockup_watchdog' per 1000 iterations to avoid this issue. (CVE-2024-57977)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57977
https://ubuntu.com/security/CVE-2024-57977

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57977

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231500 - Linux Distros Unpatched Vulnerability : CVE-2024-57985
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: Cleanup global '__scm' on probe failures If SCM driver fails the probe, it should not leave global '__scm' variable assigned, because external users of this driver will assume the probe finished successfully. For example TZMEM parts ('__scm->mempool') are initialized later in the probe, but users of it (__scm_smc_call()) rely on the '__scm' variable. This fixes theoretical NULL pointer exception, triggered via introducing probe deferral in SCM driver with call trace: qcom_tzmem_alloc+0x70/0x1ac (P) qcom_tzmem_alloc+0x64/0x1ac (L) qcom_scm_assign_mem+0x78/0x194 qcom_rmtfs_mem_probe+0x2d4/0x38c platform_probe+0x68/0xc8 (CVE-2024-57985)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57985
https://ubuntu.com/security/CVE-2024-57985

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57985

Plugin Information
Published: 2025/03/06, Modified: 2025/11/24
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231405 - Linux Distros Unpatched Vulnerability : CVE-2024-57994
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() Jakub added a lockdep_assert_no_hardirq() check in __page_pool_put_page() to increase test coverage. syzbot found a splat caused by hard irq blocking in ptr_ring_resize_multiple() [1] As current users of ptr_ring_resize_multiple() do not require hard irqs being masked, replace it to only block BH. Rename helpers to better reflect they are safe against BH only. - ptr_ring_resize_multiple() to ptr_ring_resize_multiple_bh() - skb_array_resize_multiple() to skb_array_resize_multiple_bh() [1] WARNING:
CPU: 1 PID: 9150 at net/core/page_pool.c:709 __page_pool_put_page net/core/page_pool.c:709 [inline] WARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780 Modules linked in: CPU: 1 UID: 0 PID: 9150 Comm: syz.1.1052 Not tainted 6.11.0-rc3-syzkaller-00202-gf8669d7b5f5d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:__page_pool_put_page net/core/page_pool.c:709 [inline] RIP:
0010:page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780 Code: 74 0e e8 7c aa fb f7 eb 43 e8 75 aa fb f7 eb 3c 65 8b 1d 38 a8 6a 76 31 ff 89 de e8 a3 ae fb f7 85 db 74 0b e8 5a aa fb f7 90 <0f> 0b 90 eb 1d 65 8b 1d 15 a8 6a 76 31 ff 89 de e8 84 ae fb f7 85 RSP: 0018:ffffc9000bda6b58 EFLAGS: 00010083 RAX:
ffffffff8997e523 RBX: 0000000000000000 RCX: 0000000000040000 RDX: ffffc9000fbd0000 RSI: 0000000000001842 RDI: 0000000000001843 RBP: 0000000000000000 R08: ffffffff8997df2c R09: 1ffffd40003a000d R10:
dffffc0000000000 R11: fffff940003a000e R12: ffffea0001d00040 R13: ffff88802e8a4000 R14: dffffc0000000000 R15: 00000000ffffffff FS: 00007fb7aaf716c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa15a0d4b72 CR3: 00000000561b0000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6:
00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> tun_ptr_free drivers/net/tun.c:617 [inline]
__ptr_ring_swap_queue include/linux/ptr_ring.h:571 [inline] ptr_ring_resize_multiple_noprof include/linux/ptr_ring.h:643 [inline] tun_queue_resize drivers/net/tun.c:3694 [inline] tun_device_event+0xaaf/0x1080 drivers/net/tun.c:3714 notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93 call_netdevice_notifiers_extack net/core/dev.c:2032 [inline] call_netdevice_notifiers net/core/dev.c:2046 [inline] dev_change_tx_queue_len+0x158/0x2a0 net/core/dev.c:9024 do_setlink+0xff6/0x41f0 net/core/rtnetlink.c:2923 rtnl_setlink+0x40d/0x5a0 net/core/rtnetlink.c:3201 rtnetlink_rcv_msg+0x73f/0xcf0 net/core/rtnetlink.c:6647 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550 (CVE-2024-57994)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57994
https://ubuntu.com/security/CVE-2024-57994

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57994

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231025 - Linux Distros Unpatched Vulnerability : CVE-2024-57996
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net_sched: sch_sfq: don't allow 1 packet limit The current implementation does not work correctly with a limit of 1. iproute2 actually checks for this and this patch adds the check in kernel as well. This fixes the following syzkaller reported crash: UBSAN: array-index-out-of-bounds in net/sched/sch_sfq.c:210:6 index 65535 is out of range for type 'struct sfq_head[128]' CPU: 0 PID: 2569 Comm: syz-executor101 Not tainted 5.10.0-smp-DEV #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x125/0x19f lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:148 [inline] __ubsan_handle_out_of_bounds+0xed/0x120 lib/ubsan.c:347 sfq_link net/sched/sch_sfq.c:210 [inline] sfq_dec+0x528/0x600 net/sched/sch_sfq.c:238 sfq_dequeue+0x39b/0x9d0 net/sched/sch_sfq.c:500 sfq_reset+0x13/0x50 net/sched/sch_sfq.c:525 qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026 tbf_reset+0x3d/0x100 net/sched/sch_tbf.c:319 qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026 dev_reset_queue+0x8c/0x140 net/sched/sch_generic.c:1296 netdev_for_each_tx_queue include/linux/netdevice.h:2350 [inline] dev_deactivate_many+0x6dc/0xc20 net/sched/sch_generic.c:1362 __dev_close_many+0x214/0x350 net/core/dev.c:1468 dev_close_many+0x207/0x510 net/core/dev.c:1506 unregister_netdevice_many+0x40f/0x16b0 net/core/dev.c:10738 unregister_netdevice_queue+0x2be/0x310 net/core/dev.c:10695 unregister_netdevice include/linux/netdevice.h:2893 [inline] __tun_detach+0x6b6/0x1600 drivers/net/tun.c:689 tun_detach drivers/net/tun.c:705 [inline] tun_chr_close+0x104/0x1b0 drivers/net/tun.c:3640 __fput+0x203/0x840 fs/file_table.c:280 task_work_run+0x129/0x1b0 kernel/task_work.c:185 exit_task_work include/linux/task_work.h:33 [inline] do_exit+0x5ce/0x2200 kernel/exit.c:931 do_group_exit+0x144/0x310 kernel/exit.c:1046 __do_sys_exit_group kernel/exit.c:1057 [inline] __se_sys_exit_group kernel/exit.c:1055 [inline] __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1055 do_syscall_64+0x6c/0xd0 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fe5e7b52479 Code: Unable to access opcode bytes at RIP 0x7fe5e7b5244f. RSP: 002b:00007ffd3c800398 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX:
ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe5e7b52479 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 RBP: 00007fe5e7bcd2d0 R08: ffffffffffffffb8 R09: 0000000000000014 R10:
0000000000000000 R11: 0000000000000246 R12: 00007fe5e7bcd2d0 R13: 0000000000000000 R14: 00007fe5e7bcdd20 R15: 00007fe5e7b24270 The crash can be also be reproduced with the following (with a tc recompiled to allow for sfq limits of 1): tc qdisc add dev dummy0 handle 1: root tbf rate 1Kbit burst 100b lat 1s ../iproute2-6.9.0/tc/tc qdisc add dev dummy0 handle 2: parent 1:10 sfq limit 1 ifconfig dummy0 up ping -I dummy0 -f -c2 -W0.1 8.8.8.8 sleep 1 Scenario that triggers the crash: * the first packet is sent and queued in TBF and SFQ; qdisc qlen is 1 * TBF dequeues: it peeks from SFQ which moves the packet to the gso_skb list and keeps qdisc qlen set to 1. TBF is out of tokens so it schedules itself for later. * the second packet is sent and TBF tries to queues it to SFQ. qdisc qlen is now 2 and because the SFQ limit is 1 the packet is dropped by SFQ. At this point qlen is 1, and all of the SFQ slots are empty, however q->tail is not NULL. At this point, assuming no more packets are queued, when sch_dequeue runs again it will decrement the qlen for the current empty slot causing an underflow and the subsequent out of bounds access. (CVE-2024-57996)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57996
https://ubuntu.com/security/CVE-2024-57996

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57996

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231564 - Linux Distros Unpatched Vulnerability : CVE-2024-57999
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW Power Hypervisor can possibily allocate MMIO window intersecting with Dynamic DMA Window (DDW) range, which is over 32-bit addressing. These MMIO pages needs to be marked as reserved so that IOMMU doesn't map DMA buffers in this range. The current code is not marking these pages correctly which is resulting in LPAR to OOPS while booting. The stack is at below BUG: Unable to handle kernel data access on read at 0xc00800005cd40000 Faulting instruction address:
0xc00000000005cdac Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries Modules linked in: af_packet rfkill ibmveth(X) lpfc(+) nvmet_fc nvmet nvme_keyring crct10dif_vpmsum nvme_fc nvme_fabrics nvme_core be2net(+) nvme_auth rtc_generic nfsd auth_rpcgss nfs_acl lockd grace sunrpc fuse configfs ip_tables x_tables xfs libcrc32c dm_service_time ibmvfc(X) scsi_transport_fc vmx_crypto gf128mul crc32c_vpmsum dm_mirror dm_region_hash dm_log dm_multipath dm_mod sd_mod scsi_dh_emc scsi_dh_rdac scsi_dh_alua t10_pi crc64_rocksoft_generic crc64_rocksoft sg crc64 scsi_mod Supported: Yes, External CPU: 8 PID: 241 Comm: kworker/8:1 Kdump: loaded Not tainted 6.4.0-150600.23.14-default #1 SLE15-SP6 b44ee71c81261b9e4bab5e0cde1f2ed891d5359b Hardware name:
IBM,9080-M9S POWER9 (raw) 0x4e2103 0xf000005 of:IBM,FW950.B0 (VH950_149) hv:phyp pSeries Workqueue: events work_for_cpu_fn NIP: c00000000005cdac LR: c00000000005e830 CTR: 0000000000000000 REGS: c00001400c9ff770 TRAP: 0300 Not tainted (6.4.0-150600.23.14-default) MSR: 800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 24228448 XER: 00000001 CFAR: c00000000005cdd4 DAR: c00800005cd40000 DSISR: 40000000 IRQMASK: 0 GPR00: c00000000005e830 c00001400c9ffa10 c000000001987d00 c00001400c4fe800 GPR04: 0000080000000000 0000000000000001 0000000004000000 0000000000800000 GPR08: 0000000004000000 0000000000000001 c00800005cd40000 ffffffffffffffff GPR12: 0000000084228882 c00000000a4c4f00 0000000000000010 0000080000000000 GPR16: c00001400c4fe800 0000000004000000 0800000000000000 c00000006088b800 GPR20: c00001401a7be980 c00001400eff3800 c000000002a2da68 000000000000002b GPR24:
c0000000026793a8 c000000002679368 000000000000002a c0000000026793c8 GPR28: 000008007effffff 0000080000000000 0000000000800000 c00001400c4fe800 NIP [c00000000005cdac] iommu_table_reserve_pages+0xac/0x100 LR [c00000000005e830] iommu_init_table+0x80/0x1e0 Call Trace:
[c00001400c9ffa10] [c00000000005e810] iommu_init_table+0x60/0x1e0 (unreliable) [c00001400c9ffa90] [c00000000010356c] iommu_bypass_supported_pSeriesLP+0x9cc/0xe40 [c00001400c9ffc30] [c00000000005c300] dma_iommu_dma_supported+0xf0/0x230 [c00001400c9ffcb0] [c00000000024b0c4] dma_supported+0x44/0x90 [c00001400c9ffcd0] [c00000000024b14c] dma_set_mask+0x3c/0x80 [c00001400c9ffd00] [c0080000555b715c] be_probe+0xc4/0xb90 [be2net] [c00001400c9ffdc0] [c000000000986f3c] local_pci_probe+0x6c/0x110 [c00001400c9ffe40] [c000000000188f28] work_for_cpu_fn+0x38/0x60 [c00001400c9ffe70] [c00000000018e454] process_one_work+0x314/0x620 [c00001400c9fff10] [c00000000018f280] worker_thread+0x2b0/0x620 [c00001400c9fff90] [c00000000019bb18] kthread+0x148/0x150 [c00001400c9fffe0] [c00000000000ded8] start_kernel_thread+0x14/0x18 There are 2 issues in the code 1. The index is int while the address is unsigned long. This results in negative value when setting the bitmap. 2. The DMA offset is page shifted but the MMIO range is used as-is (64-bit address). MMIO address needs to be page shifted as well.
(CVE-2024-57999)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-57999
https://security-tracker.debian.org/tracker/CVE-2024-57999
https://ubuntu.com/security/CVE-2024-57999

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-57999

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230818 - Linux Distros Unpatched Vulnerability : CVE-2024-58017
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX Shifting 1 << 31 on a 32-bit int causes signed integer overflow, which leads to undefined behavior. To prevent this, cast 1 to u32 before performing the shift, ensuring well-defined behavior. This change explicitly avoids any potential overflow by ensuring that the shift occurs on an unsigned 32-bit integer. (CVE-2024-58017)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-58017
https://ubuntu.com/security/CVE-2024-58017

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-58017

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
232256 - Linux Distros Unpatched Vulnerability : CVE-2024-58053
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- rxrpc: Fix handling of received connection abort Fix the handling of a connection abort that we've received. Though the abort is at the connection level, it needs propagating to the calls on that connection. Whilst the propagation bit is performed, the calls aren't then woken up to go and process their termination, and as no further input is forthcoming, they just hang. Also add some tracing for the logging of connection aborts. (CVE-2024-58053)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-58053
https://security-tracker.debian.org/tracker/CVE-2024-58053
https://ubuntu.com/security/CVE-2024-58053

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-58053

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
232236 - Linux Distros Unpatched Vulnerability : CVE-2024-58061
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: prohibit deactivating all links In the internal API this calls this is a WARN_ON, but that should remain since internally we want to know about bugs that may cause this. Prevent deactivating all links in the debugfs write directly.
(CVE-2024-58061)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-58061
https://ubuntu.com/security/CVE-2024-58061

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-58061

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
232235 - Linux Distros Unpatched Vulnerability : CVE-2024-58070
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT In PREEMPT_RT, kmalloc(GFP_ATOMIC) is still not safe in non preemptible context. bpf_mem_alloc must be used in PREEMPT_RT. This patch is to enforce bpf_mem_alloc in the bpf_local_storage when CONFIG_PREEMPT_RT is enabled. [ 35.118559] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 [ 35.118566] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1832, name: test_progs [ 35.118569] preempt_count: 1, expected: 0 [ 35.118571] RCU nest depth: 1, expected: 1 [ 35.118577] INFO: lockdep is turned off. ... [ 35.118647]
__might_resched+0x433/0x5b0 [ 35.118677] rt_spin_lock+0xc3/0x290 [ 35.118700] ___slab_alloc+0x72/0xc40 [ 35.118723] __kmalloc_noprof+0x13f/0x4e0 [ 35.118732] bpf_map_kzalloc+0xe5/0x220 [ 35.118740] bpf_selem_alloc+0x1d2/0x7b0 [ 35.118755] bpf_local_storage_update+0x2fa/0x8b0 [ 35.118784] bpf_sk_storage_get_tracing+0x15a/0x1d0 [ 35.118791] bpf_prog_9a118d86fca78ebb_trace_inet_sock_set_state+0x44/0x66 [ 35.118795] bpf_trace_run3+0x222/0x400 [ 35.118820] __bpf_trace_inet_sock_set_state+0x11/0x20 [ 35.118824] trace_inet_sock_set_state+0x112/0x130 [ 35.118830] inet_sk_state_store+0x41/0x90 [ 35.118836] tcp_set_state+0x3b3/0x640 There is no need to adjust the gfp_flags passing to the bpf_mem_cache_alloc_flags() which only honors the GFP_KERNEL. The verifier has ensured GFP_KERNEL is passed only in sleepable context. It has been an old issue since the first introduction of the bpf_local_storage ~5 years ago, so this patch targets the bpf-next. bpf_mem_alloc is needed to solve it, so the Fixes tag is set to the commit when bpf_mem_alloc was first used in the bpf_local_storage. (CVE-2024-58070)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-58070
https://ubuntu.com/security/CVE-2024-58070

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-58070

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
232250 - Linux Distros Unpatched Vulnerability : CVE-2024-58071
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- team: prevent adding a device which is already a team device lower Prevent adding a device which is already a team device lower, e.g. adding veth0 if vlan1 was already added and veth0 is a lower of vlan1.
This is not useful in practice and can lead to recursive locking: $ ip link add veth0 type veth peer name veth1 $ ip link set veth0 up $ ip link set veth1 up $ ip link add link veth0 name veth0.1 type vlan protocol 802.1Q id 1 $ ip link add team0 type team $ ip link set veth0.1 down $ ip link set veth0.1 master team0 team0: Port device veth0.1 added $ ip link set veth0 down $ ip link set veth0 master team0 ============================================ WARNING: possible recursive locking detected 6.13.0-rc2-virtme-00441-ga14a429069bb #46 Not tainted -------------------------------------------- ip/7684 is trying to acquire lock: ffff888016848e00 (team->team_lock_key){+.+.}-{4:4}, at: team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) but task is already holding lock: ffff888016848e00 (team->team_lock_key){+.+.}-{4:4}, at: team_add_slave (drivers/net/team/team_core.c:1147 drivers/net/team/team_core.c:1977) other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(team->team_lock_key); lock(team->team_lock_key);
*** DEADLOCK *** May be due to missing lock nesting notation 2 locks held by ip/7684: stack backtrace:
CPU: 3 UID: 0 PID: 7684 Comm: ip Not tainted 6.13.0-rc2-virtme-00441-ga14a429069bb #46 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK>
dump_stack_lvl (lib/dump_stack.c:122) print_deadlock_bug.cold (kernel/locking/lockdep.c:3040)
__lock_acquire (kernel/locking/lockdep.c:3893 kernel/locking/lockdep.c:5226) ? netlink_broadcast_filtered (net/netlink/af_netlink.c:1548) lock_acquire.part.0 (kernel/locking/lockdep.c:467 kernel/locking/lockdep.c:5851) ? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 2)) ? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) ? lock_acquire (kernel/locking/lockdep.c:5822) ? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) __mutex_lock (kernel/locking/mutex.c:587 kernel/locking/mutex.c:735) ? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) ? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) ? fib_sync_up (net/ipv4/fib_semantics.c:2167) ? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) notifier_call_chain (kernel/notifier.c:85) call_netdevice_notifiers_info (net/core/dev.c:1996) __dev_notify_flags (net/core/dev.c:8993) ?
__dev_change_flags (net/core/dev.c:8975) dev_change_flags (net/core/dev.c:9027) vlan_device_event (net/8021q/vlan.c:85 net/8021q/vlan.c:470) ? br_device_event (net/bridge/br.c:143) notifier_call_chain (kernel/notifier.c:85) call_netdevice_notifiers_info (net/core/dev.c:1996) dev_open (net/core/dev.c:1519 net/core/dev.c:1505) team_add_slave (drivers/net/team/team_core.c:1219 drivers/net/team/team_core.c:1977) ? __pfx_team_add_slave (drivers/net/team/team_core.c:1972) do_set_master (net/core/rtnetlink.c:2917) do_setlink.isra.0 (net/core/rtnetlink.c:3117) (CVE-2024-58071)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-58071
https://ubuntu.com/security/CVE-2024-58071

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-58071

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
232269 - Linux Distros Unpatched Vulnerability : CVE-2024-58074
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/i915: Grab intel_display from the encoder to avoid potential oopsies Grab the intel_display from 'encoder' rather than 'state' in the encoder hooks to avoid the massive footgun that is intel_sanitize_encoder(), which passes NULL as the 'state' argument to encoder .disable() and .post_disable(). TODO: figure out how to actually fix intel_sanitize_encoder()... (CVE-2024-58074)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-58074
https://security-tracker.debian.org/tracker/CVE-2024-58074
https://ubuntu.com/security/CVE-2024-58074

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-58074

Plugin Information
Published: 2025/03/06, Modified: 2025/11/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
232245 - Linux Distros Unpatched Vulnerability : CVE-2024-58078
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors misc_minor_alloc was allocating id using ida for minor only in case of MISC_DYNAMIC_MINOR but misc_minor_free was always freeing ids using ida_free causing a mismatch and following warn: > > WARNING: CPU: 0 PID: 159 at lib/idr.c:525 ida_free+0x3e0/0x41f > > ida_free called for id=127 which is not allocated. > > <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< ... > > [<60941eb4>] ida_free+0x3e0/0x41f > > [<605ac993>] misc_minor_free+0x3e/0xbc > > [<605acb82>] misc_deregister+0x171/0x1b3 misc_minor_alloc is changed to allocate id from ida for all minors falling in the range of dynamic/ misc dynamic minors (CVE-2024-58078)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-58078
https://ubuntu.com/security/CVE-2024-58078

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-58078

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
232249 - Linux Distros Unpatched Vulnerability : CVE-2024-58079
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix crash during unbind if gpio unit is in use We used the wrong device for the device managed functions. We used the usb device, when we should be using the interface device. If we unbind the driver from the usb interface, the cleanup functions are never called. In our case, the IRQ is never disabled. If an IRQ is triggered, it will try to access memory sections that are already free, causing an OOPS. We cannot use the function devm_request_threaded_irq here. The devm_* clean functions may be called after the main structure is released by uvc_delete. Luckily this bug has small impact, as it is only affected by devices with gpio units and the user has to unbind the device, a disconnect will not trigger this error. (CVE-2024-58079)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-58079
https://ubuntu.com/security/CVE-2024-58079

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-58079

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
232241 - Linux Distros Unpatched Vulnerability : CVE-2024-58084
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: Fix missing read barrier in qcom_scm_get_tzmem_pool() Commit 2e4955167ec5 (firmware: qcom: scm: Fix __scm and waitq completion variable initialization) introduced a write barrier in probe function to store global '__scm'
variable. We all known barriers are paired (see memory-barriers.txt: Note that write barriers should normally be paired with read or address-dependency barriers), therefore accessing it from concurrent contexts requires read barrier. Previous commit added such barrier in qcom_scm_is_available(), so let's use that directly. Lack of this read barrier can result in fetching stale '__scm' variable value, NULL, and dereferencing it. Note that barrier in qcom_scm_is_available() satisfies here the control dependency.
(CVE-2024-58084)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-58084
https://ubuntu.com/security/CVE-2024-58084

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-58084

Plugin Information
Published: 2025/03/06, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249065 - Linux Distros Unpatched Vulnerability : CVE-2024-58090
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sched/core: Prevent rescheduling when interrupts are disabled David reported a warning observed while loop testing kexec jump: Interrupts enabled after irqrouter_resume+0x0/0x50 WARNING: CPU: 0 PID: 560 at drivers/base/syscore.c:103 syscore_resume+0x18a/0x220 kernel_kexec+0xf6/0x180 __do_sys_reboot+0x206/0x250 do_syscall_64+0x95/0x180 The corresponding interrupt flag trace: hardirqs last enabled at (15573):
[<ffffffffa8281b8e>] __up_console_sem+0x7e/0x90 hardirqs last disabled at (15580): [<ffffffffa8281b73>]
__up_console_sem+0x63/0x90 That means __up_console_sem() was invoked with interrupts enabled. Further instrumentation revealed that in the interrupt disabled section of kexec jump one of the syscore_suspend() callbacks woke up a task, which set the NEED_RESCHED flag. A later callback in the resume path invoked cond_resched() which in turn led to the invocation of the scheduler: __cond_resched+0x21/0x60 down_timeout+0x18/0x60 acpi_os_wait_semaphore+0x4c/0x80 acpi_ut_acquire_mutex+0x3d/0x100 acpi_ns_get_node+0x27/0x60 acpi_ns_evaluate+0x1cb/0x2d0 acpi_rs_set_srs_method_data+0x156/0x190 acpi_pci_link_set+0x11c/0x290 irqrouter_resume+0x54/0x60 syscore_resume+0x6a/0x200 kernel_kexec+0x145/0x1c0 __do_sys_reboot+0xeb/0x240 do_syscall_64+0x95/0x180 This is a long standing problem, which probably got more visible with the recent printk changes. Something does a task wakeup and the scheduler sets the NEED_RESCHED flag. cond_resched() sees it set and invokes schedule() from a completely bogus context. The scheduler enables interrupts after context switching, which causes the above warning at the end. Quite some of the code paths in syscore_suspend()/resume() can result in triggering a wakeup with the exactly same consequences. They might not have done so yet, but as they share a lot of code with normal operations it's just a question of time. The problem only affects the PREEMPT_NONE and PREEMPT_VOLUNTARY scheduling models. Full preemption is not affected as cond_resched() is disabled and the preemption check preemptible() takes the interrupt disabled flag into account. Cure the problem by adding a corresponding check into cond_resched(). (CVE-2024-58090)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-58090
https://ubuntu.com/security/CVE-2024-58090

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-58090

Plugin Information
Published: 2025/08/12, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243704 - Linux Distros Unpatched Vulnerability : CVE-2024-58092
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: nfsd: fix legacy client tracking initialization Get rid of the nfsd4_legacy_tracking_ops->init() call in check_for_legacy_methods(). That will be handled in the caller (nfsd4_client_tracking_init()). Otherwise, we'll wind up calling nfsd4_legacy_tracking_ops->init() twice, and the second time we'll trigger the BUG_ON() in nfsd4_init_recdir(). (CVE-2024-58092)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-58092
https://ubuntu.com/security/CVE-2024-58092

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-58092

Plugin Information
Published: 2025/08/05, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248428 - Linux Distros Unpatched Vulnerability : CVE-2024-58096
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode ath11k_hal_srng_* should be used with srng->lock to protect srng data. For ath11k_dp_rx_mon_dest_process() and ath11k_dp_full_mon_process_rx(), they use ath11k_hal_srng_* for many times but never call srng->lock. So when running (full) monitor mode, warning will occur: RIP: 0010:ath11k_hal_srng_dst_peek+0x18/0x30 [ath11k] Call Trace: ? ath11k_hal_srng_dst_peek+0x18/0x30 [ath11k] ath11k_dp_rx_process_mon_status+0xc45/0x1190 [ath11k] ? idr_alloc_u32+0x97/0xd0 ath11k_dp_rx_process_mon_rings+0x32a/0x550 [ath11k] ath11k_dp_service_srng+0x289/0x5a0 [ath11k] ath11k_pcic_ext_grp_napi_poll+0x30/0xd0 [ath11k]
__napi_poll+0x30/0x1f0 net_rx_action+0x198/0x320 __do_softirq+0xdd/0x319 So add srng->lock for them to avoid such warnings. Inorder to fetch the srng->lock, should change srng's definition from 'void' to 'struct hal_srng'. And initialize them elsewhere to prevent one line of code from being too long. This is consistent with other ring process functions, such as ath11k_dp_process_rx(). Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30 Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 (CVE-2024-58096)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-58096
https://security-tracker.debian.org/tracker/CVE-2024-58096
https://ubuntu.com/security/CVE-2024-58096

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-58096

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250042 - Linux Distros Unpatched Vulnerability : CVE-2024-58097
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath11k: fix RCU stall while reaping monitor destination ring While processing the monitor destination ring, MSDUs are reaped from the link descriptor based on the corresponding buf_id. However, sometimes the driver cannot obtain a valid buffer corresponding to the buf_id received from the hardware.
This causes an infinite loop in the destination processing, resulting in a kernel crash. kernel log:
ath11k_pci 0000:58:00.0: data msdu_pop: invalid buf_id 309 ath11k_pci 0000:58:00.0: data dp_rx_monitor_link_desc_return failed ath11k_pci 0000:58:00.0: data msdu_pop: invalid buf_id 309 ath11k_pci 0000:58:00.0: data dp_rx_monitor_link_desc_return failed Fix this by skipping the problematic buf_id and reaping the next entry, replacing the break with the next MSDU processing. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30 Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 (CVE-2024-58097)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-58097
https://security-tracker.debian.org/tracker/CVE-2024-58097
https://ubuntu.com/security/CVE-2024-58097

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-58097

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245916 - Linux Distros Unpatched Vulnerability : CVE-2024-58098
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: track changes_pkt_data property for global functions When processing calls to certain helpers, verifier invalidates all packet pointers in a current state. For example, consider the following program:
__attribute__((__noinline__)) long skb_pull_data(struct __sk_buff *sk, __u32 len) { return bpf_skb_pull_data(sk, len); } SEC(tc) int test_invalidate_checks(struct __sk_buff *sk) { int *p = (void
*)(long)sk->data; if ((void *)(p + 1) > (void *)(long)sk->data_end) return TCX_DROP; skb_pull_data(sk, 0);
*p = 42; return TCX_PASS; } After a call to bpf_skb_pull_data() the pointer 'p' can't be used safely. See function filter.c:bpf_helper_changes_pkt_data() for a list of such helpers. At the moment verifier invalidates packet pointers when processing helper function calls, and does not traverse global sub- programs when processing calls to global sub-programs. This means that calls to helpers done from global sub-programs do not invalidate pointers in the caller state. E.g. the program above is unsafe, but is not rejected by verifier. This commit fixes the omission by computing field bpf_subprog_info->changes_pkt_data for each sub-program before main verification pass. changes_pkt_data should be set if: - subprogram calls helper for which bpf_helper_changes_pkt_data returns true; - subprogram calls a global function, for which bpf_subprog_info->changes_pkt_data should be set. The verifier.c:check_cfg() pass is modified to compute this information. The commit relies on depth first instruction traversal done by check_cfg() and absence of recursive function calls: - check_cfg() would eventually visit every call to subprogram S in a state when S is fully explored; - when S is fully explored: - every direct helper call within S is explored (and thus changes_pkt_data is set if needed); - every call to subprogram S1 called by S was visited with S1 fully explored (and thus S inherits changes_pkt_data from S1). The downside of such approach is that dead code elimination is not taken into account: if a helper call inside global function is dead because of current configuration, verifier would conservatively assume that the call occurs for the purpose of the changes_pkt_data computation. (CVE-2024-58098)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-58098
https://security-tracker.debian.org/tracker/CVE-2024-58098
https://ubuntu.com/security/CVE-2024-58098

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-58098

Plugin Information
Published: 2025/08/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248179 - Linux Distros Unpatched Vulnerability : CVE-2024-58100
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: check changes_pkt_data property for extension programs When processing calls to global sub-programs, verifier decides whether to invalidate all packet pointers in current state depending on the changes_pkt_data property of the global sub-program. Because of this, an extension program replacing a global sub-program must be compatible with changes_pkt_data property of the sub-program being replaced.
This commit: - adds changes_pkt_data flag to struct bpf_prog_aux: - this flag is set in check_cfg() for main sub-program; - in jit_subprogs() for other sub-programs; - modifies bpf_check_attach_btf_id() to check changes_pkt_data flag; - moves call to check_attach_btf_id() after the call to check_cfg(), because it needs changes_pkt_data flag to be set: bpf_check: ... ... - check_attach_btf_id resolve_pseudo_ldimm64 resolve_pseudo_ldimm64 --> bpf_prog_is_offloaded bpf_prog_is_offloaded check_cfg check_cfg + check_attach_btf_id ... ... The following fields are set by check_attach_btf_id(): - env->ops - prog->aux->attach_btf_trace - prog->aux->attach_func_name - prog->aux->attach_func_proto - prog->aux->dst_trampoline - prog->aux->mod - prog->aux->saved_dst_attach_type - prog->aux->saved_dst_prog_type - prog->expected_attach_type Neither of these fields are used by resolve_pseudo_ldimm64() or bpf_prog_offload_verifier_prep() (for netronome and netdevsim drivers), so the reordering is safe. (CVE-2024-58100)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-58100
https://security-tracker.debian.org/tracker/CVE-2024-58100
https://ubuntu.com/security/CVE-2024-58100

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-58100

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247123 - Linux Distros Unpatched Vulnerability : CVE-2024-58237
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: consider that tail calls invalidate packet pointers Tail-called programs could execute any of the helpers that invalidate packet pointers. Hence, conservatively assume that each tail call invalidates packet pointers. Making the change in bpf_helper_changes_pkt_data() automatically makes use of check_cfg() logic that computes 'changes_pkt_data' effect for global sub-programs, such that the following program could be rejected: int tail_call(struct __sk_buff *sk) { bpf_tail_call_static(sk, &jmp_table, 0); return 0; } SEC(tc) int not_safe(struct __sk_buff *sk) { int *p = (void *)(long)sk->data; ... make p valid ...
tail_call(sk); *p = 42; /* this is unsafe */ ... } The tc_bpf2bpf.c:subprog_tc() needs change: mark it as a function that can invalidate packet pointers. Otherwise, it can't be freplaced with tailcall_freplace.c:entry_freplace() that does a tail call. (CVE-2024-58237)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-58237
https://security-tracker.debian.org/tracker/CVE-2024-58237
https://ubuntu.com/security/CVE-2024-58237

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-58237

Plugin Information
Published: 2025/08/09, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
256837 - Linux Distros Unpatched Vulnerability : CVE-2024-58238
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test This fixes the tx timeout issue seen while running a stress test on btnxpuart for couple of hours, such that the interval between two HCI commands coincide with the power save timeout value of 2 seconds. Test procedure using bash script: <load btnxpuart.ko> hciconfig hci0 up //Enable Power Save feature hcitool -i hci0 cmd 3f 23 02 00 00 while (true) do hciconfig hci0 leadv sleep 2 hciconfig hci0 noleadv sleep 2 done Error log, after adding few more debug prints: Bluetooth: btnxpuart_queue_skb(): 01 0A 20 01 00 Bluetooth: hci0: Set UART break: on, status=0 Bluetooth: hci0: btnxpuart_tx_wakeup() tx_work scheduled Bluetooth: hci0: btnxpuart_tx_work() dequeue: 01 0A 20 01 00 Can't set advertise mode on hci0: Connection timed out (110) Bluetooth: hci0:
command 0x200a tx timeout When the power save mechanism turns on UART break, and btnxpuart_tx_work() is scheduled simultaneously, psdata->ps_state is read as PS_STATE_AWAKE, which prevents the psdata->work from being scheduled, which is responsible to turn OFF UART break. This issue is fixed by adding a ps_lock mutex around UART break on/off as well as around ps_state read/write. btnxpuart_tx_wakeup() will now read updated ps_state value. If ps_state is PS_STATE_SLEEP, it will first schedule psdata->work, and then it will reschedule itself once UART break has been turned off and ps_state is PS_STATE_AWAKE. Tested above script for 50,000 iterations and TX timeout error was not observed anymore. (CVE-2024-58238)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-58238
https://ubuntu.com/security/CVE-2024-58238

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.7 (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
3.3 (CVSS2#AV:A/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
2.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-58238

Plugin Information
Published: 2025/08/27, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
266040 - Linux Distros Unpatched Vulnerability : CVE-2024-58241
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: hci_core: Disable works on hci_unregister_dev This make use of disable_work_* on hci_unregister_dev since the hci_dev is about to be freed new submissions are not disarable.
(CVE-2024-58241)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-58241
https://security-tracker.debian.org/tracker/CVE-2024-58241
https://ubuntu.com/security/CVE-2024-58241

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-58241

Plugin Information
Published: 2025/09/29, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231067 - Linux Distros Unpatched Vulnerability : CVE-2024-6485
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin.
This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered. (CVE-2024-6485)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-6485

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.4 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.7
EPSS Score
0.002
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-6485

Plugin Information
Published: 2025/03/06, Modified: 2025/11/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
231559 - Linux Distros Unpatched Vulnerability : CVE-2024-6505
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host. (CVE-2024-6505)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-6505
https://security-tracker.debian.org/tracker/CVE-2024-6505

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
6.8 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0017
CVSS v2.0 Base Score
3.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
2.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-6505

Plugin Information
Published: 2025/03/06, Modified: 2025/09/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- qemu-guest-agent
230387 - Linux Distros Unpatched Vulnerability : CVE-2024-7264
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the
*time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used. (CVE-2024-7264)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-7264

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0101
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-7264

Plugin Information
Published: 2025/03/06, Modified: 2025/09/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- curl
- libcurl
231341 - Linux Distros Unpatched Vulnerability : CVE-2024-7531
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor. In Firefox this only affects the QUIC header protection feature when the connection is using the ChaCha20-Poly1305 cipher suite. The most likely outcome is connection failure, but if the connection persists despite the high packet loss it could be possible for a network observer to identify packets as coming from the same source despite a network path change. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, and Firefox ESR < 128.1. (CVE-2024-7531)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-7531
https://security-tracker.debian.org/tracker/CVE-2024-7531
https://ubuntu.com/security/CVE-2024-7531

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0012
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-7531

Plugin Information
Published: 2025/03/06, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- nspr
- nss
- nss-softokn
- nss-softokn-freebl
- nss-sysinit
- nss-tools
- nss-util
232140 - Linux Distros Unpatched Vulnerability : CVE-2024-8354
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c when trying to get the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and cause a denial of service condition. (CVE-2024-8354)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-8354
https://security-tracker.debian.org/tracker/CVE-2024-8354
https://ubuntu.com/security/CVE-2024-8354

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0009
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-8354

Plugin Information
Published: 2025/03/06, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- qemu-guest-agent
231619 - Linux Distros Unpatched Vulnerability : CVE-2024-9143
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a possibility of a remote code execution, however, in all the protocols involving Elliptic Curve Cryptography that we're aware of, either only named curves are supported, or, if explicit curve parameters are supported, they specify an X9.62 encoding of binary (GF(2^m)) curves that can't represent problematic input values. Thus the likelihood of existence of a vulnerable application is low. In particular, the X9.62 encoding is used for ECC keys in X.509 certificates, so problematic inputs cannot occur in the context of processing X.509 certificates. Any problematic use-cases would have to be using an exotic curve encoding. The affected APIs include:
EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(), and various supporting BN_GF2m_*() functions.
Applications working with exotic explicit binary (GF(2^m)) curve parameters, that make it possible to represent invalid field polynomials with a zero constant term, via the above or similar APIs, may terminate abruptly as a result of reading or writing outside of array bounds. Remote code execution cannot easily be ruled out. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
(CVE-2024-9143)
- Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. (CVE-2024-9143)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-9143
https://ubuntu.com/security/CVE-2024-9143

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
8.2 (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
4.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.0036
CVSS v2.0 Base Score
5.4 (CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-9143

Plugin Information
Published: 2025/03/06, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- shim-x64
231628 - Linux Distros Unpatched Vulnerability : CVE-2024-9355
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack. (CVE-2024-9355)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-9355

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.3
EPSS Score
0.0005
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-9355

Plugin Information
Published: 2025/03/06, Modified: 2025/11/24
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- containernetworking-plugins
- podman
231013 - Linux Distros Unpatched Vulnerability : CVE-2024-9397
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131. (CVE-2024-9397)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-9397
https://ubuntu.com/security/CVE-2024-9397

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
5.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.8
EPSS Score
0.0009
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-9397

Plugin Information
Published: 2025/03/06, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
231850 - Linux Distros Unpatched Vulnerability : CVE-2024-9398
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implements that protocol handler is installed. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131. (CVE-2024-9398)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-9398
https://ubuntu.com/security/CVE-2024-9398

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.0044
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-9398

Plugin Information
Published: 2025/03/06, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
230335 - Linux Distros Unpatched Vulnerability : CVE-2024-9681
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is a subdomain of the second host. (The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS accesses done as the cache needs to have entries for the domains involved to trigger this problem.) When `x.example.com` responds with `Strict-Transport-Security:` headers, this bug can make the subdomain's expiry timeout *bleed over* and get set for the parent domain `example.com` in curl's HSTS cache. The result of a triggered bug is that HTTP accesses to `example.com` get converted to HTTPS for a different period of time than what was asked for by the origin server. If `example.com` for example stops supporting HTTPS at its expiry time, curl might then fail to access `http://example.com` until the (wrongly set) timeout expires. This bug can also expire the parent's entry *earlier*, thus making curl inadvertently switch back to insecure HTTP earlier than otherwise intended. (CVE-2024-9681)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-9681
https://security-tracker.debian.org/tracker/CVE-2024-9681

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
5.0
EPSS Score
0.0012
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-9681

Plugin Information
Published: 2025/03/06, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- curl
- libcurl
231038 - Linux Distros Unpatched Vulnerability : CVE-2025-0237
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird < 128.6. (CVE-2025-0237)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-0237
https://ubuntu.com/security/CVE-2025-0237

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.3
EPSS Score
0.0005
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-0237

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
230667 - Linux Distros Unpatched Vulnerability : CVE-2025-0238
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Firefox ESR < 115.19, Thunderbird < 134, and Thunderbird < 128.6. (CVE-2025-0238)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-0238
https://ubuntu.com/security/CVE-2025-0238

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.001
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-0238

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
230860 - Linux Distros Unpatched Vulnerability : CVE-2025-0239
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird < 128.6. (CVE-2025-0239)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-0239
https://ubuntu.com/security/CVE-2025-0239

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.0 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
3.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.0001
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-0239

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
231278 - Linux Distros Unpatched Vulnerability : CVE-2025-0240
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird < 128.6. (CVE-2025-0240)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-0240
https://ubuntu.com/security/CVE-2025-0240

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.0 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
3.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-0240

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
230476 - Linux Distros Unpatched Vulnerability : CVE-2025-0242
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Firefox ESR < 115.19, Thunderbird < 134, and Thunderbird < 128.6. (CVE-2025-0242)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-0242
https://ubuntu.com/security/CVE-2025-0242

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.3
EPSS Score
0.001
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-0242

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
230798 - Linux Distros Unpatched Vulnerability : CVE-2025-0243
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 134, Firefox ESR <
128.6, Thunderbird < 134, and Thunderbird < 128.6. (CVE-2025-0243)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-0243
https://ubuntu.com/security/CVE-2025-0243

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.1 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
4.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.3
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-0243

Plugin Information
Published: 2025/03/06, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
260221 - Linux Distros Unpatched Vulnerability : CVE-2025-0620
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re- authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again. (CVE-2025-0620)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-0620

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-0620

Plugin Information
Published: 2025/09/01, Modified: 2025/09/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libsmbclient
- libwbclient
- samba-client
- samba-client-libs
- samba-common
- samba-common-libs
244882 - Linux Distros Unpatched Vulnerability : CVE-2025-0716
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing and also negatively affect the application's performance and behavior by using too large or slow-to-load images. This issue affects all versions of AngularJS. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
(CVE-2025-0716)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-0716
https://security-tracker.debian.org/tracker/CVE-2025-0716
https://ubuntu.com/security/CVE-2025-0716

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)
CVSS v3.0 Temporal Score
4.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.5
EPSS Score
0.0002
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-0716

Plugin Information
Published: 2025/08/07, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
- gjs
- polkit
- polkit-libs
275743 - Linux Distros Unpatched Vulnerability : CVE-2025-10158
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger the issue. (CVE-2025-10158)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-10158
https://security-tracker.debian.org/tracker/CVE-2025-10158
https://ubuntu.com/security/CVE-2025-10158

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
4.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-10158

Plugin Information
Published: 2025/11/18, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- rsync
230322 - Linux Distros Unpatched Vulnerability : CVE-2025-1019
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The z-order of the browser windows could be manipulated to hide the fullscreen notification. This could potentially be leveraged to perform a spoofing attack. This vulnerability affects Firefox < 135 and Thunderbird < 135. (CVE-2025-1019)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-1019
https://ubuntu.com/security/CVE-2025-1019

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
4.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.0005
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-1019

Plugin Information
Published: 2025/03/06, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
266126 - Linux Distros Unpatched Vulnerability : CVE-2025-10911
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash. (CVE-2025-10911)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-10911
https://security-tracker.debian.org/tracker/CVE-2025-10911
https://ubuntu.com/security/CVE-2025-10911

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-10911

Plugin Information
Published: 2025/09/29, Modified: 2025/10/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libxslt
266089 - Linux Distros Unpatched Vulnerability : CVE-2025-11081
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was detected in GNU Binutils 2.45. This issue affects the function dump_dwarf_section of the file binutils/objdump.c. Performing manipulation results in out-of-bounds read. The attack is only possible with local access. The exploit is now public and may be used. The patch is named f87a66db645caf8cc0e6fc87b0c28c78a38af59b. It is suggested to install a patch to address this issue.
(CVE-2025-11081)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-11081
https://security-tracker.debian.org/tracker/CVE-2025-11081

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
3.3 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
3.0 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-11081

Plugin Information
Published: 2025/09/29, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-13-binutils
- gcc-toolset-13-binutils-devel
- gcc-toolset-13-binutils-gold
- gcc-toolset-13-gdb
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
230447 - Linux Distros Unpatched Vulnerability : CVE-2025-1118
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read any memory information, and an attacker may leverage this in order to extract signatures, salts, and other sensitive information from the memory. (CVE-2025-1118)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-1118
https://security-tracker.debian.org/tracker/CVE-2025-1118
https://ubuntu.com/security/CVE-2025-1118

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
4.4 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
4.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-1118

Plugin Information
Published: 2025/03/06, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- grub2-common
- grub2-efi-x64
- grub2-tools
- grub2-tools-minimal
271572 - Linux Distros Unpatched Vulnerability : CVE-2025-11411
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks.
Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick resolvers to update their delegation information for the zone. Usually these RRSets are used to update the resolver's knowledge of the zone's name servers. A malicious actor can exploit the possible poisonous effect by injecting NS RRSets (and possibly their respective address records) in a reply. This could be done for example by trying to spoof a packet or fragmentation attacks. Unbound would then proceed to update the NS RRSet data it already has since the new data has enough trust for it, i.e., in-zone data for the delegation point. Unbound 1.24.1 includes a fix that scrubs unsolicited NS RRSets (and their respective address records) from replies mitigating the possible poison effect. Unbound 1.24.2 includes an additional fix that scrubs unsolicited NS RRSets (and their respective address records) from YXDOMAIN and non-referral nodata replies, further mitigating the possible poison effect. (CVE-2025-11411)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-11411
https://security-tracker.debian.org/tracker/CVE-2025-11411
https://ubuntu.com/security/CVE-2025-11411

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
7.1 (CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H)
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0001
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-11411

Plugin Information
Published: 2025/10/27, Modified: 2025/12/08
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- unbound-libs
271156 - Linux Distros Unpatched Vulnerability : CVE-2025-11412
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Linker. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
The identifier of the patch is 047435dd988a3975d40c6626a8f739a0b2e154bc. To fix this issue, it is recommended to deploy a patch. (CVE-2025-11412)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-11412
https://security-tracker.debian.org/tracker/CVE-2025-11412

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
3.3 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
3.0 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-11412

Plugin Information
Published: 2025/10/22, Modified: 2025/12/12
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-13-binutils
- gcc-toolset-13-binutils-devel
- gcc-toolset-13-binutils-gold
- gcc-toolset-13-gdb
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
271158 - Linux Distros Unpatched Vulnerability : CVE-2025-11413
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was found in GNU Binutils 2.45. Affected is the function elf_link_add_object_symbols of the file bfd/elflink.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 2.46 is able to address this issue. The patch is identified as 72efdf166aa0ed72ecc69fc2349af6591a7a19c0.
Upgrading the affected component is advised. (CVE-2025-11413)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-11413
https://security-tracker.debian.org/tracker/CVE-2025-11413

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-11413

Plugin Information
Published: 2025/10/22, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-13-binutils
- gcc-toolset-13-binutils-devel
- gcc-toolset-13-binutils-gold
- gcc-toolset-13-gdb
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
271159 - Linux Distros Unpatched Vulnerability : CVE-2025-11414
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was determined in GNU Binutils 2.45. Affected by this vulnerability is the function get_link_hash_entry of the file bfd/elflink.c of the component Linker. This manipulation causes out-of- bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.46 addresses this issue. Patch name:
aeaaa9af6359c8e394ce9cf24911fec4f4d23703. It is advisable to upgrade the affected component.
(CVE-2025-11414)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-11414
https://security-tracker.debian.org/tracker/CVE-2025-11414

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-11414

Plugin Information
Published: 2025/10/22, Modified: 2025/12/12
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-13-binutils
- gcc-toolset-13-binutils-devel
- gcc-toolset-13-binutils-gold
- gcc-toolset-13-gdb
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
270211 - Linux Distros Unpatched Vulnerability : CVE-2025-11494
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was found in GNU Binutils 2.45. Impacted is the function _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is identified as b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a. A patch should be applied to remediate this issue.
(CVE-2025-11494)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-11494
https://security-tracker.debian.org/tracker/CVE-2025-11494

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-11494

Plugin Information
Published: 2025/10/13, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-13-binutils
- gcc-toolset-13-binutils-devel
- gcc-toolset-13-binutils-gold
- gcc-toolset-13-gdb
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
275840 - Linux Distros Unpatched Vulnerability : CVE-2025-11495
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was determined in GNU Binutils 2.45. The affected element is the function elf_x86_64_relocate_section of the file elf64-x86-64.c of the component Linker. This manipulation causes heap-based buffer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0. To fix this issue, it is recommended to deploy a patch. (CVE-2025-11495)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-11495
https://security-tracker.debian.org/tracker/CVE-2025-11495
https://ubuntu.com/security/CVE-2025-11495

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
4.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-11495

Plugin Information
Published: 2025/11/20, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-13-binutils
- gcc-toolset-13-binutils-devel
- gcc-toolset-13-binutils-gold
- gcc-toolset-13-gdb
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
232123 - Linux Distros Unpatched Vulnerability : CVE-2025-1153
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44. Affected by this vulnerability is the function bfd_set_format of the file format.c. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 2.45 is able to address this issue. The identifier of the patch is 8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150. It is recommended to upgrade the affected component. (CVE-2025-1153)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-1153
https://security-tracker.debian.org/tracker/CVE-2025-1153

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.6 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0013
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-1153

Plugin Information
Published: 2025/03/06, Modified: 2025/12/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-13-binutils
- gcc-toolset-13-binutils-devel
- gcc-toolset-13-binutils-gold
- gcc-toolset-13-gdb
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
271687 - Linux Distros Unpatched Vulnerability : CVE-2025-11568
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. An attacker with the necessary permissions can exploit this flaw by writing a large amount of metadata to an encrypted device. The utility fails to correctly validate the available space, causing the metadata to overwrite and corrupt the user's encrypted data. This action leads to a permanent loss of the stored information. Devices using the LUKS formats other than LUKS1 are not affected by this issue. (CVE-2025-11568)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-11568
https://security-tracker.debian.org/tracker/CVE-2025-11568
https://ubuntu.com/security/CVE-2025-11568

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
4.4 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
4.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
3.8 (CVSS2#AV:L/AC:H/Au:S/C:N/I:C/A:N)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-11568

Plugin Information
Published: 2025/10/27, Modified: 2025/12/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libluksmeta
- luksmeta
271685 - Linux Distros Unpatched Vulnerability : CVE-2025-11839
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A security flaw has been discovered in GNU Binutils 2.45. Impacted is the function tg_tag_type of the file prdbg.c. Performing manipulation results in unchecked return value. The attack needs to be approached locally. The exploit has been released to the public and may be exploited. (CVE-2025-11839)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-11839
https://security-tracker.debian.org/tracker/CVE-2025-11839

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-11839

Plugin Information
Published: 2025/10/27, Modified: 2025/12/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-13-binutils
- gcc-toolset-13-binutils-devel
- gcc-toolset-13-binutils-gold
- gcc-toolset-13-gdb
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
271686 - Linux Distros Unpatched Vulnerability : CVE-2025-11840
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing manipulation can lead to out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be exploited. This patch is called 16357. It is best practice to apply a patch to resolve this issue. (CVE-2025-11840)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-11840
https://security-tracker.debian.org/tracker/CVE-2025-11840

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-11840

Plugin Information
Published: 2025/10/27, Modified: 2025/12/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-13-binutils
- gcc-toolset-13-binutils-devel
- gcc-toolset-13-binutils-gold
- gcc-toolset-13-gdb
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
272131 - Linux Distros Unpatched Vulnerability : CVE-2025-12464
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.
(CVE-2025-12464)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-12464
https://security-tracker.debian.org/tracker/CVE-2025-12464
https://ubuntu.com/security/CVE-2025-12464

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
6.0 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-12464

Plugin Information
Published: 2025/10/31, Modified: 2025/11/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- qemu-guest-agent
255369 - Linux Distros Unpatched Vulnerability : CVE-2025-1376
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue. (CVE-2025-1376)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-1376
https://security-tracker.debian.org/tracker/CVE-2025-1376
https://ubuntu.com/security/CVE-2025-1376

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v4.0 Base Score
2.0 (CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.7 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-1376

Plugin Information
Published: 2025/08/26, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- elfutils
- elfutils-default-yama-scope
- elfutils-devel
- elfutils-libelf
- elfutils-libelf-devel
- elfutils-libs
277038 - Linux Distros Unpatched Vulnerability : CVE-2025-13837
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues (CVE-2025-13837)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-13837
https://security-tracker.debian.org/tracker/CVE-2025-13837
https://ubuntu.com/security/CVE-2025-13837

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
2.1 (CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N)
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-13837

Plugin Information
Published: 2025/12/02, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
- python-unversioned-command
- python3
- python3-libs
231134 - Linux Distros Unpatched Vulnerability : CVE-2025-1414
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Memory safety bugs present in Firefox 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 135.0.1. (CVE-2025-1414)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-1414
https://ubuntu.com/security/CVE-2025-1414

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.3
EPSS Score
0.0007
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-1414

Plugin Information
Published: 2025/03/06, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
278352 - Linux Distros Unpatched Vulnerability : CVE-2025-14512
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values. (CVE-2025-14512)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-14512
https://security-tracker.debian.org/tracker/CVE-2025-14512
https://ubuntu.com/security/CVE-2025-14512

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-14512

Plugin Information
Published: 2025/12/11, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- glib2
- glib2-devel
278353 - Linux Distros Unpatched Vulnerability : CVE-2025-14523
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw in libsoup's HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend interprets it as destined for another host. This discrepancy enables request-smuggling style attacks, cache poisoning, or bypassing host-based access controls when an attacker supplies duplicate Host headers.
(CVE-2025-14523)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-14523
https://security-tracker.debian.org/tracker/CVE-2025-14523
https://ubuntu.com/security/CVE-2025-14523

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
5.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.4
EPSS Score
0.0003
CVSS v2.0 Base Score
8.5 (CVSS2#AV:N/AC:L/Au:N/C:C/I:P/A:N)
CVSS v2.0 Temporal Score
7.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-14523

Plugin Information
Published: 2025/12/11, Modified: 2025/12/12
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libsoup
255615 - Linux Distros Unpatched Vulnerability : CVE-2025-1632
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. (CVE-2025-1632)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-1632
https://security-tracker.debian.org/tracker/CVE-2025-1632

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.5 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-1632

Plugin Information
Published: 2025/08/26, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libarchive
245488 - Linux Distros Unpatched Vulnerability : CVE-2025-1647
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS).This issue affects Bootstrap: from 3.4.1 before 4.0.0.
(CVE-2025-1647)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-1647
https://security-tracker.debian.org/tracker/CVE-2025-1647
https://ubuntu.com/security/CVE-2025-1647

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.6 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.4
EPSS Score
0.0004
CVSS v2.0 Base Score
3.5 (CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
3.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-1647

Plugin Information
Published: 2025/08/07, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- aspnetcore-runtime-9.0
- aspnetcore-targeting-pack-9.0
- dotnet-apphost-pack-9.0
- dotnet-host
- dotnet-hostfxr-9.0
- dotnet-runtime-9.0
- dotnet-sdk-9.0
- dotnet-targeting-pack-9.0
- netstandard-targeting-pack-2.1
232012 - Linux Distros Unpatched Vulnerability : CVE-2025-1795
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers. (CVE-2025-1795)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-1795
https://security-tracker.debian.org/tracker/CVE-2025-1795
https://ubuntu.com/security/CVE-2025-1795

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
2.3 (CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.0008
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-1795

Plugin Information
Published: 2025/03/06, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- python-unversioned-command
- python3
- python3-libs
250820 - Linux Distros Unpatched Vulnerability : CVE-2025-20054
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Uncaught exception in the core management mechanism for some Intel(R) Processors may allow an authenticated user to potentially enable denial of service via local access. (CVE-2025-20054)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-20054
https://ubuntu.com/security/CVE-2025-20054

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-20054

Plugin Information
Published: 2025/08/18, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- microcode_ctl
256664 - Linux Distros Unpatched Vulnerability : CVE-2025-20103
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Insufficient resource pool in the core management mechanism for some Intel(R) Processors may allow an authenticated user to potentially enable denial of service via local access. (CVE-2025-20103)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-20103
https://ubuntu.com/security/CVE-2025-20103

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-20103

Plugin Information
Published: 2025/08/27, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- microcode_ctl
231591 - Linux Distros Unpatched Vulnerability : CVE-2025-21492
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2025-21492)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21492
https://ubuntu.com/security/CVE-2025-21492

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21492

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
230651 - Linux Distros Unpatched Vulnerability : CVE-2025-21502
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM for JDK: 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM Enterprise Edition: 20.3.16 and 21.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. (CVE-2025-21502)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21502
https://ubuntu.com/security/CVE-2025-21502

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
4.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.3
EPSS Score
0.0002
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21502

Plugin Information
Published: 2025/03/06, Modified: 2025/12/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- java-1.8.0-openjdk
- java-1.8.0-openjdk-demo
- java-1.8.0-openjdk-devel
- java-1.8.0-openjdk-headless
- java-1.8.0-openjdk-javadoc
- java-1.8.0-openjdk-javadoc-zip
- java-1.8.0-openjdk-src
- java-11-openjdk
- java-11-openjdk-demo
- java-11-openjdk-devel
- java-11-openjdk-headless
- java-11-openjdk-javadoc
- java-11-openjdk-javadoc-zip
- java-11-openjdk-jmods
- java-11-openjdk-src
- java-11-openjdk-static-libs
230630 - Linux Distros Unpatched Vulnerability : CVE-2025-21632
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Ensure shadow stack is active before getting registers The x86 shadow stack support has its own set of registers. Those registers are XSAVE-managed, but they are supervisor state components which means that userspace can not touch them with XSAVE/XRSTOR. It also means that they are not accessible from the existing ptrace ABI for XSAVE state. Thus, there is a new ptrace get/set interface for it. The regset code that ptrace uses provides an
->active() handler in addition to the get/set ones. For shadow stack this ->active() handler verifies that shadow stack is enabled via the ARCH_SHSTK_SHSTK bit in the thread struct. The ->active() handler is checked from some call sites of the regset get/set handlers, but not the ptrace ones. This was not understood when shadow stack support was put in place. As a result, both the set/get handlers can be called with XFEATURE_CET_USER in its init state, which would cause get_xsave_addr() to return NULL and trigger a WARN_ON(). The ssp_set() handler luckily has an ssp_active() check to avoid surprising the kernel with shadow stack behavior when the kernel is not ready for it (ARCH_SHSTK_SHSTK==0). That check just happened to avoid the warning. But the ->get() side wasn't so lucky. It can be called with shadow stacks disabled, triggering the warning in practice, as reported by Christina Schimpe: WARNING: CPU: 5 PID: 1773 at arch/x86/kernel/fpu/regset.c:198 ssp_get+0x89/0xa0 [...] Call Trace: <TASK> ? show_regs+0x6e/0x80 ? ssp_get+0x89/0xa0 ? __warn+0x91/0x150 ? ssp_get+0x89/0xa0 ? report_bug+0x19d/0x1b0 ? handle_bug+0x46/0x80 ? exc_invalid_op+0x1d/0x80 ? asm_exc_invalid_op+0x1f/0x30 ? __pfx_ssp_get+0x10/0x10 ? ssp_get+0x89/0xa0 ? ssp_get+0x52/0xa0 __regset_get+0xad/0xf0 copy_regset_to_user+0x52/0xc0 ptrace_regset+0x119/0x140 ptrace_request+0x13c/0x850 ? wait_task_inactive+0x142/0x1d0 ? do_syscall_64+0x6d/0x90 arch_ptrace+0x102/0x300 [...] Ensure that shadow stacks are active in a thread before looking them up in the XSAVE buffer. Since ARCH_SHSTK_SHSTK and user_ssp[SHSTK_EN] are set at the same time, the active check ensures that there will be something to find in the XSAVE buffer. [ dhansen:
changelog/subject tweaks ] (CVE-2025-21632)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21632
https://ubuntu.com/security/CVE-2025-21632

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:H/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21632

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230874 - Linux Distros Unpatched Vulnerability : CVE-2025-21634
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cgroup/cpuset: remove kernfs active break A warning was found: WARNING: CPU: 10 PID: 3486953 at fs/kernfs/file.c:828 CPU: 10 PID: 3486953 Comm: rmdir Kdump: loaded Tainted: G RIP:
0010:kernfs_should_drain_open_files+0x1a1/0x1b0 RSP: 0018:ffff8881107ef9e0 EFLAGS: 00010202 RAX:
0000000080000002 RBX: ffff888154738c00 RCX: dffffc0000000000 RDX: 0000000000000007 RSI: 0000000000000004 RDI: ffff888154738c04 RBP: ffff888154738c04 R08: ffffffffaf27fa15 R09: ffffed102a8e7180 R10:
ffff888154738c07 R11: 0000000000000000 R12: ffff888154738c08 R13: ffff888750f8c000 R14: ffff888750f8c0e8 R15: ffff888154738ca0 FS: 00007f84cd0be740(0000) GS:ffff8887ddc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555f9fbe00c8 CR3: 0000000153eec001 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6:
00000000fffe0ff0 DR7: 0000000000000400 Call Trace: kernfs_drain+0x15e/0x2f0 __kernfs_remove+0x165/0x300 kernfs_remove_by_name_ns+0x7b/0xc0 cgroup_rm_file+0x154/0x1c0 cgroup_addrm_files+0x1c2/0x1f0 css_clear_dir+0x77/0x110 kill_css+0x4c/0x1b0 cgroup_destroy_locked+0x194/0x380 cgroup_rmdir+0x2a/0x140 It can be explained by: rmdir echo 1 > cpuset.cpus kernfs_fop_write_iter // active=0 cgroup_rm_file kernfs_remove_by_name_ns kernfs_get_active // active=1 __kernfs_remove // active=0x80000002 kernfs_drain cpuset_write_resmask wait_event //waiting (active == 0x80000001) kernfs_break_active_protection // active = 0x80000001 // continue kernfs_unbreak_active_protection // active = 0x80000002 ...
kernfs_should_drain_open_files // warning occurs kernfs_put_active This warning is caused by 'kernfs_break_active_protection' when it is writing to cpuset.cpus, and the cgroup is removed concurrently. The commit 3a5a6d0c2b03 (cpuset: don't nest cgroup_mutex inside get_online_cpus()) made cpuset_hotplug_workfn asynchronous, This change involves calling flush_work(), which can create a multiple processes circular locking dependency that involve cgroup_mutex, potentially leading to a deadlock. To avoid deadlock. the commit 76bb5ab8f6e3 (cpuset: break kernfs active protection in cpuset_write_resmask()) added 'kernfs_break_active_protection' in the cpuset_write_resmask. This could lead to this warning. After the commit 2125c0034c5d (cgroup/cpuset: Make cpuset hotplug processing synchronous), the cpuset_write_resmask no longer needs to wait the hotplug to finish, which means that concurrent hotplug and cpuset operations are no longer possible. Therefore, the deadlock doesn't exist anymore and it does not have to 'break active protection' now. To fix this warning, just remove kernfs_break_active_protection operation in the 'cpuset_write_resmask'. (CVE-2025-21634)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21634
https://security-tracker.debian.org/tracker/CVE-2025-21634
https://ubuntu.com/security/CVE-2025-21634

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21634

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230875 - Linux Distros Unpatched Vulnerability : CVE-2025-21636
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: plpmtud_probe_interval:
avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns. - current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2). The 'net' structure can be obtained from the table->data using container_of(). Note that table->data could also be used directly, as this is the only member needed from the 'net' structure, but that would increase the size of this fix, to use '*data' everywhere 'net->sctp.probe_interval' is used.
(CVE-2025-21636)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21636
https://ubuntu.com/security/CVE-2025-21636

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21636

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230542 - Linux Distros Unpatched Vulnerability : CVE-2025-21637
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: udp_port: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current'
is not recommended for different reasons: - Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns. - current->nsproxy can be NULL in some cases, resulting in an 'Oops'
(null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2). The 'net'
structure can be obtained from the table->data using container_of(). Note that table->data could also be used directly, but that would increase the size of this fix, while 'sctp.ctl_sock' still needs to be retrieved from 'net' structure. (CVE-2025-21637)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21637
https://ubuntu.com/security/CVE-2025-21637

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21637

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230715 - Linux Distros Unpatched Vulnerability : CVE-2025-21638
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sctp: sysctl: auth_enable: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns. - current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2). The 'net' structure can be obtained from the table->data using container_of().
Note that table->data could also be used directly, but that would increase the size of this fix, while 'sctp.ctl_sock' still needs to be retrieved from 'net' structure. (CVE-2025-21638)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21638
https://ubuntu.com/security/CVE-2025-21638

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21638

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230325 - Linux Distros Unpatched Vulnerability : CVE-2025-21639
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sctp: sysctl: rto_min/max: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns. - current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2). The 'net' structure can be obtained from the table->data using container_of().
Note that table->data could also be used directly, as this is the only member needed from the 'net'
structure, but that would increase the size of this fix, to use '*data' everywhere 'net->sctp.rto_min/max'
is used. (CVE-2025-21639)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21639
https://ubuntu.com/security/CVE-2025-21639

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21639

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230999 - Linux Distros Unpatched Vulnerability : CVE-2025-21640
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inconsistency:
getting info from the reader's/writer's netns vs only from the opener's netns. - current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2). The 'net' structure can be obtained from the table->data using container_of(). Note that table->data could also be used directly, as this is the only member needed from the 'net' structure, but that would increase the size of this fix, to use '*data' everywhere 'net->sctp.sctp_hmac_alg' is used. (CVE-2025-21640)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21640
https://ubuntu.com/security/CVE-2025-21640

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21640

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231147 - Linux Distros Unpatched Vulnerability : CVE-2025-21644
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix tlb invalidation when wedging If GuC fails to load, the driver wedges, but in the process it tries to do stuff that may not be initialized yet. This moves the xe_gt_tlb_invalidation_init() to be done earlier: as its own doc says, it's a software-only initialization and should had been named with the _early() suffix. Move it to be called by xe_gt_init_early(), so the locks and seqno are initialized, avoiding a NULL ptr deref when wedging: xe 0000:03:00.0: [drm] *ERROR* GT0: load failed: status: Reset = 0, BootROM = 0x50, UKernel = 0x00, MIA = 0x00, Auth = 0x01 xe 0000:03:00.0: [drm] *ERROR* GT0: firmware signature verification failed xe 0000:03:00.0: [drm] *ERROR* CRITICAL: Xe has declared device 0000:03:00.0 as wedged. ... BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF:
error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 9 UID: 0 PID: 3908 Comm: modprobe Tainted: G U W 6.13.0-rc4-xe+ #3 Tainted: [U]=USER, [W]=WARN Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-S ADP-S DDR5 UDIMM CRB, BIOS ADLSFWI1.R00.3275.A00.2207010640 07/01/2022 RIP: 0010:xe_gt_tlb_invalidation_reset+0x75/0x110 [xe] This can be easily triggered by poking the GuC binary to force a signature failure. There will still be an extra message, xe 0000:03:00.0: [drm] *ERROR* GT0: GuC mmio request 0x4100: no reply 0x4100 but that's better than a NULL ptr deref. (cherry picked from commit 5001ef3af8f2c972d6fd9c5221a8457556f8bea6) (CVE-2025-21644)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21644
https://ubuntu.com/security/CVE-2025-21644

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-21644

Plugin Information
Published: 2025/03/06, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230381 - Linux Distros Unpatched Vulnerability : CVE-2025-21645
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it Wakeup for IRQ1 should be disabled only in cases where i8042 had actually enabled it, otherwise wake_depth for this IRQ will try to drop below zero and there will be an unpleasant WARN() logged: kernel: atkbd serio0: Disabling IRQ1 wakeup source to avoid platform firmware bug kernel: ------------[ cut here ]------------ kernel:
Unbalanced IRQ 1 wake disable kernel: WARNING: CPU: 10 PID: 6431 at kernel/irq/manage.c:920 irq_set_irq_wake+0x147/0x1a0 The PMC driver uses DEFINE_SIMPLE_DEV_PM_OPS() to define its dev_pm_ops which sets amd_pmc_suspend_handler() to the .suspend, .freeze, and .poweroff handlers. i8042_pm_suspend(), however, is only set as the .suspend handler. Fix the issue by call PMC suspend handler only from the same set of dev_pm_ops handlers as i8042_pm_suspend(), which currently means just the .suspend handler. To reproduce this issue try hibernating (S4) the machine after a fresh boot without putting it into s2idle first. [ij: edited the commit message.] (CVE-2025-21645)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21645
https://ubuntu.com/security/CVE-2025-21645

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21645

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230388 - Linux Distros Unpatched Vulnerability : CVE-2025-21649
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: hns3: fix kernel crash when 1588 is sent on HIP08 devices Currently, HIP08 devices does not register the ptp devices, so the hdev->ptp is NULL. But the tx process would still try to set hardware time stamp info with SKBTX_HW_TSTAMP flag and cause a kernel crash. [ 128.087798] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018 ... [ 128.280251] pc :
hclge_ptp_set_tx_info+0x2c/0x140 [hclge] [ 128.286600] lr : hclge_ptp_set_tx_info+0x20/0x140 [hclge] [ 128.292938] sp : ffff800059b93140 [ 128.297200] x29: ffff800059b93140 x28: 0000000000003280 [ 128.303455] x27: ffff800020d48280 x26: ffff0cb9dc814080 [ 128.309715] x25: ffff0cb9cde93fa0 x24: 0000000000000001 [ 128.315969] x23: 0000000000000000 x22: 0000000000000194 [ 128.322219] x21: ffff0cd94f986000 x20:
0000000000000000 [ 128.328462] x19: ffff0cb9d2a166c0 x18: 0000000000000000 [ 128.334698] x17:
0000000000000000 x16: ffffcf1fc523ed24 [ 128.340934] x15: 0000ffffd530a518 x14: 0000000000000000 [ 128.347162] x13: ffff0cd6bdb31310 x12: 0000000000000368 [ 128.353388] x11: ffff0cb9cfbc7070 x10:
ffff2cf55dd11e02 [ 128.359606] x9 : ffffcf1f85a212b4 x8 : ffff0cd7cf27dab0 [ 128.365831] x7 :
0000000000000a20 x6 : ffff0cd7cf27d000 [ 128.372040] x5 : 0000000000000000 x4 : 000000000000ffff [ 128.378243] x3 : 0000000000000400 x2 : ffffcf1f85a21294 [ 128.384437] x1 : ffff0cb9db520080 x0 :
ffff0cb9db500080 [ 128.390626] Call trace: [ 128.393964] hclge_ptp_set_tx_info+0x2c/0x140 [hclge] [ 128.399893] hns3_nic_net_xmit+0x39c/0x4c4 [hns3] [ 128.405468] xmit_one.constprop.0+0xc4/0x200 [ 128.410600] dev_hard_start_xmit+0x54/0xf0 [ 128.415556] sch_direct_xmit+0xe8/0x634 [ 128.420246]
__dev_queue_xmit+0x224/0xc70 [ 128.425101] dev_queue_xmit+0x1c/0x40 [ 128.429608] ovs_vport_send+0xac/0x1a0 [openvswitch] [ 128.435409] do_output+0x60/0x17c [openvswitch] [ 128.440770] do_execute_actions+0x898/0x8c4 [openvswitch] [ 128.446993] ovs_execute_actions+0x64/0xf0 [openvswitch] [ 128.453129] ovs_dp_process_packet+0xa0/0x224 [openvswitch] [ 128.459530] ovs_vport_receive+0x7c/0xfc [openvswitch] [ 128.465497] internal_dev_xmit+0x34/0xb0 [openvswitch] [ 128.471460] xmit_one.constprop.0+0xc4/0x200 [ 128.476561] dev_hard_start_xmit+0x54/0xf0 [ 128.481489]
__dev_queue_xmit+0x968/0xc70 [ 128.486330] dev_queue_xmit+0x1c/0x40 [ 128.490856] ip_finish_output2+0x250/0x570 [ 128.495810] __ip_finish_output+0x170/0x1e0 [ 128.500832] ip_finish_output+0x3c/0xf0 [ 128.505504] ip_output+0xbc/0x160 [ 128.509654] ip_send_skb+0x58/0xd4 [ 128.513892] udp_send_skb+0x12c/0x354 [ 128.518387] udp_sendmsg+0x7a8/0x9c0 [ 128.522793] inet_sendmsg+0x4c/0x8c [ 128.527116] __sock_sendmsg+0x48/0x80 [ 128.531609] __sys_sendto+0x124/0x164 [ 128.536099] __arm64_sys_sendto+0x30/0x5c [ 128.540935] invoke_syscall+0x50/0x130 [ 128.545508] el0_svc_common.constprop.0+0x10c/0x124 [ 128.551205] do_el0_svc+0x34/0xdc [ 128.555347] el0_svc+0x20/0x30 [ 128.559227] el0_sync_handler+0xb8/0xc0 [ 128.563883] el0_sync+0x160/0x180 (CVE-2025-21649)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21649
https://security-tracker.debian.org/tracker/CVE-2025-21649
https://ubuntu.com/security/CVE-2025-21649

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.6 (CVSS2#AV:A/AC:H/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21649

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230509 - Linux Distros Unpatched Vulnerability : CVE-2025-21651
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: hns3: don't auto enable misc vector Currently, there is a time window between misc irq enabled and service task inited. If an interrupte is reported at this time, it will cause warning like below: [ 16.324639] Call trace: [ 16.324641] __queue_delayed_work+0xb8/0xe0 [ 16.324643] mod_delayed_work_on+0x78/0xd0 [ 16.324655] hclge_errhand_task_schedule+0x58/0x90 [hclge] [ 16.324662] hclge_misc_irq_handle+0x168/0x240 [hclge] [ 16.324666] __handle_irq_event_percpu+0x64/0x1e0 [ 16.324667] handle_irq_event+0x80/0x170 [ 16.324670] handle_fasteoi_edge_irq+0x110/0x2bc [ 16.324671]
__handle_domain_irq+0x84/0xfc [ 16.324673] gic_handle_irq+0x88/0x2c0 [ 16.324674] el1_irq+0xb8/0x140 [ 16.324677] arch_cpu_idle+0x18/0x40 [ 16.324679] default_idle_call+0x5c/0x1bc [ 16.324682] cpuidle_idle_call+0x18c/0x1c4 [ 16.324684] do_idle+0x174/0x17c [ 16.324685] cpu_startup_entry+0x30/0x6c [ 16.324687] secondary_start_kernel+0x1a4/0x280 [ 16.324688] ---[ end trace 6aa0bff672a964aa ]--- So don't auto enable misc vector when request irq.. (CVE-2025-21651)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21651
https://security-tracker.debian.org/tracker/CVE-2025-21651
https://ubuntu.com/security/CVE-2025-21651

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:M/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21651

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231855 - Linux Distros Unpatched Vulnerability : CVE-2025-21653
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute syzbot found that TCA_FLOW_RSHIFT attribute was not validated. Right shitfing a 32bit integer is undefined for large shift values. UBSAN: shift-out-of- bounds in net/sched/cls_flow.c:329:23 shift exponent 9445 is too large for 32-bit type 'u32' (aka 'unsigned int') CPU: 1 UID: 0 PID: 54 Comm: kworker/u8:3 Not tainted 6.13.0-rc3-syzkaller-00180-g4f619d518db9 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:231 [inline] __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468 flow_classify+0x24d5/0x25b0 net/sched/cls_flow.c:329 tc_classify include/net/tc_wrapper.h:197 [inline]
__tcf_classify net/sched/cls_api.c:1771 [inline] tcf_classify+0x420/0x1160 net/sched/cls_api.c:1867 sfb_classify net/sched/sch_sfb.c:260 [inline] sfb_enqueue+0x3ad/0x18b0 net/sched/sch_sfb.c:318 dev_qdisc_enqueue+0x4b/0x290 net/core/dev.c:3793 __dev_xmit_skb net/core/dev.c:3889 [inline]
__dev_queue_xmit+0xf0e/0x3f50 net/core/dev.c:4400 dev_queue_xmit include/linux/netdevice.h:3168 [inline] neigh_hh_output include/net/neighbour.h:523 [inline] neigh_output include/net/neighbour.h:537 [inline] ip_finish_output2+0xd41/0x1390 net/ipv4/ip_output.c:236 iptunnel_xmit+0x55d/0x9b0 net/ipv4/ip_tunnel_core.c:82 udp_tunnel_xmit_skb+0x262/0x3b0 net/ipv4/udp_tunnel_core.c:173 geneve_xmit_skb drivers/net/geneve.c:916 [inline] geneve_xmit+0x21dc/0x2d00 drivers/net/geneve.c:1039
__netdev_start_xmit include/linux/netdevice.h:5002 [inline] netdev_start_xmit include/linux/netdevice.h:5011 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3606 __dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4434 (CVE-2025-21653)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21653
https://ubuntu.com/security/CVE-2025-21653

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21653

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231410 - Linux Distros Unpatched Vulnerability : CVE-2025-21659
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: netdev: prevent accessing NAPI instances from another namespace The NAPI IDs were not fully exposed to user space prior to the netlink API, so they were never namespaced. The netlink API must ensure that at the very least NAPI instance belongs to the same netns as the owner of the genl sock. napi_by_id() can become static now, but it needs to move because of dev_get_by_napi_id(). (CVE-2025-21659)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21659
https://ubuntu.com/security/CVE-2025-21659

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21659

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231655 - Linux Distros Unpatched Vulnerability : CVE-2025-21664
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dm thin: make get_first_thin use rcu-safe list first function The documentation in rculist.h explains the absence of list_empty_rcu() and cautions programmers against relying on a list_empty() -> list_first() sequence in RCU safe code. This is because each of these functions performs its own READ_ONCE() of the list head. This can lead to a situation where the list_empty() sees a valid list entry, but the subsequent list_first() sees a different view of list head state after a modification. In the case of dm-thin, this author had a production box crash from a GP fault in the process_deferred_bios path. This function saw a valid list head in get_first_thin() but when it subsequently dereferenced that and turned it into a thin_c, it got the inside of the struct pool, since the list was now empty and referring to itself. The kernel on which this occurred printed both a warning about a refcount_t being saturated, and a UBSAN error for an out-of-bounds cpuid access in the queued spinlock, prior to the fault itself. When the resulting kdump was examined, it was possible to see another thread patiently waiting in thin_dtr's synchronize_rcu.
The thin_dtr call managed to pull the thin_c out of the active thins list (and have it be the last entry in the active_thins list) at just the wrong moment which lead to this crash. Fortunately, the fix here is straight forward. Switch get_first_thin() function to use list_first_or_null_rcu() which performs just a single READ_ONCE() and returns NULL if the list is already empty. This was run against the devicemapper test suite's thin-provisioning suites for delete and suspend and no regressions were observed.
(CVE-2025-21664)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21664
https://ubuntu.com/security/CVE-2025-21664

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21664

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230934 - Linux Distros Unpatched Vulnerability : CVE-2025-21670
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: vsock/bpf: return early if transport is not assigned Some of the core functions can only be called if the transport has been assigned. As Michal reported, a socket might have the transport at NULL, for example after a failed connect(), causing the following trace: BUG: kernel NULL pointer dereference, address: 00000000000000a0 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 12faf8067 P4D 12faf8067 PUD 113670067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 15 UID: 0 PID: 1198 Comm: a.out Not tainted 6.13.0-rc2+ RIP: 0010:vsock_connectible_has_data+0x1f/0x40 Call Trace: vsock_bpf_recvmsg+0xca/0x5e0 sock_recvmsg+0xb9/0xc0 __sys_recvfrom+0xb3/0x130 __x64_sys_recvfrom+0x20/0x30 do_syscall_64+0x93/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e So we need to check the `vsk->transport` in vsock_bpf_recvmsg(), especially for connected sockets (stream/seqpacket) as we already do in __vsock_connectible_recvmsg().
(CVE-2025-21670)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21670
https://ubuntu.com/security/CVE-2025-21670

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21670

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231385 - Linux Distros Unpatched Vulnerability : CVE-2025-21673
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smb: client: fix double free of TCP_Server_Info::hostname When shutting down the server in cifs_put_tcp_session(), cifsd thread might be reconnecting to multiple DFS targets before it realizes it should exit the loop, so @server->hostname can't be freed as long as cifsd thread isn't done. Otherwise the following can happen: RIP: 0010:__slab_free+0x223/0x3c0 Code: 5e 41 5f c3 cc cc cc cc 4c 89 de 4c 89 cf 44 89 44 24 08 4c 89 1c 24 e8 fb cf 8e 00 44 8b 44 24 08 4c 8b 1c 24 e9 5f fe ff ff <0f> 0b 41 f7 45 08 00 0d 21 00 0f 85 2d ff ff ff e9 1f ff ff ff 80 RSP: 0018:ffffb26180dbfd08 EFLAGS: 00010246 RAX:
ffff8ea34728e510 RBX: ffff8ea34728e500 RCX: 0000000000800068 RDX: 0000000000800068 RSI: 0000000000000000 RDI: ffff8ea340042400 RBP: ffffe112041ca380 R08: 0000000000000001 R09: 0000000000000000 R10:
6170732e31303000 R11: 70726f632e786563 R12: ffff8ea34728e500 R13: ffff8ea340042400 R14: ffff8ea34728e500 R15: 0000000000800068 FS: 0000000000000000(0000) GS:ffff8ea66fd80000(0000) 000000 CS: 0010 DS: 0000 ES:
0000 CR0: 0000000080050033 CR2: 00007ffc25376080 CR3: 000000012a2ba001 CR4: PKRU: 55555554 Call Trace:
<TASK> ? show_trace_log_lvl+0x1c4/0x2df ? show_trace_log_lvl+0x1c4/0x2df ?
__reconnect_target_unlocked+0x3e/0x160 [cifs] ? __die_body.cold+0x8/0xd ? die+0x2b/0x50 ? do_trap+0xce/0x120 ? __slab_free+0x223/0x3c0 ? do_error_trap+0x65/0x80 ? __slab_free+0x223/0x3c0 ? exc_invalid_op+0x4e/0x70 ? __slab_free+0x223/0x3c0 ? asm_exc_invalid_op+0x16/0x20 ?
__slab_free+0x223/0x3c0 ? extract_hostname+0x5c/0xa0 [cifs] ? extract_hostname+0x5c/0xa0 [cifs] ?
__kmalloc+0x4b/0x140 __reconnect_target_unlocked+0x3e/0x160 [cifs] reconnect_dfs_server+0x145/0x430 [cifs] cifs_handle_standard+0x1ad/0x1d0 [cifs] cifs_demultiplex_thread+0x592/0x730 [cifs] ?
__pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] kthread+0xdd/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x29/0x50 </TASK> (CVE-2025-21673)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21673
https://security-tracker.debian.org/tracker/CVE-2025-21673
https://ubuntu.com/security/CVE-2025-21673

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21673

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230805 - Linux Distros Unpatched Vulnerability : CVE-2025-21681
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix lockup on tx to unregistering netdev with carrier Commit in a fixes tag attempted to fix the issue in the following sequence of calls: do_output -> ovs_vport_send -> dev_queue_xmit -> __dev_queue_xmit ->
netdev_core_pick_tx -> skb_tx_hash When device is unregistering, the 'dev->real_num_tx_queues' goes to zero and the 'while (unlikely(hash >= qcount))' loop inside the 'skb_tx_hash' becomes infinite, locking up the core forever. But unfortunately, checking just the carrier status is not enough to fix the issue, because some devices may still be in unregistering state while reporting carrier status OK. One example of such device is a net/dummy. It sets carrier ON on start, but it doesn't implement .ndo_stop to set the carrier off. And it makes sense, because dummy doesn't really have a carrier. Therefore, while this device is unregistering, it's still easy to hit the infinite loop in the skb_tx_hash() from the OVS datapath.
There might be other drivers that do the same, but dummy by itself is important for the OVS ecosystem, because it is frequently used as a packet sink for tcpdump while debugging OVS deployments. And when the issue is hit, the only way to recover is to reboot. Fix that by also checking if the device is running.
The running state is handled by the net core during unregistering, so it covers unregistering case better, and we don't really need to send packets to devices that are not running anyway. While only checking the running state might be enough, the carrier check is preserved. The running and the carrier states seem disjoined throughout the code and different drivers. And other core functions like __dev_direct_xmit() check both before attempting to transmit a packet. So, it seems safer to check both flags in OVS as well.
(CVE-2025-21681)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21681
https://ubuntu.com/security/CVE-2025-21681

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21681

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230359 - Linux Distros Unpatched Vulnerability : CVE-2025-21682
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- eth: bnxt: always recalculate features after XDP clearing, fix null-deref Recalculate features when XDP is detached. Before: # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp # ip li set dev eth0 xdp off # ethtool -k eth0 | grep gro rx-gro-hw: off [requested on] After: # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp # ip li set dev eth0 xdp off # ethtool -k eth0 | grep gro rx-gro-hw: on The fact that HW-GRO doesn't get re-enabled automatically is just a minor annoyance. The real issue is that the features will randomly come back during another reconfiguration which just happens to invoke netdev_update_features(). The driver doesn't handle reconfiguring two things at a time very robustly.
Starting with commit 98ba1d931f61 (bnxt_en: Fix RSS logic in __bnxt_reserve_rings()) we only reconfigure the RSS hash table if the effective number of Rx rings has changed. If HW-GRO is enabled effective number of rings is 2x what user sees. So if we are in the bad state, with HW-GRO re-enablement pending after XDP off, and we lower the rings by / 2 - the HW-GRO rings doing 2x and the ethtool -L doing / 2 may cancel each other out, and the: if (old_rx_rings != bp->hw_resc.resv_rx_rings && condition in
__bnxt_reserve_rings() will be false. The RSS map won't get updated, and we'll crash with: BUG: kernel NULL pointer dereference, address: 0000000000000168 RIP: 0010:__bnxt_hwrm_vnic_set_rss+0x13a/0x1a0 bnxt_hwrm_vnic_rss_cfg_p5+0x47/0x180 __bnxt_setup_vnic_p5+0x58/0x110 bnxt_init_nic+0xb72/0xf50
__bnxt_open_nic+0x40d/0xab0 bnxt_open_nic+0x2b/0x60 ethtool_set_channels+0x18c/0x1d0 As we try to access a freed ring. The issue is present since XDP support was added, really, but prior to commit 98ba1d931f61 (bnxt_en: Fix RSS logic in __bnxt_reserve_rings()) it wasn't causing major issues. (CVE-2025-21682)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21682
https://security-tracker.debian.org/tracker/CVE-2025-21682
https://ubuntu.com/security/CVE-2025-21682

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21682

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231679 - Linux Distros Unpatched Vulnerability : CVE-2025-21683
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_sk_select_reuseport() memory leak As pointed out in the original comment, lookup in sockmap can return a TCP ESTABLISHED socket.
Such TCP socket may have had SO_ATTACH_REUSEPORT_EBPF set before it was ESTABLISHED. In other words, a non-NULL sk_reuseport_cb does not imply a non-refcounted socket. Drop sk's reference in both error paths.
unreferenced object 0xffff888101911800 (size 2048): comm test_progs, pid 44109, jiffies 4297131437 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 80 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 9336483b): __kmalloc_noprof+0x3bf/0x560
__reuseport_alloc+0x1d/0x40 reuseport_alloc+0xca/0x150 reuseport_attach_prog+0x87/0x140 sk_reuseport_attach_bpf+0xc8/0x100 sk_setsockopt+0x1181/0x1990 do_sock_setsockopt+0x12b/0x160
__sys_setsockopt+0x7b/0xc0 __x64_sys_setsockopt+0x1b/0x30 do_syscall_64+0x93/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e (CVE-2025-21683)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21683
https://ubuntu.com/security/CVE-2025-21683

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21683

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230757 - Linux Distros Unpatched Vulnerability : CVE-2025-21690
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: storvsc: Ratelimit warning logs to prevent VM denial of service If there's a persistent error in the hypervisor, the SCSI warning for failed I/O can flood the kernel log and max out CPU utilization, preventing troubleshooting from the VM side. Ratelimit the warning so it doesn't DoS the VM.
(CVE-2025-21690)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21690
https://security-tracker.debian.org/tracker/CVE-2025-21690
https://ubuntu.com/security/CVE-2025-21690

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21690

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230909 - Linux Distros Unpatched Vulnerability : CVE-2025-21701
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: avoid race between device unregistration and ethnl ops The following trace can be seen if a device is being unregistered while its number of channels are being modified. DEBUG_LOCKS_WARN_ON(lock->magic != lock) WARNING: CPU: 3 PID: 3754 at kernel/locking/mutex.c:564 __mutex_lock+0xc8a/0x1120 CPU: 3 UID: 0 PID:
3754 Comm: ethtool Not tainted 6.13.0-rc6+ #771 RIP: 0010:__mutex_lock+0xc8a/0x1120 Call Trace: <TASK>
ethtool_check_max_channel+0x1ea/0x880 ethnl_set_channels+0x3c3/0xb10 ethnl_default_set_doit+0x306/0x650 genl_family_rcv_msg_doit+0x1e3/0x2c0 genl_rcv_msg+0x432/0x6f0 netlink_rcv_skb+0x13d/0x3b0 genl_rcv+0x28/0x40 netlink_unicast+0x42e/0x720 netlink_sendmsg+0x765/0xc20 __sys_sendto+0x3ac/0x420
__x64_sys_sendto+0xe0/0x1c0 do_syscall_64+0x95/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e This is because unregister_netdevice_many_notify might run before the rtnl lock section of ethnl operations, eg.
set_channels in the above example. In this example the rss lock would be destroyed by the device unregistration path before being used again, but in general running ethnl operations while dismantle has started is not a good idea. Fix this by denying any operation on devices being unregistered. A check was already there in ethnl_ops_begin, but not wide enough. Note that the same issue cannot be seen on the ioctl version (__dev_ethtool) because the device reference is retrieved from within the rtnl lock section there. Once dismantle started, the net device is unlisted and no reference will be found. (CVE-2025-21701)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21701
https://security-tracker.debian.org/tracker/CVE-2025-21701
https://ubuntu.com/security/CVE-2025-21701

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0008
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21701

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231584 - Linux Distros Unpatched Vulnerability : CVE-2025-21705
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mptcp: handle fastopen disconnect correctly Syzbot was able to trigger a data stream corruption: WARNING: CPU: 0 PID: 9846 at net/mptcp/protocol.c:1024 __mptcp_clean_una+0xddb/0xff0 net/mptcp/protocol.c:1024 Modules linked in: CPU:
0 UID: 0 PID: 9846 Comm: syz-executor351 Not tainted 6.13.0-rc2-syzkaller-00059-g00a5acdbf398 #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024 RIP:
0010:__mptcp_clean_una+0xddb/0xff0 net/mptcp/protocol.c:1024 Code: fa ff ff 48 8b 4c 24 18 80 e1 07 fe c1 38 c1 0f 8c 8e fa ff ff 48 8b 7c 24 18 e8 e0 db 54 f6 e9 7f fa ff ff e8 e6 80 ee f5 90 <0f> 0b 90 4c 8b 6c 24 40 4d 89 f4 e9 04 f5 ff ff 44 89 f1 80 e1 07 RSP: 0018:ffffc9000c0cf400 EFLAGS: 00010293 RAX:
ffffffff8bb0dd5a RBX: ffff888033f5d230 RCX: ffff888059ce8000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000c0cf518 R08: ffffffff8bb0d1dd R09: 1ffff110170c8928 R10:
dffffc0000000000 R11: ffffed10170c8929 R12: 0000000000000000 R13: ffff888033f5d220 R14: dffffc0000000000 R15: ffff8880592b8000 FS: 00007f6e866496c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6e86f491a0 CR3: 00000000310e6000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6:
00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __mptcp_clean_una_wakeup+0x7f/0x2d0 net/mptcp/protocol.c:1074 mptcp_release_cb+0x7cb/0xb30 net/mptcp/protocol.c:3493 release_sock+0x1aa/0x1f0 net/core/sock.c:3640 inet_wait_for_connect net/ipv4/af_inet.c:609 [inline]
__inet_stream_connect+0x8bd/0xf30 net/ipv4/af_inet.c:703 mptcp_sendmsg_fastopen+0x2a2/0x530 net/mptcp/protocol.c:1755 mptcp_sendmsg+0x1884/0x1b10 net/mptcp/protocol.c:1830 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:726 ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2583 ___sys_sendmsg net/socket.c:2637 [inline] __sys_sendmsg+0x269/0x350 net/socket.c:2669 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f6e86ebfe69 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 1f 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f6e86649168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f6e86f491b8 RCX: 00007f6e86ebfe69 RDX:
0000000030004001 RSI: 0000000020000080 RDI: 0000000000000003 RBP: 00007f6e86f491b0 R08: 00007f6e866496c0 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6e86f491bc R13:
000000000000006e R14: 00007ffe445d9420 R15: 00007ffe445d9508 </TASK> The root cause is the bad handling of disconnect() generated internally by the MPTCP protocol in case of connect FASTOPEN errors. Address the issue increasing the socket disconnect counter even on such a case, to allow other threads waiting on the same socket lock to properly error out. (CVE-2025-21705)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21705
https://ubuntu.com/security/CVE-2025-21705

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
9.4 (CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
8.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21705

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231824 - Linux Distros Unpatched Vulnerability : CVE-2025-21706
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: only set fullmesh for subflow endp With the in-kernel path-manager, it is possible to change the 'fullmesh' flag. The code in mptcp_pm_nl_fullmesh() expects to change it only on 'subflow' endpoints, to recreate more or less subflows using the linked address. Unfortunately, the set_flags() hook was a bit more permissive, and allowed 'implicit' endpoints to get the 'fullmesh' flag while it is not allowed before. That's what syzbot found, triggering the following warning: WARNING: CPU: 0 PID: 6499 at net/mptcp/pm_netlink.c:1496
__mark_subflow_endp_available net/mptcp/pm_netlink.c:1496 [inline] WARNING: CPU: 0 PID: 6499 at net/mptcp/pm_netlink.c:1496 mptcp_pm_nl_fullmesh net/mptcp/pm_netlink.c:1980 [inline] WARNING: CPU: 0 PID:
6499 at net/mptcp/pm_netlink.c:1496 mptcp_nl_set_flags net/mptcp/pm_netlink.c:2003 [inline] WARNING: CPU:
0 PID: 6499 at net/mptcp/pm_netlink.c:1496 mptcp_pm_nl_set_flags+0x974/0xdc0 net/mptcp/pm_netlink.c:2064 Modules linked in: CPU: 0 UID: 0 PID: 6499 Comm: syz.1.413 Not tainted 6.13.0-rc5-syzkaller-00172-gd1bf27c4e176 #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:__mark_subflow_endp_available net/mptcp/pm_netlink.c:1496 [inline] RIP:
0010:mptcp_pm_nl_fullmesh net/mptcp/pm_netlink.c:1980 [inline] RIP: 0010:mptcp_nl_set_flags net/mptcp/pm_netlink.c:2003 [inline] RIP: 0010:mptcp_pm_nl_set_flags+0x974/0xdc0 net/mptcp/pm_netlink.c:2064 Code: 01 00 00 49 89 c5 e8 fb 45 e8 f5 e9 b8 fc ff ff e8 f1 45 e8 f5 4c 89 f7 be 03 00 00 00 e8 44 1d 0b f9 eb a0 e8 dd 45 e8 f5 90 <0f> 0b 90 e9 17 ff ff ff 89 d9 80 e1 07 38 c1 0f 8c c9 fc ff ff 48 RSP: 0018:ffffc9000d307240 EFLAGS: 00010293 RAX: ffffffff8bb72e03 RBX: 0000000000000000 RCX: ffff88807da88000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP:
ffffc9000d307430 R08: ffffffff8bb72cf0 R09: 1ffff1100b842a5e R10: dffffc0000000000 R11: ffffed100b842a5f R12: ffff88801e2e5ac0 R13: ffff88805c214800 R14: ffff88805c2152e8 R15: 1ffff1100b842a5d FS:
00005555619f6500(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 CR2: 0000000020002840 CR3: 00000000247e6000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400 Call Trace: <TASK> genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0xb14/0xec0 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2542 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1347 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1891 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:726 ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2583 ___sys_sendmsg net/socket.c:2637 [inline]
__sys_sendmsg+0x269/0x350 net/socket.c:2669 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP:
0033:0x7f5fe8785d29 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff571f5558 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX:
00007f5fe8975fa0 RCX: 00007f5fe8785d29 RDX: 0000000000000000 RSI: 0000000020000480 RDI: 0000000000000007 RBP: 00007f5fe8801b08 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11:
0000000000000246 R12: 0000000000000000 R13: 00007f5fe8975fa0 R14: 00007f5fe8975fa0 R15: 000000
---truncated--- (CVE-2025-21706)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21706
https://ubuntu.com/security/CVE-2025-21706

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21706

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230507 - Linux Distros Unpatched Vulnerability : CVE-2025-21707
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mptcp: consolidate suboption status MPTCP maintains the received sub-options status is the bitmask carrying the received suboptions and in several bitfields carrying per suboption additional info. Zeroing the bitmask before parsing is not enough to ensure a consistent status, and the MPTCP code has to additionally clear some bitfiled depending on the actually parsed suboption. The above schema is fragile, and syzbot managed to trigger a path where a relevant bitfield is not cleared/initialized: BUG: KMSAN: uninit-value in __mptcp_expand_seq net/mptcp/options.c:1030 [inline] BUG: KMSAN: uninit-value in mptcp_expand_seq net/mptcp/protocol.h:864 [inline] BUG: KMSAN: uninit-value in ack_update_msk net/mptcp/options.c:1060 [inline] BUG: KMSAN: uninit- value in mptcp_incoming_options+0x2036/0x3d30 net/mptcp/options.c:1209 __mptcp_expand_seq net/mptcp/options.c:1030 [inline] mptcp_expand_seq net/mptcp/protocol.h:864 [inline] ack_update_msk net/mptcp/options.c:1060 [inline] mptcp_incoming_options+0x2036/0x3d30 net/mptcp/options.c:1209 tcp_data_queue+0xb4/0x7be0 net/ipv4/tcp_input.c:5233 tcp_rcv_established+0x1061/0x2510 net/ipv4/tcp_input.c:6264 tcp_v4_do_rcv+0x7f3/0x11a0 net/ipv4/tcp_ipv4.c:1916 tcp_v4_rcv+0x51df/0x5750 net/ipv4/tcp_ipv4.c:2351 ip_protocol_deliver_rcu+0x2a3/0x13d0 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x336/0x500 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:314 [inline] ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:460 [inline] ip_rcv_finish+0x4a2/0x520 net/ipv4/ip_input.c:447 NF_HOOK include/linux/netfilter.h:314 [inline] ip_rcv+0xcd/0x380 net/ipv4/ip_input.c:567 __netif_receive_skb_one_core net/core/dev.c:5704 [inline]
__netif_receive_skb+0x319/0xa00 net/core/dev.c:5817 process_backlog+0x4ad/0xa50 net/core/dev.c:6149
__napi_poll+0xe7/0x980 net/core/dev.c:6902 napi_poll net/core/dev.c:6971 [inline] net_rx_action+0xa5a/0x19b0 net/core/dev.c:7093 handle_softirqs+0x1a0/0x7c0 kernel/softirq.c:561
__do_softirq+0x14/0x1a kernel/softirq.c:595 do_softirq+0x9a/0x100 kernel/softirq.c:462
__local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:389 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:919 [inline] __dev_queue_xmit+0x2758/0x57d0 net/core/dev.c:4493 dev_queue_xmit include/linux/netdevice.h:3168 [inline] neigh_hh_output include/net/neighbour.h:523 [inline] neigh_output include/net/neighbour.h:537 [inline] ip_finish_output2+0x187c/0x1b70 net/ipv4/ip_output.c:236 __ip_finish_output+0x287/0x810 ip_finish_output+0x4b/0x600 net/ipv4/ip_output.c:324 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip_output+0x15f/0x3f0 net/ipv4/ip_output.c:434 dst_output include/net/dst.h:450 [inline] ip_local_out net/ipv4/ip_output.c:130 [inline] __ip_queue_xmit+0x1f2a/0x20d0 net/ipv4/ip_output.c:536 ip_queue_xmit+0x60/0x80 net/ipv4/ip_output.c:550 __tcp_transmit_skb+0x3cea/0x4900 net/ipv4/tcp_output.c:1468 tcp_transmit_skb net/ipv4/tcp_output.c:1486 [inline] tcp_write_xmit+0x3b90/0x9070 net/ipv4/tcp_output.c:2829 __tcp_push_pending_frames+0xc4/0x380 net/ipv4/tcp_output.c:3012 tcp_send_fin+0x9f6/0xf50 net/ipv4/tcp_output.c:3618 __tcp_close+0x140c/0x1550 net/ipv4/tcp.c:3130 __mptcp_close_ssk+0x74e/0x16f0 net/mptcp/protocol.c:2496 mptcp_close_ssk+0x26b/0x2c0 net/mptcp/protocol.c:2550 mptcp_pm_nl_rm_addr_or_subflow+0x635/0xd10 net/mptcp/pm_netlink.c:889 mptcp_pm_nl_rm_subflow_received net/mptcp/pm_netlink.c:924 [inline] mptcp_pm_flush_addrs_and_subflows net/mptcp/pm_netlink.c:1688 [inline] mptcp_nl_flush_addrs_list net/mptcp/pm_netlink.c:1709 [inline] mptcp_pm_nl_flush_addrs_doit+0xe10/0x1630 net/mptcp/pm_netlink.c:1750 genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline] ---truncated--- (CVE-2025-21707)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21707
https://ubuntu.com/security/CVE-2025-21707

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:A/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21707

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231325 - Linux Distros Unpatched Vulnerability : CVE-2025-21708
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: usb: rtl8150: enable basic endpoint checking Syzkaller reports [1] encountering a common issue of utilizing a wrong usb endpoint type during URB submitting stage. This, in turn, triggers a warning shown below. For now, enable simple endpoint checking (specifically, bulk and interrupt eps, testing control one is not essential) to mitigate the issue with a view to do other related cosmetic changes later, if they are necessary. [1] Syzkaller report: usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 2586 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 driv> Modules linked in: CPU: 1 UID: 0 PID: 2586 Comm: dhcpcd Not tainted 6.11.0-rc4-syzkaller-00069-gfc88bb11617> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503 Code: 84 3c 02 00 00 e8 05 e4 fc fc 4c 89 ef e8 fd 25 d7 fe 45 89 e0 89 e9 4c 89 f2 48 8> RSP: 0018:ffffc9000441f740 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff888112487a00 RCX:
ffffffff811a99a9 RDX: ffff88810df6ba80 RSI: ffffffff811a99b6 RDI: 0000000000000001 RBP: 0000000000000003 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12:
0000000000000001 R13: ffff8881023bf0a8 R14: ffff888112452a20 R15: ffff888112487a7c FS:
00007fc04eea5740(0000) GS:ffff8881f6300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 CR2: 00007f0a1de9f870 CR3: 000000010dbd0000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400 Call Trace: <TASK> rtl8150_open+0x300/0xe30 drivers/net/usb/rtl8150.c:733
__dev_open+0x2d4/0x4e0 net/core/dev.c:1474 __dev_change_flags+0x561/0x720 net/core/dev.c:8838 dev_change_flags+0x8f/0x160 net/core/dev.c:8910 devinet_ioctl+0x127a/0x1f10 net/ipv4/devinet.c:1177 inet_ioctl+0x3aa/0x3f0 net/ipv4/af_inet.c:1003 sock_do_ioctl+0x116/0x280 net/socket.c:1222 sock_ioctl+0x22e/0x6c0 net/socket.c:1341 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __x64_sys_ioctl+0x193/0x220 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc04ef73d49 ... This change has not been tested on real hardware. (CVE-2025-21708)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21708
https://ubuntu.com/security/CVE-2025-21708

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21708

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231031 - Linux Distros Unpatched Vulnerability : CVE-2025-21709
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- kernel: be more careful about dup_mmap() failures and uprobe registering If a memory allocation fails during dup_mmap(), the maple tree can be left in an unsafe state for other iterators besides the exit path. All the locks are dropped before the exit_mmap() call (in mm/mmap.c), but the incomplete mm_struct can be reached through (at least) the rmap finding the vmas which have a pointer back to the mm_struct. Up to this point, there have been no issues with being able to find an mm_struct that was only partially initialised. Syzbot was able to make the incomplete mm_struct fail with recent forking changes, so it has been proven unsafe to use the mm_struct that hasn't been initialised, as referenced in the link below.
Although 8ac662f5da19f (fork: avoid inappropriate uprobe access to invalid mm) fixed the uprobe access, it does not completely remove the race. This patch sets the MMF_OOM_SKIP to avoid the iteration of the vmas on the oom side (even though this is extremely unlikely to be selected as an oom victim in the race window), and sets MMF_UNSTABLE to avoid other potential users from using a partially initialised mm_struct. When registering vmas for uprobe, skip the vmas in an mm that is marked unstable. Modifying a vma in an unstable mm may cause issues if the mm isn't fully initialised. (CVE-2025-21709)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21709
https://security-tracker.debian.org/tracker/CVE-2025-21709
https://ubuntu.com/security/CVE-2025-21709

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21709

Plugin Information
Published: 2025/03/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230633 - Linux Distros Unpatched Vulnerability : CVE-2025-21712
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime After commit ec6bb299c7c3 (md/md- bitmap: add 'sync_size' into struct md_bitmap_stats), following panic is reported: Oops: general protection fault, probably for non-canonical address RIP: 0010:bitmap_get_stats+0x2b/0xa0 Call Trace:
<TASK> md_seq_show+0x2d2/0x5b0 seq_read_iter+0x2b9/0x470 seq_read+0x12f/0x180 proc_reg_read+0x57/0xb0 vfs_read+0xf6/0x380 ksys_read+0x6c/0xf0 do_syscall_64+0x82/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Root cause is that bitmap_get_stats() can be called at anytime if mddev is still there, even if bitmap is destroyed, or not fully initialized. Deferenceing bitmap in this case can crash the kernel. Meanwhile, the above commit start to deferencing bitmap->storage, make the problem easier to trigger. Fix the problem by protecting bitmap_get_stats() with bitmap_info.mutex. (CVE-2025-21712)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21712
https://security-tracker.debian.org/tracker/CVE-2025-21712
https://ubuntu.com/security/CVE-2025-21712

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21712

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231474 - Linux Distros Unpatched Vulnerability : CVE-2025-21713
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/iommu: Don't unset window if it was never set On pSeries, when user attempts to use the same vfio container used by different iommu group, the spapr_tce_set_window() returns -EPERM and the subsequent cleanup leads to the below crash. Kernel attempted to read user page (308) - exploit attempt? BUG: Kernel NULL pointer dereference on read at 0x00000308 Faulting instruction address: 0xc0000000001ce358 Oops: Kernel access of bad area, sig:
11 [#1] NIP: c0000000001ce358 LR: c0000000001ce05c CTR: c00000000005add0 <snip> NIP [c0000000001ce358] spapr_tce_unset_window+0x3b8/0x510 LR [c0000000001ce05c] spapr_tce_unset_window+0xbc/0x510 Call Trace:
spapr_tce_unset_window+0xbc/0x510 (unreliable) tce_iommu_attach_group+0x24c/0x340 [vfio_iommu_spapr_tce] vfio_container_attach_group+0xec/0x240 [vfio] vfio_group_fops_unl_ioctl+0x548/0xb00 [vfio] sys_ioctl+0x754/0x1580 system_call_exception+0x13c/0x330 system_call_vectored_common+0x15c/0x2ec <snip>
--- interrupt: 3000 Fix this by having null check for the tbl passed to the spapr_tce_unset_window().
(CVE-2025-21713)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21713
https://ubuntu.com/security/CVE-2025-21713

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21713

Plugin Information
Published: 2025/03/06, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230482 - Linux Distros Unpatched Vulnerability : CVE-2025-21716
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix uninit-value in vxlan_vnifilter_dump() KMSAN reported an uninit-value access in vxlan_vnifilter_dump() [1]. If the length of the netlink message payload is less than sizeof(struct tunnel_msg), vxlan_vnifilter_dump() accesses bytes beyond the message. This can lead to uninit-value access. Fix this by returning an error in such situations. [1] BUG: KMSAN: uninit-value in vxlan_vnifilter_dump+0x328/0x920 drivers/net/vxlan/vxlan_vnifilter.c:422 vxlan_vnifilter_dump+0x328/0x920 drivers/net/vxlan/vxlan_vnifilter.c:422 rtnl_dumpit+0xd5/0x2f0 net/core/rtnetlink.c:6786 netlink_dump+0x93e/0x15f0 net/netlink/af_netlink.c:2317 __netlink_dump_start+0x716/0xd60 net/netlink/af_netlink.c:2432 netlink_dump_start include/linux/netlink.h:340 [inline] rtnetlink_dump_start net/core/rtnetlink.c:6815 [inline] rtnetlink_rcv_msg+0x1256/0x14a0 net/core/rtnetlink.c:6882 netlink_rcv_skb+0x467/0x660 net/netlink/af_netlink.c:2542 rtnetlink_rcv+0x35/0x40 net/core/rtnetlink.c:6944 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0xed6/0x1290 net/netlink/af_netlink.c:1347 netlink_sendmsg+0x1092/0x1230 net/netlink/af_netlink.c:1891 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x330/0x3d0 net/socket.c:726 ____sys_sendmsg+0x7f4/0xb50 net/socket.c:2583 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2637 __sys_sendmsg net/socket.c:2669 [inline] __do_sys_sendmsg net/socket.c:2674 [inline]
__se_sys_sendmsg net/socket.c:2672 [inline] __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2672 x64_sys_call+0x3878/0x3d90 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd9/0x1d0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:4110 [inline] slab_alloc_node mm/slub.c:4153 [inline] kmem_cache_alloc_node_noprof+0x800/0xe80 mm/slub.c:4205 kmalloc_reserve+0x13b/0x4b0 net/core/skbuff.c:587 __alloc_skb+0x347/0x7d0 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1323 [inline] netlink_alloc_large_skb+0xa5/0x280 net/netlink/af_netlink.c:1196 netlink_sendmsg+0xac9/0x1230 net/netlink/af_netlink.c:1866 sock_sendmsg_nosec net/socket.c:711 [inline]
__sock_sendmsg+0x330/0x3d0 net/socket.c:726 ____sys_sendmsg+0x7f4/0xb50 net/socket.c:2583
___sys_sendmsg+0x271/0x3b0 net/socket.c:2637 __sys_sendmsg net/socket.c:2669 [inline] __do_sys_sendmsg net/socket.c:2674 [inline] __se_sys_sendmsg net/socket.c:2672 [inline] __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2672 x64_sys_call+0x3878/0x3d90 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd9/0x1d0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 30991 Comm: syz.4.10630 Not tainted 6.12.0-10694-gc44daa7e3c73 #29 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 (CVE-2025-21716)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21716
https://ubuntu.com/security/CVE-2025-21716

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21716

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231104 - Linux Distros Unpatched Vulnerability : CVE-2025-21723
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: mpi3mr: Fix possible crash when setting up bsg fails If bsg_setup_queue() fails, the bsg_queue is assigned a non-NULL value. Consequently, in mpi3mr_bsg_exit(), the condition if(!mrioc->bsg_queue) will not be satisfied, preventing execution from entering bsg_remove_queue(), which could lead to the following crash: BUG: kernel NULL pointer dereference, address: 000000000000041c Call Trace: <TASK>
mpi3mr_bsg_exit+0x1f/0x50 [mpi3mr] mpi3mr_remove+0x6f/0x340 [mpi3mr] pci_device_remove+0x3f/0xb0 device_release_driver_internal+0x19d/0x220 unbind_store+0xa4/0xb0 kernfs_fop_write_iter+0x11f/0x200 vfs_write+0x1fc/0x3e0 ksys_write+0x67/0xe0 do_syscall_64+0x38/0x80 entry_SYSCALL_64_after_hwframe+0x78/0xe2 (CVE-2025-21723)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21723
https://security-tracker.debian.org/tracker/CVE-2025-21723
https://ubuntu.com/security/CVE-2025-21723

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21723

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230547 - Linux Distros Unpatched Vulnerability : CVE-2025-21725
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: smb: client: fix oops due to unset link speed It isn't guaranteed that NETWORK_INTERFACE_INFO::LinkSpeed will always be set by the server, so the client must handle any values and then prevent oopses like below from happening: Oops: divide error:
0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 UID: 0 PID: 1323 Comm: cat Not tainted 6.13.0-rc7 #2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-3.fc41 04/01/2014 RIP:
0010:cifs_debug_data_proc_show+0xa45/0x1460 [cifs] Code: 00 00 48 89 df e8 3b cd 1b c1 41 f6 44 24 2c 04 0f 84 50 01 00 00 48 89 ef e8 e7 d0 1b c1 49 8b 44 24 18 31 d2 49 8d 7c 24 28 <48> f7 74 24 18 48 89 c3 e8 6e cf 1b c1 41 8b 6c 24 28 49 8d 7c 24 RSP: 0018:ffffc90001817be0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88811230022c RCX: ffffffffc041bd99 RDX: 0000000000000000 RSI: 0000000000000567 RDI:
ffff888112300228 RBP: ffff888112300218 R08: fffff52000302f5f R09: ffffed1022fa58ac R10: ffff888117d2c566 R11: 00000000fffffffe R12: ffff888112300200 R13: 000000012a15343f R14: 0000000000000001 R15:
ffff888113f2db58 FS: 00007fe27119e740(0000) GS:ffff888148600000(0000) knlGS:0000000000000000 CS: 0010 DS:
0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe2633c5000 CR3: 0000000124da0000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> ? __die_body.cold+0x19/0x27 ? die+0x2e/0x50 ? do_trap+0x159/0x1b0 ? cifs_debug_data_proc_show+0xa45/0x1460 [cifs] ? do_error_trap+0x90/0x130 ? cifs_debug_data_proc_show+0xa45/0x1460 [cifs] ? exc_divide_error+0x39/0x50 ? cifs_debug_data_proc_show+0xa45/0x1460 [cifs] ? asm_exc_divide_error+0x1a/0x20 ? cifs_debug_data_proc_show+0xa39/0x1460 [cifs] ? cifs_debug_data_proc_show+0xa45/0x1460 [cifs] ? seq_read_iter+0x42e/0x790 seq_read_iter+0x19a/0x790 proc_reg_read_iter+0xbe/0x110 ?
__pfx_proc_reg_read_iter+0x10/0x10 vfs_read+0x469/0x570 ? do_user_addr_fault+0x398/0x760 ?
__pfx_vfs_read+0x10/0x10 ? find_held_lock+0x8a/0xa0 ? __pfx_lock_release+0x10/0x10 ksys_read+0xd3/0x170 ?
__pfx_ksys_read+0x10/0x10 ? __rcu_read_unlock+0x50/0x270 ? mark_held_locks+0x1a/0x90 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe271288911 Code: 00 48 8b 15 01 25 10 00 f7 d8 64 89 02 b8 ff ff ff ff eb bd e8 20 ad 01 00 f3 0f 1e fa 80 3d b5 a7 10 00 00 74 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 4f c3 66 0f 1f 44 00 00 55 48 89 e5 48 83 ec RSP: 002b:00007ffe87c079d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 0000000000040000 RCX:
00007fe271288911 RDX: 0000000000040000 RSI: 00007fe2633c6000 RDI: 0000000000000003 RBP: 00007ffe87c07a00 R08: 0000000000000000 R09: 00007fe2713e6380 R10: 0000000000000022 R11: 0000000000000246 R12:
0000000000040000 R13: 00007fe2633c6000 R14: 0000000000000003 R15: 0000000000000000 </TASK> Fix this by setting cifs_server_iface::speed to a sane value (1Gbps) by default when link speed is unset.
(CVE-2025-21725)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21725
https://ubuntu.com/security/CVE-2025-21725

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21725

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230917 - Linux Distros Unpatched Vulnerability : CVE-2025-21732
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error This patch addresses a race condition for an ODP MR that can result in a CQE with an error on the UMR QP. During the __mlx5_ib_dereg_mr() flow, the following sequence of calls occurs: mlx5_revoke_mr() mlx5r_umr_revoke_mr() mlx5r_umr_post_send_wait() At this point, the lkey is freed from the hardware's perspective. However, concurrently, mlx5_ib_invalidate_range() might be triggered by another task attempting to invalidate a range for the same freed lkey. This task will: - Acquire the umem_odp->umem_mutex lock. - Call mlx5r_umr_update_xlt() on the UMR QP. - Since the lkey has already been freed, this can lead to a CQE error, causing the UMR QP to enter an error state [1]. To resolve this race condition, the umem_odp->umem_mutex lock is now also acquired as part of the mlx5_revoke_mr() scope. Upon successful revoke, we set umem_odp->private which points to that MR to NULL, preventing any further invalidation attempts on its lkey. [1] From dmesg:
infiniband rocep8s0f0: dump_cqe:277:(pid 0): WC error: 6, Message: memory bind operation error cqe_dump:
00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cqe_dump: 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cqe_dump: 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cqe_dump:
00000030: 00 00 00 00 08 00 78 06 25 00 11 b9 00 0e dd d2 WARNING: CPU: 15 PID: 1506 at drivers/infiniband/hw/mlx5/umr.c:394 mlx5r_umr_post_send_wait+0x15a/0x2b0 [mlx5_ib] Modules linked in:
ip6table_mangle ip6table_natip6table_filter ip6_tables iptable_mangle xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_umad ib_ipoib ib_cm mlx5_ib ib_uverbs ib_core fuse mlx5_core CPU: 15 UID: 0 PID: 1506 Comm: ibv_rc_pingpong Not tainted 6.12.0-rc7+ #1626 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5r_umr_post_send_wait+0x15a/0x2b0 [mlx5_ib] [..] Call Trace: <TASK> mlx5r_umr_update_xlt+0x23c/0x3e0 [mlx5_ib] mlx5_ib_invalidate_range+0x2e1/0x330 [mlx5_ib] __mmu_notifier_invalidate_range_start+0x1e1/0x240 zap_page_range_single+0xf1/0x1a0 madvise_vma_behavior+0x677/0x6e0 do_madvise+0x1a2/0x4b0
__x64_sys_madvise+0x25/0x30 do_syscall_64+0x6b/0x140 entry_SYSCALL_64_after_hwframe+0x76/0x7e (CVE-2025-21732)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21732
https://security-tracker.debian.org/tracker/CVE-2025-21732
https://ubuntu.com/security/CVE-2025-21732

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21732

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230780 - Linux Distros Unpatched Vulnerability : CVE-2025-21744
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() On removal of the device or unloading of the kernel module a potential NULL pointer dereference occurs. The following sequence deletes the interface: brcmf_detach() brcmf_remove_interface() brcmf_del_if() Inside the brcmf_del_if() function the drvr->if2bss[ifidx] is updated to BRCMF_BSSIDX_INVALID (-1) if the bsscfgidx matches. After brcmf_remove_interface() call the brcmf_proto_detach() function is called providing the following sequence: brcmf_detach() brcmf_proto_detach() brcmf_proto_msgbuf_detach() brcmf_flowring_detach() brcmf_msgbuf_delete_flowring() brcmf_msgbuf_remove_flowring() brcmf_flowring_delete() brcmf_get_ifp() brcmf_txfinalize() Since brcmf_get_ip() can and actually will return NULL in this case the call to brcmf_txfinalize() will result in a NULL pointer dereference inside brcmf_txfinalize() when trying to update ifp->ndev->stats.tx_errors. This will only happen if a flowring still has an skb. Although the NULL pointer dereference has only been seen when trying to update the tx statistic, all other uses of the ifp pointer have been guarded as well with an early return if ifp is NULL. (CVE-2025-21744)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21744
https://ubuntu.com/security/CVE-2025-21744

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21744

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230933 - Linux Distros Unpatched Vulnerability : CVE-2025-21750
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: brcmfmac: Check the return value of of_property_read_string_index() Somewhen between 6.10 and 6.11 the driver started to crash on my MacBookPro14,3. The property doesn't exist and 'tmp' remains uninitialized, so we pass a random pointer to devm_kstrdup(). The crash I am getting looks like this: BUG:
unable to handle page fault for address: 00007f033c669379 PF: supervisor read access in kernel mode PF:
error_code(0x0001) - permissions violation PGD 8000000101341067 P4D 8000000101341067 PUD 101340067 PMD 1013bb067 PTE 800000010aee9025 Oops: Oops: 0001 [#1] SMP PTI CPU: 4 UID: 0 PID: 827 Comm: (udev-worker) Not tainted 6.11.8-gentoo #1 Hardware name: Apple Inc. MacBookPro14,3/Mac-551B86E5744E2388, BIOS 529.140.2.0.0 06/23/2024 RIP: 0010:strlen+0x4/0x30 Code: f7 75 ec 31 c0 c3 cc cc cc cc 48 89 f8 c3 cc cc cc cc 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <80> 3f 00 74 14 48 89 f8 48 83 c0 01 80 38 00 75 f7 48 29 f8 c3 cc RSP: 0018:ffffb4aac0683ad8 EFLAGS: 00010202 RAX: 00000000ffffffea RBX: 00007f033c669379 RCX: 0000000000000001 RDX: 0000000000000cc0 RSI: 00007f033c669379 RDI:
00007f033c669379 RBP: 00000000ffffffea R08: 0000000000000000 R09: 00000000c0ba916a R10: ffffffffffffffff R11: ffffffffb61ea260 R12: ffff91f7815b50c8 R13: 0000000000000cc0 R14: ffff91fafefffe30 R15:
ffffb4aac0683b30 FS: 00007f033ccbe8c0(0000) GS:ffff91faeed00000(0000) knlGS:0000000000000000 CS: 0010 DS:
0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f033c669379 CR3: 0000000107b1e004 CR4: 00000000003706f0 DR0:
0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __die+0x23/0x70 ? page_fault_oops+0x149/0x4c0 ? raw_spin_rq_lock_nested+0xe/0x20 ? sched_balance_newidle+0x22b/0x3c0 ? update_load_avg+0x78/0x770 ? exc_page_fault+0x6f/0x150 ? asm_exc_page_fault+0x26/0x30 ? __pfx_pci_conf1_write+0x10/0x10 ? strlen+0x4/0x30 devm_kstrdup+0x25/0x70 brcmf_of_probe+0x273/0x350 [brcmfmac] (CVE-2025-21750)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21750
https://security-tracker.debian.org/tracker/CVE-2025-21750
https://ubuntu.com/security/CVE-2025-21750

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21750

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230393 - Linux Distros Unpatched Vulnerability : CVE-2025-21766
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipv4: use RCU protection in __ip_rt_update_pmtu() __ip_rt_update_pmtu() must use RCU protection to make sure the net structure it reads does not disappear. (CVE-2025-21766)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21766
https://security-tracker.debian.org/tracker/CVE-2025-21766
https://ubuntu.com/security/CVE-2025-21766

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21766

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231479 - Linux Distros Unpatched Vulnerability : CVE-2025-21767
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context The following bug report happened with a PREEMPT_RT kernel: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic():
1, irqs_disabled(): 0, non_block: 0, pid: 2012, name: kwatchdog preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 get_random_u32+0x4f/0x110 clocksource_verify_choose_cpus+0xab/0x1a0 clocksource_verify_percpu.part.0+0x6b/0x330 clocksource_watchdog_kthread+0x193/0x1a0 It is due to the fact that clocksource_verify_choose_cpus() is invoked with preemption disabled. This function invokes get_random_u32() to obtain random numbers for choosing CPUs. The batched_entropy_32 local lock and/or the base_crng.lock spinlock in driver/char/random.c will be acquired during the call. In PREEMPT_RT kernel, they are both sleeping locks and so cannot be acquired in atomic context. Fix this problem by using migrate_disable() to allow smp_processor_id() to be reliably used without introducing atomic context.
preempt_disable() is then called after clocksource_verify_choose_cpus() but before the clocksource measurement is being run to avoid introducing unexpected latency. (CVE-2025-21767)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21767
https://ubuntu.com/security/CVE-2025-21767

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21767

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230720 - Linux Distros Unpatched Vulnerability : CVE-2025-21768
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels Some lwtunnels have a dst cache for post- transformation dst. If the packet destination did not change we may end up recording a reference to the lwtunnel in its own cache, and the lwtunnel state will never be freed. Discovered by the ioam6.sh test, kmemleak was recently fixed to catch per-cpu memory leaks. I'm not sure if rpl and seg6 can actually hit this, but in principle I don't see why not. (CVE-2025-21768)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21768
https://security-tracker.debian.org/tracker/CVE-2025-21768
https://ubuntu.com/security/CVE-2025-21768

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21768

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230294 - Linux Distros Unpatched Vulnerability : CVE-2025-21770
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: iommu: Fix potential memory leak in iopf_queue_remove_device() The iopf_queue_remove_device() helper removes a device from the per-iommu iopf queue when PRI is disabled on the device. It responds to all outstanding iopf's with an IOMMU_PAGE_RESP_INVALID code and detaches the device from the queue. However, it fails to release the group structure that represents a group of iopf's awaiting for a response after responding to the hardware. This can cause a memory leak if iopf_queue_remove_device() is called with pending iopf's. Fix it by calling iopf_free_group() after the iopf group is responded. (CVE-2025-21770)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21770
https://ubuntu.com/security/CVE-2025-21770

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21770

Plugin Information
Published: 2025/03/06, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231113 - Linux Distros Unpatched Vulnerability : CVE-2025-21776
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- USB: hub: Ignore non-compliant devices with too many configs or interfaces Robert Morris created a test program which can cause usb_hub_to_struct_hub() to dereference a NULL or inappropriate pointer: Oops:
general protection fault, probably for non-canonical address 0xcccccccccccccccc: 0000 [#1] SMP DEBUG_PAGEALLOC PTI CPU: 7 UID: 0 PID: 117 Comm: kworker/7:1 Not tainted 6.13.0-rc3-00017-gf44d154d6e3d #14 Hardware name: FreeBSD BHYVE/BHYVE, BIOS 14.0 10/17/2021 Workqueue: usb_hub_wq hub_event RIP:
0010:usb_hub_adjust_deviceremovable+0x78/0x110 ... Call Trace: <TASK> ? die_addr+0x31/0x80 ? exc_general_protection+0x1b4/0x3c0 ? asm_exc_general_protection+0x26/0x30 ? usb_hub_adjust_deviceremovable+0x78/0x110 hub_probe+0x7c7/0xab0 usb_probe_interface+0x14b/0x350 really_probe+0xd0/0x2d0 ? __pfx___device_attach_driver+0x10/0x10 __driver_probe_device+0x6e/0x110 driver_probe_device+0x1a/0x90 __device_attach_driver+0x7e/0xc0 bus_for_each_drv+0x7f/0xd0
__device_attach+0xaa/0x1a0 bus_probe_device+0x8b/0xa0 device_add+0x62e/0x810 usb_set_configuration+0x65d/0x990 usb_generic_driver_probe+0x4b/0x70 usb_probe_device+0x36/0xd0 The cause of this error is that the device has two interfaces, and the hub driver binds to interface 1 instead of interface 0, which is where usb_hub_to_struct_hub() looks. We can prevent the problem from occurring by refusing to accept hub devices that violate the USB spec by having more than one configuration or interface. (CVE-2025-21776)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21776
https://ubuntu.com/security/CVE-2025-21776

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21776

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231667 - Linux Distros Unpatched Vulnerability : CVE-2025-21779
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel Advertise support for Hyper-V's SEND_IPI and SEND_IPI_EX hypercalls if and only if the local API is emulated/virtualized by KVM, and explicitly reject said hypercalls if the local APIC is emulated in userspace, i.e. don't rely on userspace to opt-in to KVM_CAP_HYPERV_ENFORCE_CPUID. Rejecting SEND_IPI and SEND_IPI_EX fixes a NULL- pointer dereference if Hyper-V enlightenments are exposed to the guest without an in-kernel local APIC:
dump_stack+0xbe/0xfd __kasan_report.cold+0x34/0x84 kasan_report+0x3a/0x50 __apic_accept_irq+0x3a/0x5c0 kvm_hv_send_ipi.isra.0+0x34e/0x820 kvm_hv_hypercall+0x8d9/0x9d0 kvm_emulate_hypercall+0x506/0x7e0
__vmx_handle_exit+0x283/0xb60 vmx_handle_exit+0x1d/0xd0 vcpu_enter_guest+0x16b0/0x24c0 vcpu_run+0xc0/0x550 kvm_arch_vcpu_ioctl_run+0x170/0x6d0 kvm_vcpu_ioctl+0x413/0xb20 __se_sys_ioctl+0x111/0x160 do_syscal1_64+0x30/0x40 entry_SYSCALL_64_after_hwframe+0x67/0xd1 Note, checking the sending vCPU is sufficient, as the per-VM irqchip_mode can't be modified after vCPUs are created, i.e. if one vCPU has an in-kernel local APIC, then all vCPUs have an in-kernel local APIC. (CVE-2025-21779)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21779
https://ubuntu.com/security/CVE-2025-21779

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21779

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230851 - Linux Distros Unpatched Vulnerability : CVE-2025-21783
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: gpiolib: Fix crash on error in gpiochip_get_ngpios() The gpiochip_get_ngpios() uses chip_*() macros to print messages. However these macros rely on gpiodev to be initialised and set, which is not the case when called via bgpio_init(). In such a case the printing messages will crash on NULL pointer dereference. Replace chip_*() macros by the respective dev_*() ones to avoid such crash. (CVE-2025-21783)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21783
https://ubuntu.com/security/CVE-2025-21783

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21783

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230446 - Linux Distros Unpatched Vulnerability : CVE-2025-21807
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- block: fix queue freeze vs limits lock order in sysfs store methods queue_attr_store() always freezes a device queue before calling the attribute store operation. For attributes that control queue limits, the store operation will also lock the queue limits with a call to queue_limits_start_update(). However, some drivers (e.g. SCSI sd) may need to issue commands to a device to obtain limit values from the hardware with the queue limits locked. This creates a potential ABBA deadlock situation if a user attempts to modify a limit (thus freezing the device queue) while the device driver starts a revalidation of the device queue limits. Avoid such deadlock by not freezing the queue before calling the ->store_limit() method in struct queue_sysfs_entry and instead use the queue_limits_commit_update_frozen helper to freeze the queue after taking the limits lock. This also removes taking the sysfs lock for the store_limit method as it doesn't protect anything here, but creates even more nesting. Hopefully it will go away from the actual sysfs methods entirely soon. (commit log adapted from a similar patch from Damien Le Moal) (CVE-2025-21807)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21807
https://security-tracker.debian.org/tracker/CVE-2025-21807
https://ubuntu.com/security/CVE-2025-21807

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21807

Plugin Information
Published: 2025/03/06, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230880 - Linux Distros Unpatched Vulnerability : CVE-2025-21808
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: xdp: Disallow attaching device- bound programs in generic mode Device-bound programs are used to support RX metadata kfuncs. These kfuncs are driver-specific and rely on the driver context to read the metadata. This means they can't work in generic XDP mode. However, there is no check to disallow such programs from being attached in generic mode, in which case the metadata kfuncs will be called in an invalid context, leading to crashes. Fix this by adding a check to disallow attaching device-bound programs in generic mode. (CVE-2025-21808)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21808
https://ubuntu.com/security/CVE-2025-21808

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21808

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230617 - Linux Distros Unpatched Vulnerability : CVE-2025-21809
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: rxrpc, afs: Fix peer hash locking vs RCU callback In its address list, afs now retains pointers to and refs on one or more rxrpc_peer objects.
The address list is freed under RCU and at this time, it puts the refs on those peers. Now, when an rxrpc_peer object runs out of refs, it gets removed from the peer hash table and, for that, rxrpc has to take a spinlock. However, it is now being called from afs's RCU cleanup, which takes place in BH context - but it is just taking an ordinary spinlock. The put may also be called from non-BH context, and so there exists the possibility of deadlock if the BH-based RCU cleanup happens whilst the hash spinlock is held.
This led to the attached lockdep complaint. Fix this by changing spinlocks of rxnet->peer_hash_lock back to BH-disabling locks. ================================ WARNING: inconsistent lock state 6.13.0-rc5-build2+ #1223 Tainted: G E -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN- SOFTIRQ-W} usage. swapper/1/0 [HC0[0]:SC1[1]:HE1:SE0] takes: ffff88810babe228 (&rxnet->peer_hash_lock){+.?.}-{3:3}, at: rxrpc_put_peer+0xcb/0x180 {SOFTIRQ-ON-W} state was registered at: mark_usage+0x164/0x180 __lock_acquire+0x544/0x990 lock_acquire.part.0+0x103/0x280
_raw_spin_lock+0x2f/0x40 rxrpc_peer_keepalive_worker+0x144/0x440 process_one_work+0x486/0x7c0 process_scheduled_works+0x73/0x90 worker_thread+0x1c8/0x2a0 kthread+0x19b/0x1b0 ret_from_fork+0x24/0x40 ret_from_fork_asm+0x1a/0x30 irq event stamp: 972402 hardirqs last enabled at (972402):
[<ffffffff8244360e>] _raw_spin_unlock_irqrestore+0x2e/0x50 hardirqs last disabled at (972401):
[<ffffffff82443328>] _raw_spin_lock_irqsave+0x18/0x60 softirqs last enabled at (972300):
[<ffffffff810ffbbe>] handle_softirqs+0x3ee/0x430 softirqs last disabled at (972313): [<ffffffff810ffc54>]
__irq_exit_rcu+0x44/0x110 other info that might help us debug this: Possible unsafe locking scenario: CPU0
---- lock(&rxnet->peer_hash_lock); <Interrupt> lock(&rxnet->peer_hash_lock); *** DEADLOCK *** 1 lock held by swapper/1/0: #0: ffffffff83576be0 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire+0x7/0x30 stack backtrace: CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G E 6.13.0-rc5-build2+ #1223 Tainted:
[E]=UNSIGNED_MODULE Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014 Call Trace: <IRQ>
dump_stack_lvl+0x57/0x80 print_usage_bug.part.0+0x227/0x240 valid_state+0x53/0x70 mark_lock_irq+0xa5/0x2f0 mark_lock+0xf7/0x170 mark_usage+0xe1/0x180 __lock_acquire+0x544/0x990 lock_acquire.part.0+0x103/0x280
_raw_spin_lock+0x2f/0x40 rxrpc_put_peer+0xcb/0x180 afs_free_addrlist+0x46/0x90 [kafs] rcu_do_batch+0x2d2/0x640 rcu_core+0x2f7/0x350 handle_softirqs+0x1ee/0x430 __irq_exit_rcu+0x44/0x110 irq_exit_rcu+0xa/0x30 sysvec_apic_timer_interrupt+0x7f/0xa0 </IRQ> (CVE-2025-21809)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21809
https://ubuntu.com/security/CVE-2025-21809

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21809

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230846 - Linux Distros Unpatched Vulnerability : CVE-2025-21810
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: driver core: class: Fix wild pointer dereferences in API class_dev_iter_next() There are a potential wild pointer dereferences issue regarding APIs class_dev_iter_(init|next|exit)(), as explained by below typical usage: // All members of @iter are wild pointers. struct class_dev_iter iter; // class_dev_iter_init(@iter, @class, ...) checks parameter @class for // potential class_to_subsys() error, and it returns void type and does // not initialize its output parameter @iter, so caller can not detect // the error and continues to invoke class_dev_iter_next(@iter) even if // @iter still contains wild pointers. class_dev_iter_init(&iter, ...);
// Dereference these wild pointers in @iter here once suffer the error. while (dev = class_dev_iter_next(&iter)) { ... }; // Also dereference these wild pointers here.
class_dev_iter_exit(&iter); Actually, all callers of these APIs have such usage pattern in kernel tree.
Fix by: - Initialize output parameter @iter by memset() in class_dev_iter_init() and give callers prompt by pr_crit() for the error. - Check if @iter is valid in class_dev_iter_next(). (CVE-2025-21810)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21810
https://ubuntu.com/security/CVE-2025-21810

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21810

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231288 - Linux Distros Unpatched Vulnerability : CVE-2025-21814
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ptp: Ensure info->enable callback is always set The ioctl and sysfs handlers unconditionally call the
->enable callback. Not all drivers implement that callback, leading to NULL dereferences. Example of affected drivers: ptp_s390.c, ptp_vclock.c and ptp_mock.c. Instead use a dummy callback if no better was specified by the driver. (CVE-2025-21814)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21814
https://ubuntu.com/security/CVE-2025-21814

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21814

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231503 - Linux Distros Unpatched Vulnerability : CVE-2025-21816
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING hrtimers are migrated away from the dying CPU to any online target at the CPUHP_AP_HRTIMERS_DYING stage in order not to delay bandwidth timers handling tasks involved in the CPU hotplug forward progress. However wakeups can still be performed by the outgoing CPU after CPUHP_AP_HRTIMERS_DYING. Those can result again in bandwidth timers being armed.
Depending on several considerations (crystal ball power management based election, earliest timer already enqueued, timer migration enabled or not), the target may eventually be the current CPU even if offline.
If that happens, the timer is eventually ignored. The most notable example is RCU which had to deal with each and every of those wake-ups by deferring them to an online CPU, along with related workarounds: _ e787644caf76 (rcu: Defer RCU kthreads wakeup when CPU is dying) _ 9139f93209d1 (rcu/nocb: Fix RT throttling hrtimer armed from offline CPU) _ f7345ccc62a4 (rcu/nocb: Fix rcuog wake-up from offline softirq) The problem isn't confined to RCU though as the stop machine kthread (which runs CPUHP_AP_HRTIMERS_DYING) reports its completion at the end of its work through cpu_stop_signal_done() and performs a wake up that eventually arms the deadline server timer: WARNING: CPU: 94 PID: 588 at kernel/time/hrtimer.c:1086 hrtimer_start_range_ns+0x289/0x2d0 CPU: 94 UID: 0 PID: 588 Comm: migration/94 Not tainted Stopper: multi_cpu_stop+0x0/0x120 <- stop_machine_cpuslocked+0x66/0xc0 RIP:
0010:hrtimer_start_range_ns+0x289/0x2d0 Call Trace: <TASK> start_dl_timer enqueue_dl_entity dl_server_start enqueue_task_fair enqueue_task ttwu_do_activate try_to_wake_up complete cpu_stopper_thread Instead of providing yet another bandaid to work around the situation, fix it in the hrtimers infrastructure instead: always migrate away a timer to an online target whenever it is enqueued from an offline CPU. This will also allow to revert all the above RCU disgraceful hacks. (CVE-2025-21816)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21816
https://security-tracker.debian.org/tracker/CVE-2025-21816
https://ubuntu.com/security/CVE-2025-21816

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21816

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230420 - Linux Distros Unpatched Vulnerability : CVE-2025-21817
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- block: mark GFP_NOIO around sysfs ->store() sysfs ->store is called with queue freezed, meantime we have several ->store() callbacks(update_nr_requests, wbt, scheduler) to allocate memory with GFP_KERNEL which may run into direct reclaim code path, then potential deadlock can be caused. Fix the issue by marking NOIO around sysfs ->store() (CVE-2025-21817)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21817
https://ubuntu.com/security/CVE-2025-21817

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21817

Plugin Information
Published: 2025/03/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
232271 - Linux Distros Unpatched Vulnerability : CVE-2025-21825
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT During the update procedure, when overwrite element in a pre-allocated htab, the freeing of old_element is protected by the bucket lock. The reason why the bucket lock is necessary is that the old_element has already been stashed in htab->extra_elems after alloc_htab_elem() returns. If freeing the old_element after the bucket lock is unlocked, the stashed element may be reused by concurrent update procedure and the freeing of old_element will run concurrently with the reuse of the old_element. However, the invocation of check_and_free_fields() may acquire a spin-lock which violates the lockdep rule because its caller has already held a raw-spin-lock (bucket lock). The following warning will be reported when such race happens:
BUG: scheduling while atomic: test_progs/676/0x00000003 3 locks held by test_progs/676: #0:
ffffffff864b0240 (rcu_read_lock_trace){....}-{0:0}, at: bpf_prog_test_run_syscall+0x2c0/0x830 #1:
ffff88810e961188 (&htab->lockdep_key){....}-{2:2}, at: htab_map_update_elem+0x306/0x1500 #2:
ffff8881f4eac1b8 (&base->softirq_expiry_lock){....}-{2:2}, at: hrtimer_cancel_wait_running+0xe9/0x1b0 Modules linked in: bpf_testmod(O) Preemption disabled at: [<ffffffff817837a3>] htab_map_update_elem+0x293/0x1500 CPU: 0 UID: 0 PID: 676 Comm: test_progs Tainted: G ... 6.12.0+ #11 Tainted: [W]=WARN, [O]=OOT_MODULE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)... Call Trace:
<TASK> dump_stack_lvl+0x57/0x70 dump_stack+0x10/0x20 __schedule_bug+0x120/0x170 __schedule+0x300c/0x4800 schedule_rtlock+0x37/0x60 rtlock_slowlock_locked+0x6d9/0x54c0 rt_spin_lock+0x168/0x230 hrtimer_cancel_wait_running+0xe9/0x1b0 hrtimer_cancel+0x24/0x30 bpf_timer_delete_work+0x1d/0x40 bpf_timer_cancel_and_free+0x5e/0x80 bpf_obj_free_fields+0x262/0x4a0 check_and_free_fields+0x1d0/0x280 htab_map_update_elem+0x7fc/0x1500 bpf_prog_9f90bc20768e0cb9_overwrite_cb+0x3f/0x43 bpf_prog_ea601c4649694dbd_overwrite_timer+0x5d/0x7e bpf_prog_test_run_syscall+0x322/0x830
__sys_bpf+0x135d/0x3ca0 __x64_sys_bpf+0x75/0xb0 x64_sys_call+0x1b5/0xa10 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ... </TASK> It seems feasible to break the reuse and refill of per-cpu extra_elems into two independent parts: reuse the per-cpu extra_elems with bucket lock being held and refill the old_element as per-cpu extra_elems after the bucket lock is unlocked. However, it will make the concurrent overwrite procedures on the same CPU return unexpected -E2BIG error when the map is full.
Therefore, the patch fixes the lock problem by breaking the cancelling of bpf_timer into two steps for PREEMPT_RT: 1) use hrtimer_try_to_cancel() and check its return value 2) if the timer is running, use hrtimer_cancel() through a kworker to cancel it again Considering that the current implementation of hrtimer_cancel() will try to acquire a being held softirq_expiry_lock when the current timer is running, these steps above are reasonable. However, it also has downside. When the timer is running, the cancelling of the timer is delayed when releasing the last map uref. The delay is also fixable (e.g., break the cancelling of bpf timer into two parts: one part in locked scope, another one in unlocked scope), it can be revised later if necessary. It is a bit hard to decide the right fix tag. One reason is that the problem depends on PREEMPT_RT which is enabled in v6.12. Considering the softirq_expiry_lock lock exists since v5.4 and bpf_timer is introduced in v5.15, the bpf_timer commit is used in the fixes tag and an extra depends-on tag is added to state the dependency on PREEMPT_RT. Depends-on: v6.12+ with PREEMPT_RT enabled (CVE-2025-21825)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21825
https://security-tracker.debian.org/tracker/CVE-2025-21825
https://ubuntu.com/security/CVE-2025-21825

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21825

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
232231 - Linux Distros Unpatched Vulnerability : CVE-2025-21827
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface() The documentation for usb_driver_claim_interface() says that the device lock is needed when the function is called from places other than probe(). This appears to be the lock for the USB interface device. The Mediatek btusb code gets called via this path: Workqueue: hci0 hci_power_on [bluetooth] Call trace: usb_driver_claim_interface btusb_mtk_claim_iso_intf btusb_mtk_setup hci_dev_open_sync hci_power_on process_scheduled_works worker_thread kthread With the above call trace the device lock hasn't been claimed. Claim it. Without this fix, we'd sometimes see the error Failed to claim iso interface. Sometimes we'd even see worse errors, like a NULL pointer dereference (where `intf->dev.driver` was NULL) with a trace like: Call trace: usb_suspend_both usb_runtime_suspend
__rpm_callback rpm_suspend pm_runtime_work process_scheduled_works Both errors appear to be fixed with the proper locking. (CVE-2025-21827)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21827
https://ubuntu.com/security/CVE-2025-21827

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21827

Plugin Information
Published: 2025/03/06, Modified: 2025/11/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
232237 - Linux Distros Unpatched Vulnerability : CVE-2025-21830
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: landlock: Handle weird files A corrupted filesystem (e.g. bcachefs) might return weird files. Instead of throwing a warning and allowing access to such file, treat them as regular files. (CVE-2025-21830)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21830
https://ubuntu.com/security/CVE-2025-21830

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21830

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
232276 - Linux Distros Unpatched Vulnerability : CVE-2025-21831
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 commit 9d26d3a8f1b0 (PCI: Put PCIe ports into D3 during suspend) sets the policy that all PCIe ports are allowed to use D3. When the system is suspended if the port is not power manageable by the platform and won't be used for wakeup via a PME this sets up the policy for these ports to go into D3hot. This policy generally makes sense from an OSPM perspective but it leads to problems with wakeup from suspend on the TUXEDO Sirius 16 Gen 1 with a specific old BIOS. This manifests as a system hang. On the affected Device + BIOS combination, add a quirk for the root port of the problematic controller to ensure that these root ports are not put into D3hot at suspend. This patch is based on https://lore.kernel.org/linux- pci/20230708214457.1229-2-mario.limonciello@amd.com but with the added condition both in the documentation and in the code to apply only to the TUXEDO Sirius 16 Gen 1 with a specific old BIOS and only the affected root ports. (CVE-2025-21831)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21831
https://security-tracker.debian.org/tracker/CVE-2025-21831
https://ubuntu.com/security/CVE-2025-21831

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21831

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
232265 - Linux Distros Unpatched Vulnerability : CVE-2025-21832
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- block: don't revert iter for -EIOCBQUEUED blkdev_read_iter() has a few odd checks, like gating the position and count adjustment on whether or not the result is bigger-than-or-equal to zero (where bigger than makes more sense), and not checking the return value of blkdev_direct_IO() before doing an iov_iter_revert(). The latter can lead to attempting to revert with a negative value, which when passed to iov_iter_revert() as an unsigned value will lead to throwing a WARN_ON() because unroll is bigger than MAX_RW_COUNT. Be sane and don't revert for -EIOCBQUEUED, like what is done in other spots.
(CVE-2025-21832)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21832
https://ubuntu.com/security/CVE-2025-21832

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21832

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
232261 - Linux Distros Unpatched Vulnerability : CVE-2025-21833
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE There is a WARN_ON_ONCE to catch an unlikely situation when domain_remove_dev_pasid can't find the `pasid`. In case it nevertheless happens we must avoid using a NULL pointer. (CVE-2025-21833)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21833
https://ubuntu.com/security/CVE-2025-21833

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21833

Plugin Information
Published: 2025/03/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246439 - Linux Distros Unpatched Vulnerability : CVE-2025-21836
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- io_uring/kbuf: reallocate buf lists on upgrade IORING_REGISTER_PBUF_RING can reuse an old struct io_buffer_list if it was created for legacy selected buffer and has been emptied. It violates the requirement that most of the field should stay stable after publish. Always reallocate it instead.
(CVE-2025-21836)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21836
https://security-tracker.debian.org/tracker/CVE-2025-21836
https://ubuntu.com/security/CVE-2025-21836

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21836

Plugin Information
Published: 2025/08/09, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249932 - Linux Distros Unpatched Vulnerability : CVE-2025-21838
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: gadget: core: flush gadget workqueue after device removal device_del() can lead to new work being scheduled in gadget->work workqueue. This is observed, for example, with the dwc3 driver with the following call stack: device_del() gadget_unbind_driver() usb_gadget_disconnect_locked() dwc3_gadget_pullup() dwc3_gadget_soft_disconnect() usb_gadget_set_state() schedule_work(&gadget->work) Move flush_work() after device_del() to ensure the workqueue is cleaned up. (CVE-2025-21838)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21838
https://security-tracker.debian.org/tracker/CVE-2025-21838
https://ubuntu.com/security/CVE-2025-21838

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21838

Plugin Information
Published: 2025/08/15, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243995 - Linux Distros Unpatched Vulnerability : CVE-2025-21852
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: Add rx_skb of kfree_skb to raw_tp_null_args[]. Yan Zhai reported a BPF prog could trigger a null-ptr-deref [0] in trace_kfree_skb if the prog does not check if rx_sk is NULL. Commit c53795d48ee8 (net: add rx_sk to trace_kfree_skb) added rx_sk to trace_kfree_skb, but rx_sk is optional and could be NULL. Let's add kfree_skb to raw_tp_null_args[] to let the BPF verifier validate such a prog and prevent the issue. Now we fail to load such a prog: libbpf: prog 'drop': -- BEGIN PROG LOAD LOG -- 0: R1=ctx() R10=fp0 ; int BPF_PROG(drop, struct sk_buff *skb, void *location, @ kfree_skb_sk_null.bpf.c:21 0: (79) r3 = *(u64 *)(r1 +24) func 'kfree_skb' arg3 has btf_id 5253 type STRUCT 'sock' 1: R1=ctx() R3_w=trusted_ptr_or_null_sock(id=1) ;
bpf_printk(sk: %d, %d , sk, sk->__sk_common.skc_family); @ kfree_skb_sk_null.bpf.c:24 1: (69) r4 =
*(u16 *)(r3 +16) R3 invalid mem access 'trusted_ptr_or_null_' processed 2 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 -- END PROG LOAD LOG -- Note this fix requires commit 838a10bd2ebf (bpf: Augment raw_tp arguments with PTR_MAYBE_NULL). [0]: BUG: kernel NULL pointer dereference, address: 0000000000000010 PF: supervisor read access in kernel mode PF:
error_code(0x0000) - not-present page PGD 0 P4D 0 PREEMPT SMP RIP:
0010:bpf_prog_5e21a6db8fcff1aa_drop+0x10/0x2d Call Trace: <TASK> ? __die+0x1f/0x60 ? page_fault_oops+0x148/0x420 ? search_bpf_extables+0x5b/0x70 ? fixup_exception+0x27/0x2c0 ? exc_page_fault+0x75/0x170 ? asm_exc_page_fault+0x22/0x30 ? bpf_prog_5e21a6db8fcff1aa_drop+0x10/0x2d bpf_trace_run4+0x68/0xd0 ? unix_stream_connect+0x1f4/0x6f0 sk_skb_reason_drop+0x90/0x120 unix_stream_connect+0x1f4/0x6f0 __sys_connect+0x7f/0xb0 __x64_sys_connect+0x14/0x20 do_syscall_64+0x47/0xc30 entry_SYSCALL_64_after_hwframe+0x4b/0x53 (CVE-2025-21852)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21852
https://ubuntu.com/security/CVE-2025-21852

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21852

Plugin Information
Published: 2025/08/06, Modified: 2025/11/24
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249750 - Linux Distros Unpatched Vulnerability : CVE-2025-21854
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: sockmap, vsock: For connectible sockets allow only connected sockmap expects all vsocks to have a transport assigned, which is expressed in vsock_proto::psock_update_sk_prot(). However, there is an edge case where an unconnected (connectible) socket may lose its previously assigned transport. This is handled with a NULL check in the vsock/BPF recv path. Another design detail is that listening vsocks are not supposed to have any transport assigned at all. Which implies they are not supported by the sockmap. But this is complicated by the fact that a socket, before switching to TCP_LISTEN, may have had some transport assigned during a failed connect() attempt. Hence, we may end up with a listening vsock in a sockmap, which blows up quickly: KASAN: null- ptr-deref in range [0x0000000000000120-0x0000000000000127] CPU: 7 UID: 0 PID: 56 Comm: kworker/7:0 Not tainted 6.14.0-rc1+ Workqueue: vsock-loopback vsock_loopback_work RIP: 0010:vsock_read_skb+0x4b/0x90 Call Trace: sk_psock_verdict_data_ready+0xa4/0x2e0 virtio_transport_recv_pkt+0x1ca8/0x2acc vsock_loopback_work+0x27d/0x3f0 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x35a/0x700 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 For connectible sockets, instead of relying solely on the state of vsk->transport, tell sockmap to only allow those representing established connections. This aligns with the behaviour for AF_INET and AF_UNIX. (CVE-2025-21854)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21854
https://ubuntu.com/security/CVE-2025-21854

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21854

Plugin Information
Published: 2025/08/15, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246896 - Linux Distros Unpatched Vulnerability : CVE-2025-21857
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: fix error handling causing NULL dereference tcf_exts_miss_cookie_base_alloc() calls xa_alloc_cyclic() which can return 1 if the allocation succeeded after wrapping. This was treated as an error, with value 1 returned to caller tcf_exts_init_ex() which sets exts->actions to NULL and returns 1 to caller fl_change(). fl_change() treats err == 1 as success, calling tcf_exts_validate_ex() which calls tcf_action_init() with exts->actions as argument, where it is dereferenced. Example trace: BUG: kernel NULL pointer dereference, address: 0000000000000000 CPU: 114 PID: 16151 Comm: handler114 Kdump: loaded Not tainted 5.14.0-503.16.1.el9_5.x86_64 #1 RIP: 0010:tcf_action_init+0x1f8/0x2c0 Call Trace:
tcf_action_init+0x1f8/0x2c0 tcf_exts_validate_ex+0x175/0x190 fl_change+0x537/0x1120 [cls_flower] (CVE-2025-21857)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21857
https://ubuntu.com/security/CVE-2025-21857

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21857

Plugin Information
Published: 2025/08/09, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247578 - Linux Distros Unpatched Vulnerability : CVE-2025-21862
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drop_monitor: fix incorrect initialization order Syzkaller reports the following bug: BUG: spinlock bad magic on CPU#1, syz-executor.0/7995 lock: 0xffff88805303f3e0, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0 CPU: 1 PID: 7995 Comm: syz-executor.0 Tainted: G E 5.10.209+ #1 Hardware name: VMware, Inc.
VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x119/0x179 lib/dump_stack.c:118 debug_spin_lock_before kernel/locking/spinlock_debug.c:83 [inline] do_raw_spin_lock+0x1f6/0x270 kernel/locking/spinlock_debug.c:112 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:117 [inline]
_raw_spin_lock_irqsave+0x50/0x70 kernel/locking/spinlock.c:159 reset_per_cpu_data+0xe6/0x240 [drop_monitor] net_dm_cmd_trace+0x43d/0x17a0 [drop_monitor] genl_family_rcv_msg_doit+0x22f/0x330 net/netlink/genetlink.c:739 genl_family_rcv_msg net/netlink/genetlink.c:783 [inline] genl_rcv_msg+0x341/0x5a0 net/netlink/genetlink.c:800 netlink_rcv_skb+0x14d/0x440 net/netlink/af_netlink.c:2497 genl_rcv+0x29/0x40 net/netlink/genetlink.c:811 netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline] netlink_unicast+0x54b/0x800 net/netlink/af_netlink.c:1348 netlink_sendmsg+0x914/0xe00 net/netlink/af_netlink.c:1916 sock_sendmsg_nosec net/socket.c:651 [inline]
__sock_sendmsg+0x157/0x190 net/socket.c:663 ____sys_sendmsg+0x712/0x870 net/socket.c:2378
___sys_sendmsg+0xf8/0x170 net/socket.c:2432 __sys_sendmsg+0xea/0x1b0 net/socket.c:2461 do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x62/0xc7 RIP:
0033:0x7f3f9815aee9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f3f972bf0c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX:
00007f3f9826d050 RCX: 00007f3f9815aee9 RDX: 0000000020000000 RSI: 0000000020001300 RDI: 0000000000000007 RBP: 00007f3f981b63bd R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11:
0000000000000246 R12: 0000000000000000 R13: 000000000000006e R14: 00007f3f9826d050 R15: 00007ffe01ee6768 If drop_monitor is built as a kernel module, syzkaller may have time to send a netlink NET_DM_CMD_START message during the module loading. This will call the net_dm_monitor_start() function that uses a spinlock that has not yet been initialized. To fix this, let's place resource initialization above the registration of a generic netlink family. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with Syzkaller. (CVE-2025-21862)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21862
https://ubuntu.com/security/CVE-2025-21862

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21862

Plugin Information
Published: 2025/08/10, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247033 - Linux Distros Unpatched Vulnerability : CVE-2025-21866
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC Erhard reported the following KASAN hit while booting his PowerMac G4 with a KASAN-enabled kernel 6.13-rc6: BUG: KASAN:
vmalloc-out-of-bounds in copy_to_kernel_nofault+0xd8/0x1c8 Write of size 8 at addr f1000000 by task chronyd/1293 CPU: 0 UID: 123 PID: 1293 Comm: chronyd Tainted: G W 6.13.0-rc6-PMacG4 #2 Tainted: [W]=WARN Hardware name: PowerMac3,6 7455 0x80010303 PowerMac Call Trace: [c2437590] [c1631a84] dump_stack_lvl+0x70/0x8c (unreliable) [c24375b0] [c0504998] print_report+0xdc/0x504 [c2437610] [c050475c] kasan_report+0xf8/0x108 [c2437690] [c0505a3c] kasan_check_range+0x24/0x18c [c24376a0] [c03fb5e4] copy_to_kernel_nofault+0xd8/0x1c8 [c24376c0] [c004c014] patch_instructions+0x15c/0x16c [c2437710] [c00731a8] bpf_arch_text_copy+0x60/0x7c [c2437730] [c0281168] bpf_jit_binary_pack_finalize+0x50/0xac [c2437750] [c0073cf4] bpf_int_jit_compile+0xb30/0xdec [c2437880] [c0280394] bpf_prog_select_runtime+0x15c/0x478 [c24378d0] [c1263428] bpf_prepare_filter+0xbf8/0xc14 [c2437990] [c12677ec] bpf_prog_create_from_user+0x258/0x2b4 [c24379d0] [c027111c] do_seccomp+0x3dc/0x1890 [c2437ac0] [c001d8e0] system_call_exception+0x2dc/0x420 [c2437f30] [c00281ac] ret_from_syscall+0x0/0x2c --- interrupt: c00 at 0x5a1274 NIP: 005a1274 LR: 006a3b3c CTR: 005296c8 REGS: c2437f40 TRAP: 0c00 Tainted: G W (6.13.0-rc6-PMacG4) MSR: 0200f932 <VEC,EE,PR,FP,ME,IR,DR,RI> CR: 24004422 XER: 00000000 GPR00: 00000166 af8f3fa0 a7ee3540 00000001 00000000 013b6500 005a5858 0200f932 GPR08: 00000000 00001fe9 013d5fc8 005296c8 2822244c 00b2fcd8 00000000 af8f4b57 GPR16: 00000000 00000001 00000000 00000000 00000000 00000001 00000000 00000002 GPR24: 00afdbb0 00000000 00000000 00000000 006e0004 013ce060 006e7c1c 00000001 NIP [005a1274] 0x5a1274 LR [006a3b3c] 0x6a3b3c --- interrupt: c00 The buggy address belongs to the virtual mapping at [f1000000, f1002000) created by: text_area_cpu_up+0x20/0x190 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:00000000 index:0x0 pfn:0x76e30 flags: 0x80000000(zone=2) raw:
80000000 00000000 00000122 00000000 00000000 00000000 ffffffff 00000001 raw: 00000000 page dumped because:
kasan: bad access detected Memory state around the buggy address: f0ffff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0ffff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >f1000000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ f1000080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f1000100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ================================================================== f8 corresponds to KASAN_VMALLOC_INVALID which means the area is not initialised hence not supposed to be used yet. Powerpc text patching infrastructure allocates a virtual memory area using get_vm_area() and flags it as VM_ALLOC. But that flag is meant to be used for vmalloc() and vmalloc() allocated memory is not supposed to be used before a call to __vmalloc_node_range() which is never called for that area. That went undetected until commit e4137f08816b (mm, kasan, kmsan: instrument copy_from/to_kernel_nofault) The area allocated by text_area_cpu_up() is not vmalloc memory, it is mapped directly on demand when needed by map_kernel_page(). There is no VM flag corresponding to such usage, so just pass no flag. That way the area will be unpoisonned and usable immediately. (CVE-2025-21866)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21866
https://security-tracker.debian.org/tracker/CVE-2025-21866
https://ubuntu.com/security/CVE-2025-21866

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:M/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21866

Plugin Information
Published: 2025/08/09, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246964 - Linux Distros Unpatched Vulnerability : CVE-2025-21870
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers Other, non DAI copier widgets could have the same stream name (sname) as the ALH copier and in that case the copier->data is NULL, no alh_data is attached, which could lead to NULL pointer dereference. We could check for this NULL pointer in sof_ipc4_prepare_copier_module() and avoid the crash, but a similar loop in sof_ipc4_widget_setup_comp_dai() will miscalculate the ALH device count, causing broken audio. The correct fix is to harden the matching logic by making sure that the 1. widget is a DAI widget - so dai = w->private is valid 2. the dai (and thus the copier) is ALH copier (CVE-2025-21870)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21870
https://security-tracker.debian.org/tracker/CVE-2025-21870
https://ubuntu.com/security/CVE-2025-21870

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21870

Plugin Information
Published: 2025/08/09, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244639 - Linux Distros Unpatched Vulnerability : CVE-2025-21872
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- efi: Don't map the entire mokvar table to determine its size Currently, when validating the mokvar table, we (re)map the entire table on each iteration of the loop, adding space as we discover new entries. If the table grows over a certain size, this fails due to limitations of early_memmap(), and we get a failure and traceback: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 0 at mm/early_ioremap.c:139
__early_ioremap+0xef/0x220 ... Call Trace: <TASK> ? __early_ioremap+0xef/0x220 ? __warn.cold+0x93/0xfa ?
__early_ioremap+0xef/0x220 ? report_bug+0xff/0x140 ? early_fixup_exception+0x5d/0xb0 ? early_idt_handler_common+0x2f/0x3a ? __early_ioremap+0xef/0x220 ? efi_mokvar_table_init+0xce/0x1d0 ? setup_arch+0x864/0xc10 ? start_kernel+0x6b/0xa10 ? x86_64_start_reservations+0x24/0x30 ? x86_64_start_kernel+0xed/0xf0 ? common_startup_64+0x13e/0x141 </TASK> ---[ end trace 0000000000000000 ]--- mokvar: Failed to map EFI MOKvar config table pa=0x7c4c3000, size=265187. Mapping the entire structure isn't actually necessary, as we don't ever need more than one entry header mapped at once. Changes efi_mokvar_table_init() to only map each entry header, not the entire table, when determining the table size. Since we're not mapping any data past the variable name, it also changes the code to enforce that each variable name is NUL terminated, rather than attempting to verify it in place. (CVE-2025-21872)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21872
https://security-tracker.debian.org/tracker/CVE-2025-21872
https://ubuntu.com/security/CVE-2025-21872

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21872

Plugin Information
Published: 2025/08/07, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249571 - Linux Distros Unpatched Vulnerability : CVE-2025-21874
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: dm-integrity: Avoid divide by zero in table status in Inline mode In Inline mode, the journal is unused, and journal_sectors is zero.
Calculating the journal watermark requires dividing by journal_sectors, which should be done only if the journal is configured. Otherwise, a simple table query (dmsetup table) can cause OOPS. This bug did not show on some systems, perhaps only due to compiler optimization. On my 32-bit testing machine, this reliably crashes with the following: : Oops: divide error: 0000 [#1] PREEMPT SMP : CPU: 0 UID: 0 PID: 2450 Comm: dmsetup Not tainted 6.14.0-rc2+ #959 : EIP: dm_integrity_status+0x2f8/0xab0 [dm_integrity] ...
(CVE-2025-21874)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21874
https://ubuntu.com/security/CVE-2025-21874

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21874

Plugin Information
Published: 2025/08/15, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247687 - Linux Distros Unpatched Vulnerability : CVE-2025-21875
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mptcp: always handle address removal under msk socket lock Syzkaller reported a lockdep splat in the PM control path: WARNING: CPU: 0 PID: 6693 at ./include/net/sock.h:1711 sock_owned_by_me include/net/sock.h:1711 [inline] WARNING: CPU: 0 PID: 6693 at ./include/net/sock.h:1711 msk_owned_by_me net/mptcp/protocol.h:363 [inline] WARNING: CPU: 0 PID: 6693 at ./include/net/sock.h:1711 mptcp_pm_nl_addr_send_ack+0x57c/0x610 net/mptcp/pm_netlink.c:788 Modules linked in: CPU: 0 UID: 0 PID: 6693 Comm: syz.0.205 Not tainted 6.14.0-rc2-syzkaller-00303-gad1b832bf1cf #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 RIP:
0010:sock_owned_by_me include/net/sock.h:1711 [inline] RIP: 0010:msk_owned_by_me net/mptcp/protocol.h:363 [inline] RIP: 0010:mptcp_pm_nl_addr_send_ack+0x57c/0x610 net/mptcp/pm_netlink.c:788 Code: 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc e8 ca 7b d3 f5 eb b9 e8 c3 7b d3 f5 90 0f 0b 90 e9 dd fb ff ff e8 b5 7b d3 f5 90 <0f> 0b 90 e9 3e fb ff ff 44 89 f1 80 e1 07 38 c1 0f 8c eb fb ff ff RSP: 0000:ffffc900034f6f60 EFLAGS: 00010283 RAX: ffffffff8bee3c2b RBX: 0000000000000001 RCX: 0000000000080000 RDX: ffffc90004d42000 RSI: 000000000000a407 RDI: 000000000000a408 RBP: ffffc900034f7030 R08: ffffffff8bee37f6 R09:
0100000000000000 R10: dffffc0000000000 R11: ffffed100bcc62e4 R12: ffff88805e6316e0 R13: ffff88805e630c00 R14: dffffc0000000000 R15: ffff88805e630c00 FS: 00007f7e9a7e96c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2fd18ff8 CR3:
0000000032c24000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK>
mptcp_pm_remove_addr+0x103/0x1d0 net/mptcp/pm.c:59 mptcp_pm_remove_anno_addr+0x1f4/0x2f0 net/mptcp/pm_netlink.c:1486 mptcp_nl_remove_subflow_and_signal_addr net/mptcp/pm_netlink.c:1518 [inline] mptcp_pm_nl_del_addr_doit+0x118d/0x1af0 net/mptcp/pm_netlink.c:1629 genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0xb1f/0xec0 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x206/0x480 net/netlink/af_netlink.c:2543 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1348 netlink_sendmsg+0x8de/0xcb0 net/netlink/af_netlink.c:1892 sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:733 ____sys_sendmsg+0x53a/0x860 net/socket.c:2573 ___sys_sendmsg net/socket.c:2627 [inline] __sys_sendmsg+0x269/0x350 net/socket.c:2659 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f7e9998cde9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f7e9a7e9038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f7e99ba5fa0 RCX: 00007f7e9998cde9 RDX:
000000002000c094 RSI: 0000400000000000 RDI: 0000000000000007 RBP: 00007f7e99a0e2a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13:
0000000000000000 R14: 00007f7e99ba5fa0 R15: 00007fff49231088 Indeed the PM can try to send a RM_ADDR over a msk without acquiring first the msk socket lock. The bugged code-path comes from an early optimization:
when there are no subflows, the PM should (usually) not send RM_ADDR notifications. The above statement is incorrect, as without locks another process could concur ---truncated--- (CVE-2025-21875)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21875
https://ubuntu.com/security/CVE-2025-21875

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21875

Plugin Information
Published: 2025/08/10, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248646 - Linux Distros Unpatched Vulnerability : CVE-2025-21876
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix suspicious RCU usage Commit <d74169ceb0d2> (iommu/vt-d: Allocate DMAR fault interrupts locally) moved the call to enable_drhd_fault_handling() to a code path that does not hold any lock while traversing the drhd list.
Fix it by ensuring the dmar_global_lock lock is held when traversing the drhd list. Without this fix, the following warning is triggered: ============================= WARNING: suspicious RCU usage 6.14.0-rc3 #55 Not tainted ----------------------------- drivers/iommu/intel/dmar.c:2046 RCU-list traversed in non-reader section!! other info that might help us debug this: rcu_scheduler_active = 1, debug_locks = 1 2 locks held by cpuhp/1/23: #0: ffffffff84a67c50 (cpu_hotplug_lock){++++}-{0:0}, at: cpuhp_thread_fun+0x87/0x2c0 #1:
ffffffff84a6a380 (cpuhp_state-up){+.+.}-{0:0}, at: cpuhp_thread_fun+0x87/0x2c0 stack backtrace: CPU: 1 UID: 0 PID: 23 Comm: cpuhp/1 Not tainted 6.14.0-rc3 #55 Call Trace: <TASK> dump_stack_lvl+0xb7/0xd0 lockdep_rcu_suspicious+0x159/0x1f0 ? __pfx_enable_drhd_fault_handling+0x10/0x10 enable_drhd_fault_handling+0x151/0x180 cpuhp_invoke_callback+0x1df/0x990 cpuhp_thread_fun+0x1ea/0x2c0 smpboot_thread_fn+0x1f5/0x2e0 ? __pfx_smpboot_thread_fn+0x10/0x10 kthread+0x12a/0x2d0 ?
__pfx_kthread+0x10/0x10 ret_from_fork+0x4a/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Holding the lock in enable_drhd_fault_handling() triggers a lockdep splat about a possible deadlock between dmar_global_lock and cpu_hotplug_lock. This is avoided by not holding dmar_global_lock when calling iommu_device_register(), which initiates the device probe process. (CVE-2025-21876)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21876
https://ubuntu.com/security/CVE-2025-21876

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21876

Plugin Information
Published: 2025/08/12, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247597 - Linux Distros Unpatched Vulnerability : CVE-2025-21877
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usbnet: gl620a: fix endpoint checking in genelink_bind() Syzbot reports [1] a warning in usb_submit_urb() triggered by inconsistencies between expected and actually present endpoints in gl620a driver. Since genelink_bind() does not properly verify whether specified eps are in fact provided by the device, in this case, an artificially manufactured one, one may get a mismatch. Fix the issue by resorting to a usbnet utility function usbnet_get_endpoints(), usually reserved for this very problem. Check for endpoints and return early before proceeding further if any are missing. [1] Syzbot report: usb 5-1: Manufacturer: syz usb 5-1: SerialNumber: syz usb 5-1: config 0 descriptor?? gl620a 5-1:0.23 usb0: register 'gl620a' at usb- dummy_hcd.0-1, ... ------------[ cut here ]------------ usb 5-1: BOGUS urb xfer, pipe 3 != type 1 WARNING:
CPU: 2 PID: 1841 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503 Modules linked in: CPU: 2 UID: 0 PID: 1841 Comm: kworker/2:2 Not tainted 6.12.0-syzkaller-07834-g06afb0f36106 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: mld mld_ifc_work RIP:
0010:usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503 ... Call Trace: <TASK>
usbnet_start_xmit+0x6be/0x2780 drivers/net/usb/usbnet.c:1467 __netdev_start_xmit include/linux/netdevice.h:5002 [inline] netdev_start_xmit include/linux/netdevice.h:5011 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x9a/0x7b0 net/core/dev.c:3606 sch_direct_xmit+0x1ae/0xc30 net/sched/sch_generic.c:343 __dev_xmit_skb net/core/dev.c:3827 [inline]
__dev_queue_xmit+0x13d4/0x43e0 net/core/dev.c:4400 dev_queue_xmit include/linux/netdevice.h:3168 [inline] neigh_resolve_output net/core/neighbour.c:1514 [inline] neigh_resolve_output+0x5bc/0x950 net/core/neighbour.c:1494 neigh_output include/net/neighbour.h:539 [inline] ip6_finish_output2+0xb1b/0x2070 net/ipv6/ip6_output.c:141 __ip6_finish_output net/ipv6/ip6_output.c:215 [inline] ip6_finish_output+0x3f9/0x1360 net/ipv6/ip6_output.c:226 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x1f8/0x540 net/ipv6/ip6_output.c:247 dst_output include/net/dst.h:450 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] mld_sendpack+0x9f0/0x11d0 net/ipv6/mcast.c:1819 mld_send_cr net/ipv6/mcast.c:2120 [inline] mld_ifc_work+0x740/0xca0 net/ipv6/mcast.c:2651 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> (CVE-2025-21877)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21877
https://ubuntu.com/security/CVE-2025-21877

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21877

Plugin Information
Published: 2025/08/10, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246366 - Linux Distros Unpatched Vulnerability : CVE-2025-21880
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/xe/userptr: fix EFAULT handling Currently we treat EFAULT from hmm_range_fault() as a non-fatal error when called from xe_vm_userptr_pin() with the idea that we want to avoid killing the entire vm and chucking an error, under the assumption that the user just did an unmap or something, and has no intention of actually touching that memory from the GPU. At this point we have already zapped the PTEs so any access should generate a page fault, and if the pin fails there also it will then become fatal. However it looks like it's possible for the userptr vma to still be on the rebind list in preempt_rebind_work_func(), if we had to retry the pin again due to something happening in the caller before we did the rebind step, but in the meantime needing to re- validate the userptr and this time hitting the EFAULT. This explains an internal user report of hitting: [ 191.738349] WARNING: CPU: 1 PID: 157 at drivers/gpu/drm/xe/xe_res_cursor.h:158 xe_pt_stage_bind.constprop.0+0x60a/0x6b0 [xe] [ 191.738551] Workqueue: xe-ordered-wq preempt_rebind_work_func [xe] [ 191.738616] RIP: 0010:xe_pt_stage_bind.constprop.0+0x60a/0x6b0 [xe] [ 191.738690] Call Trace: [ 191.738692] <TASK> [ 191.738694] ? show_regs+0x69/0x80 [ 191.738698] ?
__warn+0x93/0x1a0 [ 191.738703] ? xe_pt_stage_bind.constprop.0+0x60a/0x6b0 [xe] [ 191.738759] ? report_bug+0x18f/0x1a0 [ 191.738764] ? handle_bug+0x63/0xa0 [ 191.738767] ? exc_invalid_op+0x19/0x70 [ 191.738770] ? asm_exc_invalid_op+0x1b/0x20 [ 191.738777] ? xe_pt_stage_bind.constprop.0+0x60a/0x6b0 [xe] [ 191.738834] ? ret_from_fork_asm+0x1a/0x30 [ 191.738849] bind_op_prepare+0x105/0x7b0 [xe] [ 191.738906] ? dma_resv_reserve_fences+0x301/0x380 [ 191.738912] xe_pt_update_ops_prepare+0x28c/0x4b0 [xe] [ 191.738966] ? kmemleak_alloc+0x4b/0x80 [ 191.738973] ops_execute+0x188/0x9d0 [xe] [ 191.739036] xe_vm_rebind+0x4ce/0x5a0 [xe] [ 191.739098] ? trace_hardirqs_on+0x4d/0x60 [ 191.739112] preempt_rebind_work_func+0x76f/0xd00 [xe] Followed by NPD, when running some workload, since the sg was never actually populated but the vma is still marked for rebind when it should be skipped for this special EFAULT case. This is confirmed to fix the user report. v2 (MattB): - Move earlier. v3 (MattB): - Update the commit message to make it clear that this indeed fixes the issue. (cherry picked from commit 6b93cb98910c826c2e2004942f8b060311e43618) (CVE-2025-21880)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21880
https://ubuntu.com/security/CVE-2025-21880

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21880

Plugin Information
Published: 2025/08/08, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244694 - Linux Distros Unpatched Vulnerability : CVE-2025-21881
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- uprobes: Reject the shared zeropage in uprobe_write_opcode() We triggered the following crash in syzkaller tests: BUG: Bad page state in process syz.7.38 pfn:1eff3 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eff3 flags:
0x3fffff00004004(referenced|reserved|node=0|zone=1|lastcpupid=0x1fffff) raw: 003fffff00004004 ffffe6c6c07bfcc8 ffffe6c6c07bfcc8 0000000000000000 raw: 0000000000000000 0000000000000000 00000000fffffffe 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x32/0x50 bad_page+0x69/0xf0 free_unref_page_prepare+0x401/0x500 free_unref_page+0x6d/0x1b0 uprobe_write_opcode+0x460/0x8e0 install_breakpoint.part.0+0x51/0x80 register_for_each_vma+0x1d9/0x2b0
__uprobe_register+0x245/0x300 bpf_uprobe_multi_link_attach+0x29b/0x4f0 link_create+0x1e2/0x280
__sys_bpf+0x75f/0xac0 __x64_sys_bpf+0x1a/0x30 do_syscall_64+0x56/0x100 entry_SYSCALL_64_after_hwframe+0x78/0xe2 BUG: Bad rss-counter state mm:00000000452453e0 type:MM_FILEPAGES val:-1 The following syzkaller test case can be used to reproduce: r2 = creat(&(0x7f0000000000)='./file0\x00', 0x8) write$nbd(r2, &(0x7f0000000580)=ANY=[], 0x10) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x12, r4, 0x0) r5 = userfaultfd(0x80801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x20}) r6 = userfaultfd(0x80801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2}) ioctl$UFFDIO_ZEROPAGE(r5, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x2, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB=1800000000120000000000000000000095], &(0x7f0000000000)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r7, 0x0, 0x30, 0x1e, @val=@uprobe_multi={&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=[0x2], 0x0, 0x0, 0x1}}, 0x40) The cause is that zero pfn is set to the PTE without increasing the RSS count in mfill_atomic_pte_zeropage() and the refcount of zero folio does not increase accordingly. Then, the operation on the same pfn is performed in uprobe_write_opcode()->__replace_page() to unconditional decrease the RSS count and old_folio's refcount. Therefore, two bugs are introduced: 1. The RSS count is incorrect, when process exit, the check_mm() report error Bad rss-count. 2. The reserved folio (zero folio) is freed when folio->refcount is zero, then free_pages_prepare->free_page_is_bad() report error Bad page state. There is more, the following warning could also theoretically be triggered: __replace_page() -> ... ->
folio_remove_rmap_pte() -> VM_WARN_ON_FOLIO(is_zero_folio(folio), folio) Considering that uprobe hit on the zero folio is a very rare case, just reject zero old folio immediately after get_user_page_vma_remote(). [ mingo: Cleaned up the changelog ] (CVE-2025-21881)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21881
https://security-tracker.debian.org/tracker/CVE-2025-21881
https://ubuntu.com/security/CVE-2025-21881

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21881

Plugin Information
Published: 2025/08/07, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245603 - Linux Distros Unpatched Vulnerability : CVE-2025-21884
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: better track kernel sockets lifetime While kernel sockets are dismantled during pernet_operations->exit(), their freeing can be delayed by any tx packets still held in qdisc or device queues, due to skb_set_owner_w() prior calls. This then trigger the following warning from ref_tracker_dir_exit() [1] To fix this, make sure that kernel sockets own a reference on net->passive. Add sk_net_refcnt_upgrade() helper, used whenever a kernel socket is converted to a refcounted one. [1] [ 136.263918][ T35] ref_tracker: net notrefcnt@ffff8880638f01e0 has 1/2 users at [ 136.263918][ T35] sk_alloc+0x2b3/0x370 [ 136.263918][ T35] inet6_create+0x6ce/0x10f0 [ 136.263918][ T35]
__sock_create+0x4c0/0xa30 [ 136.263918][ T35] inet_ctl_sock_create+0xc2/0x250 [ 136.263918][ T35] igmp6_net_init+0x39/0x390 [ 136.263918][ T35] ops_init+0x31e/0x590 [ 136.263918][ T35] setup_net+0x287/0x9e0 [ 136.263918][ T35] copy_net_ns+0x33f/0x570 [ 136.263918][ T35] create_new_namespaces+0x425/0x7b0 [ 136.263918][ T35] unshare_nsproxy_namespaces+0x124/0x180 [ 136.263918][ T35] ksys_unshare+0x57d/0xa70 [ 136.263918][ T35] __x64_sys_unshare+0x38/0x40 [ 136.263918][ T35] do_syscall_64+0xf3/0x230 [ 136.263918][ T35] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.263918][ T35] [ 136.343488][ T35] ref_tracker: net notrefcnt@ffff8880638f01e0 has 1/2 users at [ 136.343488][ T35] sk_alloc+0x2b3/0x370 [ 136.343488][ T35] inet6_create+0x6ce/0x10f0 [ 136.343488][ T35]
__sock_create+0x4c0/0xa30 [ 136.343488][ T35] inet_ctl_sock_create+0xc2/0x250 [ 136.343488][ T35] ndisc_net_init+0xa7/0x2b0 [ 136.343488][ T35] ops_init+0x31e/0x590 [ 136.343488][ T35] setup_net+0x287/0x9e0 [ 136.343488][ T35] copy_net_ns+0x33f/0x570 [ 136.343488][ T35] create_new_namespaces+0x425/0x7b0 [ 136.343488][ T35] unshare_nsproxy_namespaces+0x124/0x180 [ 136.343488][ T35] ksys_unshare+0x57d/0xa70 [ 136.343488][ T35] __x64_sys_unshare+0x38/0x40 [ 136.343488][ T35] do_syscall_64+0xf3/0x230 [ 136.343488][ T35] entry_SYSCALL_64_after_hwframe+0x77/0x7f (CVE-2025-21884)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21884
https://ubuntu.com/security/CVE-2025-21884

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21884

Plugin Information
Published: 2025/08/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249600 - Linux Distros Unpatched Vulnerability : CVE-2025-21885
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers While using nvme target with use_srq on, below kernel panic is noticed. [ 549.698111] bnxt_en 0000:41:00.0 enp65s0np0: FEC autoneg off encoding: Clause 91 RS(544,514) [ 566.393619] Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI .. [ 566.393799] <TASK> [ 566.393807] ? __die_body+0x1a/0x60 [ 566.393823] ? die+0x38/0x60 [ 566.393835] ? do_trap+0xe4/0x110 [ 566.393847] ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re] [ 566.393867] ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re] [ 566.393881] ? do_error_trap+0x7c/0x120 [ 566.393890] ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re] [ 566.393911] ? exc_divide_error+0x34/0x50 [ 566.393923] ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re] [ 566.393939] ? asm_exc_divide_error+0x16/0x20 [ 566.393966] ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re] [ 566.393997] bnxt_qplib_create_srq+0xc9/0x340 [bnxt_re] [ 566.394040] bnxt_re_create_srq+0x335/0x3b0 [bnxt_re] [ 566.394057] ? srso_return_thunk+0x5/0x5f [ 566.394068] ? __init_swait_queue_head+0x4a/0x60 [ 566.394090] ib_create_srq_user+0xa7/0x150 [ib_core] [ 566.394147] nvmet_rdma_queue_connect+0x7d0/0xbe0 [nvmet_rdma] [ 566.394174] ? lock_release+0x22c/0x3f0 [ 566.394187] ? srso_return_thunk+0x5/0x5f Page size and shift info is set only for the user space SRQs. Set page size and page shift for kernel space SRQs also.
(CVE-2025-21885)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21885
https://security-tracker.debian.org/tracker/CVE-2025-21885
https://ubuntu.com/security/CVE-2025-21885

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21885

Plugin Information
Published: 2025/08/15, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248877 - Linux Distros Unpatched Vulnerability : CVE-2025-21886
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix implicit ODP hang on parent deregistration Fix the destroy_unused_implicit_child_mr() to prevent hanging during parent deregistration as of below [1]. Upon entering destroy_unused_implicit_child_mr(), the reference count for the implicit MR parent is incremented using: refcount_inc_not_zero(). A corresponding decrement must be performed if free_implicit_child_mr_work() is not called. The code has been updated to properly manage the reference count that was incremented. [1] INFO: task python3:2157 blocked for more than 120 seconds. Not tainted 6.12.0-rc7+ #1633 echo 0 > /proc/sys/kernel/hung_task_timeout_secs disables this message.
task:python3 state:D stack:0 pid:2157 tgid:2157 ppid:1685 flags:0x00000000 Call Trace: <TASK>
__schedule+0x420/0xd30 schedule+0x47/0x130 __mlx5_ib_dereg_mr+0x379/0x5d0 [mlx5_ib] ?
__pfx_autoremove_wake_function+0x10/0x10 ib_dereg_mr_user+0x5f/0x120 [ib_core] ? lock_release+0xc6/0x280 destroy_hw_idr_uobject+0x1d/0x60 [ib_uverbs] uverbs_destroy_uobject+0x58/0x1d0 [ib_uverbs] uobj_destroy+0x3f/0x70 [ib_uverbs] ib_uverbs_cmd_verbs+0x3e4/0xbb0 [ib_uverbs] ?
__pfx_uverbs_destroy_def_handler+0x10/0x10 [ib_uverbs] ? lock_acquire+0xc1/0x2f0 ? ib_uverbs_ioctl+0xcb/0x170 [ib_uverbs] ? ib_uverbs_ioctl+0x116/0x170 [ib_uverbs] ? lock_release+0xc6/0x280 ib_uverbs_ioctl+0xe7/0x170 [ib_uverbs] ? ib_uverbs_ioctl+0xcb/0x170 [ib_uverbs]
__x64_sys_ioctl+0x1b0/0xa70 ? kmem_cache_free+0x221/0x400 do_syscall_64+0x6b/0x140 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f20f21f017b RSP: 002b:00007ffcfc4a77c8 EFLAGS:
00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffcfc4a78d8 RCX: 00007f20f21f017b RDX:
00007ffcfc4a78c0 RSI: 00000000c0181b01 RDI: 0000000000000003 RBP: 00007ffcfc4a78a0 R08: 000056147d125190 R09: 00007f20f1f14c60 R10: 0000000000000001 R11: 0000000000000246 R12: 00007ffcfc4a7890 R13:
000000000000001c R14: 000056147d100fc0 R15: 00007f20e365c9d0 </TASK> (CVE-2025-21886)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21886
https://ubuntu.com/security/CVE-2025-21886

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21886

Plugin Information
Published: 2025/08/12, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245411 - Linux Distros Unpatched Vulnerability : CVE-2025-21889
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: perf/core: Add RCU read lock protection to perf_iterate_ctx() The perf_iterate_ctx() function performs RCU list traversal but currently lacks RCU read lock protection. This causes lockdep warnings when running perf probe with unshare(1) under CONFIG_PROVE_RCU_LIST=y: WARNING: suspicious RCU usage kernel/events/core.c:8168 RCU-list traversed in non-reader section!! Call Trace: lockdep_rcu_suspicious ? perf_event_addr_filters_apply perf_iterate_ctx perf_event_exec begin_new_exec ? load_elf_phdrs load_elf_binary ? lock_acquire ? find_held_lock ? bprm_execve bprm_execve do_execveat_common.isra.0 __x64_sys_execve do_syscall_64 entry_SYSCALL_64_after_hwframe This protection was previously present but was removed in commit bd2756811766 (perf: Rewrite core context handling). Add back the necessary rcu_read_lock()/rcu_read_unlock() pair around perf_iterate_ctx() call in perf_event_exec(). [ mingo: Use scoped_guard() as suggested by Peter ] (CVE-2025-21889)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21889
https://ubuntu.com/security/CVE-2025-21889

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21889

Plugin Information
Published: 2025/08/07, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244733 - Linux Distros Unpatched Vulnerability : CVE-2025-21890
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: idpf: fix checksums set in idpf_rx_rsc() idpf_rx_rsc() uses skb_transport_offset(skb) while the transport header is not set yet. This triggers the following warning for CONFIG_DEBUG_NET=y builds.
DEBUG_NET_WARN_ON_ONCE(!skb_transport_header_was_set(skb)) [ 69.261620] WARNING: CPU: 7 PID: 0 at ./include/linux/skbuff.h:3020 idpf_vport_splitq_napi_poll (include/linux/skbuff.h:3020) idpf [ 69.261629] Modules linked in: vfat fat dummy bridge intel_uncore_frequency_tpmi intel_uncore_frequency_common intel_vsec_tpmi idpf intel_vsec cdc_ncm cdc_eem cdc_ether usbnet mii xhci_pci xhci_hcd ehci_pci ehci_hcd libeth [ 69.261644] CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Tainted: G S W 6.14.0-smp-DEV #1697 [ 69.261648] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN [ 69.261650] RIP: 0010:idpf_vport_splitq_napi_poll (include/linux/skbuff.h:3020) idpf [ 69.261677] ? __warn (kernel/panic.c:242 kernel/panic.c:748) [ 69.261682] ? idpf_vport_splitq_napi_poll (include/linux/skbuff.h:3020) idpf [ 69.261687] ? report_bug (lib/bug.c:?) [ 69.261690] ? handle_bug (arch/x86/kernel/traps.c:285) [ 69.261694] ? exc_invalid_op (arch/x86/kernel/traps.c:309) [ 69.261697] ? asm_exc_invalid_op (arch/x86/include/asm/idtentry.h:621) [ 69.261700] ? __pfx_idpf_vport_splitq_napi_poll (drivers/net/ethernet/intel/idpf/idpf_txrx.c:4011) idpf [ 69.261704] ? idpf_vport_splitq_napi_poll (include/linux/skbuff.h:3020) idpf [ 69.261708] ? idpf_vport_splitq_napi_poll (drivers/net/ethernet/intel/idpf/idpf_txrx.c:3072) idpf [ 69.261712]
__napi_poll (net/core/dev.c:7194) [ 69.261716] net_rx_action (net/core/dev.c:7265) [ 69.261718] ?
__qdisc_run (net/sched/sch_generic.c:293) [ 69.261721] ? sched_clock (arch/x86/include/asm/preempt.h:84 arch/x86/kernel/tsc.c:288) [ 69.261726] handle_softirqs (kernel/softirq.c:561) (CVE-2025-21890)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21890
https://ubuntu.com/security/CVE-2025-21890

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21890

Plugin Information
Published: 2025/08/07, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248116 - Linux Distros Unpatched Vulnerability : CVE-2025-21891
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipvlan: ensure network headers are in skb linear part syzbot found that ipvlan_process_v6_outbound() was assuming the IPv6 network header isis present in skb->head [1] Add the needed pskb_network_may_pull() calls for both IPv4 and IPv6 handlers. [1] BUG: KMSAN: uninit-value in __ipv6_addr_type+0xa2/0x490 net/ipv6/addrconf_core.c:47 __ipv6_addr_type+0xa2/0x490 net/ipv6/addrconf_core.c:47 ipv6_addr_type include/net/ipv6.h:555 [inline] ip6_route_output_flags_noref net/ipv6/route.c:2616 [inline] ip6_route_output_flags+0x51/0x720 net/ipv6/route.c:2651 ip6_route_output include/net/ip6_route.h:93 [inline] ipvlan_route_v6_outbound+0x24e/0x520 drivers/net/ipvlan/ipvlan_core.c:476 ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:491 [inline] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:541 [inline] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:605 [inline] ipvlan_queue_xmit+0xd72/0x1780 drivers/net/ipvlan/ipvlan_core.c:671 ipvlan_start_xmit+0x5b/0x210 drivers/net/ipvlan/ipvlan_main.c:223 __netdev_start_xmit include/linux/netdevice.h:5150 [inline] netdev_start_xmit include/linux/netdevice.h:5159 [inline] xmit_one net/core/dev.c:3735 [inline] dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3751 sch_direct_xmit+0x399/0xd40 net/sched/sch_generic.c:343 qdisc_restart net/sched/sch_generic.c:408 [inline] __qdisc_run+0x14da/0x35d0 net/sched/sch_generic.c:416 qdisc_run+0x141/0x4d0 include/net/pkt_sched.h:127 net_tx_action+0x78b/0x940 net/core/dev.c:5484 handle_softirqs+0x1a0/0x7c0 kernel/softirq.c:561 __do_softirq+0x14/0x1a kernel/softirq.c:595 do_softirq+0x9a/0x100 kernel/softirq.c:462 __local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:389 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:919 [inline] __dev_queue_xmit+0x2758/0x57d0 net/core/dev.c:4611 dev_queue_xmit include/linux/netdevice.h:3311 [inline] packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3132 [inline] packet_sendmsg+0x93e0/0xa7e0 net/packet/af_packet.c:3164 sock_sendmsg_nosec net/socket.c:718 [inline] (CVE-2025-21891)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21891
https://security-tracker.debian.org/tracker/CVE-2025-21891
https://ubuntu.com/security/CVE-2025-21891

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21891

Plugin Information
Published: 2025/08/11, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
253007 - Linux Distros Unpatched Vulnerability : CVE-2025-21895
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list Syskaller triggers a warning due to prev_epc->pmu != next_epc->pmu in perf_event_swap_task_ctx_data(). vmcore shows that two lists have the same perf_event_pmu_context, but not in the same order. The problem is that the order of pmu_ctx_list for the parent is impacted by the time when an event/PMU is added. While the order for a child is impacted by the event order in the pinned_groups and flexible_groups. So the order of pmu_ctx_list in the parent and child may be different.
To fix this problem, insert the perf_event_pmu_context to its proper place after iteration of the pmu_ctx_list. The follow testcase can trigger above warning: # perf record -e cycles --call-graph lbr -- taskset -c 3 ./a.out & # perf stat -e cpu-clock,cs -p xxx // xxx is the pid of a.out test.c void main() { int count = 0; pid_t pid; printf(%d running , getpid()); sleep(30); printf(running ); pid = fork();
if (pid == -1) { printf(fork error ); return; } if (pid == 0) { while (1) { count++; } } else { while (1) { count++; } } } The testcase first opens an LBR event, so it will allocate task_ctx_data, and then open tracepoint and software events, so the parent context will have 3 different perf_event_pmu_contexts.
On inheritance, child ctx will insert the perf_event_pmu_context in another order and the warning will trigger. [ mingo: Tidied up the changelog. ] (CVE-2025-21895)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21895
https://ubuntu.com/security/CVE-2025-21895

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21895

Plugin Information
Published: 2025/08/20, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245536 - Linux Distros Unpatched Vulnerability : CVE-2025-21898
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ftrace: Avoid potential division by zero in function_stat_show() Check whether denominator expression x * (x - 1) * 1000 mod {2^32, 2^64} produce zero and skip stddev computation in that case. For now don't care about rec->counter * rec->counter overflow because rec->time * rec->time overflow will likely happen earlier. (CVE-2025-21898)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21898
https://ubuntu.com/security/CVE-2025-21898

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21898

Plugin Information
Published: 2025/08/07, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243902 - Linux Distros Unpatched Vulnerability : CVE-2025-21899
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tracing: Fix bad hist from corrupting named_triggers list The following commands causes a crash: ~# cd /sys/kernel/tracing/events/rcu/rcu_callback ~# echo 'hist:name=bad:keys=common_pid:onmax(bogus).save(common_pid)' > trigger bash: echo: write error: Invalid argument ~# echo 'hist:name=bad:keys=common_pid' > trigger Because the following occurs:
event_trigger_write() { trigger_process_regex() { event_hist_trigger_parse() { data = event_trigger_alloc(..); event_trigger_register(.., data) { cmd_ops->reg(.., data, ..) [hist_register_trigger()] { data->ops->init() [event_hist_trigger_init()] { save_named_trigger(name, data) { list_add(&data->named_list, &named_triggers); } } } } ret = create_actions(); (return -EINVAL) if (ret) goto out_unreg; [..] ret = hist_trigger_enable(data, ...) { list_add_tail_rcu(&data->list, &file->triggers); <<<---- SKIPPED!!! (this is important!) [..] out_unreg: event_hist_unregister(.., data) { cmd_ops->unreg(.., data, ..) [hist_unregister_trigger()] { list_for_each_entry(iter, &file->triggers, list) { if (!hist_trigger_match(data, iter, named_data, false)) <- never matches continue; [..] test = iter; } if (test && test->ops->free) <<<-- test is NULL test->ops->free(test) [event_hist_trigger_free()] { [..] if (data->name) del_named_trigger(data) { list_del(&data->named_list); <<<<-- NEVER gets removed! } } } } [..] kfree(data); <<<-- frees item but it is still on list The next time a hist with name is registered, it causes an u-a-f bug and the kernel can crash. Move the code around such that if event_trigger_register() succeeds, the next thing called is hist_trigger_enable() which adds it to the list. A bunch of actions is called if get_named_trigger_data() returns false. But that doesn't need to be called after event_trigger_register(), so it can be moved up, allowing event_trigger_register() to be called just before hist_trigger_enable() keeping them together and allowing the file->triggers to be properly populated. (CVE-2025-21899)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21899
https://security-tracker.debian.org/tracker/CVE-2025-21899
https://ubuntu.com/security/CVE-2025-21899

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21899

Plugin Information
Published: 2025/08/05, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243356 - Linux Distros Unpatched Vulnerability : CVE-2025-21900
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix a deadlock when recovering state on a sillyrenamed file If the file is sillyrenamed, and slated for delete on close, it is possible for a server reboot to triggeer an open reclaim, with can again race with the application call to close().
When that happens, the call to put_nfs_open_context() can trigger a synchronous delegreturn call which deadlocks because it is not marked as privileged. Instead, ensure that the call to nfs4_inode_return_delegation_on_close() catches the delegreturn, and schedules it asynchronously.
(CVE-2025-21900)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21900
https://ubuntu.com/security/CVE-2025-21900

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21900

Plugin Information
Published: 2025/08/04, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246449 - Linux Distros Unpatched Vulnerability : CVE-2025-21901
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Add sanity checks on rdev validity There is a possibility that ulp_irq_stop and ulp_irq_start callbacks will be called when the device is in detached state. This can cause a crash due to NULL pointer dereference as the rdev is already freed. (CVE-2025-21901)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21901
https://ubuntu.com/security/CVE-2025-21901

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21901

Plugin Information
Published: 2025/08/09, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245516 - Linux Distros Unpatched Vulnerability : CVE-2025-21906
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: clean up ROC on failure If the firmware fails to start the session protection, then we do call iwl_mvm_roc_finished() here, but that won't do anything at all because IWL_MVM_STATUS_ROC_P2P_RUNNING was never set. Set IWL_MVM_STATUS_ROC_P2P_RUNNING in the failure/stop path. If it started successfully before, it's already set, so that doesn't matter, and if it didn't start it needs to be set to clean up. Not doing so will lead to a WARN_ON() later on a fresh remain- on-channel, since the link is already active when activated as it was never deactivated. (CVE-2025-21906)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21906
https://ubuntu.com/security/CVE-2025-21906

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21906

Plugin Information
Published: 2025/08/07, Modified: 2025/11/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250154 - Linux Distros Unpatched Vulnerability : CVE-2025-21907
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm: memory-failure: update ttu flag inside unmap_poisoned_folio Patch series mm: memory_failure: unmap poisoned folio during migrate properly, v3. Fix two bugs during folio migration if the folio is poisoned.
This patch (of 3): Commit 6da6b1d4a7df (mm/hwpoison: convert TTU_IGNORE_HWPOISON to TTU_HWPOISON) introduce TTU_HWPOISON to replace TTU_IGNORE_HWPOISON in order to stop send SIGBUS signal when accessing an error page after a memory error on a clean folio. However during page migration, anon folio must be set with TTU_HWPOISON during unmap_*(). For pagecache we need some policy just like the one in hwpoison_user_mappings to set this flag. So move this policy from hwpoison_user_mappings to unmap_poisoned_folio to handle this warning properly. Warning will be produced during unamp poison folio with the following log: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 365 at mm/rmap.c:1847 try_to_unmap_one+0x8fc/0xd3c Modules linked in: CPU: 1 UID: 0 PID: 365 Comm: bash Tainted: G W 6.13.0-rc1-00018-gacdb4bbda7ab #42 Tainted: [W]=WARN Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc :
try_to_unmap_one+0x8fc/0xd3c lr : try_to_unmap_one+0x3dc/0xd3c Call trace: try_to_unmap_one+0x8fc/0xd3c (P) try_to_unmap_one+0x3dc/0xd3c (L) rmap_walk_anon+0xdc/0x1f8 rmap_walk+0x3c/0x58 try_to_unmap+0x88/0x90 unmap_poisoned_folio+0x30/0xa8 do_migrate_range+0x4a0/0x568 offline_pages+0x5a4/0x670 memory_block_action+0x17c/0x374 memory_subsys_offline+0x3c/0x78 device_offline+0xa4/0xd0 state_store+0x8c/0xf0 dev_attr_store+0x18/0x2c sysfs_kf_write+0x44/0x54 kernfs_fop_write_iter+0x118/0x1a8 vfs_write+0x3a8/0x4bc ksys_write+0x6c/0xf8 __arm64_sys_write+0x1c/0x28 invoke_syscall+0x44/0x100 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x30/0xd0 el0t_64_sync_handler+0xc8/0xcc el0t_64_sync+0x198/0x19c ---[ end trace 0000000000000000 ]--- [mawupeng1@huawei.com:
unmap_poisoned_folio(): remove shadowed local `mapping', per Miaohe] (CVE-2025-21907)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21907
https://security-tracker.debian.org/tracker/CVE-2025-21907
https://ubuntu.com/security/CVE-2025-21907

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21907

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247465 - Linux Distros Unpatched Vulnerability : CVE-2025-21908
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback Add PF_KCOMPACTD flag and current_is_kcompactd() helper to check for it so nfs_release_folio() can skip calling nfs_wb_folio() from kcompactd. Otherwise NFS can deadlock waiting for kcompactd enduced writeback which recurses back to NFS (which triggers writeback to NFSD via NFS loopback mount on the same host, NFSD blocks waiting for XFS's call to __filemap_get_folio): 6070.550357] INFO: task kcompactd0:58 blocked for more than 4435 seconds.
{--- [58] kcompactd0 [<0>] folio_wait_bit+0xe8/0x200 [<0>] folio_wait_writeback+0x2b/0x80 [<0>] nfs_wb_folio+0x80/0x1b0 [nfs] [<0>] nfs_release_folio+0x68/0x130 [nfs] [<0>] split_huge_page_to_list_to_order+0x362/0x840 [<0>] migrate_pages_batch+0x43d/0xb90 [<0>] migrate_pages_sync+0x9a/0x240 [<0>] migrate_pages+0x93c/0x9f0 [<0>] compact_zone+0x8e2/0x1030 [<0>] compact_node+0xdb/0x120 [<0>] kcompactd+0x121/0x2e0 [<0>] kthread+0xcf/0x100 [<0>] ret_from_fork+0x31/0x40 [<0>] ret_from_fork_asm+0x1a/0x30 ---} [akpm@linux-foundation.org: fix build] (CVE-2025-21908)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21908
https://ubuntu.com/security/CVE-2025-21908

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
References

CVE | CVE-2025-21908

Plugin Information
Published: 2025/08/10, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247944 - Linux Distros Unpatched Vulnerability : CVE-2025-21909
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: nl80211: reject cooked mode if it is set along with other flags It is possible to set both MONITOR_FLAG_COOK_FRAMES and MONITOR_FLAG_ACTIVE flags simultaneously on the same monitor interface from the userspace. This causes a sub-interface to be created with no IEEE80211_SDATA_IN_DRIVER bit set because the monitor interface is in the cooked state and it takes precedence over all other states. When the interface is then being deleted the kernel calls WARN_ONCE() from check_sdata_in_driver() because of missing that bit. Fix this by rejecting MONITOR_FLAG_COOK_FRAMES if it is set along with other flags.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller. (CVE-2025-21909)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21909
https://ubuntu.com/security/CVE-2025-21909

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
References

CVE | CVE-2025-21909

Plugin Information
Published: 2025/08/11, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248789 - Linux Distros Unpatched Vulnerability : CVE-2025-21910
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: cfg80211: regulatory: improve invalid hints checking Syzbot keeps reporting an issue [1] that occurs when erroneous symbols sent from userspace get through into user_alpha2[] via regulatory_hint_user() call.
Such invalid regulatory hints should be rejected. While a sanity check from commit 47caf685a685 (cfg80211: regulatory: reject invalid hints) looks to be enough to deter these very cases, there is a way to get around it due to 2 reasons. 1) The way isalpha() works, symbols other than latin lower and upper letters may be used to determine a country/domain. For instance, greek letters will also be considered upper/lower letters and for such characters isalpha() will return true as well. However, ISO-3166-1 alpha2 codes should only hold latin characters. 2) While processing a user regulatory request, between reg_process_hint_user() and regulatory_hint_user() there happens to be a call to queue_regulatory_request() which modifies letters in request->alpha2[] with toupper(). This works fine for latin symbols, less so for weird letter characters from the second part of _ctype[]. Syzbot triggers a warning in is_user_regdom_saved() by first sending over an unexpected non-latin letter that gets malformed by toupper() into a character that ends up failing isalpha() check. Prevent this by enhancing is_an_alpha2() to ensure that incoming symbols are latin letters and nothing else. [1] Syzbot report:
------------[ cut here ]------------ Unexpected user alpha2: A WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 is_user_regdom_saved net/wireless/reg.c:440 [inline] WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 restore_alpha2 net/wireless/reg.c:3424 [inline] WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 restore_regulatory_settings+0x3c0/0x1e50 net/wireless/reg.c:3516 Modules linked in:
CPU: 1 UID: 0 PID: 964 Comm: kworker/1:2 Not tainted 6.12.0-rc5-syzkaller-00044-gc1e939a21eb1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue:
events_power_efficient crda_timeout_work RIP: 0010:is_user_regdom_saved net/wireless/reg.c:440 [inline] RIP: 0010:restore_alpha2 net/wireless/reg.c:3424 [inline] RIP:
0010:restore_regulatory_settings+0x3c0/0x1e50 net/wireless/reg.c:3516 ... Call Trace: <TASK>
crda_timeout_work+0x27/0x50 net/wireless/reg.c:542 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f2/0x390 kernel/kthread.c:389 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>
(CVE-2025-21910)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21910
https://ubuntu.com/security/CVE-2025-21910

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21910

Plugin Information
Published: 2025/08/12, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248573 - Linux Distros Unpatched Vulnerability : CVE-2025-21913
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() Xen doesn't offer MSR_FAM10H_MMIO_CONF_BASE to all guests. This results in the following warning: unchecked MSR access error: RDMSR from 0xc0010058 at rIP: 0xffffffff8101d19f (xen_do_read_msr+0x7f/0xa0) Call Trace: xen_read_msr+0x1e/0x30 amd_get_mmconfig_range+0x2b/0x80 quirk_amd_mmconfig_area+0x28/0x100 pnp_fixup_device+0x39/0x50 __pnp_add_device+0xf/0x150 pnp_add_device+0x3d/0x100 pnpacpi_add_device_handler+0x1f9/0x280 acpi_ns_get_device_callback+0x104/0x1c0 acpi_ns_walk_namespace+0x1d0/0x260 acpi_get_devices+0x8a/0xb0 pnpacpi_init+0x50/0x80 do_one_initcall+0x46/0x2e0 kernel_init_freeable+0x1da/0x2f0 kernel_init+0x16/0x1b0 ret_from_fork+0x30/0x50 ret_from_fork_asm+0x1b/0x30 based on quirks for a PNP0c01 device. Treating MMCFG as disabled is the right course of action, so no change is needed there. This was most likely exposed by fixing the Xen MSR accessors to not be silently-safe. (CVE-2025-21913)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21913
https://ubuntu.com/security/CVE-2025-21913

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21913

Plugin Information
Published: 2025/08/12, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247781 - Linux Distros Unpatched Vulnerability : CVE-2025-21916
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: atm: cxacru: fix a flaw in existing endpoint checks Syzbot once again identified a flaw in usb endpoint checking, see [1]. This time the issue stems from a commit authored by me (2eabb655a968 (usb:
atm: cxacru: fix endpoint checking in cxacru_bind())). While using usb_find_common_endpoints() may usually be enough to discard devices with wrong endpoints, in this case one needs more than just finding and identifying the sufficient number of endpoints of correct types - one needs to check the endpoint's address as well. Since cxacru_bind() fills URBs with CXACRU_EP_CMD address in mind, switch the endpoint verification approach to usb_check_XXX_endpoints() instead to fix incomplete ep testing. [1] Syzbot report: usb 5-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 1378 at drivers/usb/core/urb.c:504 usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503 ... RIP: 0010:usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503 ... Call Trace: <TASK> cxacru_cm+0x3c8/0xe50 drivers/usb/atm/cxacru.c:649 cxacru_card_status drivers/usb/atm/cxacru.c:760 [inline] cxacru_bind+0xcf9/0x1150 drivers/usb/atm/cxacru.c:1223 usbatm_usb_probe+0x314/0x1d30 drivers/usb/atm/usbatm.c:1058 cxacru_usb_probe+0x184/0x220 drivers/usb/atm/cxacru.c:1377 usb_probe_interface+0x641/0xbb0 drivers/usb/core/driver.c:396 really_probe+0x2b9/0xad0 drivers/base/dd.c:658
__driver_probe_device+0x1a2/0x390 drivers/base/dd.c:800 driver_probe_device+0x50/0x430 drivers/base/dd.c:830 ... (CVE-2025-21916)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21916
https://ubuntu.com/security/CVE-2025-21916

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21916

Plugin Information
Published: 2025/08/10, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
253791 - Linux Distros Unpatched Vulnerability : CVE-2025-21918
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: typec: ucsi: Fix NULL pointer access Resources should be released only after all threads that utilize them have been destroyed. This commit ensures that resources are not released prematurely by waiting for the associated workqueue to complete before deallocating them. (CVE-2025-21918)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21918
https://ubuntu.com/security/CVE-2025-21918

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21918

Plugin Information
Published: 2025/08/24, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243324 - Linux Distros Unpatched Vulnerability : CVE-2025-21921
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: ethtool: netlink: Allow NULL nlattrs when getting a phy_device ethnl_req_get_phydev() is used to lookup a phy_device, in the case an ethtool netlink command targets a specific phydev within a netdev's topology. It takes as a parameter a const struct nlattr *header that's used for error handling : if (!phydev) { NL_SET_ERR_MSG_ATTR(extack, header, no phy matching phyindex); return ERR_PTR(-ENODEV); } In the notify path after a ->set operation however, there's no request attributes available. The typical callsite for the above function looks like:
phydev = ethnl_req_get_phydev(req_base, tb[ETHTOOL_A_XXX_HEADER], info->extack); So, when tb is NULL (such as in the ethnl notify path), we have a nice crash. It turns out that there's only the PLCA command that is in that case, as the other phydev-specific commands don't have a notification. This commit fixes the crash by passing the cmd index and the nlattr array separately, allowing NULL-checking it directly inside the helper. (CVE-2025-21921)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21921
https://ubuntu.com/security/CVE-2025-21921

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21921

Plugin Information
Published: 2025/08/04, Modified: 2025/11/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247901 - Linux Distros Unpatched Vulnerability : CVE-2025-21922
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ppp: Fix KMSAN uninit-value warning with bpf Syzbot caught an KMSAN: uninit-value warning [1], which is caused by the ppp driver not initializing a 2-byte header when using socket filter. The following code can generate a PPP filter BPF program: ''' struct bpf_program fp; pcap_t *handle; handle = pcap_open_dead(DLT_PPP_PPPD, 65535); pcap_compile(handle, &fp, ip and outbound, 0, 0); bpf_dump(&fp, 1);
''' Its output is: ''' (000) ldh [2] (001) jeq #0x21 jt 2 jf 5 (002) ldb [0] (003) jeq #0x1 jt 4 jf 5 (004) ret #65535 (005) ret #0 ''' Wen can find similar code at the following link: https://github.com/ppp- project/ppp/blob/master/pppd/options.c#L1680 The maintainer of this code repository is also the original maintainer of the ppp driver. As you can see the BPF program skips 2 bytes of data and then reads the 'Protocol' field to determine if it's an IP packet. Then it read the first byte of the first 2 bytes to determine the direction. The issue is that only the first byte indicating direction is initialized in current ppp driver code while the second byte is not initialized. For normal BPF programs generated by libpcap, uninitialized data won't be used, so it's not a problem. However, for carefully crafted BPF programs, such as those generated by syzkaller [2], which start reading from offset 0, the uninitialized data will be used and caught by KMSAN. [1] https://syzkaller.appspot.com/bug?extid=853242d9c9917165d791 [2] https://syzkaller.appspot.com/text?tag=ReproC&x=11994913980000 (CVE-2025-21922)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21922
https://ubuntu.com/security/CVE-2025-21922

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21922

Plugin Information
Published: 2025/08/11, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245118 - Linux Distros Unpatched Vulnerability : CVE-2025-21924
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error During the initialization of ptp, hclge_ptp_get_cycle might return an error and returned directly without unregister clock and free it. To avoid that, call hclge_ptp_destroy_clock to unregist and free clock if hclge_ptp_get_cycle failed.
(CVE-2025-21924)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21924
https://ubuntu.com/security/CVE-2025-21924

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21924

Plugin Information
Published: 2025/08/07, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245260 - Linux Distros Unpatched Vulnerability : CVE-2025-21930
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't try to talk to a dead firmware This fixes: bad state = 0 WARNING: CPU: 10 PID: 702 at drivers/net/wireless/inel/iwlwifi/iwl-trans.c:178 iwl_trans_send_cmd+0xba/0xe0 [iwlwifi] Call Trace:
<TASK> ? __warn+0xca/0x1c0 ? iwl_trans_send_cmd+0xba/0xe0 [iwlwifi 64fa9ad799a0e0d2ba53d4af93a53ad9a531f8d4] iwl_fw_dbg_clear_monitor_buf+0xd7/0x110 [iwlwifi 64fa9ad799a0e0d2ba53d4af93a53ad9a531f8d4] _iwl_dbgfs_fw_dbg_clear_write+0xe2/0x120 [iwlmvm 0e8adb18cea92d2c341766bcc10b18699290068a] Ask whether the firmware is alive before sending a command.
(CVE-2025-21930)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21930
https://ubuntu.com/security/CVE-2025-21930

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21930

Plugin Information
Published: 2025/08/07, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245335 - Linux Distros Unpatched Vulnerability : CVE-2025-21936
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected() Add check for the return value of mgmt_alloc_skb() in mgmt_device_connected() to prevent null pointer dereference. (CVE-2025-21936)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21936
https://ubuntu.com/security/CVE-2025-21936

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21936

Plugin Information
Published: 2025/08/07, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248991 - Linux Distros Unpatched Vulnerability : CVE-2025-21937
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name() Add check for the return value of mgmt_alloc_skb() in mgmt_remote_name() to prevent null pointer dereference. (CVE-2025-21937)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21937
https://ubuntu.com/security/CVE-2025-21937

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21937

Plugin Information
Published: 2025/08/12, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244982 - Linux Distros Unpatched Vulnerability : CVE-2025-21938
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mptcp: fix 'scheduling while atomic'
in mptcp_pm_nl_append_new_local_addr If multiple connection requests attempt to create an implicit mptcp endpoint in parallel, more than one caller may end up in mptcp_pm_nl_append_new_local_addr because none found the address in local_addr_list during their call to mptcp_pm_nl_get_local_id. In this case, the concurrent new_local_addr calls may delete the address entry created by the previous caller. These deletes use synchronize_rcu, but this is not permitted in some of the contexts where this function may be called.
During packet recv, the caller may be in a rcu read critical section and have preemption disabled. An example stack: BUG: scheduling while atomic: swapper/2/0/0x00000302 Call Trace: <IRQ> dump_stack_lvl (lib/dump_stack.c:117 (discriminator 1)) dump_stack (lib/dump_stack.c:124) __schedule_bug (kernel/sched/core.c:5943) schedule_debug.constprop.0 (arch/x86/include/asm/preempt.h:33 kernel/sched/core.c:5970) __schedule (arch/x86/include/asm/jump_label.h:27 include/linux/jump_label.h:207 kernel/sched/features.h:29 kernel/sched/core.c:6621) schedule (arch/x86/include/asm/preempt.h:84 kernel/sched/core.c:6804 kernel/sched/core.c:6818) schedule_timeout (kernel/time/timer.c:2160) wait_for_completion (kernel/sched/completion.c:96 kernel/sched/completion.c:116 kernel/sched/completion.c:127 kernel/sched/completion.c:148) __wait_rcu_gp (include/linux/rcupdate.h:311 kernel/rcu/update.c:444) synchronize_rcu (kernel/rcu/tree.c:3609) mptcp_pm_nl_append_new_local_addr (net/mptcp/pm_netlink.c:966 net/mptcp/pm_netlink.c:1061) mptcp_pm_nl_get_local_id (net/mptcp/pm_netlink.c:1164) mptcp_pm_get_local_id (net/mptcp/pm.c:420) subflow_check_req (net/mptcp/subflow.c:98 net/mptcp/subflow.c:213) subflow_v4_route_req (net/mptcp/subflow.c:305) tcp_conn_request (net/ipv4/tcp_input.c:7216) subflow_v4_conn_request (net/mptcp/subflow.c:651) tcp_rcv_state_process (net/ipv4/tcp_input.c:6709) tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1934) tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2334) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205 (discriminator 1)) ip_local_deliver_finish (include/linux/rcupdate.h:813 net/ipv4/ip_input.c:234) ip_local_deliver (include/linux/netfilter.h:314 include/linux/netfilter.h:308 net/ipv4/ip_input.c:254) ip_sublist_rcv_finish (include/net/dst.h:461 net/ipv4/ip_input.c:580) ip_sublist_rcv (net/ipv4/ip_input.c:640) ip_list_rcv (net/ipv4/ip_input.c:675) __netif_receive_skb_list_core (net/core/dev.c:5583 net/core/dev.c:5631) netif_receive_skb_list_internal (net/core/dev.c:5685 net/core/dev.c:5774) napi_complete_done (include/linux/list.h:37 include/net/gro.h:449 include/net/gro.h:444 net/core/dev.c:6114) igb_poll (drivers/net/ethernet/intel/igb/igb_main.c:8244) igb
__napi_poll (net/core/dev.c:6582) net_rx_action (net/core/dev.c:6653 net/core/dev.c:6787) handle_softirqs (kernel/softirq.c:553) __irq_exit_rcu (kernel/softirq.c:588 kernel/softirq.c:427 kernel/softirq.c:636) irq_exit_rcu (kernel/softirq.c:651) common_interrupt (arch/x86/kernel/irq.c:247 (discriminator 14)) </IRQ>
This problem seems particularly prevalent if the user advertises an endpoint that has a different external vs internal address. In the case where the external address is advertised and multiple connections already exist, multiple subflow SYNs arrive in parallel which tends to trigger the race during creation of the first local_addr_list entries which have the internal address instead. Fix by skipping the replacement of an existing implicit local address if called via mptcp_pm_nl_get_local_id. (CVE-2025-21938)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21938
https://ubuntu.com/security/CVE-2025-21938

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21938

Plugin Information
Published: 2025/08/07, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245069 - Linux Distros Unpatched Vulnerability : CVE-2025-21939
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/xe/hmm: Don't dereference struct page pointers without notifier lock The pnfs that we obtain from hmm_range_fault() point to pages that we don't have a reference on, and the guarantee that they are still in the cpu page-tables is that the notifier lock must be held and the notifier seqno is still valid. So while building the sg table and marking the pages accesses / dirty we need to hold this lock with a validated seqno. However, the lock is reclaim tainted which makes sg_alloc_table_from_pages_segment() unusable, since it internally allocates memory. Instead build the sg-table manually. For the non-iommu case this might lead to fewer coalesces, but if that's a problem it can be fixed up later in the resource cursor code. For the iommu case, the whole sg-table may still be coalesced to a single contigous device va region. This avoids marking pages that we don't own dirty and accessed, and it also avoid dereferencing struct pages that we don't own. v2:
- Use assert to check whether hmm pfns are valid (Matthew Auld) - Take into account that large pages may cross range boundaries (Matthew Auld) v3: - Don't unnecessarily check for a non-freed sg-table. (Matthew Auld) - Add a missing up_read() in an error path. (Matthew Auld) (cherry picked from commit ea3e66d280ce2576664a862693d1da8fd324c317) (CVE-2025-21939)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21939
https://ubuntu.com/security/CVE-2025-21939

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21939

Plugin Information
Published: 2025/08/07, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248077 - Linux Distros Unpatched Vulnerability : CVE-2025-21948
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- HID: appleir: Fix potential NULL dereference at raw event handle Syzkaller reports a NULL pointer dereference issue in input_event(). BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: null-ptr-deref in _test_bit include/asm- generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: null-ptr-deref in is_event_supported drivers/input/input.c:67 [inline] BUG: KASAN: null-ptr-deref in input_event+0x42/0xa0 drivers/input/input.c:395 Read of size 8 at addr 0000000000000028 by task syz-executor199/2949 CPU: 0 UID:
0 PID: 2949 Comm: syz-executor199 Not tainted 6.13.0-rc4-syzkaller-00076-gf097a36ef88d #0 Hardware name:
Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 kasan_report+0xd9/0x110 mm/kasan/report.c:602 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189 instrument_atomic_read include/linux/instrumented.h:68 [inline] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] is_event_supported drivers/input/input.c:67 [inline] input_event+0x42/0xa0 drivers/input/input.c:395 input_report_key include/linux/input.h:439 [inline] key_down drivers/hid/hid-appleir.c:159 [inline] appleir_raw_event+0x3e5/0x5e0 drivers/hid/hid-appleir.c:232 __hid_input_report.constprop.0+0x312/0x440 drivers/hid/hid-core.c:2111 hid_ctrl+0x49f/0x550 drivers/hid/usbhid/hid-core.c:484
__usb_hcd_giveback_urb+0x389/0x6e0 drivers/usb/core/hcd.c:1650 usb_hcd_giveback_urb+0x396/0x450 drivers/usb/core/hcd.c:1734 dummy_timer+0x17f7/0x3960 drivers/usb/gadget/udc/dummy_hcd.c:1993
__run_hrtimer kernel/time/hrtimer.c:1739 [inline] __hrtimer_run_queues+0x20a/0xae0 kernel/time/hrtimer.c:1803 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1820 handle_softirqs+0x206/0x8d0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0xfa/0x160 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1049 </IRQ> <TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 __mod_timer+0x8f6/0xdc0 kernel/time/timer.c:1185 add_timer+0x62/0x90 kernel/time/timer.c:1295 schedule_timeout+0x11f/0x280 kernel/time/sleep_timeout.c:98 usbhid_wait_io+0x1c7/0x380 drivers/hid/usbhid/hid-core.c:645 usbhid_init_reports+0x19f/0x390 drivers/hid/usbhid/hid-core.c:784 hiddev_ioctl+0x1133/0x15b0 drivers/hid/usbhid/hiddev.c:794 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl fs/ioctl.c:892 [inline] __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> This happens due to the malformed report items sent by the emulated device which results in a report, that has no fields, being added to the report list. Due to this appleir_input_configured() is never called, hidinput_connect() fails which results in the HID_CLAIMED_INPUT flag is not being set. However, it does not make appleir_probe() fail and lets the event callback to be called without the associated input device. Thus, add a check for the HID_CLAIMED_INPUT flag and leave the event hook early if the driver didn't claim any input_dev for some reason. Moreover, some other hid drivers accessing input_dev in their event callbacks do have similar checks, too. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. (CVE-2025-21948)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21948
https://ubuntu.com/security/CVE-2025-21948

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21948

Plugin Information
Published: 2025/08/11, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243603 - Linux Distros Unpatched Vulnerability : CVE-2025-21951
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock There are multiple places from where the recovery work gets scheduled asynchronously. Also, there are multiple places where the caller waits synchronously for the recovery to be completed. One such place is during the PM shutdown() callback. If the device is not alive during recovery_work, it will try to reset the device using pci_reset_function(). This function internally will take the device_lock() first before resetting the device. By this time, if the lock has already been acquired, then recovery_work will get stalled while waiting for the lock. And if the lock was already acquired by the caller which waits for the recovery_work to be completed, it will lead to deadlock. This is what happened on the X1E80100 CRD device when the device died before shutdown() callback. Driver core calls the driver's shutdown() callback while holding the device_lock() leading to deadlock. And this deadlock scenario can occur on other paths as well, like during the PM suspend() callback, where the driver core would hold the device_lock() before calling driver's suspend() callback. And if the recovery_work was already started, it could lead to deadlock. This is also observed on the X1E80100 CRD.
So to fix both issues, use pci_try_reset_function() in recovery_work. This function first checks for the availability of the device_lock() before trying to reset the device. If the lock is available, it will acquire it and reset the device. Otherwise, it will return -EAGAIN. If that happens, recovery_work will fail with the error message Recovery failed as not much could be done. (CVE-2025-21951)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21951
https://ubuntu.com/security/CVE-2025-21951

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21951

Plugin Information
Published: 2025/08/05, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250233 - Linux Distros Unpatched Vulnerability : CVE-2025-21953
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net: mana: cleanup mana struct after debugfs_remove() When on a MANA VM hibernation is triggered, as part of hibernate_snapshot(), mana_gd_suspend() and mana_gd_resume() are called. If during this mana_gd_resume(), a failure occurs with HWC creation, mana_port_debugfs pointer does not get reinitialized and ends up pointing to older, cleaned- up dentry. Further in the hibernation path, as part of power_down(), mana_gd_shutdown() is triggered. This call, unaware of the failures in resume, tries to cleanup the already cleaned up mana_port_debugfs value and hits the following bug: [ 191.359296] mana 7870:00:00.0: Shutdown was called [ 191.359918] BUG: kernel NULL pointer dereference, address: 0000000000000098 [ 191.360584] #PF: supervisor write access in kernel mode [ 191.361125] #PF: error_code(0x0002) - not-present page [ 191.361727] PGD 1080ea067 P4D 0 [ 191.362172] Oops: Oops: 0002 [#1] SMP NOPTI [ 191.362606] CPU: 11 UID: 0 PID: 1674 Comm: bash Not tainted 6.14.0-rc5+ #2 [ 191.363292] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 11/21/2024 [ 191.364124] RIP: 0010:down_write+0x19/0x50 [ 191.364537] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 53 48 89 fb e8 de cd ff ff 31 c0 ba 01 00 00 00 <f0> 48 0f b1 13 75 16 65 48 8b 05 88 24 4c 6a 48 89 43 08 48 8b 5d [ 191.365867] RSP:
0000:ff45fbe0c1c037b8 EFLAGS: 00010246 [ 191.366350] RAX: 0000000000000000 RBX: 0000000000000098 RCX:
ffffff8100000000 [ 191.366951] RDX: 0000000000000001 RSI: 0000000000000064 RDI: 0000000000000098 [ 191.367600] RBP: ff45fbe0c1c037c0 R08: 0000000000000000 R09: 0000000000000001 [ 191.368225] R10:
ff45fbe0d2b01000 R11: 0000000000000008 R12: 0000000000000000 [ 191.368874] R13: 000000000000000b R14:
ff43dc27509d67c0 R15: 0000000000000020 [ 191.369549] FS: 00007dbc5001e740(0000) GS:ff43dc663f380000(0000) knlGS:0000000000000000 [ 191.370213] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 191.370830] CR2:
0000000000000098 CR3: 0000000168e8e002 CR4: 0000000000b73ef0 [ 191.371557] DR0: 0000000000000000 DR1:
0000000000000000 DR2: 0000000000000000 [ 191.372192] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7:
0000000000000400 [ 191.372906] Call Trace: [ 191.373262] <TASK> [ 191.373621] ? show_regs+0x64/0x70 [ 191.374040] ? __die+0x24/0x70 [ 191.374468] ? page_fault_oops+0x290/0x5b0 [ 191.374875] ? do_user_addr_fault+0x448/0x800 [ 191.375357] ? exc_page_fault+0x7a/0x160 [ 191.375971] ? asm_exc_page_fault+0x27/0x30 [ 191.376416] ? down_write+0x19/0x50 [ 191.376832] ? down_write+0x12/0x50 [ 191.377232] simple_recursive_removal+0x4a/0x2a0 [ 191.377679] ? __pfx_remove_one+0x10/0x10 [ 191.378088] debugfs_remove+0x44/0x70 [ 191.378530] mana_detach+0x17c/0x4f0 [ 191.378950] ? __flush_work+0x1e2/0x3b0 [ 191.379362] ? __cond_resched+0x1a/0x50 [ 191.379787] mana_remove+0xf2/0x1a0 [ 191.380193] mana_gd_shutdown+0x3b/0x70 [ 191.380642] pci_device_shutdown+0x3a/0x80 [ 191.381063] device_shutdown+0x13e/0x230 [ 191.381480] kernel_power_off+0x35/0x80 [ 191.381890] hibernate+0x3c6/0x470 [ 191.382312] state_store+0xcb/0xd0 [ 191.382734] kobj_attr_store+0x12/0x30 [ 191.383211] sysfs_kf_write+0x3e/0x50 [ 191.383640] kernfs_fop_write_iter+0x140/0x1d0 [ 191.384106] vfs_write+0x271/0x440 [ 191.384521] ksys_write+0x72/0xf0 [ 191.384924] __x64_sys_write+0x19/0x20 [ 191.385313] x64_sys_call+0x2b0/0x20b0 [ 191.385736] do_syscall_64+0x79/0x150 [ 191.386146] ?
__mod_memcg_lruvec_state+0xe7/0x240 [ 191.386676] ? __lruvec_stat_mod_folio+0x79/0xb0 [ 191.387124] ?
__pfx_lru_add+0x10/0x10 [ 191.387515] ? queued_spin_unlock+0x9/0x10 [ 191.387937] ? do_anonymous_page+0x33c/0xa00 [ 191.388374] ? __handle_mm_fault+0xcf3/0x1210 [ 191.388805] ?
__count_memcg_events+0xbe/0x180 [ 191.389235] ? handle_mm_fault+0xae/0x300 [ 19 ---truncated--- (CVE-2025-21953)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21953
https://ubuntu.com/security/CVE-2025-21953

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21953

Plugin Information
Published: 2025/08/15, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246613 - Linux Distros Unpatched Vulnerability : CVE-2025-21959
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree() Since commit b36e4523d4d5 (netfilter: nf_conncount: fix garbage collection confirm race), `cpu` and `jiffies32` were introduced to the struct nf_conncount_tuple. The commit made nf_conncount_add() initialize `conn->cpu` and `conn->jiffies32` when allocating the struct. In contrast, count_tree() was not changed to initialize them. By commit 34848d5c896e (netfilter: nf_conncount: Split insert and traversal), count_tree() was split and the relevant allocation code now resides in insert_tree(). Initialize `conn->cpu` and `conn->jiffies32` in insert_tree(). BUG: KMSAN: uninit-value in find_or_evict net/netfilter/nf_conncount.c:117 [inline] BUG: KMSAN: uninit-value in __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143 find_or_evict net/netfilter/nf_conncount.c:117 [inline]
__nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143 count_tree net/netfilter/nf_conncount.c:438 [inline] nf_conncount_count+0x82f/0x1e80 net/netfilter/nf_conncount.c:521 connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72 __nft_match_eval net/netfilter/nft_compat.c:403 [inline] nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663 NF_HOOK_LIST include/linux/netfilter.h:350 [inline] ip_sublist_rcv+0x17b7/0x17f0 net/ipv4/ip_input.c:633 ip_list_rcv+0x9ef/0xa40 net/ipv4/ip_input.c:669
__netif_receive_skb_list_ptype net/core/dev.c:5936 [inline] __netif_receive_skb_list_core+0x15c5/0x1670 net/core/dev.c:5983 __netif_receive_skb_list net/core/dev.c:6035 [inline] netif_receive_skb_list_internal+0x1085/0x1700 net/core/dev.c:6126 netif_receive_skb_list+0x5a/0x460 net/core/dev.c:6178 xdp_recv_frames net/bpf/test_run.c:280 [inline] xdp_test_run_batch net/bpf/test_run.c:361 [inline] bpf_test_run_xdp_live+0x2e86/0x3480 net/bpf/test_run.c:390 bpf_prog_test_run_xdp+0xf1d/0x1ae0 net/bpf/test_run.c:1316 bpf_prog_test_run+0x5e5/0xa30 kernel/bpf/syscall.c:4407 __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5813 __do_sys_bpf kernel/bpf/syscall.c:5902 [inline] __se_sys_bpf kernel/bpf/syscall.c:5900 [inline]
__ia32_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5900 ia32_sys_call+0x394d/0x4180 arch/x86/include/generated/asm/syscalls_32.h:358 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/common.c:387 do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:412 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:450 entry_SYSENTER_compat_after_hwframe+0x84/0x8e Uninit was created at: slab_post_alloc_hook mm/slub.c:4121 [inline] slab_alloc_node mm/slub.c:4164 [inline] kmem_cache_alloc_noprof+0x915/0xe10 mm/slub.c:4171 insert_tree net/netfilter/nf_conncount.c:372 [inline] count_tree net/netfilter/nf_conncount.c:450 [inline] nf_conncount_count+0x1415/0x1e80 net/netfilter/nf_conncount.c:521 connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72 __nft_match_eval net/netfilter/nft_compat.c:403 [inline] nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663 NF_HOOK_LIST include/linux/netfilter.h:350 [inline] ip_sublist_rcv+0x17b7/0x17f0 net/ipv4/ip_input.c:633 ip_list_rcv+0x9ef/0xa40 net/ip ---truncated--- (CVE-2025-21959)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21959
https://ubuntu.com/security/CVE-2025-21959

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.9 (CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21959

Plugin Information
Published: 2025/08/09, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245309 - Linux Distros Unpatched Vulnerability : CVE-2025-21970
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Bridge, fix the crash caused by LAG state check When removing LAG device from bridge, NETDEV_CHANGEUPPER event is triggered. Driver finds the lower devices (PFs) to flush all the offloaded entries. And mlx5_lag_is_shared_fdb is checked, it returns false if one of PF is unloaded. In such case, mlx5_esw_bridge_lag_rep_get() and its caller return NULL, instead of the alive PF, and the flush is skipped. Besides, the bridge fdb entry's lastuse is updated in mlx5 bridge event handler. But this SWITCHDEV_FDB_ADD_TO_BRIDGE event can be ignored in this case because the upper interface for bond is deleted, and the entry will never be aged because lastuse is never updated. To make things worse, as the entry is alive, mlx5 bridge workqueue keeps sending that event, which is then handled by kernel bridge notifier. It causes the following crash when accessing the passed bond netdev which is already destroyed. To fix this issue, remove such checks. LAG state is already checked in commit 15f8f168952f (net/mlx5: Bridge, verify LAG state when adding bond to bridge), driver still need to skip offload if LAG becomes invalid state after initialization. Oops: stack segment: 0000 [#1] SMP CPU: 3 UID: 0 PID: 23695 Comm: kworker/u40:3 Tainted: G OE 6.11.0_mlnx #1 Tainted:
[O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: mlx5_bridge_wq mlx5_esw_bridge_update_work [mlx5_core] RIP: 0010:br_switchdev_event+0x2c/0x110 [bridge] Code: 44 00 00 48 8b 02 48 f7 00 00 02 00 00 74 69 41 54 55 53 48 83 ec 08 48 8b a8 08 01 00 00 48 85 ed 74 4a 48 83 fe 02 48 89 d3 <4c> 8b 65 00 74 23 76 49 48 83 fe 05 74 7e 48 83 fe 06 75 2f 0f b7 RSP: 0018:ffffc900092cfda0 EFLAGS: 00010297 RAX: ffff888123bfe000 RBX: ffffc900092cfe08 RCX: 00000000ffffffff RDX: ffffc900092cfe08 RSI: 0000000000000001 RDI: ffffffffa0c585f0 RBP: 6669746f6e690a30 R08: 0000000000000000 R09:
ffff888123ae92c8 R10: 0000000000000000 R11: fefefefefefefeff R12: ffff888123ae9c60 R13: 0000000000000001 R14: ffffc900092cfe08 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88852c980000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f15914c8734 CR3:
0000000002830005 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ?
__die_body+0x1a/0x60 ? die+0x38/0x60 ? do_trap+0x10b/0x120 ? do_error_trap+0x64/0xa0 ? exc_stack_segment+0x33/0x50 ? asm_exc_stack_segment+0x22/0x30 ? br_switchdev_event+0x2c/0x110 [bridge] ? sched_balance_newidle.isra.149+0x248/0x390 notifier_call_chain+0x4b/0xa0 atomic_notifier_call_chain+0x16/0x20 mlx5_esw_bridge_update+0xec/0x170 [mlx5_core] mlx5_esw_bridge_update_work+0x19/0x40 [mlx5_core] process_scheduled_works+0x81/0x390 worker_thread+0x106/0x250 ? bh_worker+0x110/0x110 kthread+0xb7/0xe0 ? kthread_park+0x80/0x80 ret_from_fork+0x2d/0x50 ? kthread_park+0x80/0x80 ret_from_fork_asm+0x11/0x20 </TASK> (CVE-2025-21970)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21970
https://ubuntu.com/security/CVE-2025-21970

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21970

Plugin Information
Published: 2025/08/07, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244725 - Linux Distros Unpatched Vulnerability : CVE-2025-21971
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net_sched: Prevent creation of classes with TC_H_ROOT The function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination condition when traversing up the qdisc tree to update parent backlog counters.
However, if a class is created with classid TC_H_ROOT, the traversal terminates prematurely at this class instead of reaching the actual root qdisc, causing parent statistics to be incorrectly maintained. In case of DRR, this could lead to a crash as reported by Mingi Cho. Prevent the creation of any Qdisc class with classid TC_H_ROOT (0xFFFFFFFF) across all qdisc types, as suggested by Jamal. (CVE-2025-21971)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21971
https://ubuntu.com/security/CVE-2025-21971

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21971

Plugin Information
Published: 2025/08/07, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244653 - Linux Distros Unpatched Vulnerability : CVE-2025-21973
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fix kernel panic in the bnxt_get_queue_stats{rx | tx} When qstats-get operation is executed, callbacks of netdev_stats_ops are called. The bnxt_get_queue_stats{rx | tx} collect per-queue stats from sw_stats in the rings. But {rx | tx | cp}_ring are allocated when the interface is up. So, these rings are not allocated when the interface is down. The qstats-get is allowed even if the interface is down. However, the bnxt_get_queue_stats{rx | tx}() accesses cp_ring and tx_ring without null check. So, it needs to avoid accessing rings if the interface is down. Reproducer: ip link set $interface down ./cli.py --spec netdev.yaml --dump qstats-get OR ip link set $interface down python ./stats.py Splat looks like: BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 1680fa067 P4D 1680fa067 PUD 16be3b067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 UID: 0 PID: 1495 Comm: python3 Not tainted 6.14.0-rc4+ #32 5cd0f999d5a15c574ac72b3e4b907341 Hardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021 RIP: 0010:bnxt_get_queue_stats_rx+0xf/0x70 [bnxt_en] Code: c6 87 b5 18 00 00 02 eb a2 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 01 RSP: 0018:ffffabef43cdb7e0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffffc04c8710 RCX:
0000000000000000 RDX: ffffabef43cdb858 RSI: 0000000000000000 RDI: ffff8d504e850000 RBP: ffff8d506c9f9c00 R08: 0000000000000004 R09: ffff8d506bcd901c R10: 0000000000000015 R11: ffff8d506bcd9000 R12:
0000000000000000 R13: ffffabef43cdb8c0 R14: ffff8d504e850000 R15: 0000000000000000 FS:
00007f2c5462b080(0000) GS:ffff8d575f600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 CR2: 0000000000000000 CR3: 0000000167fd0000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <TASK> ? __die+0x20/0x70 ? page_fault_oops+0x15a/0x460 ? sched_balance_find_src_group+0x58d/0xd10 ? exc_page_fault+0x6e/0x180 ? asm_exc_page_fault+0x22/0x30 ? bnxt_get_queue_stats_rx+0xf/0x70 [bnxt_en cdd546fd48563c280cfd30e9647efa420db07bf1] netdev_nl_stats_by_netdev+0x2b1/0x4e0 ? xas_load+0x9/0xb0 ? xas_find+0x183/0x1d0 ? xa_find+0x8b/0xe0 netdev_nl_qstats_get_dumpit+0xbf/0x1e0 genl_dumpit+0x31/0x90 netlink_dump+0x1a8/0x360 (CVE-2025-21973)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21973
https://ubuntu.com/security/CVE-2025-21973

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21973

Plugin Information
Published: 2025/08/07, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244088 - Linux Distros Unpatched Vulnerability : CVE-2025-21974
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: return fail if interface is down in bnxt_queue_mem_alloc() The bnxt_queue_mem_alloc() is called to allocate new queue memory when a queue is restarted. It internally accesses rx buffer descriptor corresponding to the index. The rx buffer descriptor is allocated and set when the interface is up and it's freed when the interface is down. So, if queue is restarted if interface is down, kernel panic occurs. Splat looks like: BUG: unable to handle page fault for address: 000000000000b240 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 UID: 0 PID: 1563 Comm:
ncdevmem2 Not tainted 6.14.0-rc2+ #9 844ddba6e7c459cafd0bf4db9a3198e Hardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021 RIP: 0010:bnxt_queue_mem_alloc+0x3f/0x4e0 [bnxt_en] Code: 41 54 4d 89 c4 4d 69 c0 c0 05 00 00 55 48 89 f5 53 48 89 fb 4c 8d b5 40 05 00 00 48 83 ec 15 RSP:
0018:ffff9dcc83fef9e8 EFLAGS: 00010202 RAX: ffffffffc0457720 RBX: ffff934ed8d40000 RCX: 0000000000000000 RDX: 000000000000001f RSI: ffff934ea508f800 RDI: ffff934ea508f808 RBP: ffff934ea508f800 R08:
000000000000b240 R09: ffff934e84f4b000 R10: ffff9dcc83fefa30 R11: ffff934e84f4b000 R12: 000000000000001f R13: ffff934ed8d40ac0 R14: ffff934ea508fd40 R15: ffff934e84f4b000 FS: 00007fa73888c740(0000) GS:ffff93559f780000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
000000000000b240 CR3: 0000000145a2e000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <TASK> ?
__die+0x20/0x70 ? page_fault_oops+0x15a/0x460 ? exc_page_fault+0x6e/0x180 ? asm_exc_page_fault+0x22/0x30 ?
__pfx_bnxt_queue_mem_alloc+0x10/0x10 [bnxt_en 7f85e76f4d724ba07471d7e39d9e773aea6597b7] ? bnxt_queue_mem_alloc+0x3f/0x4e0 [bnxt_en 7f85e76f4d724ba07471d7e39d9e773aea6597b7] netdev_rx_queue_restart+0xc5/0x240 net_devmem_bind_dmabuf_to_queue+0xf8/0x200 netdev_nl_bind_rx_doit+0x3a7/0x450 genl_family_rcv_msg_doit+0xd9/0x130 genl_rcv_msg+0x184/0x2b0 ?
__pfx_netdev_nl_bind_rx_doit+0x10/0x10 ? __pfx_genl_rcv_msg+0x10/0x10 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 ... (CVE-2025-21974)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21974
https://ubuntu.com/security/CVE-2025-21974

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21974

Plugin Information
Published: 2025/08/06, Modified: 2025/11/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248947 - Linux Distros Unpatched Vulnerability : CVE-2025-21975
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/mlx5: handle errors in mlx5_chains_create_table() In mlx5_chains_create_table(), the return value of mlx5_get_fdb_sub_ns() and mlx5_get_flow_namespace() must be checked to prevent NULL pointer dereferences. If either function fails, the function should log error message with mlx5_core_warn() and return error pointer. (CVE-2025-21975)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21975
https://ubuntu.com/security/CVE-2025-21975

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21975

Plugin Information
Published: 2025/08/12, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244066 - Linux Distros Unpatched Vulnerability : CVE-2025-21976
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fbdev: hyperv_fb: Allow graceful removal of framebuffer When a Hyper-V framebuffer device is unbind, hyperv_fb driver tries to release the framebuffer forcefully. If this framebuffer is in use it produce the following WARN and hence this framebuffer is never released. [ 44.111220] WARNING: CPU: 35 PID: 1882 at drivers/video/fbdev/core/fb_info.c:70 framebuffer_release+0x2c/0x40 < snip > [ 44.111289] Call Trace: [ 44.111290] <TASK> [ 44.111291] ? show_regs+0x6c/0x80 [ 44.111295] ? __warn+0x8d/0x150 [ 44.111298] ? framebuffer_release+0x2c/0x40 [ 44.111300] ? report_bug+0x182/0x1b0 [ 44.111303] ? handle_bug+0x6e/0xb0 [ 44.111306] ? exc_invalid_op+0x18/0x80 [ 44.111308] ? asm_exc_invalid_op+0x1b/0x20 [ 44.111311] ? framebuffer_release+0x2c/0x40 [ 44.111313] ? hvfb_remove+0x86/0xa0 [hyperv_fb] [ 44.111315] vmbus_remove+0x24/0x40 [hv_vmbus] [ 44.111323] device_remove+0x40/0x80 [ 44.111325] device_release_driver_internal+0x20b/0x270 [ 44.111327] ? bus_find_device+0xb3/0xf0 Fix this by moving the release of framebuffer and assosiated memory to fb_ops.fb_destroy function, so that framebuffer framework handles it gracefully. While we fix this, also replace manual registrations/unregistration of framebuffer with devm_register_framebuffer. (CVE-2025-21976)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21976
https://security-tracker.debian.org/tracker/CVE-2025-21976
https://ubuntu.com/security/CVE-2025-21976

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21976

Plugin Information
Published: 2025/08/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247982 - Linux Distros Unpatched Vulnerability : CVE-2025-21978
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: Fix address space leak when Hyper-V DRM device is removed When a Hyper-V DRM device is probed, the driver allocates MMIO space for the vram, and maps it cacheable. If the device removed, or in the error path for device probing, the MMIO space is released but no unmap is done. Consequently the kernel address space for the mapping is leaked. Fix this by adding iounmap() calls in the device removal path, and in the error path during device probing. (CVE-2025-21978)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21978
https://ubuntu.com/security/CVE-2025-21978

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21978

Plugin Information
Published: 2025/08/11, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248034 - Linux Distros Unpatched Vulnerability : CVE-2025-21980
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: sched: address a potential NULL pointer dereference in the GRED scheduler. If kzalloc in gred_init returns a NULL pointer, the code follows the error handling path, invoking gred_destroy. This, in turn, calls gred_offload, where memset could receive a NULL pointer as input, potentially leading to a kernel crash. When table->opt is NULL in gred_init(), gred_change_table_def() is not called yet, so it is not necessary to call ->ndo_setup_tc() in gred_offload(). (CVE-2025-21980)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21980
https://ubuntu.com/security/CVE-2025-21980

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21980

Plugin Information
Published: 2025/08/11, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243696 - Linux Distros Unpatched Vulnerability : CVE-2025-21981
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ice: fix memory leak in aRFS after reset Fix aRFS (accelerated Receive Flow Steering) structures memory leak by adding a checker to verify if aRFS memory is already allocated while configuring VSI. aRFS objects are allocated in two cases: - as part of VSI initialization (at probe), and - as part of reset handling However, VSI reconfiguration executed during reset involves memory allocation one more time, without prior releasing already allocated resources. This led to the memory leak with the following signature: [root@os-delivery ~]# cat /sys/kernel/debug/kmemleak unreferenced object 0xff3c1ca7252e6000 (size 8192): comm kworker/0:0, pid 8, jiffies 4296833052 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 0):
[<ffffffff991ec485>] __kmalloc_cache_noprof+0x275/0x340 [<ffffffffc0a6e06a>] ice_init_arfs+0x3a/0xe0 [ice] [<ffffffffc09f1027>] ice_vsi_cfg_def+0x607/0x850 [ice] [<ffffffffc09f244b>] ice_vsi_setup+0x5b/0x130 [ice] [<ffffffffc09c2131>] ice_init+0x1c1/0x460 [ice] [<ffffffffc09c64af>] ice_probe+0x2af/0x520 [ice] [<ffffffff994fbcd3>] local_pci_probe+0x43/0xa0 [<ffffffff98f07103>] work_for_cpu_fn+0x13/0x20 [<ffffffff98f0b6d9>] process_one_work+0x179/0x390 [<ffffffff98f0c1e9>] worker_thread+0x239/0x340 [<ffffffff98f14abc>] kthread+0xcc/0x100 [<ffffffff98e45a6d>] ret_from_fork+0x2d/0x50 [<ffffffff98e083ba>] ret_from_fork_asm+0x1a/0x30 ... (CVE-2025-21981)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21981
https://ubuntu.com/security/CVE-2025-21981

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21981

Plugin Information
Published: 2025/08/05, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244890 - Linux Distros Unpatched Vulnerability : CVE-2025-21986
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: switchdev: Convert blocking notification chain to a raw one A blocking notification chain uses a read-write semaphore to protect the integrity of the chain. The semaphore is acquired for writing when adding / removing notifiers to / from the chain and acquired for reading when traversing the chain and informing notifiers about an event. In case of the blocking switchdev notification chain, recursive notifications are possible which leads to the semaphore being acquired twice for reading and to lockdep warnings being generated [1]. Specifically, this can happen when the bridge driver processes a SWITCHDEV_BRPORT_UNOFFLOADED event which causes it to emit notifications about deferred events when calling switchdev_deferred_process(). Fix this by converting the notification chain to a raw notification chain in a similar fashion to the netdev notification chain. Protect the chain using the RTNL mutex by acquiring it when modifying the chain. Events are always informed under the RTNL mutex, but add an assertion in call_switchdev_blocking_notifiers() to make sure this is not violated in the future. Maintain the blocking prefix as events are always emitted from process context and listeners are allowed to block. [1]: WARNING: possible recursive locking detected 6.14.0-rc4-custom-g079270089484 #1 Not tainted
-------------------------------------------- ip/52731 is trying to acquire lock: ffffffff850918d8 ((switchdev_blocking_notif_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x58/0xa0 but task is already holding lock: ffffffff850918d8 ((switchdev_blocking_notif_chain).rwsem){++++}-{4:4}, at:
blocking_notifier_call_chain+0x58/0xa0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock((switchdev_blocking_notif_chain).rwsem);
lock((switchdev_blocking_notif_chain).rwsem); *** DEADLOCK *** May be due to missing lock nesting notation 3 locks held by ip/52731: #0: ffffffff84f795b0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x727/0x1dc0 #1:
ffffffff8731f628 (&net->rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x790/0x1dc0 #2: ffffffff850918d8 ((switchdev_blocking_notif_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x58/0xa0 stack backtrace: ... ? __pfx_down_read+0x10/0x10 ? __pfx_mark_lock+0x10/0x10 ?
__pfx_switchdev_port_attr_set_deferred+0x10/0x10 blocking_notifier_call_chain+0x58/0xa0 switchdev_port_attr_notify.constprop.0+0xb3/0x1b0 ? __pfx_switchdev_port_attr_notify.constprop.0+0x10/0x10 ? mark_held_locks+0x94/0xe0 ? switchdev_deferred_process+0x11a/0x340 switchdev_port_attr_set_deferred+0x27/0xd0 switchdev_deferred_process+0x164/0x340 br_switchdev_port_unoffload+0xc8/0x100 [bridge] br_switchdev_blocking_event+0x29f/0x580 [bridge] notifier_call_chain+0xa2/0x440 blocking_notifier_call_chain+0x6e/0xa0 switchdev_bridge_port_unoffload+0xde/0x1a0 ... (CVE-2025-21986)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21986
https://ubuntu.com/security/CVE-2025-21986

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21986

Plugin Information
Published: 2025/08/07, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248036 - Linux Distros Unpatched Vulnerability : CVE-2025-21992
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- HID: ignore non-functional sensor in HP 5MP Camera The HP 5MP Camera (USB ID 0408:5473) reports a HID sensor interface that is not actually implemented. Attempting to access this non-functional sensor via iio_info causes system hangs as runtime PM tries to wake up an unresponsive sensor. [453] hid-sensor-hub 0003:0408:5473.0003: Report latency attributes: ffffffff:ffffffff [453] hid-sensor-hub 0003:0408:5473.0003: common attributes: 5:1, 2:1, 3:1 ffffffff:ffffffff Add this device to the HID ignore list since the sensor interface is non-functional by design and should not be exposed to userspace.
(CVE-2025-21992)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21992
https://ubuntu.com/security/CVE-2025-21992

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21992

Plugin Information
Published: 2025/08/11, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246246 - Linux Distros Unpatched Vulnerability : CVE-2025-21995
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix fence reference count leak The last_scheduled fence leaks when an entity is being killed and adding the cleanup callback fails.
Decrement the reference count of prev when dma_fence_add_callback() fails, ensuring proper balance.
[phasta: add git tag info for stable kernel] (CVE-2025-21995)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21995
https://ubuntu.com/security/CVE-2025-21995

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21995

Plugin Information
Published: 2025/08/08, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245653 - Linux Distros Unpatched Vulnerability : CVE-2025-21996
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() On the off chance that command stream passed from userspace via ioctl() call to radeon_vce_cs_parse() is weirdly crafted and first command to execute is to encode (case 0x03000001), the function in question will attempt to call radeon_vce_cs_reloc() with size argument that has not been properly initialized. Specifically, 'size' will point to 'tmp' variable before the latter had a chance to be assigned any value. Play it safe and init 'tmp' with 0, thus ensuring that radeon_vce_cs_reloc() will catch an early error in cases like these.
Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. (cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68) (CVE-2025-21996)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-21996
https://ubuntu.com/security/CVE-2025-21996

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-21996

Plugin Information
Published: 2025/08/08, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244211 - Linux Distros Unpatched Vulnerability : CVE-2025-22005
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). fib_check_nh_v6_gw() expects that fib6_nh_init() cleans up everything when it fails. Commit 7dd73168e273 (ipv6: Always allocate pcpu memory in a fib6_nh) moved fib_nh_common_init() before alloc_percpu_gfp() within fib6_nh_init() but forgot to add cleanup for fib6_nh->nh_common.nhc_pcpu_rth_output in case it fails to allocate fib6_nh->rt6i_pcpu, resulting in memleak. Let's call fib_nh_common_release() and clear nhc_pcpu_rth_output in the error path. Note that we can remove the fib6_nh_release() call in nh_create_ipv6() later in net-next.git. (CVE-2025-22005)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22005
https://ubuntu.com/security/CVE-2025-22005

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22005

Plugin Information
Published: 2025/08/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
234199 - Linux Distros Unpatched Vulnerability : CVE-2025-22008
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- regulator: check that dummy regulator has been probed before using it Due to asynchronous driver probing there is a chance that the dummy regulator hasn't already been probed when first accessing it.
(CVE-2025-22008)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22008
https://ubuntu.com/security/CVE-2025-22008

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22008

Plugin Information
Published: 2025/04/11, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244281 - Linux Distros Unpatched Vulnerability : CVE-2025-22009
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: regulator: dummy: force synchronous probing Sometimes I get a NULL pointer dereference at boot time in kobject_get() with the following call stack: anatop_regulator_probe() devm_regulator_register() regulator_register() regulator_resolve_supply() kobject_get() By placing some extra BUG_ON() statements I could verify that this is raised because probing of the 'dummy' regulator driver is not completed ('dummy_regulator_rdev' is still NULL). In the JTAG debugger I can see that dummy_regulator_probe() and anatop_regulator_probe() can be run by different kernel threads (kworker/u4:*). I haven't further investigated whether this can be changed or if there are other possibilities to force synchronization between these two probe routines. On the other hand I don't expect much boot time penalty by probing the 'dummy' regulator synchronously. (CVE-2025-22009)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22009
https://ubuntu.com/security/CVE-2025-22009

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22009

Plugin Information
Published: 2025/08/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249806 - Linux Distros Unpatched Vulnerability : CVE-2025-22013
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state There are several problems with the way hyp code lazily saves the host's FPSIMD/SVE state, including: * Host SVE being discarded unexpectedly due to inconsistent configuration of TIF_SVE and CPACR_ELx.ZEN. This has been seen to result in QEMU crashes where SVE is used by memmove(), as reported by Eric Auger: https://issues.redhat.com/browse/RHEL-68997 * Host SVE state is discarded *after* modification by ptrace, which was an unintentional ptrace ABI change introduced with lazy discarding of SVE state. * The host FPMR value can be discarded when running a non-protected VM, where FPMR support is not exposed to a VM, and that VM uses FPSIMD/SVE. In these cases the hyp code does not save the host's FPMR before unbinding the host's FPSIMD/SVE/SME state, leaving a stale value in memory. Avoid these by eagerly saving and flushing the host's FPSIMD/SVE/SME state when loading a vCPU such that KVM does not need to save any of the host's FPSIMD/SVE/SME state. For clarity, fpsimd_kvm_prepare() is removed and the necessary call to fpsimd_save_and_flush_cpu_state() is placed in kvm_arch_vcpu_load_fp(). As 'fpsimd_state' and 'fpmr_ptr' should not be used, they are set to NULL; all uses of these will be removed in subsequent patches. Historical problems go back at least as far as v5.17, e.g. erroneous assumptions about TIF_SVE being clear in commit: 8383741ab2e773a9 (KVM: arm64: Get rid of host SVE tracking/saving) ... and so this eager save+flush probably needs to be backported to ALL stable trees. (CVE-2025-22013)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22013
https://ubuntu.com/security/CVE-2025-22013

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22013

Plugin Information
Published: 2025/08/15, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
234192 - Linux Distros Unpatched Vulnerability : CVE-2025-22015
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: mm/migrate: fix shmem xarray update during migration A shmem folio can be either in page cache or in swap cache, but not at the same time.
Namely, once it is in swap cache, folio->mapping should be NULL, and the folio is no longer in a shmem mapping. In __folio_migrate_mapping(), to determine the number of xarray entries to update, folio_test_swapbacked() is used, but that conflates shmem in page cache case and shmem in swap cache case.
It leads to xarray multi-index entry corruption, since it turns a sibling entry to a normal entry during xas_store() (see [1] for a userspace reproduction). Fix it by only using folio_test_swapcache() to determine whether xarray is storing swap cache entries or not to choose the right number of xarray entries to update. [1] https://lore.kernel.org/linux-mm/Z8idPCkaJW1IChjT@casper.infradead.org/ Note: In
__split_huge_page(), folio_test_anon() && folio_test_swapcache() is used to get swap_cache address space, but that ignores the shmem folio in swap cache case. It could lead to NULL pointer dereferencing when a in-swap-cache shmem folio is split at __xa_store(), since !folio_test_anon() is true and folio->mapping is NULL. But fortunately, its caller split_huge_page_to_list_to_order() bails out early with EBUSY when folio->mapping is NULL. So no need to take care of it here. (CVE-2025-22015)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22015
https://ubuntu.com/security/CVE-2025-22015

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22015

Plugin Information
Published: 2025/04/11, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245054 - Linux Distros Unpatched Vulnerability : CVE-2025-22016
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: dpll: fix xa_alloc_cyclic() error handling In case of returning 1 from xa_alloc_cyclic() (wrapping) ERR_PTR(1) will be returned, which will cause IS_ERR() to be false. Which can lead to dereference not allocated pointer (pin). Fix it by checking if err is lower than zero. This wasn't found in real usecase, only noticed. Credit to Pierre.
(CVE-2025-22016)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22016
https://ubuntu.com/security/CVE-2025-22016

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22016

Plugin Information
Published: 2025/08/07, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247782 - Linux Distros Unpatched Vulnerability : CVE-2025-22017
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: devlink: fix xa_alloc_cyclic() error handling In case of returning 1 from xa_alloc_cyclic() (wrapping) ERR_PTR(1) will be returned, which will cause IS_ERR() to be false. Which can lead to dereference not allocated pointer (rel). Fix it by checking if err is lower than zero. This wasn't found in real usecase, only noticed. Credit to Pierre.
(CVE-2025-22017)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22017
https://ubuntu.com/security/CVE-2025-22017

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
References

CVE | CVE-2025-22017

Plugin Information
Published: 2025/08/10, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245068 - Linux Distros Unpatched Vulnerability : CVE-2025-22021
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfilter: socket: Lookup orig tuple for IPv6 SNAT nf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to restore the original 5-tuple in case of SNAT, to be able to find the right socket (if any).
Then socket_match() can correctly check whether the socket was transparent. However, the IPv6 counterpart (nf_sk_lookup_slow_v6) lacks this conntrack lookup, making xt_socket fail to match on the socket when the packet was SNATed. Add the same logic to nf_sk_lookup_slow_v6. IPv6 SNAT is used in Kubernetes clusters for pod-to-world packets, as pods' addresses are in the fd00::/8 ULA subnet and need to be replaced with the node's external address. Cilium leverages Envoy to enforce L7 policies, and Envoy uses transparent sockets. Cilium inserts an iptables prerouting rule that matches on `-m socket --transparent` and redirects the packets to localhost, but it fails to match SNATed IPv6 packets due to that missing conntrack lookup. (CVE-2025-22021)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22021
https://ubuntu.com/security/CVE-2025-22021

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
References

CVE | CVE-2025-22021

Plugin Information
Published: 2025/08/07, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244464 - Linux Distros Unpatched Vulnerability : CVE-2025-22024
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: nfsd: fix management of listener transports Currently, when no active threads are running, a root user using nfsdctl command can try to remove a particular listener from the list of previously added ones, then start the server by increasing the number of threads, it leads to the following problem: [ 158.835354] refcount_t: addition on 0; use- after-free. [ 158.835603] WARNING: CPU: 2 PID: 9145 at lib/refcount.c:25 refcount_warn_saturate+0x160/0x1a0 [ 158.836017] Modules linked in: rpcrdma rdma_cm iw_cm ib_cm ib_core nfsd auth_rpcgss nfs_acl lockd grace overlay isofs uinput snd_seq_dummy snd_hrtimer nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 rfkill ip_set nf_tables qrtr sunrpc vfat fat uvcvideo videobuf2_vmalloc videobuf2_memops uvc videobuf2_v4l2 videodev videobuf2_common snd_hda_codec_generic mc e1000e snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hda_core snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer snd soundcore sg loop dm_multipath dm_mod nfnetlink vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs libcrc32c crct10dif_ce ghash_ce vmwgfx sha2_ce sha256_arm64 sr_mod sha1_ce cdrom nvme drm_client_lib drm_ttm_helper ttm nvme_core drm_kms_helper nvme_auth drm fuse [ 158.840093] CPU: 2 UID: 0 PID: 9145 Comm: nfsd Kdump:
loaded Tainted: G B W 6.13.0-rc6+ #7 [ 158.840624] Tainted: [B]=BAD_PAGE, [W]=WARN [ 158.840802] Hardware name: VMware, Inc. VMware20,1/VBSA, BIOS VMW201.00V.24006586.BA64.2406042154 06/04/2024 [ 158.841220] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 158.841563] pc :
refcount_warn_saturate+0x160/0x1a0 [ 158.841780] lr : refcount_warn_saturate+0x160/0x1a0 [ 158.842000] sp : ffff800089be7d80 [ 158.842147] x29: ffff800089be7d80 x28: ffff00008e68c148 x27: ffff00008e68c148 [ 158.842492] x26: ffff0002e3b5c000 x25: ffff600011cd1829 x24: ffff00008653c010 [ 158.842832] x23:
ffff00008653c000 x22: 1fffe00011cd1829 x21: ffff00008653c028 [ 158.843175] x20: 0000000000000002 x19:
ffff00008653c010 x18: 0000000000000000 [ 158.843505] x17: 0000000000000000 x16: 0000000000000000 x15:
0000000000000000 [ 158.843836] x14: 0000000000000000 x13: 0000000000000001 x12: ffff600050a26493 [ 158.844143] x11: 1fffe00050a26492 x10: ffff600050a26492 x9 : dfff800000000000 [ 158.844475] x8 :
00009fffaf5d9b6e x7 : ffff000285132493 x6 : 0000000000000001 [ 158.844823] x5 : ffff000285132490 x4 :
ffff600050a26493 x3 : ffff8000805e72bc [ 158.845174] x2 : 0000000000000000 x1 : 0000000000000000 x0 :
ffff000098588000 [ 158.845528] Call trace: [ 158.845658] refcount_warn_saturate+0x160/0x1a0 (P) [ 158.845894] svc_recv+0x58c/0x680 [sunrpc] [ 158.846183] nfsd+0x1fc/0x348 [nfsd] [ 158.846390] kthread+0x274/0x2f8 [ 158.846546] ret_from_fork+0x10/0x20 [ 158.846714] ---[ end trace 0000000000000000 ]--- nfsd_nl_listener_set_doit() would manipulate the list of transports of server's sv_permsocks and close the specified listener but the other list of transports (server's sp_xprts list) would not be changed leading to the problem above. Instead, determined if the nfsdctl is trying to remove a listener, in which case, delete all the existing listener transports and re-create all-but-the-removed ones.
(CVE-2025-22024)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22024
https://ubuntu.com/security/CVE-2025-22024

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22024

Plugin Information
Published: 2025/08/06, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246513 - Linux Distros Unpatched Vulnerability : CVE-2025-22025
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nfsd: put dl_stid if fail to queue dl_recall Before calling nfsd4_run_cb to queue dl_recall to the callback_wq, we increment the reference count of dl_stid. We expect that after the corresponding work_struct is processed, the reference count of dl_stid will be decremented through the callback function nfsd4_cb_recall_release. However, if the call to nfsd4_run_cb fails, the incremented reference count of dl_stid will not be decremented correspondingly, leading to the following nfs4_stid leak: unreferenced object 0xffff88812067b578 (size 344): comm nfsd, pid 2761, jiffies 4295044002 (age 5541.241s) hex dump (first 32 bytes): 01 00 00 00 6b 6b 6b 6b b8 02 c0 e2 81 88 ff ff ....kkkk........ 00 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 ad 4e ad de .kkkkkkk.....N.. backtrace: kmem_cache_alloc+0x4b9/0x700 nfsd4_process_open1+0x34/0x300 nfsd4_open+0x2d1/0x9d0 nfsd4_proc_compound+0x7a2/0xe30 nfsd_dispatch+0x241/0x3e0 svc_process_common+0x5d3/0xcc0 svc_process+0x2a3/0x320 nfsd+0x180/0x2e0 kthread+0x199/0x1d0 ret_from_fork+0x30/0x50 ret_from_fork_asm+0x1b/0x30 unreferenced object 0xffff8881499f4d28 (size 368): comm nfsd, pid 2761, jiffies 4295044005 (age 5541.239s) hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 30 4d 9f 49 81 88 ff ff ........0M.I.... 30 4d 9f 49 81 88 ff ff 20 00 00 00 01 00 00 00 0M.I.... ....... backtrace: kmem_cache_alloc+0x4b9/0x700 nfs4_alloc_stid+0x29/0x210 alloc_init_deleg+0x92/0x2e0 nfs4_set_delegation+0x284/0xc00 nfs4_open_delegation+0x216/0x3f0 nfsd4_process_open2+0x2b3/0xee0 nfsd4_open+0x770/0x9d0 nfsd4_proc_compound+0x7a2/0xe30 nfsd_dispatch+0x241/0x3e0 svc_process_common+0x5d3/0xcc0 svc_process+0x2a3/0x320 nfsd+0x180/0x2e0 kthread+0x199/0x1d0 ret_from_fork+0x30/0x50 ret_from_fork_asm+0x1b/0x30 Fix it by checking the result of nfsd4_run_cb and call nfs4_put_stid if fail to queue dl_recall. (CVE-2025-22025)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22025
https://ubuntu.com/security/CVE-2025-22025

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22025

Plugin Information
Published: 2025/08/09, Modified: 2025/12/12
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250047 - Linux Distros Unpatched Vulnerability : CVE-2025-22031
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: PCI/bwctrl: Fix NULL pointer dereference on bus number exhaustion When BIOS neglects to assign bus numbers to PCI bridges, the kernel attempts to correct that during PCI device enumeration. If it runs out of bus numbers, no pci_bus is allocated and the subordinate pointer in the bridge's pci_dev remains NULL. The PCIe bandwidth controller erroneously does not check for a NULL subordinate pointer and dereferences it on probe.
Bandwidth control of unusable devices below the bridge is of questionable utility, so simply error out instead. This mirrors what PCIe hotplug does since commit 62e4492c3063 (PCI: Prevent NULL dereference during pciehp probe). The PCI core emits a message with KERN_INFO severity if it has run out of bus numbers. PCIe hotplug emits an additional message with KERN_ERR severity to inform the user that hotplug functionality is disabled at the bridge. A similar message for bandwidth control does not seem merited, given that its only purpose so far is to expose an up-to-date link speed in sysfs and throttle the link speed on certain laptops with limited Thermal Design Power. So error out silently. User-visible messages:
pci 0000:16:02.0: bridge configuration invalid ([bus 00-00]), reconfiguring [...] pci_bus 0000:45:
busn_res: [bus 45-74] end is updated to 74 pci 0000:16:02.0: devices behind bridge are unusable because [bus 45-74] cannot be assigned for them [...] pcieport 0000:16:02.0: pciehp: Hotplug bridge without secondary bus, ignoring [...] BUG: kernel NULL pointer dereference RIP: pcie_update_link_speed pcie_bwnotif_enable pcie_bwnotif_probe pcie_port_probe_service really_probe (CVE-2025-22031)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22031
https://ubuntu.com/security/CVE-2025-22031

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22031

Plugin Information
Published: 2025/08/15, Modified: 2025/12/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244732 - Linux Distros Unpatched Vulnerability : CVE-2025-22044
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: acpi: nfit: fix narrowing conversion in acpi_nfit_ctl Syzkaller has reported a warning in to_nfit_bus_uuid(): only secondary bus families can be translated. This warning is emited if the argument is equal to NVDIMM_BUS_FAMILY_NFIT == 0. Function acpi_nfit_ctl() first verifies that a user-provided value call_pkg->nd_family of type u64 is not equal to 0. Then the value is converted to int, and only after that is compared to NVDIMM_BUS_FAMILY_MAX. This can lead to passing an invalid argument to acpi_nfit_ctl(), if call_pkg->nd_family is non-zero, while the lower 32 bits are zero. Furthermore, it is best to return EINVAL immediately upon seeing the invalid user input. The WARNING is insufficient to prevent further undefined behavior based on other invalid user input. All checks of the input value should be applied to the original variable call_pkg->nd_family.
[iweiny: update commit message] (CVE-2025-22044)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22044
https://ubuntu.com/security/CVE-2025-22044

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22044

Plugin Information
Published: 2025/08/07, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244322 - Linux Distros Unpatched Vulnerability : CVE-2025-22045
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs On the following path, flush_tlb_range() can be used for zapping normal PMD entries (PMD entries that point to page tables) together with the PTE entries in the pointed-to page table: collapse_pte_mapped_thp pmdp_collapse_flush flush_tlb_range The arm64 version of flush_tlb_range() has a comment describing that it can be used for page table removal, and does not use any last-level invalidation optimizations. Fix the X86 version by making it behave the same way. Currently, X86 only uses this information for the following two purposes, which I think means the issue doesn't have much impact: - In native_flush_tlb_multi() for checking if lazy TLB CPUs need to be IPI'd to avoid issues with speculative page table walks. - In Hyper-V TLB paravirtualization, again for lazy TLB stuff. The patch x86/mm: only invalidate final translations with INVLPGB which is currently under review (see <https://lore.kernel.org/all/20241230175550.4046587-13-riel@surriel.com/>) would probably be making the impact of this a lot worse. (CVE-2025-22045)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22045
https://ubuntu.com/security/CVE-2025-22045

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22045

Plugin Information
Published: 2025/08/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244674 - Linux Distros Unpatched Vulnerability : CVE-2025-22050
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: usbnet:fix NPE during rx_complete Missing usbnet_going_away Check in Critical Path. The usb_submit_urb function lacks a usbnet_going_away validation, whereas __usbnet_queue_skb includes this check. This inconsistency creates a race condition where: A URB request may succeed, but the corresponding SKB data fails to be queued. Subsequent processes:
(e.g., rx_complete defer_bh __skb_unlink(skb, list)) attempt to access skb->next, triggering a NULL pointer dereference (Kernel Panic). (CVE-2025-22050)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22050
https://ubuntu.com/security/CVE-2025-22050

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22050

Plugin Information
Published: 2025/08/07, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248249 - Linux Distros Unpatched Vulnerability : CVE-2025-22053
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: ibmveth: make veth_pool_store stop hanging v2: - Created a single error handling unlock and exit in veth_pool_store - Greatly expanded commit message with previous explanatory-only text Summary: Use rtnl_mutex to synchronize veth_pool_store with itself, ibmveth_close and ibmveth_open, preventing multiple calls in a row to napi_disable. Background: Two (or more) threads could call veth_pool_store through writing to /sys/devices/vio/30000002/pool*/*. You can do this easily with a little shell script. This causes a hang. I configured LOCKDEP, compiled ibmveth.c with DEBUG, and built a new kernel. I ran this test again and saw: Setting pool0/active to 0 Setting pool1/active to 1 [ 73.911067][ T4365] ibmveth 30000002 eth0: close starting Setting pool1/active to 1 Setting pool1/active to 0 [ 73.911367][ T4366] ibmveth 30000002 eth0: close starting [ 73.916056][ T4365] ibmveth 30000002 eth0: close complete [ 73.916064][ T4365] ibmveth 30000002 eth0: open starting [ 110.808564][ T712] systemd-journald[712]: Sent WATCHDOG=1 notification. [ 230.808495][ T712] systemd-journald[712]: Sent WATCHDOG=1 notification. [ 243.683786][ T123] INFO: task stress.sh:4365 blocked for more than 122 seconds. [ 243.683827][ T123] Not tainted 6.14.0-01103-g2df0c02dab82-dirty #8 [ 243.683833][ T123] echo 0 >
/proc/sys/kernel/hung_task_timeout_secs disables this message. [ 243.683838][ T123] task:stress.sh state:D stack:28096 pid:4365 tgid:4365 ppid:4364 task_flags:0x400040 flags:0x00042000 [ 243.683852][ T123] Call Trace: [ 243.683857][ T123] [c00000000c38f690] [0000000000000001] 0x1 (unreliable) [ 243.683868][ T123] [c00000000c38f840] [c00000000001f908] __switch_to+0x318/0x4e0 [ 243.683878][ T123] [c00000000c38f8a0] [c000000001549a70] __schedule+0x500/0x12a0 [ 243.683888][ T123] [c00000000c38f9a0] [c00000000154a878] schedule+0x68/0x210 [ 243.683896][ T123] [c00000000c38f9d0] [c00000000154ac80] schedule_preempt_disabled+0x30/0x50 [ 243.683904][ T123] [c00000000c38fa00] [c00000000154dbb0]
__mutex_lock+0x730/0x10f0 [ 243.683913][ T123] [c00000000c38fb10] [c000000001154d40] napi_enable+0x30/0x60 [ 243.683921][ T123] [c00000000c38fb40] [c000000000f4ae94] ibmveth_open+0x68/0x5dc [ 243.683928][ T123] [c00000000c38fbe0] [c000000000f4aa20] veth_pool_store+0x220/0x270 [ 243.683936][ T123] [c00000000c38fc70] [c000000000826278] sysfs_kf_write+0x68/0xb0 [ 243.683944][ T123] [c00000000c38fcb0] [c0000000008240b8] kernfs_fop_write_iter+0x198/0x2d0 [ 243.683951][ T123] [c00000000c38fd00] [c00000000071b9ac] vfs_write+0x34c/0x650 [ 243.683958][ T123] [c00000000c38fdc0] [c00000000071bea8] ksys_write+0x88/0x150 [ 243.683966][ T123] [c00000000c38fe10] [c0000000000317f4] system_call_exception+0x124/0x340 [ 243.683973][ T123] [c00000000c38fe50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec ... [ 243.684087][ T123] Showing all locks held in the system: [ 243.684095][ T123] 1 lock held by khungtaskd/123: [ 243.684099][ T123] #0: c00000000278e370 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x50/0x248 [ 243.684114][ T123] 4 locks held by stress.sh/4365: [ 243.684119][ T123] #0: c00000003a4cd3f8 (sb_writers#3){.+.+}-{0:0}, at: ksys_write+0x88/0x150 [ 243.684132][ T123] #1: c000000041aea888 (&of->mutex#2){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x154/0x2d0 [ 243.684143][ T123] #2:
c0000000366fb9a8 (kn->active#64){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x160/0x2d0 [ 243.684155][ T123] #3: c000000035ff4cb8 (&dev->lock){+.+.}-{3:3}, at: napi_enable+0x30/0x60 [ 243.684166][ T123] 5 locks held by stress.sh/4366: [ 243.684170][ T123] #0: c00000003a4cd3f8 (sb_writers#3){.+.+}-{0:0}, at:
ksys_write+0x88/0x150 [ 243. ---truncated--- (CVE-2025-22053)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22053
https://security-tracker.debian.org/tracker/CVE-2025-22053
https://ubuntu.com/security/CVE-2025-22053

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22053

Plugin Information
Published: 2025/08/11, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243765 - Linux Distros Unpatched Vulnerability : CVE-2025-22057
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: decrease cached dst counters in dst_release Upstream fix ac888d58869b (net: do not delay dst_entries_add() in dst_release()) moved decrementing the dst count from dst_destroy to dst_release to avoid accessing already freed data in case of netns dismantle. However in case CONFIG_DST_CACHE is enabled and OvS+tunnels are used, this fix is incomplete as the same issue will be seen for cached dsts: Unable to handle kernel paging request at virtual address ffff5aabf6b5c000 Call trace:
percpu_counter_add_batch+0x3c/0x160 (P) dst_release+0xec/0x108 dst_cache_destroy+0x68/0xd8 dst_destroy+0x13c/0x168 dst_destroy_rcu+0x1c/0xb0 rcu_do_batch+0x18c/0x7d0 rcu_core+0x174/0x378 rcu_core_si+0x18/0x30 Fix this by invalidating the cache, and thus decrementing cached dst counters, in dst_release too. (CVE-2025-22057)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22057
https://security-tracker.debian.org/tracker/CVE-2025-22057
https://ubuntu.com/security/CVE-2025-22057

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22057

Plugin Information
Published: 2025/08/05, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250138 - Linux Distros Unpatched Vulnerability : CVE-2025-22062
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: sctp: add mutual exclusion in proc_sctp_do_udp_port() We must serialize calls to sctp_udp_sock_stop() and sctp_udp_sock_start() or risk a crash as syzbot reported: Oops: general protection fault, probably for non-canonical address 0xdffffc000000000d: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f] CPU: 1 UID: 0 PID: 6551 Comm: syz.1.44 Not tainted 6.14.0-syzkaller-g7f2ff7b62617 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 RIP: 0010:kernel_sock_shutdown+0x47/0x70 net/socket.c:3653 Call Trace:
<TASK> udp_tunnel_sock_release+0x68/0x80 net/ipv4/udp_tunnel_core.c:181 sctp_udp_sock_stop+0x71/0x160 net/sctp/protocol.c:930 proc_sctp_do_udp_port+0x264/0x450 net/sctp/sysctl.c:553 proc_sys_call_handler+0x3d0/0x5b0 fs/proc/proc_sysctl.c:601 iter_file_splice_write+0x91c/0x1150 fs/splice.c:738 do_splice_from fs/splice.c:935 [inline] direct_splice_actor+0x18f/0x6c0 fs/splice.c:1158 splice_direct_to_actor+0x342/0xa30 fs/splice.c:1102 do_splice_direct_actor fs/splice.c:1201 [inline] do_splice_direct+0x174/0x240 fs/splice.c:1227 do_sendfile+0xafd/0xe50 fs/read_write.c:1368
__do_sys_sendfile64 fs/read_write.c:1429 [inline] __se_sys_sendfile64 fs/read_write.c:1415 [inline]
__x64_sys_sendfile64+0x1d8/0x220 fs/read_write.c:1415 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] (CVE-2025-22062)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22062
https://ubuntu.com/security/CVE-2025-22062

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22062

Plugin Information
Published: 2025/08/15, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248760 - Linux Distros Unpatched Vulnerability : CVE-2025-22063
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets When calling netlbl_conn_setattr(), addr->sa_family is used to determine the function behavior. If sk is an IPv4 socket, but the connect function is called with an IPv6 address, the function calipso_sock_setattr() is triggered. Inside this function, the following code is executed: sk_fullsock(__sk) ? inet_sk(__sk)->pinet6 : NULL; Since sk is an IPv4 socket, pinet6 is NULL, leading to a null pointer dereference. This patch fixes the issue by checking if inet6_sk(sk) returns a NULL pointer before accessing pinet6. (CVE-2025-22063)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22063
https://ubuntu.com/security/CVE-2025-22063

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22063

Plugin Information
Published: 2025/08/12, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249589 - Linux Distros Unpatched Vulnerability : CVE-2025-22065
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: idpf: fix adapter NULL pointer dereference on reboot With SRIOV enabled, idpf ends up calling into idpf_remove() twice. First via idpf_shutdown() and then again when idpf_remove() calls into sriov_disable(), because the VF devices use the idpf driver, hence the same remove routine. When that happens, it is possible for the adapter to be NULL from the first call to idpf_remove(), leading to a NULL pointer dereference. echo 1 >
/sys/class/net/<netif>/device/sriov_numvfs reboot BUG: kernel NULL pointer dereference, address:
0000000000000020 ... RIP: 0010:idpf_remove+0x22/0x1f0 [idpf] ... ? idpf_remove+0x22/0x1f0 [idpf] ? idpf_remove+0x1e4/0x1f0 [idpf] pci_device_remove+0x3f/0xb0 device_release_driver_internal+0x19f/0x200 pci_stop_bus_device+0x6d/0x90 pci_stop_and_remove_bus_device+0x12/0x20 pci_iov_remove_virtfn+0xbe/0x120 sriov_disable+0x34/0xe0 idpf_sriov_configure+0x58/0x140 [idpf] idpf_remove+0x1b9/0x1f0 [idpf] idpf_shutdown+0x12/0x30 [idpf] pci_device_shutdown+0x35/0x60 device_shutdown+0x156/0x200 ... Replace the direct idpf_remove() call in idpf_shutdown() with idpf_vc_core_deinit() and idpf_deinit_dflt_mbx(), which perform the bulk of the cleanup, such as stopping the init task, freeing IRQs, destroying the vports and freeing the mailbox. This avoids the calls to sriov_disable() in addition to a small netdev cleanup, and destroying workqueues, which don't seem to be required on shutdown. (CVE-2025-22065)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22065
https://ubuntu.com/security/CVE-2025-22065

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22065

Plugin Information
Published: 2025/08/15, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246564 - Linux Distros Unpatched Vulnerability : CVE-2025-22075
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Allocate vfinfo size for VF GUIDs when supported Commit 30aad41721e0 (net/core: Add support for getting VF GUIDs) added support for getting VF port and node GUIDs in netlink ifinfo messages, but their size was not taken into consideration in the function that allocates the netlink message, causing the following warning when a netlink message is filled with many VF port and node GUIDs: # echo 64 > /sys/bus/pci/devices/0000\:08\:00.0/sriov_numvfs # ip link show dev ib0 RTNETLINK answers: Message too long Cannot send link get request: Message too long Kernel warning: ------------[ cut here ]------------ WARNING: CPU: 2 PID: 1930 at net/core/rtnetlink.c:4151 rtnl_getlink+0x586/0x5a0 Modules linked in: xt_conntrack xt_MASQUERADE nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter overlay mlx5_ib macsec mlx5_core tls rpcrdma rdma_ucm ib_uverbs ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm iw_cm ib_ipoib fuse ib_cm ib_core CPU: 2 UID: 0 PID: 1930 Comm: ip Not tainted 6.14.0-rc2+ #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:rtnl_getlink+0x586/0x5a0 Code: cb 82 e8 3d af 0a 00 4d 85 ff 0f 84 08 ff ff ff 4c 89 ff 41 be ea ff ff ff e8 66 63 5b ff 49 c7 07 80 4f cb 82 e9 36 fc ff ff <0f> 0b e9 16 fe ff ff e8 de a0 56 00 66 66 2e 0f 1f 84 00 00 00 00 RSP:
0018:ffff888113557348 EFLAGS: 00010246 RAX: 00000000ffffffa6 RBX: ffff88817e87aa34 RCX: dffffc0000000000 RDX: 0000000000000003 RSI: 0000000000000000 RDI: ffff88817e87afb8 RBP: 0000000000000009 R08:
ffffffff821f44aa R09: 0000000000000000 R10: ffff8881260f79a8 R11: ffff88817e87af00 R12: ffff88817e87aa00 R13: ffffffff8563d300 R14: 00000000ffffffa6 R15: 00000000ffffffff FS: 00007f63a5dbf280(0000) GS:ffff88881ee00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
00007f63a5ba4493 CR3: 00000001700fe002 CR4: 0000000000772eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __warn+0xa5/0x230 ? rtnl_getlink+0x586/0x5a0 ? report_bug+0x22d/0x240 ? handle_bug+0x53/0xa0 ? exc_invalid_op+0x14/0x50 ? asm_exc_invalid_op+0x16/0x20 ? skb_trim+0x6a/0x80 ? rtnl_getlink+0x586/0x5a0 ? __pfx_rtnl_getlink+0x10/0x10 ? rtnetlink_rcv_msg+0x1e5/0x860 ?
__pfx___mutex_lock+0x10/0x10 ? rcu_is_watching+0x34/0x60 ? __pfx_lock_acquire+0x10/0x10 ? stack_trace_save+0x90/0xd0 ? filter_irq_stacks+0x1d/0x70 ? kasan_save_stack+0x30/0x40 ? kasan_save_stack+0x20/0x40 ? kasan_save_track+0x10/0x30 rtnetlink_rcv_msg+0x21c/0x860 ? entry_SYSCALL_64_after_hwframe+0x76/0x7e ? __pfx_rtnetlink_rcv_msg+0x10/0x10 ? arch_stack_walk+0x9e/0xf0 ? rcu_is_watching+0x34/0x60 ? lock_acquire+0xd5/0x410 ? rcu_is_watching+0x34/0x60 netlink_rcv_skb+0xe0/0x210 ? __pfx_rtnetlink_rcv_msg+0x10/0x10 ? __pfx_netlink_rcv_skb+0x10/0x10 ? rcu_is_watching+0x34/0x60 ?
__pfx___netlink_lookup+0x10/0x10 ? lock_release+0x62/0x200 ? netlink_deliver_tap+0xfd/0x290 ? rcu_is_watching+0x34/0x60 ? lock_release+0x62/0x200 ? netlink_deliver_tap+0x95/0x290 netlink_unicast+0x31f/0x480 ? __pfx_netlink_unicast+0x10/0x10 ? rcu_is_watching+0x34/0x60 ? lock_acquire+0xd5/0x410 netlink_sendmsg+0x369/0x660 ? lock_release+0x62/0x200 ?
__pfx_netlink_sendmsg+0x10/0x10 ? import_ubuf+0xb9/0xf0 ? __import_iovec+0x254/0x2b0 ? lock_release+0x62/0x200 ? __pfx_netlink_sendmsg+0x10/0x10 ____sys_sendmsg+0x559/0x5a0 ?
__pfx_____sys_sendmsg+0x10/0x10 ? __pfx_copy_msghdr_from_user+0x10/0x10 ? rcu_is_watching+0x34/0x60 ? do_read_fault+0x213/0x4a0 ? rcu_is_watching+0x34/0x60 ___sys_sendmsg+0xe4/0x150 ?
__pfx____sys_sendmsg+0x10/0x10 ? do_fault+0x2cc/0x6f0 ? handle_pte_fault+0x2e3/0x3d0 ?
__pfx_handle_pte_fault+0x10/0x10 ---truncated--- (CVE-2025-22075)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22075
https://ubuntu.com/security/CVE-2025-22075

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22075

Plugin Information
Published: 2025/08/09, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249058 - Linux Distros Unpatched Vulnerability : CVE-2025-22077
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Revert smb: client: fix TCP timers deadlock after rmmod This reverts commit e9f2517a3e18a54a3943c098d2226b245d488801. Commit e9f2517a3e18 (smb: client: fix TCP timers deadlock after rmmod) is intended to fix a null-ptr-deref in LOCKDEP, which is mentioned as CVE-2024-54680, but is actually did not fix anything; The issue can be reproduced on top of it. [0] Also, it reverted the change by commit ef7134c7fc48 (smb: client: Fix use-after-free of network namespace.) and introduced a real issue by reviving the kernel TCP socket. When a reconnect happens for a CIFS connection, the socket state transitions to FIN_WAIT_1. Then, inet_csk_clear_xmit_timers_sync() in tcp_close() stops all timers for the socket. If an incoming FIN packet is lost, the socket will stay at FIN_WAIT_1 forever, and such sockets could be leaked up to net.ipv4.tcp_max_orphans. Usually, FIN can be retransmitted by the peer, but if the peer aborts the connection, the issue comes into reality. I warned about this privately by pointing out the exact report [1], but the bogus fix was finally merged. So, we should not stop the timers to finally kill the connection on our side in that case, meaning we must not use a kernel socket for TCP whose sk->sk_net_refcnt is 0. The kernel socket does not have a reference to its netns to make it possible to tear down netns without cleaning up every resource in it. For example, tunnel devices use a UDP socket internally, but we can destroy netns without removing such devices and let it complete during exit.
Otherwise, netns would be leaked when the last application died. However, this is problematic for TCP sockets because TCP has timers to close the connection gracefully even after the socket is close()d. The lifetime of the socket and its netns is different from the lifetime of the underlying connection. If the socket user does not maintain the netns lifetime, the timer could be fired after the socket is close()d and its netns is freed up, resulting in use-after-free. Actually, we have seen so many similar issues and converted such sockets to have a reference to netns. That's why I converted the CIFS client socket to have a reference to netns (sk->sk_net_refcnt == 1), which is somehow mentioned as out-of-scope of CIFS and technically wrong in e9f2517a3e18, but **is in-scope and right fix**. Regarding the LOCKDEP issue, we can prevent the module unload by bumping the module refcount when switching the LOCKDDEP key in sock_lock_init_class_and_name(). [2] For a while, let's revert the bogus fix. Note that now we can use sk_net_refcnt_upgrade() for the socket conversion, but I'll do so later separately to make backport easy.
(CVE-2025-22077)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22077
https://ubuntu.com/security/CVE-2025-22077

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22077

Plugin Information
Published: 2025/08/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243657 - Linux Distros Unpatched Vulnerability : CVE-2025-22090
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() If track_pfn_copy() fails, we already added the dst VMA to the maple tree. As fork() fails, we'll cleanup the maple tree, and stumble over the dst VMA for which we neither performed any reservation nor copied any page tables. Consequently untrack_pfn() will see VM_PAT and try obtaining the PAT information from the page table -- which fails because the page table was not copied. The easiest fix would be to simply clear the VM_PAT flag of the dst VMA if track_pfn_copy() fails. However, the whole thing is about simply clearing the VM_PAT flag is shaky as well: if we passed track_pfn_copy() and performed a reservation, but copying the page tables fails, we'll simply clear the VM_PAT flag, not properly undoing the reservation ... which is also wrong.
So let's fix it properly: set the VM_PAT flag only if the reservation succeeded (leaving it clear initially), and undo the reservation if anything goes wrong while copying the page tables: clearing the VM_PAT flag after undoing the reservation. Note that any copied page table entries will get zapped when the VMA will get removed later, after copy_page_range() succeeded; as VM_PAT is not set then, we won't try cleaning VM_PAT up once more and untrack_pfn() will be happy. Note that leaving these page tables in place without a reservation is not a problem, as we are aborting fork(); this process will never run. A reproducer can trigger this usually at the first try:
https://gitlab.com/davidhildenbrand/scratchspace/-/raw/main/reproducers/pat_fork.c WARNING: CPU: 26 PID:
11650 at arch/x86/mm/pat/memtype.c:983 get_pat_info+0xf6/0x110 Modules linked in: ... CPU: 26 UID: 0 PID:
11650 Comm: repro3 Not tainted 6.12.0-rc5+ #92 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:get_pat_info+0xf6/0x110 ... Call Trace: <TASK> ...
untrack_pfn+0x52/0x110 unmap_single_vma+0xa6/0xe0 unmap_vmas+0x105/0x1f0 exit_mmap+0xf6/0x460
__mmput+0x4b/0x120 copy_process+0x1bf6/0x2aa0 kernel_clone+0xab/0x440 __do_sys_clone+0x66/0x90 do_syscall_64+0x95/0x180 Likely this case was missed in: d155df53f310 (x86/mm/pat: clear VM_PAT if copy_p4d_range failed) ... and instead of undoing the reservation we simply cleared the VM_PAT flag. Keep the documentation of these functions in include/linux/pgtable.h, one place is more than sufficient -- we should clean that up for the other functions like track_pfn_remap/untrack_pfn separately. (CVE-2025-22090)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22090
https://security-tracker.debian.org/tracker/CVE-2025-22090
https://ubuntu.com/security/CVE-2025-22090

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
References

CVE | CVE-2025-22090

Plugin Information
Published: 2025/08/05, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244927 - Linux Distros Unpatched Vulnerability : CVE-2025-22105
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bonding: check xdp prog when set bond mode Following operations can trigger a warning[1]: ip netns add ns1 ip netns exec ns1 ip link add bond0 type bond mode balance-rr ip netns exec ns1 ip link set dev bond0 xdp obj af_xdp_kern.o sec xdp ip netns exec ns1 ip link set bond0 type bond mode broadcast ip netns del ns1 When delete the namespace, dev_xdp_uninstall() is called to remove xdp program on bond dev, and bond_xdp_set() will check the bond mode. If bond mode is changed after attaching xdp program, the warning may occur. Some bond modes (broadcast, etc.) do not support native xdp. Set bond mode with xdp program attached is not good. Add check for xdp program when set bond mode. [1] ------------[ cut here ]------------ WARNING: CPU: 0 PID: 11 at net/core/dev.c:9912 unregister_netdevice_many_notify+0x8d9/0x930 Modules linked in: CPU: 0 UID: 0 PID: 11 Comm: kworker/u4:0 Not tainted 6.14.0-rc4 #107 Hardware name:
QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 Workqueue: netns cleanup_net RIP: 0010:unregister_netdevice_many_notify+0x8d9/0x930 Code: 00 00 48 c7 c6 6f e3 a2 82 48 c7 c7 d0 b3 96 82 e8 9c 10 3e ... RSP: 0018:ffffc90000063d80 EFLAGS: 00000282 RAX:
00000000ffffffa1 RBX: ffff888004959000 RCX: 00000000ffffdfff RDX: 0000000000000000 RSI: 00000000ffffffea RDI: ffffc90000063b48 RBP: ffffc90000063e28 R08: ffffffff82d39b28 R09: 0000000000009ffb R10:
0000000000000175 R11: ffffffff82d09b40 R12: ffff8880049598e8 R13: 0000000000000001 R14: dead000000000100 R15: ffffc90000045000 FS: 0000000000000000(0000) GS:ffff888007a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000d406b60 CR3: 000000000483e000 CR4: 00000000000006f0 Call Trace: <TASK> ? __warn+0x83/0x130 ? unregister_netdevice_many_notify+0x8d9/0x930 ? report_bug+0x18e/0x1a0 ? handle_bug+0x54/0x90 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? unregister_netdevice_many_notify+0x8d9/0x930 ? bond_net_exit_batch_rtnl+0x5c/0x90 cleanup_net+0x237/0x3d0 process_one_work+0x163/0x390 worker_thread+0x293/0x3b0 ? __pfx_worker_thread+0x10/0x10 kthread+0xec/0x1e0 ? __pfx_kthread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2f/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> ---[ end trace 0000000000000000 ]--- (CVE-2025-22105)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22105
https://security-tracker.debian.org/tracker/CVE-2025-22105
https://ubuntu.com/security/CVE-2025-22105

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22105

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248082 - Linux Distros Unpatched Vulnerability : CVE-2025-22106
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vmxnet3: unregister xdp rxq info in the reset path vmxnet3 does not unregister xdp rxq info in the vmxnet3_reset_work() code path as vmxnet3_rq_destroy() is not invoked in this code path. So, we get below message with a backtrace. Missing unregister, handled but fix driver WARNING: CPU:48 PID: 500 at net/core/xdp.c:182 __xdp_rxq_info_reg+0x93/0xf0 This patch fixes the problem by moving the unregister code of XDP from vmxnet3_rq_destroy() to vmxnet3_rq_cleanup(). (CVE-2025-22106)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22106
https://ubuntu.com/security/CVE-2025-22106

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22106

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248940 - Linux Distros Unpatched Vulnerability : CVE-2025-22117
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() Fix using the untrusted value of proto->raw.pkt_len in function ice_vc_fdir_parse_raw() by verifying if it does not exceed the VIRTCHNL_MAX_SIZE_RAW_PACKET value. (CVE-2025-22117)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22117
https://security-tracker.debian.org/tracker/CVE-2025-22117
https://ubuntu.com/security/CVE-2025-22117

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22117

Plugin Information
Published: 2025/08/12, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245510 - Linux Distros Unpatched Vulnerability : CVE-2025-22124
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb In clustermd, separate write-intent- bitmaps are used for each cluster node: 0 4k 8k 12k
------------------------------------------------------------------- | idle | md super | bm super [0] + bits | | bm bits[0, contd] | bm super[1] + bits | bm bits[1, contd] | | bm super[2] + bits | bm bits [2, contd] | bm super[3] + bits | | bm bits [3, contd] | | | So in node 1, pg_index in __write_sb_page() could equal to bitmap->storage.file_pages. Then bitmap_limit will be calculated to 0. md_super_write() will be called with 0 size. That means the first 4k sb area of node 1 will never be updated through filemap_write_page(). This bug causes hang of mdadm/clustermd_tests/01r1_Grow_resize. Here use (pg_index % bitmap->storage.file_pages) to make calculation of bitmap_limit correct. (CVE-2025-22124)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22124
https://ubuntu.com/security/CVE-2025-22124

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22124

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247736 - Linux Distros Unpatched Vulnerability : CVE-2025-22125
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- md/raid1,raid10: don't ignore IO flags If blk-wbt is enabled by default, it's found that raid write performance is quite bad because all IO are throttled by wbt of underlying disks, due to flag REQ_IDLE is ignored. And turns out this behaviour exist since blk-wbt is introduced. Other than REQ_IDLE, other flags should not be ignored as well, for example REQ_META can be set for filesystems, clearing it can cause priority reverse problems; And REQ_NOWAIT should not be cleared as well, because io will wait instead of failing directly in underlying disks. Fix those problems by keep IO flags from master bio. Fises:
f51d46d0e7cb (md: add support for REQ_NOWAIT) (CVE-2025-22125)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22125
https://security-tracker.debian.org/tracker/CVE-2025-22125
https://ubuntu.com/security/CVE-2025-22125

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22125

Plugin Information
Published: 2025/08/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246546 - Linux Distros Unpatched Vulnerability : CVE-2025-22128
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path If a shared IRQ is used by the driver due to platform limitation, then the IRQ affinity hint is set right after the allocation of IRQ vectors in ath12k_pci_msi_alloc(). This does no harm unless one of the functions requesting the IRQ fails and attempt to free the IRQ. This may end up with a warning from the IRQ core that is expecting the affinity hint to be cleared before freeing the IRQ: kernel/irq/manage.c: /* make sure affinity_hint is cleaned up */ if (WARN_ON_ONCE(desc->affinity_hint)) desc->affinity_hint = NULL; So to fix this issue, clear the IRQ affinity hint before calling ath12k_pci_free_irq() in the error path. The affinity will be cleared once again further down the error path due to code organization, but that does no harm. (CVE-2025-22128)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22128
https://ubuntu.com/security/CVE-2025-22128

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22128

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
230541 - Linux Distros Unpatched Vulnerability : CVE-2025-22134
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before opening other windows and buffers and therefore fix this bug. In addition it does verify that it won't try to access a position if the position is greater than the corresponding buffer line. Impact is medium since the user must have switched on visual mode when executing the :all ex command. The Vim project would like to thank github user gandalf4a for reporting this issue. The issue has been fixed as of Vim patch v9.1.1003 (CVE-2025-22134)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22134
https://security-tracker.debian.org/tracker/CVE-2025-22134
https://ubuntu.com/security/CVE-2025-22134

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22134

Plugin Information
Published: 2025/03/06, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
232161 - Linux Distros Unpatched Vulnerability : CVE-2025-22870
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to *.example.com, a request to [::1%25.example.com]:80` will incorrectly match and not be proxied. (CVE-2025-22870)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22870
https://security-tracker.debian.org/tracker/CVE-2025-22870
https://ubuntu.com/security/CVE-2025-22870

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.4 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)
CVSS v3.0 Temporal Score
4.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
3.3
EPSS Score
0.0002
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-22870

Plugin Information
Published: 2025/03/06, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- conmon
- containernetworking-plugins
- podman
- rhc
252197 - Linux Distros Unpatched Vulnerability : CVE-2025-22872
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g.
<math>, <svg>, etc contexts). (CVE-2025-22872)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-22872
https://security-tracker.debian.org/tracker/CVE-2025-22872
https://ubuntu.com/security/CVE-2025-22872

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.0
EPSS Score
0.0001
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-22872

Plugin Information
Published: 2025/08/19, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- podman
244885 - Linux Distros Unpatched Vulnerability : CVE-2025-2312
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache. (CVE-2025-2312)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-2312
https://security-tracker.debian.org/tracker/CVE-2025-2312
https://ubuntu.com/security/CVE-2025-2312

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.9 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-2312

Plugin Information
Published: 2025/08/07, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- cifs-utils
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244481 - Linux Distros Unpatched Vulnerability : CVE-2025-23131
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dlm: prevent NPD when writing a positive value to event_done do_uevent returns the value written to event_done. In case it is a positive value, new_lockspace would undo all the work, and lockspace would not be set. __dlm_new_lockspace, however, would treat that positive value as a success due to commit 8511a2728ab8 (dlm: fix use count with multiple joins). Down the line, device_create_lockspace would pass that NULL lockspace to dlm_find_lockspace_local, leading to a NULL pointer dereference. Treating such positive values as successes prevents the problem. Given this has been broken for so long, this is unlikely to break userspace expectations. (CVE-2025-23131)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-23131
https://security-tracker.debian.org/tracker/CVE-2025-23131
https://ubuntu.com/security/CVE-2025-23131

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-23131

Plugin Information
Published: 2025/08/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245418 - Linux Distros Unpatched Vulnerability : CVE-2025-23132
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- f2fs: quota: fix to avoid warning in dquot_writeback_dquots() F2FS-fs (dm-59): checkpoint=enable has some unwritten data. ------------[ cut here ]------------ WARNING: CPU: 6 PID: 8013 at fs/quota/dquot.c:691 dquot_writeback_dquots+0x2fc/0x308 pc : dquot_writeback_dquots+0x2fc/0x308 lr : f2fs_quota_sync+0xcc/0x1c4 Call trace: dquot_writeback_dquots+0x2fc/0x308 f2fs_quota_sync+0xcc/0x1c4 f2fs_write_checkpoint+0x3d4/0x9b0 f2fs_issue_checkpoint+0x1bc/0x2c0 f2fs_sync_fs+0x54/0x150 f2fs_do_sync_file+0x2f8/0x814 __f2fs_ioctl+0x1960/0x3244 f2fs_ioctl+0x54/0xe0 __arm64_sys_ioctl+0xa8/0xe4 invoke_syscall+0x58/0x114 checkpoint and f2fs_remount may race as below, resulting triggering warning in dquot_writeback_dquots(). atomic write remount - do_remount - down_write(&sb->s_umount); - f2fs_remount - ioctl - f2fs_do_sync_file - f2fs_sync_fs - f2fs_write_checkpoint - block_operations - locked = down_read_trylock(&sbi->sb->s_umount) : fail to lock due to the write lock was held by remount - up_write(&sb->s_umount); - f2fs_quota_sync - dquot_writeback_dquots - WARN_ON_ONCE(!rwsem_is_locked(&sb->s_umount)) : trigger warning because s_umount lock was unlocked by remount If checkpoint comes from mount/umount/remount/freeze/quotactl, caller of checkpoint has already held s_umount lock, calling dquot_writeback_dquots() in the context should be safe. So let's record task to sbi->umount_lock_holder, so that checkpoint can know whether the lock has held in the context or not by checking current w/ it. In addition, in order to not misrepresent caller of checkpoint, we should not allow to trigger async checkpoint for those callers: mount/umount/remount/ freeze/quotactl.
(CVE-2025-23132)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-23132
https://security-tracker.debian.org/tracker/CVE-2025-23132
https://ubuntu.com/security/CVE-2025-23132

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-23132

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249894 - Linux Distros Unpatched Vulnerability : CVE-2025-23134
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Don't take register_mutex with copy_from/to_user() The infamous mmap_lock taken in copy_from/to_user() can be often problematic when it's called inside another mutex, as they might lead to deadlocks. In the case of ALSA timer code, the bad pattern is with guard(mutex)(ister_mutex) that covers copy_from/to_user() -- which was mistakenly introduced at converting to guard(), and it had been carefully worked around in the past. This patch fixes those pieces simply by moving copy_from/to_user() out of the register mutex lock again. (CVE-2025-23134)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-23134
https://ubuntu.com/security/CVE-2025-23134

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-23134

Plugin Information
Published: 2025/08/15, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248534 - Linux Distros Unpatched Vulnerability : CVE-2025-23136
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- thermal: int340x: Add NULL check for adev Not all devices have an ACPI companion fwnode, so adev might be NULL. This is similar to the commit cd2fd6eab480 (platform/x86: int3472: Check for adev == NULL). Add a check for adev not being set and return -ENODEV in that case to avoid a possible NULL pointer deref in int3402_thermal_probe(). Note, under the same directory, int3400_thermal_probe() has such a check. [ rjw:
Subject edit, added Fixes: ] (CVE-2025-23136)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-23136
https://ubuntu.com/security/CVE-2025-23136

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-23136

Plugin Information
Published: 2025/08/12, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248372 - Linux Distros Unpatched Vulnerability : CVE-2025-23137
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update Check if policy is NULL before dereferencing it in amd_pstate_update.
(CVE-2025-23137)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-23137
https://ubuntu.com/security/CVE-2025-23137

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-23137

Plugin Information
Published: 2025/08/11, Modified: 2025/11/24
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246568 - Linux Distros Unpatched Vulnerability : CVE-2025-23138
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: watch_queue: fix pipe accounting mismatch Currently, watch_queue_set_size() modifies the pipe buffers charged to user->pipe_bufs without updating the pipe->nr_accounted on the pipe itself, due to the if (!pipe_has_watch_queue()) test in pipe_resize_ring(). This means that when the pipe is ultimately freed, we decrement user->pipe_bufs by something other than what than we had charged to it, potentially leading to an underflow. This in turn can cause subsequent too_many_pipe_buffers_soft() tests to fail with -EPERM. To remedy this, explicitly account for the pipe usage in watch_queue_set_size() to match the number set via account_pipe_buffers() (It's unclear why watch_queue_set_size() does not update nr_accounted; it may be due to intentional overprovisioning in watch_queue_set_size()?) (CVE-2025-23138)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-23138
https://ubuntu.com/security/CVE-2025-23138

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-23138

Plugin Information
Published: 2025/08/09, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246031 - Linux Distros Unpatched Vulnerability : CVE-2025-23141
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses Acquire a lock on kvm->srcu when userspace is getting MP state to handle a rather extreme edge case where accepting APIC events, i.e. processing pending INIT or SIPI, can trigger accesses to guest memory. If the vCPU is in L2 with INIT
*and* a TRIPLE_FAULT request pending, then getting MP state will trigger a nested VM-Exit by way of
->check_nested_events(), and emuating the nested VM-Exit can access guest memory. The splat was originally hit by syzkaller on a Google-internal kernel, and reproduced on an upstream kernel by hacking the triple_fault_event_test selftest to stuff a pending INIT, store an MSR on VM-Exit (to generate a memory access on VMX), and do vcpu_mp_state_get() to trigger the scenario. ============================= WARNING:
suspicious RCU usage 6.14.0-rc3-b112d356288b-vmx/pi_lockdep_false_pos-lock #3 Not tainted
----------------------------- include/linux/kvm_host.h:1058 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by triple_fault_ev/1256: #0: ffff88810df5a330 (&vcpu->mutex){+.+.}-{4:4}, at: kvm_vcpu_ioctl+0x8b/0x9a0 [kvm] stack backtrace: CPU: 11 UID: 1000 PID: 1256 Comm: triple_fault_ev Not tainted 6.14.0-rc3-b112d356288b-vmx #3 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK>
dump_stack_lvl+0x7f/0x90 lockdep_rcu_suspicious+0x144/0x190 kvm_vcpu_gfn_to_memslot+0x156/0x180 [kvm] kvm_vcpu_read_guest+0x3e/0x90 [kvm] read_and_check_msr_entry+0x2e/0x180 [kvm_intel]
__nested_vmx_vmexit+0x550/0xde0 [kvm_intel] kvm_check_nested_events+0x1b/0x30 [kvm] kvm_apic_accept_events+0x33/0x100 [kvm] kvm_arch_vcpu_ioctl_get_mpstate+0x30/0x1d0 [kvm] kvm_vcpu_ioctl+0x33e/0x9a0 [kvm] __x64_sys_ioctl+0x8b/0xb0 do_syscall_64+0x6c/0x170 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> (CVE-2025-23141)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-23141
https://ubuntu.com/security/CVE-2025-23141

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-23141

Plugin Information
Published: 2025/08/08, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
252978 - Linux Distros Unpatched Vulnerability : CVE-2025-23143
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. When I ran the repro [0] and waited a few seconds, I observed two LOCKDEP splats: a warning immediately followed by a null-ptr-deref. [1] Reproduction Steps: 1) Mount CIFS 2) Add an iptables rule to drop incoming FIN packets for CIFS 3) Unmount CIFS 4) Unload the CIFS module 5) Remove the iptables rule At step 3), the CIFS module calls sock_release() for the underlying TCP socket, and it returns quickly. However, the socket remains in FIN_WAIT_1 because incoming FIN packets are dropped. At this point, the module's refcnt is 0 while the socket is still alive, so the following rmmod command succeeds. # ss -tan State Recv-Q Send-Q Local Address:Port Peer Address:Port FIN-WAIT-1 0 477 10.0.2.15:51062 10.0.0.137:445 # lsmod | grep cifs cifs 1159168 0 This highlights a discrepancy between the lifetime of the CIFS module and the underlying TCP socket. Even after CIFS calls sock_release() and it returns, the TCP socket does not die immediately in order to close the connection gracefully. While this is generally fine, it causes an issue with LOCKDEP because CIFS assigns a different lock class to the TCP socket's sk->sk_lock using sock_lock_init_class_and_name(). Once an incoming packet is processed for the socket or a timer fires, sk->sk_lock is acquired. Then, LOCKDEP checks the lock context in check_wait_context(), where hlock_class() is called to retrieve the lock class. However, since the module has already been unloaded, hlock_class() logs a warning and returns NULL, triggering the null-ptr-deref. If LOCKDEP is enabled, we must ensure that a module calling sock_lock_init_class_and_name() (CIFS, NFS, etc) cannot be unloaded while such a socket is still alive to prevent this issue. Let's hold the module reference in sock_lock_init_class_and_name() and release it when the socket is freed in sk_prot_free(). Note that sock_lock_init() clears sk->sk_owner for svc_create_socket() that calls sock_lock_init_class_and_name() for a listening socket, which clones a socket by sk_clone_lock() without GFP_ZERO. [0]:
CIFS_SERVER=10.0.0.137 CIFS_PATH=//${CIFS_SERVER}/Users/Administrator/Desktop/CIFS_TEST DEV=enp0s3 CRED=/root/WindowsCredential.txt MNT=$(mktemp -d /tmp/XXXXXX) mount -t cifs ${CIFS_PATH} ${MNT} -o vers=3.0,credentials=${CRED},cache=none,echo_interval=1 iptables -A INPUT -s ${CIFS_SERVER} -j DROP for i in $(seq 10); do umount ${MNT} rmmod cifs sleep 1 done rm -r ${MNT} iptables -D INPUT -s ${CIFS_SERVER} -j DROP [1]: DEBUG_LOCKS_WARN_ON(1) WARNING: CPU: 10 PID: 0 at kernel/locking/lockdep.c:234 hlock_class (kernel/locking/lockdep.c:234 kernel/locking/lockdep.c:223) Modules linked in: cifs_arc4 nls_ucs2_utils cifs_md4 [last unloaded: cifs] CPU: 10 UID: 0 PID: 0 Comm: swapper/10 Not tainted 6.14.0 #36 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:hlock_class (kernel/locking/lockdep.c:234 kernel/locking/lockdep.c:223) ... Call Trace: <IRQ>
__lock_acquire (kernel/locking/lockdep.c:4853 kernel/locking/lockdep.c:5178) lock_acquire (kernel/locking/lockdep.c:469 kernel/locking/lockdep.c:5853 kernel/locking/lockdep.c:5816)
_raw_spin_lock_nested (kernel/locking/spinlock.c:379) tcp_v4_rcv (./include/linux/skbuff.h:1678 ./include/net/tcp.h:2547 net/ipv4/tcp_ipv4.c:2350) ... BUG: kernel NULL pointer dereference, address:
00000000000000c4 PF: supervisor read access in kernel mode PF: error_code(0x0000) - not-present page PGD 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 10 UID: 0 PID: 0 Comm: swapper/10 Tainted: G W 6.14.0 #36 Tainted: [W]=WARN Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:__lock_acquire (kernel/ ---truncated--- (CVE-2025-23143)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-23143
https://ubuntu.com/security/CVE-2025-23143

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-23143

Plugin Information
Published: 2025/08/20, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246575 - Linux Distros Unpatched Vulnerability : CVE-2025-23144
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() Lockdep detects the following issue on led-backlight removal: [ 142.315935] ------------[ cut here ]------------ [ 142.315954] WARNING:
CPU: 2 PID: 292 at drivers/leds/led-core.c:455 led_sysfs_enable+0x54/0x80 ... [ 142.500725] Call trace: [ 142.503176] led_sysfs_enable+0x54/0x80 (P) [ 142.507370] led_bl_remove+0x80/0xa8 [led_bl] [ 142.511742] platform_remove+0x30/0x58 [ 142.515501] device_remove+0x54/0x90 ... Indeed, led_sysfs_enable() has to be called with the led_access lock held. Hold the lock when calling led_sysfs_disable(). (CVE-2025-23144)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-23144
https://ubuntu.com/security/CVE-2025-23144

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-23144

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243594 - Linux Distros Unpatched Vulnerability : CVE-2025-23145
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mptcp: fix NULL pointer in can_accept_new_subflow When testing valkey benchmark tool with MPTCP, the kernel panics in 'mptcp_can_accept_new_subflow' because subflow_req->msk is NULL. Call trace:
mptcp_can_accept_new_subflow (./net/mptcp/subflow.c:63 (discriminator 4)) (P) subflow_syn_recv_sock (./net/mptcp/subflow.c:854) tcp_check_req (./net/ipv4/tcp_minisocks.c:863) tcp_v4_rcv (./net/ipv4/tcp_ipv4.c:2268) ip_protocol_deliver_rcu (./net/ipv4/ip_input.c:207) ip_local_deliver_finish (./net/ipv4/ip_input.c:234) ip_local_deliver (./net/ipv4/ip_input.c:254) ip_rcv_finish (./net/ipv4/ip_input.c:449) ... According to the debug log, the same req received two SYN-ACK in a very short time, very likely because the client retransmits the syn ack due to multiple reasons. Even if the packets are transmitted with a relevant time interval, they can be processed by the server on different CPUs concurrently). The 'subflow_req->msk' ownership is transferred to the subflow the first, and there will be a risk of a null pointer dereference here. This patch fixes this issue by moving the 'subflow_req->msk' under the `own_req == true` conditional. Note that the !msk check in subflow_hmac_valid() can be dropped, because the same check already exists under the own_req mpj branch where the code has been moved to. (CVE-2025-23145)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-23145
https://ubuntu.com/security/CVE-2025-23145

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-23145

Plugin Information
Published: 2025/08/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248389 - Linux Distros Unpatched Vulnerability : CVE-2025-23147
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- i3c: Add NULL pointer check in i3c_master_queue_ibi() The I3C master driver may receive an IBI from a target device that has not been probed yet. In such cases, the master calls `i3c_master_queue_ibi()` to queue an IBI work task, leading to Unable to handle kernel read from unreadable memory and resulting in a kernel panic. Typical IBI handling flow: 1. The I3C master scans target devices and probes their respective drivers. 2. The target device driver calls `i3c_device_request_ibi()` to enable IBI and assigns `dev->ibi = ibi`. 3. The I3C master receives an IBI from the target device and calls `i3c_master_queue_ibi()` to queue the target device driver's IBI handler task. However, since target device events are asynchronous to the I3C probe sequence, step 3 may occur before step 2, causing `dev->ibi` to be `NULL`, leading to a kernel panic. Add a NULL pointer check in `i3c_master_queue_ibi()` to prevent accessing an uninitialized `dev->ibi`, ensuring stability. (CVE-2025-23147)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-23147
https://ubuntu.com/security/CVE-2025-23147

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-23147

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248364 - Linux Distros Unpatched Vulnerability : CVE-2025-23149
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tpm: do not start chip while suspended Checking TPM_CHIP_FLAG_SUSPENDED after the call to tpm_find_get_ops() can lead to a spurious tpm_chip_start() call: [35985.503771] i2c i2c-1: Transfer while suspended [35985.503796] WARNING: CPU: 0 PID: 74 at drivers/i2c/i2c-core.h:56 __i2c_transfer+0xbe/0x810 [35985.503802] Modules linked in: [35985.503808] CPU: 0 UID: 0 PID: 74 Comm: hwrng Tainted: G W 6.13.0-next-20250203-00005-gfa0cb5642941 #19 9c3d7f78192f2d38e32010ac9c90fdc71109ef6f [35985.503814] Tainted: [W]=WARN [35985.503817] Hardware name: Google Morphius/Morphius, BIOS Google_Morphius.13434.858.0 10/26/2023 [35985.503819] RIP: 0010:__i2c_transfer+0xbe/0x810 [35985.503825] Code: 30 01 00 00 4c 89 f7 e8 40 fe d8 ff 48 8b 93 80 01 00 00 48 85 d2 75 03 49 8b 16 48 c7 c7 0a fb 7c a7 48 89 c6 e8 32 ad b0 fe <0f>
0b b8 94 ff ff ff e9 33 04 00 00 be 02 00 00 00 83 fd 02 0f 5 [35985.503828] RSP: 0018:ffffa106c0333d30 EFLAGS: 00010246 [35985.503833] RAX: 074ba64aa20f7000 RBX: ffff8aa4c1167120 RCX: 0000000000000000 [35985.503836] RDX: 0000000000000000 RSI: ffffffffa77ab0e4 RDI: 0000000000000001 [35985.503838] RBP:
0000000000000001 R08: 0000000000000001 R09: 0000000000000000 [35985.503841] R10: 0000000000000004 R11:
00000001000313d5 R12: ffff8aa4c10f1820 [35985.503843] R13: ffff8aa4c0e243c0 R14: ffff8aa4c1167250 R15:
ffff8aa4c1167120 [35985.503846] FS: 0000000000000000(0000) GS:ffff8aa4eae00000(0000) knlGS:0000000000000000 [35985.503849] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [35985.503852] CR2:
00007fab0aaf1000 CR3: 0000000105328000 CR4: 00000000003506f0 [35985.503855] Call Trace: [35985.503859] <TASK> [35985.503863] ? __warn+0xd4/0x260 [35985.503868] ? __i2c_transfer+0xbe/0x810 [35985.503874] ? report_bug+0xf3/0x210 [35985.503882] ? handle_bug+0x63/0xb0 [35985.503887] ? exc_invalid_op+0x16/0x50 [35985.503892] ? asm_exc_invalid_op+0x16/0x20 [35985.503904] ? __i2c_transfer+0xbe/0x810 [35985.503913] tpm_cr50_i2c_transfer_message+0x24/0xf0 [35985.503920] tpm_cr50_i2c_read+0x8e/0x120 [35985.503928] tpm_cr50_request_locality+0x75/0x170 [35985.503935] tpm_chip_start+0x116/0x160 [35985.503942] tpm_try_get_ops+0x57/0x90 [35985.503948] tpm_find_get_ops+0x26/0xd0 [35985.503955] tpm_get_random+0x2d/0x80 Don't move forward with tpm_chip_start() inside tpm_try_get_ops(), unless TPM_CHIP_FLAG_SUSPENDED is not set. tpm_find_get_ops() will return NULL in such a failure case.
(CVE-2025-23149)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-23149
https://ubuntu.com/security/CVE-2025-23149

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-23149

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247688 - Linux Distros Unpatched Vulnerability : CVE-2025-23151
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bus: mhi: host: Fix race between unprepare and queue_buf A client driver may use mhi_unprepare_from_transfer() to quiesce incoming data during the client driver's tear down. The client driver might also be processing data at the same time, resulting in a call to mhi_queue_buf() which will invoke mhi_gen_tre(). If mhi_gen_tre() runs after mhi_unprepare_from_transfer() has torn down the channel, a panic will occur due to an invalid dereference leading to a page fault. This occurs because mhi_gen_tre() does not verify the channel state after locking it. Fix this by having mhi_gen_tre() confirm the channel state is valid, or return error to avoid accessing deinitialized data. [mani: added stable tag] (CVE-2025-23151)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-23151
https://ubuntu.com/security/CVE-2025-23151

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-23151

Plugin Information
Published: 2025/08/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243662 - Linux Distros Unpatched Vulnerability : CVE-2025-23154
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix io_req_post_cqe abuse by send bundle [ 114.987980][ T5313] WARNING: CPU: 6 PID: 5313 at io_uring/io_uring.c:872 io_req_post_cqe+0x12e/0x4f0 [ 114.991597][ T5313] RIP: 0010:io_req_post_cqe+0x12e/0x4f0 [ 115.001880][ T5313] Call Trace: [ 115.002222][ T5313] <TASK> [ 115.007813][ T5313] io_send+0x4fe/0x10f0 [ 115.009317][ T5313] io_issue_sqe+0x1a6/0x1740 [ 115.012094][ T5313] io_wq_submit_work+0x38b/0xed0 [ 115.013223][ T5313] io_worker_handle_work+0x62a/0x1600 [ 115.013876][ T5313] io_wq_worker+0x34f/0xdf0 As the comment states, io_req_post_cqe() should only be used by multishot requests, i.e. REQ_F_APOLL_MULTISHOT, which bundled sends are not. Add a flag signifying whether a request wants to post multiple CQEs. Eventually REQ_F_APOLL_MULTISHOT should imply the new flag, but that's left out for simplicity. (CVE-2025-23154)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-23154
https://ubuntu.com/security/CVE-2025-23154

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-23154

Plugin Information
Published: 2025/08/05, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247811 - Linux Distros Unpatched Vulnerability : CVE-2025-23161
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type The access to the PCI config space via pci_ops::read and pci_ops::write is a low-level hardware access. The functions can be accessed with disabled interrupts even on PREEMPT_RT. The pci_lock is a raw_spinlock_t for this purpose. A spinlock_t becomes a sleeping lock on PREEMPT_RT, so it cannot be acquired with disabled interrupts. The vmd_dev::cfg_lock is accessed in the same context as the pci_lock. Make vmd_dev::cfg_lock a raw_spinlock_t type so it can be used with interrupts disabled. This was reported as: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 Call Trace: rt_spin_lock+0x4e/0x130 vmd_pci_read+0x8d/0x100 [vmd] pci_user_read_config_byte+0x6f/0xe0 pci_read_config+0xfe/0x290 sysfs_kf_bin_read+0x68/0x90 [bigeasy: reword commit message] Tested-off-by: Luis Claudio R. Goncalves <lgoncalv@redhat.com> [kwilczynski: commit log] [bhelgaas: add back report info from https://lore.kernel.org/lkml/20241218115951.83062-1-ryotkkr98@gmail.com/] (CVE-2025-23161)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-23161
https://security-tracker.debian.org/tracker/CVE-2025-23161
https://ubuntu.com/security/CVE-2025-23161

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-23161

Plugin Information
Published: 2025/08/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247969 - Linux Distros Unpatched Vulnerability : CVE-2025-23162
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/xe/vf: Don't try to trigger a full GT reset if VF VFs don't have access to the GDRST(0x941c) register that driver uses to reset a GT. Attempt to trigger a reset using debugfs: $ cat /sys/kernel/debug/dri/0000:00:02.1/gt0/force_reset or due to a hang condition detected by the driver leads to: [ ] xe 0000:00:02.1: [drm] GT0: trying reset from force_reset [xe] [ ] xe 0000:00:02.1: [drm] GT0:
reset queued [ ] xe 0000:00:02.1: [drm] GT0: reset started [ ] ------------[ cut here ]------------ [ ] xe 0000:00:02.1: [drm] GT0: VF is trying to write 0x1 to an inaccessible register 0x941c+0x0 [ ] WARNING:
CPU: 3 PID: 3069 at drivers/gpu/drm/xe/xe_gt_sriov_vf.c:996 xe_gt_sriov_vf_write32+0xc6/0x580 [xe] [ ] RIP: 0010:xe_gt_sriov_vf_write32+0xc6/0x580 [xe] [ ] Call Trace: [ ] <TASK> [ ] ? show_regs+0x6c/0x80 [ ] ? __warn+0x93/0x1c0 [ ] ? xe_gt_sriov_vf_write32+0xc6/0x580 [xe] [ ] ? report_bug+0x182/0x1b0 [ ] ? handle_bug+0x6e/0xb0 [ ] ? exc_invalid_op+0x18/0x80 [ ] ? asm_exc_invalid_op+0x1b/0x20 [ ] ? xe_gt_sriov_vf_write32+0xc6/0x580 [xe] [ ] ? xe_gt_sriov_vf_write32+0xc6/0x580 [xe] [ ] ? xe_gt_tlb_invalidation_reset+0xef/0x110 [xe] [ ] ? __mutex_unlock_slowpath+0x41/0x2e0 [ ] xe_mmio_write32+0x64/0x150 [xe] [ ] do_gt_reset+0x2f/0xa0 [xe] [ ] gt_reset_worker+0x14e/0x1e0 [xe] [ ] process_one_work+0x21c/0x740 [ ] worker_thread+0x1db/0x3c0 Fix that by sending H2G VF_RESET(0x5507) action instead. (CVE-2025-23162)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-23162
https://ubuntu.com/security/CVE-2025-23162

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-23162

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244589 - Linux Distros Unpatched Vulnerability : CVE-2025-23163
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: vlan: don't propagate flags on open With the device instance lock, there is now a possibility of a deadlock: [ 1.211455] ============================================ [ 1.211571] WARNING: possible recursive locking detected [ 1.211687] 6.14.0-rc5-01215-g032756b4ca7a-dirty #5 Not tainted [ 1.211823]
-------------------------------------------- [ 1.211936] ip/184 is trying to acquire lock: [ 1.212032] ffff8881024a4c30 (&dev->lock){+.+.}-{4:4}, at: dev_set_allmulti+0x4e/0xb0 [ 1.212207] [ 1.212207] but task is already holding lock: [ 1.212332] ffff8881024a4c30 (&dev->lock){+.+.}-{4:4}, at: dev_open+0x50/0xb0 [ 1.212487] [ 1.212487] other info that might help us debug this: [ 1.212626] Possible unsafe locking scenario: [ 1.212626] [ 1.212751] CPU0 [ 1.212815] ---- [ 1.212871] lock(&dev->lock); [ 1.212944] lock(&dev->lock); [ 1.213016] [ 1.213016] *** DEADLOCK *** [ 1.213016] [ 1.213143] May be due to missing lock nesting notation [ 1.213143] [ 1.213294] 3 locks held by ip/184: [ 1.213371] #0: ffffffff838b53e0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock+0x1b/0xa0 [ 1.213543] #1: ffffffff84e5fc70 (&net->rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock+0x37/0xa0 [ 1.213727] #2: ffff8881024a4c30 (&dev->lock){+.+.}-{4:4}, at: dev_open+0x50/0xb0 [ 1.213895] [ 1.213895] stack backtrace: [ 1.213991] CPU:
0 UID: 0 PID: 184 Comm: ip Not tainted 6.14.0-rc5-01215-g032756b4ca7a-dirty #5 [ 1.213993] Hardware name:
QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 [ 1.213994] Call Trace: [ 1.213995] <TASK> [ 1.213996] dump_stack_lvl+0x8e/0xd0 [ 1.214000] print_deadlock_bug+0x28b/0x2a0 [ 1.214020] lock_acquire+0xea/0x2a0 [ 1.214027] __mutex_lock+0xbf/0xd40 [ 1.214038] dev_set_allmulti+0x4e/0xb0 # real_dev->flags & IFF_ALLMULTI [ 1.214040] vlan_dev_open+0xa5/0x170 # ndo_open on vlandev [ 1.214042] __dev_open+0x145/0x270 [ 1.214046] __dev_change_flags+0xb0/0x1e0 [ 1.214051] netif_change_flags+0x22/0x60 # IFF_UP vlandev [ 1.214053] dev_change_flags+0x61/0xb0 # for each device in group from dev->vlan_info [ 1.214055] vlan_device_event+0x766/0x7c0 # on netdevsim0 [ 1.214058] notifier_call_chain+0x78/0x120 [ 1.214062] netif_open+0x6d/0x90 [ 1.214064] dev_open+0x5b/0xb0 # locks netdevsim0 [ 1.214066] bond_enslave+0x64c/0x1230 [ 1.214075] do_set_master+0x175/0x1e0 # on netdevsim0 [ 1.214077] do_setlink+0x516/0x13b0 [ 1.214094] rtnl_newlink+0xaba/0xb80 [ 1.214132] rtnetlink_rcv_msg+0x440/0x490 [ 1.214144] netlink_rcv_skb+0xeb/0x120 [ 1.214150] netlink_unicast+0x1f9/0x320 [ 1.214153] netlink_sendmsg+0x346/0x3f0 [ 1.214157] __sock_sendmsg+0x86/0xb0 [ 1.214160] ____sys_sendmsg+0x1c8/0x220 [ 1.214164] ___sys_sendmsg+0x28f/0x2d0 [ 1.214179]
__x64_sys_sendmsg+0xef/0x140 [ 1.214184] do_syscall_64+0xec/0x1d0 [ 1.214190] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1.214191] RIP: 0033:0x7f2d1b4a7e56 Device setup: netdevsim0 (down) ^ ^ bond netdevsim1.100@netdevsim1 allmulticast=on (down) When we enslave the lower device (netdevsim0) which has a vlan, we propagate vlan's allmuti/promisc flags during ndo_open. This causes (re)locking on of the real_dev. Propagate allmulti/promisc on flags change, not on the open. There is a slight semantics change that vlans that are down now propagate the flags, but this seems unlikely to result in the real issues. Reproducer: echo 0 1 > /sys/bus/netdevsim/new_device dev_path=$(ls -d /sys/bus/netdevsim/devices/netdevsim0/net/*) dev=$(echo $dev_path | rev | cut -d/ -f1 | rev) ip link set dev $dev name netdevsim0 ip link set dev netdevsim0 up ip link add link netdevsim0 name netdevsim0.100 type vlan id 100 ip link set dev netdevsim0.100 allm ---truncated--- (CVE-2025-23163)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-23163
https://ubuntu.com/security/CVE-2025-23163

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-23163

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
252877 - Linux Distros Unpatched Vulnerability : CVE-2025-2368
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was found in WebAssembly wabt 1.0.36 and classified as critical. This issue affects the function wabt::interp::(anonymous namespace)::BinaryReaderInterp::OnExport of the file wabt/src/interp/binary-reader-interp.cc of the component Malformed File Handler. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. (CVE-2025-2368)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-2368
https://security-tracker.debian.org/tracker/CVE-2025-2368
https://ubuntu.com/security/CVE-2025-2368

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.4
EPSS Score
0.0008
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-2368

Plugin Information
Published: 2025/08/20, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
231943 - Linux Distros Unpatched Vulnerability : CVE-2025-24014
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode.
However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim by feeding some binary characters to Vim. The function that handles the scrolling however may be triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been allocated (since there is no screen). This vulnerability is fixed in 9.1.1043. (CVE-2025-24014)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-24014
https://security-tracker.debian.org/tracker/CVE-2025-24014

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.5
EPSS Score
0.0003
CVSS v2.0 Base Score
4.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-24014

Plugin Information
Published: 2025/03/06, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
231169 - Linux Distros Unpatched Vulnerability : CVE-2025-24143
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The issue was addressed with improved access restrictions to the file system. This issue is fixed in macOS Sequoia 15.3, Safari 18.3, iOS 18.3 and iPadOS 18.3, visionOS 2.3. A maliciously crafted webpage may be able to fingerprint the user. (CVE-2025-24143)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-24143
https://security-tracker.debian.org/tracker/CVE-2025-24143
https://ubuntu.com/security/CVE-2025-24143

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-24143

Plugin Information
Published: 2025/03/06, Modified: 2025/08/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- webkit2gtk3
- webkit2gtk3-jsc
256844 - Linux Distros Unpatched Vulnerability : CVE-2025-26603
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:redir` ex command to register, variables and files. It also allows to show the contents of registers using the `:registers` or `:display` ex command. When redirecting the output of `:display` to a register, Vim will free the register content before storing the new content in the register. Now when redirecting the `:display` command to a register that is being displayed, Vim will free the content while shortly afterwards trying to access it, which leads to a use-after-free. Vim pre 9.1.1115 checks in the ex_display() function, that it does not try to redirect to a register while displaying this register at the same time. However this check is not complete, and so Vim does not check the `+` and `*` registers (which typically donate the X11/clipboard registers, and when a clipboard connection is not possible will fall back to use register 0 instead. In Patch 9.1.1115 Vim will therefore skip outputting to register zero when trying to redirect to the clipboard registers `*` or `+`. Users are advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2025-26603)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-26603
https://security-tracker.debian.org/tracker/CVE-2025-26603

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.2 (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
3.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-26603

Plugin Information
Published: 2025/08/27, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
258346 - Linux Distros Unpatched Vulnerability : CVE-2025-29768
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to 9.1.1198. The impact is medium because a user must be made to view such an archive with Vim and then press 'x' on such a strange filename. The issue has been fixed as of Vim patch v9.1.1198.
(CVE-2025-29768)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-29768
https://security-tracker.debian.org/tracker/CVE-2025-29768

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
4.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.5
EPSS Score
0.0004
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-29768

Plugin Information
Published: 2025/08/30, Modified: 2025/11/24
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- vim-common
- vim-enhanced
- vim-filesystem
- vim-minimal
261588 - Linux Distros Unpatched Vulnerability : CVE-2025-30162
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who use Gateway API for Ingress for some services and use LB-IPAM or BGP for LB Service implementation and use network policies to block egress traffic from workloads in a namespace to workloads in other namespaces, egress traffic from workloads covered by such network policies to LoadBalancers configured by `Gateway` resources will incorrectly be allowed. LoadBalancer resources not deployed via a Gateway API configuration are not affected by this issue. This issue affects: Cilium v1.15 between v1.15.0 and v1.15.14 inclusive, v1.16 between v1.16.0 and v1.16.7 inclusive, and v1.17 between v1.17.0 and v1.17.1 inclusive. This issue is fixed in Cilium v1.15.15, v1.16.8, and v1.17.2. A Clusterwide Cilium Network Policy can be used to work around this issue for users who are unable to upgrade. (CVE-2025-30162)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-30162

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
3.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.6
EPSS Score
0.0001
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-30162

Plugin Information
Published: 2025/09/06, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- podman
261593 - Linux Distros Unpatched Vulnerability : CVE-2025-30163
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Node based network policies (`fromNodes` and `toNodes`) will incorrectly permit traffic to/from non-node endpoints that share the labels specified in `fromNodes` and `toNodes` sections of network policies. Node based network policy is disabled by default in Cilium. This issue affects: Cilium v1.16 between v1.16.0 and v1.16.7 inclusive and v1.17 between v1.17.0 and v1.17.1 inclusive. This issue is fixed in Cilium v1.16.8 and v1.17.2. Users can work around this issue by ensuring that the labels used in `fromNodes` and `toNodes` fields are used exclusively by nodes and not by other endpoints. (CVE-2025-30163)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-30163

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
4.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.6
EPSS Score
0.0001
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-30163

Plugin Information
Published: 2025/09/06, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- podman
251944 - Linux Distros Unpatched Vulnerability : CVE-2025-30258
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a verification DoS. (CVE-2025-30258)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-30258
https://security-tracker.debian.org/tracker/CVE-2025-30258

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-30258

Plugin Information
Published: 2025/08/19, Modified: 2025/12/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gnupg2
249495 - Linux Distros Unpatched Vulnerability : CVE-2025-3031
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An attacker could read 32 bits of values spilled onto the stack in a JIT compiled function. This vulnerability affects Firefox < 137 and Thunderbird < 137. (CVE-2025-3031)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-3031
https://ubuntu.com/security/CVE-2025-3031

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.3
EPSS Score
0.0003
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-3031

Plugin Information
Published: 2025/08/15, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
250941 - Linux Distros Unpatched Vulnerability : CVE-2025-3198
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability has been found in GNU Binutils 2.43/2.44 and classified as problematic. Affected by this vulnerability is the function display_info of the file binutils/bucomm.c of the component objdump. The manipulation leads to memory leak. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named ba6ad3a18cb26b79e0e3b84c39f707535bbc344d. It is recommended to apply a patch to fix this issue. (CVE-2025-3198)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-3198
https://security-tracker.debian.org/tracker/CVE-2025-3198

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.7 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-3198

Plugin Information
Published: 2025/08/18, Modified: 2025/12/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-13-binutils
- gcc-toolset-13-binutils-devel
- gcc-toolset-13-binutils-gold
- gcc-toolset-13-gdb
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
252193 - Linux Distros Unpatched Vulnerability : CVE-2025-32364
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN. (CVE-2025-32364)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-32364

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.0 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-32364

Plugin Information
Published: 2025/08/19, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- poppler
- poppler-cpp
- poppler-glib
- poppler-utils
247071 - Linux Distros Unpatched Vulnerability : CVE-2025-32909
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in libsoup. SoupContentSniffer may be vulnerable to a NULL pointer dereference in the sniff_mp4 function. The HTTP server may cause the libsoup client to crash. (CVE-2025-32909)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-32909
https://security-tracker.debian.org/tracker/CVE-2025-32909

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0004
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-32909

Plugin Information
Published: 2025/08/09, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libsoup
245533 - Linux Distros Unpatched Vulnerability : CVE-2025-32910
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in libsoup, where soup_auth_digest_authenticate() is vulnerable to a NULL pointer dereference. This issue may cause the libsoup client to crash. (CVE-2025-32910)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-32910
https://security-tracker.debian.org/tracker/CVE-2025-32910

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-32910

Plugin Information
Published: 2025/08/07, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libsoup
249468 - Linux Distros Unpatched Vulnerability : CVE-2025-32912
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in libsoup, where SoupAuthDigest is vulnerable to a NULL pointer dereference. The HTTP server may cause the libsoup client to crash. (CVE-2025-32912)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-32912
https://security-tracker.debian.org/tracker/CVE-2025-32912

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-32912

Plugin Information
Published: 2025/08/15, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libsoup
257978 - Linux Distros Unpatched Vulnerability : CVE-2025-3573
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, which may take input from a user-controlled placeholder value. This value will populate a message via $.validator.messages in a user localizable dictionary. (CVE-2025-3573)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-3573
https://security-tracker.debian.org/tracker/CVE-2025-3573
https://ubuntu.com/security/CVE-2025-3573

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
5.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.0
EPSS Score
0.0003
CVSS v2.0 Base Score
3.5 (CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
3.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-3573

Plugin Information
Published: 2025/08/27, Modified: 2025/11/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- aspnetcore-runtime-9.0
- aspnetcore-targeting-pack-9.0
- dotnet-apphost-pack-9.0
- dotnet-host
- dotnet-hostfxr-9.0
- dotnet-runtime-9.0
- dotnet-sdk-9.0
- dotnet-targeting-pack-9.0
- netstandard-targeting-pack-2.1
252989 - Linux Distros Unpatched Vulnerability : CVE-2025-37743
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath12k: Avoid memory leak while enabling statistics Driver uses monitor destination rings for extended statistics mode and standalone monitor mode. In extended statistics mode, TLVs are parsed from the buffer received from the monitor destination ring and assigned to the ppdu_info structure to update per-packet statistics. In standalone monitor mode, along with per-packet statistics, the packet data (payload) is captured, and the driver updates per MSDU to mac80211. When the AP interface is enabled, only extended statistics mode is activated. As part of enabling monitor rings for collecting statistics, the driver subscribes to HAL_RX_MPDU_START TLV in the filter configuration. This TLV is received from the monitor destination ring, and kzalloc for the mon_mpdu object occurs, which is not freed, leading to a memory leak. The kzalloc for the mon_mpdu object is only required while enabling the standalone monitor interface. This causes a memory leak while enabling extended statistics mode in the driver. Fix this memory leak by removing the kzalloc for the mon_mpdu object in the HAL_RX_MPDU_START TLV handling.
Additionally, remove the standalone monitor mode handlings in the HAL_MON_BUF_ADDR and HAL_RX_MSDU_END TLVs. These TLV tags will be handled properly when enabling standalone monitor mode in the future. Tested- on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 (CVE-2025-37743)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37743
https://security-tracker.debian.org/tracker/CVE-2025-37743
https://ubuntu.com/security/CVE-2025-37743

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.7 (CVSS2#AV:A/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37743

Plugin Information
Published: 2025/08/20, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248619 - Linux Distros Unpatched Vulnerability : CVE-2025-37744
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath12k: fix memory leak in ath12k_pci_remove() Kmemleak reported this error: unreferenced object 0xffff1c165cec3060 (size 32): comm insmod, pid 560, jiffies 4296964570 (age 235.596s) backtrace:
[<000000005434db68>] __kmem_cache_alloc_node+0x1f4/0x2c0 [<000000001203b155>] kmalloc_trace+0x40/0x88 [<0000000028adc9c8>] _request_firmware+0xb8/0x608 [<00000000cad1aef7>] firmware_request_nowarn+0x50/0x80 [<000000005011a682>] local_pci_probe+0x48/0xd0 [<00000000077cd295>] pci_device_probe+0xb4/0x200 [<0000000087184c94>] really_probe+0x150/0x2c0 The firmware memory was allocated in ath12k_pci_probe(), but not freed in ath12k_pci_remove() in case ATH12K_FLAG_QMI_FAIL bit is set. So call ath12k_fw_unmap() to free the memory. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.2.0-02280-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 (CVE-2025-37744)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37744
https://ubuntu.com/security/CVE-2025-37744

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37744

Plugin Information
Published: 2025/08/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248061 - Linux Distros Unpatched Vulnerability : CVE-2025-37745
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() syzbot reported a deadlock in lock_system_sleep() (see below). The write operation to /sys/module/hibernate/parameters/compressor conflicts with the registration of ieee80211 device, resulting in a deadlock when attempting to acquire system_transition_mutex under param_lock. To avoid this deadlock, change hibernate_compressor_param_set() to use mutex_trylock() for attempting to acquire system_transition_mutex and return -EBUSY when it fails.
Task flags need not be saved or adjusted before calling mutex_trylock(&system_transition_mutex) because the caller is not going to end up waiting for this mutex and if it runs concurrently with system suspend in progress, it will be frozen properly when it returns to user space. syzbot report: syz-executor895/5833 is trying to acquire lock: ffffffff8e0828c8 (system_transition_mutex){+.+.}-{4:4}, at:
lock_system_sleep+0x87/0xa0 kernel/power/main.c:56 but task is already holding lock: ffffffff8e07dc68 (param_lock){+.+.}-{4:4}, at: kernel_param_lock kernel/params.c:607 [inline] ffffffff8e07dc68 (param_lock){+.+.}-{4:4}, at: param_attr_store+0xe6/0x300 kernel/params.c:586 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (param_lock){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/mutex.c:585 [inline] __mutex_lock+0x19b/0xb10 kernel/locking/mutex.c:730 ieee80211_rate_control_ops_get net/mac80211/rate.c:220 [inline] rate_control_alloc net/mac80211/rate.c:266 [inline] ieee80211_init_rate_ctrl_alg+0x18d/0x6b0 net/mac80211/rate.c:1015 ieee80211_register_hw+0x20cd/0x4060 net/mac80211/main.c:1531 mac80211_hwsim_new_radio+0x304e/0x54e0 drivers/net/wireless/virtual/mac80211_hwsim.c:5558 init_mac80211_hwsim+0x432/0x8c0 drivers/net/wireless/virtual/mac80211_hwsim.c:6910 do_one_initcall+0x128/0x700 init/main.c:1257 do_initcall_level init/main.c:1319 [inline] do_initcalls init/main.c:1335 [inline] do_basic_setup init/main.c:1354 [inline] kernel_init_freeable+0x5c7/0x900 init/main.c:1568 kernel_init+0x1c/0x2b0 init/main.c:1457 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 -> #2 (rtnl_mutex){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:585 [inline] __mutex_lock+0x19b/0xb10 kernel/locking/mutex.c:730 wg_pm_notification drivers/net/wireguard/device.c:80 [inline] wg_pm_notification+0x49/0x180 drivers/net/wireguard/device.c:64 notifier_call_chain+0xb7/0x410 kernel/notifier.c:85 notifier_call_chain_robust kernel/notifier.c:120 [inline] blocking_notifier_call_chain_robust kernel/notifier.c:345 [inline] blocking_notifier_call_chain_robust+0xc9/0x170 kernel/notifier.c:333 pm_notifier_call_chain_robust+0x27/0x60 kernel/power/main.c:102 snapshot_open+0x189/0x2b0 kernel/power/user.c:77 misc_open+0x35a/0x420 drivers/char/misc.c:179 chrdev_open+0x237/0x6a0 fs/char_dev.c:414 do_dentry_open+0x735/0x1c40 fs/open.c:956 vfs_open+0x82/0x3f0 fs/open.c:1086 do_open fs/namei.c:3830 [inline] path_openat+0x1e88/0x2d80 fs/namei.c:3989 do_filp_open+0x20c/0x470 fs/namei.c:4016 do_sys_openat2+0x17a/0x1e0 fs/open.c:1428 do_sys_open fs/open.c:1443 [inline]
__do_sys_openat fs/open.c:1459 [inline] __se_sys_openat fs/open.c:1454 [inline]
__x64_sys_openat+0x175/0x210 fs/open.c:1454 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #1 ((pm_chain_head).rwsem){++++}-{4:4}: down_read+0x9a/0x330 kernel/locking/rwsem.c:1524 blocking_notifier_call_chain_robust kerne ---truncated--- (CVE-2025-37745)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37745
https://ubuntu.com/security/CVE-2025-37745

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37745

Plugin Information
Published: 2025/08/11, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244282 - Linux Distros Unpatched Vulnerability : CVE-2025-37747
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- perf: Fix hang while freeing sigtrap event Perf can hang while freeing a sigtrap event if a related deferred signal hadn't managed to be sent before the file got closed: perf_event_overflow() task_work_add(perf_pending_task) fput() task_work_add(____fput()) task_work_run() ____fput() perf_release() perf_event_release_kernel() _free_event() perf_pending_task_sync() task_work_cancel() ->
FAILED rcuwait_wait_event() Once task_work_run() is running, the list of pending callbacks is removed from the task_struct and from this point on task_work_cancel() can't remove any pending and not yet started work items, hence the task_work_cancel() failure and the hang on rcuwait_wait_event(). Task work could be changed to remove one work at a time, so a work running on the current task can always cancel a pending one, however the wait / wake design is still subject to inverted dependencies when remote targets are involved, as pictured by Oleg: T1 T2 fd = perf_event_open(pid => T2->pid); fd = perf_event_open(pid =>
T1->pid); close(fd) close(fd) <IRQ> <IRQ> perf_event_overflow() perf_event_overflow() task_work_add(perf_pending_task) task_work_add(perf_pending_task) </IRQ> </IRQ> fput() fput() task_work_add(____fput()) task_work_add(____fput()) task_work_run() task_work_run() ____fput() ____fput() perf_release() perf_release() perf_event_release_kernel() perf_event_release_kernel() _free_event()
_free_event() perf_pending_task_sync() perf_pending_task_sync() rcuwait_wait_event() rcuwait_wait_event() Therefore the only option left is to acquire the event reference count upon queueing the perf task work and release it from the task work, just like it was done before 3a5465418f5f (perf: Fix event leak upon exec and file release) but without the leaks it fixed. Some adjustments are necessary to make it work: * A child event might dereference its parent upon freeing. Care must be taken to release the parent last. * Some places assuming the event doesn't have any reference held and therefore can be freed right away must instead put the reference and let the reference counting to its job. (CVE-2025-37747)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37747
https://security-tracker.debian.org/tracker/CVE-2025-37747
https://ubuntu.com/security/CVE-2025-37747

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37747

Plugin Information
Published: 2025/08/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245198 - Linux Distros Unpatched Vulnerability : CVE-2025-37756
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: tls: explicitly disallow disconnect syzbot discovered that it can disconnect a TLS socket and then run into all sort of unexpected corner cases. I have a vague recollection of Eric pointing this out to us a long time ago. Supporting disconnect is really hard, for one thing if offload is enabled we'd need to wait for all packets to be _acked_. Disconnect is not commonly used, disallow it. The immediate problem syzbot run into is the warning in the strp, but that's just the easiest bug to trigger: WARNING: CPU: 0 PID: 5834 at net/tls/tls_strp.c:486 tls_strp_msg_load+0x72e/0xa80 net/tls/tls_strp.c:486 RIP:
0010:tls_strp_msg_load+0x72e/0xa80 net/tls/tls_strp.c:486 Call Trace: <TASK> tls_rx_rec_wait+0x280/0xa60 net/tls/tls_sw.c:1363 tls_sw_recvmsg+0x85c/0x1c30 net/tls/tls_sw.c:2043 inet6_recvmsg+0x2c9/0x730 net/ipv6/af_inet6.c:678 sock_recvmsg_nosec net/socket.c:1023 [inline] sock_recvmsg+0x109/0x280 net/socket.c:1045 __sys_recvfrom+0x202/0x380 net/socket.c:2237 (CVE-2025-37756)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37756
https://ubuntu.com/security/CVE-2025-37756

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37756

Plugin Information
Published: 2025/08/07, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250232 - Linux Distros Unpatched Vulnerability : CVE-2025-37757
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tipc: fix memory leak in tipc_link_xmit In case the backlog transmit queue for system-importance messages is overloaded, tipc_link_xmit() returns -ENOBUFS but the skb list is not purged. This leads to memory leak and failure when a skb is allocated. This commit fixes this issue by purging the skb list before tipc_link_xmit() returns. (CVE-2025-37757)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37757
https://ubuntu.com/security/CVE-2025-37757

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37757

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248957 - Linux Distros Unpatched Vulnerability : CVE-2025-37773
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- virtiofs: add filesystem context source name check In certain scenarios, for example, during fuzz testing, the source name may be NULL, which could lead to a kernel panic. Therefore, an extra check for the source name should be added. (CVE-2025-37773)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37773
https://ubuntu.com/security/CVE-2025-37773

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37773

Plugin Information
Published: 2025/08/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244649 - Linux Distros Unpatched Vulnerability : CVE-2025-37788
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path In the for loop used to allocate the loc_array and bmap for each port, a memory leak is possible when the allocation for loc_array succeeds, but the allocation for bmap fails. This is because when the control flow goes to the label free_eth_finfo, only the allocations starting from (i-1)th iteration are freed. Fix that by freeing the loc_array in the bmap allocation error path. (CVE-2025-37788)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37788
https://ubuntu.com/security/CVE-2025-37788

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37788

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245616 - Linux Distros Unpatched Vulnerability : CVE-2025-37791
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() rpl is passed as a pointer to ethtool_cmis_module_poll(), so the correct size of rpl is sizeof(*rpl) which should be just 1 byte. Using the pointer size instead can cause stack corruption: Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in:
ethtool_cmis_wait_for_cond+0xf4/0x100 CPU: 72 UID: 0 PID: 4440 Comm: kworker/72:2 Kdump: loaded Tainted: G OE 6.11.0 #24 Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. PowerEdge R760/04GWWM, BIOS 1.6.6 09/20/2023 Workqueue: events module_flash_fw_work Call Trace: <TASK> panic+0x339/0x360 ? ethtool_cmis_wait_for_cond+0xf4/0x100 ? __pfx_status_success+0x10/0x10 ? __pfx_status_fail+0x10/0x10
__stack_chk_fail+0x10/0x10 ethtool_cmis_wait_for_cond+0xf4/0x100 ethtool_cmis_cdb_execute_cmd+0x1fc/0x330 ? __pfx_status_fail+0x10/0x10 cmis_cdb_module_features_get+0x6d/0xd0 ethtool_cmis_cdb_init+0x8a/0xd0 ethtool_cmis_fw_update+0x46/0x1d0 module_flash_fw_work+0x17/0xa0 process_one_work+0x179/0x390 worker_thread+0x239/0x340 ? __pfx_worker_thread+0x10/0x10 kthread+0xcc/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2d/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> (CVE-2025-37791)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37791
https://ubuntu.com/security/CVE-2025-37791

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37791

Plugin Information
Published: 2025/08/08, Modified: 2025/11/24
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245806 - Linux Distros Unpatched Vulnerability : CVE-2025-37792
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: btrtl: Prevent potential NULL dereference The btrtl_initialize() function checks that rtl_load_file() either had an error or it loaded a zero length file. However, if it loaded a zero length file then the error code is not set correctly. It results in an error pointer vs NULL bug, followed by a NULL pointer dereference. This was detected by Smatch: drivers/bluetooth/btrtl.c:592 btrtl_initialize() warn: passing zero to 'ERR_PTR' (CVE-2025-37792)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37792
https://ubuntu.com/security/CVE-2025-37792

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37792

Plugin Information
Published: 2025/08/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244976 - Linux Distros Unpatched Vulnerability : CVE-2025-37793
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() devm_kasprintf() returns NULL when memory allocation fails. Currently, avs_component_probe() does not check for this case, which results in a NULL pointer dereference. (CVE-2025-37793)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37793
https://ubuntu.com/security/CVE-2025-37793

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37793

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249960 - Linux Distros Unpatched Vulnerability : CVE-2025-37794
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: mac80211: Purge vif txq in ieee80211_do_stop() After ieee80211_do_stop() SKB from vif's txq could still be processed. Indeed another concurrent vif schedule_and_wake_txq call could cause those packets to be dequeued (see ieee80211_handle_wake_tx_queue()) without checking the sdata current state. Because vif.drv_priv is now cleared in this function, this could lead to driver crash. For example in ath12k, ahvif is store in vif.drv_priv. Thus if ath12k_mac_op_tx() is called after ieee80211_do_stop(), ahvif->ah can be NULL, leading the ath12k_warn(ahvif->ah,...) call in this function to trigger the NULL deref below.
Unable to handle kernel paging request at virtual address dfffffc000000001 KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] batman_adv: bat0: Interface deactivated: brbh1337 Mem abort info:
ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [dfffffc000000001] address between user and kernel address ranges Internal error: Oops: 0000000096000004 [#1] SMP CPU: 1 UID: 0 PID:
978 Comm: lbd Not tainted 6.13.0-g633f875b8f1e #114 Hardware name: HW (DT) pstate: 10000005 (nzcV daif
-PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ath12k_mac_op_tx+0x6cc/0x29b8 [ath12k] lr :
ath12k_mac_op_tx+0x174/0x29b8 [ath12k] sp : ffffffc086ace450 x29: ffffffc086ace450 x28: 0000000000000000 x27: 1ffffff810d59ca4 x26: ffffff801d05f7c0 x25: 0000000000000000 x24: 000000004000001e x23:
ffffff8009ce4926 x22: ffffff801f9c0800 x21: ffffff801d05f7f0 x20: ffffff8034a19f40 x19: 0000000000000000 x18: ffffff801f9c0958 x17: ffffff800bc0a504 x16: dfffffc000000000 x15: ffffffc086ace4f8 x14:
ffffff801d05f83c x13: 0000000000000000 x12: ffffffb003a0bf03 x11: 0000000000000000 x10: ffffffb003a0bf02 x9 : ffffff8034a19f40 x8 : ffffff801d05f818 x7 : 1ffffff0069433dc x6 : ffffff8034a19ee0 x5 :
ffffff801d05f7f0 x4 : 0000000000000000 x3 : 0000000000000001 x2 : 0000000000000000 x1 : dfffffc000000000 x0 : 0000000000000008 Call trace: ath12k_mac_op_tx+0x6cc/0x29b8 [ath12k] (P) ieee80211_handle_wake_tx_queue+0x16c/0x260 ieee80211_queue_skb+0xeec/0x1d20 ieee80211_tx+0x200/0x2c8 ieee80211_xmit+0x22c/0x338 __ieee80211_subif_start_xmit+0x7e8/0xc60 ieee80211_subif_start_xmit+0xc4/0xee0
__ieee80211_subif_start_xmit_8023.isra.0+0x854/0x17a0 ieee80211_subif_start_xmit_8023+0x124/0x488 dev_hard_start_xmit+0x160/0x5a8 __dev_queue_xmit+0x6f8/0x3120 br_dev_queue_push_xmit+0x120/0x4a8
__br_forward+0xe4/0x2b0 deliver_clone+0x5c/0xd0 br_flood+0x398/0x580 br_dev_xmit+0x454/0x9f8 dev_hard_start_xmit+0x160/0x5a8 __dev_queue_xmit+0x6f8/0x3120 ip6_finish_output2+0xc28/0x1b60
__ip6_finish_output+0x38c/0x638 ip6_output+0x1b4/0x338 ip6_local_out+0x7c/0xa8 ip6_send_skb+0x7c/0x1b0 ip6_push_pending_frames+0x94/0xd0 rawv6_sendmsg+0x1a98/0x2898 inet_sendmsg+0x94/0xe0
__sys_sendto+0x1e4/0x308 __arm64_sys_sendto+0xc4/0x140 do_el0_svc+0x110/0x280 el0_svc+0x20/0x60 el0t_64_sync_handler+0x104/0x138 el0t_64_sync+0x154/0x158 To avoid that, empty vif's txq at ieee80211_do_stop() so no packet could be dequeued after ieee80211_do_stop() (new packets cannot be queued because SDATA_STATE_RUNNING is cleared at this point). (CVE-2025-37794)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37794
https://ubuntu.com/security/CVE-2025-37794

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37794

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244990 - Linux Distros Unpatched Vulnerability : CVE-2025-37800
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- driver core: fix potential NULL pointer dereference in dev_uevent() If userspace reads uevent device attribute at the same time as another threads unbinds the device from its driver, change to dev->driver from a valid pointer to NULL may result in crash. Fix this by using READ_ONCE() when fetching the pointer, and take bus' drivers klist lock to make sure driver instance will not disappear while we access it. Use WRITE_ONCE() when setting the driver pointer to ensure there is no tearing. (CVE-2025-37800)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37800
https://security-tracker.debian.org/tracker/CVE-2025-37800
https://ubuntu.com/security/CVE-2025-37800

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37800

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245925 - Linux Distros Unpatched Vulnerability : CVE-2025-37801
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- spi: spi-imx: Add check for spi_imx_setupxfer() Add check for the return value of spi_imx_setupxfer().
spi_imx->rx and spi_imx->tx function pointer can be NULL when spi_imx_setupxfer() return error, and make NULL pointer dereference. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Call trace: 0x0 spi_imx_pio_transfer+0x50/0xd8 spi_imx_transfer_one+0x18c/0x858 spi_transfer_one_message+0x43c/0x790 __spi_pump_transfer_message+0x238/0x5d4 __spi_sync+0x2b0/0x454 spi_write_then_read+0x11c/0x200 (CVE-2025-37801)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37801
https://ubuntu.com/security/CVE-2025-37801

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37801

Plugin Information
Published: 2025/08/08, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250104 - Linux Distros Unpatched Vulnerability : CVE-2025-37805
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sound/virtio: Fix cancel_sync warnings on uninitialized work_structs Betty reported hitting the following warning: [ 8.709131][ T221] WARNING: CPU: 2 PID: 221 at kernel/workqueue.c:4182 ... [ 8.713282][ T221] Call trace: [ 8.713365][ T221] __flush_work+0x8d0/0x914 [ 8.713468][ T221] __cancel_work_sync+0xac/0xfc [ 8.713570][ T221] cancel_work_sync+0x24/0x34 [ 8.713667][ T221] virtsnd_remove+0xa8/0xf8 [virtio_snd ab15f34d0dd772f6d11327e08a81d46dc9c36276] [ 8.713868][ T221] virtsnd_probe+0x48c/0x664 [virtio_snd ab15f34d0dd772f6d11327e08a81d46dc9c36276] [ 8.714035][ T221] virtio_dev_probe+0x28c/0x390 [ 8.714139][ T221] really_probe+0x1bc/0x4c8 ... It seems we're hitting the error path in virtsnd_probe(), which triggers a virtsnd_remove() which iterates over the substreams calling cancel_work_sync() on the elapsed_period work_struct. Looking at the code, from earlier in:
virtsnd_probe()->virtsnd_build_devs()->virtsnd_pcm_parse_cfg() We set snd->nsubstreams, allocate the snd->substreams, and if we then hit an error on the info allocation or something in virtsnd_ctl_query_info() fails, we will exit without having initialized the elapsed_period work_struct.
When that error path unwinds we then call virtsnd_remove() which as long as the substreams array is allocated, will iterate through calling cancel_work_sync() on the uninitialized work struct hitting this warning. Takashi Iwai suggested this fix, which initializes the substreams structure right after allocation, so that if we hit the error paths we avoid trying to cleanup uninitialized data. Note: I have not yet managed to reproduce the issue myself, so this patch has had limited testing. Feedback or thoughts would be appreciated! (CVE-2025-37805)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37805
https://ubuntu.com/security/CVE-2025-37805

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37805

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245994 - Linux Distros Unpatched Vulnerability : CVE-2025-37807
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Fix kmemleak warning for percpu hashmap Vlad Poenaru reported the following kmemleak issue:
unreferenced object 0x606fd7c44ac8 (size 32): backtrace (crc 0): pcpu_alloc_noprof+0x730/0xeb0 bpf_map_alloc_percpu+0x69/0xc0 prealloc_init+0x9d/0x1b0 htab_map_alloc+0x363/0x510 map_create+0x215/0x3a0
__sys_bpf+0x16b/0x3e0 __x64_sys_bpf+0x18/0x20 do_syscall_64+0x7b/0x150 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Further investigation shows the reason is due to not 8-byte aligned store of percpu pointer in htab_elem_set_ptr(): *(void __percpu **)(l->key + key_size) = pptr;
Note that the whole htab_elem alignment is 8 (for x86_64). If the key_size is 4, that means pptr is stored in a location which is 4 byte aligned but not 8 byte aligned. In mm/kmemleak.c, scan_block() scans the memory based on 8 byte stride, so it won't detect above pptr, hence reporting the memory leak. In htab_map_alloc(), we already have htab->elem_size = sizeof(struct htab_elem) + round_up(htab->map.key_size, 8); if (percpu) htab->elem_size += sizeof(void *); else htab->elem_size += round_up(htab->map.value_size, 8); So storing pptr with 8-byte alignment won't cause any problem and can fix kmemleak too. The issue can be reproduced with bpf selftest as well: 1. Enable CONFIG_DEBUG_KMEMLEAK config 2. Add a getchar() before skel destroy in test_hash_map() in prog_tests/for_each.c. The purpose is to keep map available so kmemleak can be detected. 3. run './test_progs -t for_each/hash_map &' and a kmemleak should be reported. (CVE-2025-37807)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37807
https://security-tracker.debian.org/tracker/CVE-2025-37807
https://ubuntu.com/security/CVE-2025-37807

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37807

Plugin Information
Published: 2025/08/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245796 - Linux Distros Unpatched Vulnerability : CVE-2025-37808
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- crypto: null - Use spin lock instead of mutex As the null algorithm may be freed in softirq context through af_alg, use spin locks instead of mutexes to protect the default null algorithm. (CVE-2025-37808)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37808
https://ubuntu.com/security/CVE-2025-37808

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37808

Plugin Information
Published: 2025/08/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248630 - Linux Distros Unpatched Vulnerability : CVE-2025-37809
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: typec: class: Fix NULL pointer access Concurrent calls to typec_partner_unlink_device can lead to a NULL pointer dereference. This patch adds a mutex to protect USB device pointers and prevent this issue.
The same mutex protects both the device pointers and the partner device registration. (CVE-2025-37809)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37809
https://ubuntu.com/security/CVE-2025-37809

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37809

Plugin Information
Published: 2025/08/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246352 - Linux Distros Unpatched Vulnerability : CVE-2025-37811
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: chipidea: ci_hdrc_imx: fix usbmisc handling usbmisc is an optional device property so it is totally valid for the corresponding data->usbmisc_data to have a NULL value. Check that before dereferencing the pointer. Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool.
(CVE-2025-37811)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37811
https://ubuntu.com/security/CVE-2025-37811

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37811

Plugin Information
Published: 2025/08/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246887 - Linux Distros Unpatched Vulnerability : CVE-2025-37813
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: xhci: Fix invalid pointer dereference in Etron workaround This check is performed before prepare_transfer() and prepare_ring(), so enqueue can already point at the final link TRB of a segment.
And indeed it will, some 0.4% of times this code is called. Then enqueue + 1 is an invalid pointer. It will crash the kernel right away or load some junk which may look like a link TRB and cause the real link TRB to be replaced with a NOOP. This wouldn't end well. Use a functionally equivalent test which doesn't dereference the pointer and always gives correct result. Something has crashed my machine twice in recent days while playing with an Etron HC, and a control transfer stress test ran for confirmation has just crashed it again. The same test passes with this patch applied. (CVE-2025-37813)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37813
https://ubuntu.com/security/CVE-2025-37813

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37813

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250037 - Linux Distros Unpatched Vulnerability : CVE-2025-37820
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() The function xdp_convert_buff_to_frame() may return NULL if it fails to correctly convert the XDP buffer into an XDP frame due to memory constraints, internal errors, or invalid data. Failing to check for NULL may lead to a NULL pointer dereference if the result is used later in processing, potentially causing crashes, data corruption, or undefined behavior. On XDP redirect failure, the associated page must be released explicitly if it was previously retained via get_page(). Failing to do so may result in a memory leak, as the pages reference count is not decremented. (CVE-2025-37820)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37820
https://security-tracker.debian.org/tracker/CVE-2025-37820
https://ubuntu.com/security/CVE-2025-37820

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37820

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244113 - Linux Distros Unpatched Vulnerability : CVE-2025-37824
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tipc: fix NULL pointer dereference in tipc_mon_reinit_self() syzbot reported: tipc: Node number set to 1055423674 Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 3 UID: 0 PID: 6017 Comm: kworker/3:5 Not tainted 6.15.0-rc1-syzkaller-00246-g900241a5cc15 #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue:
events tipc_net_finalize_work RIP: 0010:tipc_mon_reinit_self+0x11c/0x210 net/tipc/monitor.c:719 ... RSP:
0018:ffffc9000356fb68 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000003ee87cba RDX: 0000000000000000 RSI: ffffffff8dbc56a7 RDI: ffff88804c2cc010 RBP: dffffc0000000000 R08:
0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000007 R13: fffffbfff2111097 R14: ffff88804ead8000 R15: ffff88804ead9010 FS: 0000000000000000(0000) GS:ffff888097ab9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
00000000f720eb00 CR3: 000000000e182000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK>
tipc_net_finalize+0x10b/0x180 net/tipc/net.c:140 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c2/0x780 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> ... RIP:
0010:tipc_mon_reinit_self+0x11c/0x210 net/tipc/monitor.c:719 ... RSP: 0018:ffffc9000356fb68 EFLAGS:
00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000003ee87cba RDX: 0000000000000000 RSI:
ffffffff8dbc56a7 RDI: ffff88804c2cc010 RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000007 R13: fffffbfff2111097 R14:
ffff88804ead8000 R15: ffff88804ead9010 FS: 0000000000000000(0000) GS:ffff888097ab9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000f720eb00 CR3:
000000000e182000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 There is a racing condition between workqueue created when enabling bearer and another thread created when disabling bearer right after that as follow: enabling_bearer | disabling_bearer --------------- | ---------------- tipc_disc_timeout() | { | bearer_disable() ... | { schedule_work(&tn->work); | tipc_mon_delete() ... | { } | ... | write_lock_bh(&mon->lock); | mon->self = NULL; | write_unlock_bh(&mon->lock); | ... | } tipc_net_finalize_work() | } { | ... | tipc_net_finalize() | { | ... | tipc_mon_reinit_self() | { | ... | write_lock_bh(&mon->lock); | mon->self->addr = tipc_own_addr(net); | write_unlock_bh(&mon->lock); | ...
---truncated--- (CVE-2025-37824)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37824
https://ubuntu.com/security/CVE-2025-37824

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37824

Plugin Information
Published: 2025/08/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247775 - Linux Distros Unpatched Vulnerability : CVE-2025-37829
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() cpufreq_cpu_get_raw() can return NULL when the target CPU is not present in the policy->cpus mask. scpi_cpufreq_get_rate() does not check for this case, which results in a NULL pointer dereference. (CVE-2025-37829)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37829
https://ubuntu.com/security/CVE-2025-37829

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37829

Plugin Information
Published: 2025/08/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249464 - Linux Distros Unpatched Vulnerability : CVE-2025-37830
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() cpufreq_cpu_get_raw() can return NULL when the target CPU is not present in the policy->cpus mask. scmi_cpufreq_get_rate() does not check for this case, which results in a NULL pointer dereference. Add NULL check after cpufreq_cpu_get_raw() to prevent this issue. (CVE-2025-37830)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37830
https://security-tracker.debian.org/tracker/CVE-2025-37830
https://ubuntu.com/security/CVE-2025-37830

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37830

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250070 - Linux Distros Unpatched Vulnerability : CVE-2025-37834
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm/vmscan: don't try to reclaim hwpoison folio Syzkaller reports a bug as follows: Injecting memory failure for pfn 0x18b00e at process virtual address 0x20ffd000 Memory failure: 0x18b00e: dirty swapcache page still referenced by 2 users Memory failure: 0x18b00e: recovery action for dirty swapcache page:
Failed page: refcount:2 mapcount:0 mapping:0000000000000000 index:0x20ffd pfn:0x18b00e memcg:ffff0000dd6d9000 anon flags:
0x5ffffe00482011(locked|dirty|arch_1|swapbacked|hwpoison|node=0|zone=2|lastcpupid=0xfffff) raw:
005ffffe00482011 dead000000000100 dead000000000122 ffff0000e232a7c9 raw: 0000000000020ffd 0000000000000000 00000002ffffffff ffff0000dd6d9000 page dumped because: VM_BUG_ON_FOLIO(!folio_test_uptodate(folio))
------------[ cut here ]------------ kernel BUG at mm/swap_state.c:184! Internal error: Oops - BUG:
00000000f2000800 [#1] SMP Modules linked in: CPU: 0 PID: 60 Comm: kswapd0 Not tainted 6.6.0-gcb097e7de84e #3 Hardware name: linux,dummy-virt (DT) pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : add_to_swap+0xbc/0x158 lr : add_to_swap+0xbc/0x158 sp : ffff800087f37340 x29: ffff800087f37340 x28:
fffffc00052c0380 x27: ffff800087f37780 x26: ffff800087f37490 x25: ffff800087f37c78 x24: ffff800087f377a0 x23: ffff800087f37c50 x22: 0000000000000000 x21: fffffc00052c03b4 x20: 0000000000000000 x19:
fffffc00052c0380 x18: 0000000000000000 x17: 296f696c6f662865 x16: 7461646f7470755f x15: 747365745f6f696c x14: 6f6621284f494c4f x13: 0000000000000001 x12: ffff600036d8b97b x11: 1fffe00036d8b97a x10:
ffff600036d8b97a x9 : dfff800000000000 x8 : 00009fffc9274686 x7 : ffff0001b6c5cbd3 x6 : 0000000000000001 x5 : ffff0000c25896c0 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 :
ffff0000c25896c0 x0 : 0000000000000000 Call trace: add_to_swap+0xbc/0x158 shrink_folio_list+0x12ac/0x2648 shrink_inactive_list+0x318/0x948 shrink_lruvec+0x450/0x720 shrink_node_memcgs+0x280/0x4a8 shrink_node+0x128/0x978 balance_pgdat+0x4f0/0xb20 kswapd+0x228/0x438 kthread+0x214/0x230 ret_from_fork+0x10/0x20 I can reproduce this issue with the following steps: 1) When a dirty swapcache page is isolated by reclaim process and the page isn't locked, inject memory failure for the page.
me_swapcache_dirty() clears uptodate flag and tries to delete from lru, but fails. Reclaim process will put the hwpoisoned page back to lru. 2) The process that maps the hwpoisoned page exits, the page is deleted the page will never be freed and will be in the lru forever. 3) If we trigger a reclaim again and tries to reclaim the page, add_to_swap() will trigger VM_BUG_ON_FOLIO due to the uptodate flag is cleared.
To fix it, skip the hwpoisoned page in shrink_folio_list(). Besides, the hwpoison folio may not be unmapped by hwpoison_user_mappings() yet, unmap it in shrink_folio_list(), otherwise the folio will fail to be unmaped by hwpoison_user_mappings() since the folio isn't in lru list. (CVE-2025-37834)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37834
https://security-tracker.debian.org/tracker/CVE-2025-37834
https://ubuntu.com/security/CVE-2025-37834

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37834

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247144 - Linux Distros Unpatched Vulnerability : CVE-2025-37836
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- PCI: Fix reference leak in pci_register_host_bridge() If device_register() fails, call put_device() to give up the reference to avoid a memory leak, per the comment at device_register(). Found by code review.
[bhelgaas: squash Dan Carpenter's double free fix from https://lore.kernel.org/r/db806a6c-a91b-4e5a-a84b-6b7e01bdac85@stanley.mountain] (CVE-2025-37836)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37836
https://ubuntu.com/security/CVE-2025-37836

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37836

Plugin Information
Published: 2025/08/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246752 - Linux Distros Unpatched Vulnerability : CVE-2025-37837
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent() Two WARNINGs are observed when SMMU driver rolls back upon failure: arm- smmu-v3.9.auto: Failed to register iommu arm-smmu-v3.9.auto: probe with driver arm-smmu-v3 failed with error -22 ------------[ cut here ]------------ WARNING: CPU: 5 PID: 1 at kernel/dma/mapping.c:74 dmam_free_coherent+0xc0/0xd8 Call trace: dmam_free_coherent+0xc0/0xd8 (P) tegra241_vintf_free_lvcmdq+0x74/0x188 tegra241_cmdqv_remove_vintf+0x60/0x148 tegra241_cmdqv_remove+0x48/0xc8 arm_smmu_impl_remove+0x28/0x60 devm_action_release+0x1c/0x40 ------------[ cut here ]------------ 128 pages are still in use! WARNING: CPU: 16 PID: 1 at mm/page_alloc.c:6902 free_contig_range+0x18c/0x1c8 Call trace: free_contig_range+0x18c/0x1c8 (P) cma_release+0x154/0x2f0 dma_free_contiguous+0x38/0xa0 dma_direct_free+0x10c/0x248 dma_free_attrs+0x100/0x290 dmam_free_coherent+0x78/0xd8 tegra241_vintf_free_lvcmdq+0x74/0x160 tegra241_cmdqv_remove+0x98/0x198 arm_smmu_impl_remove+0x28/0x60 devm_action_release+0x1c/0x40 This is because the LVCMDQ queue memory are managed by devres, while that dmam_free_coherent() is called in the context of devm_action_release().
Jason pointed out that arm_smmu_impl_probe() has mis-ordered the devres callbacks if ops->device_remove() is going to be manually freeing things that probe allocated: https://lore.kernel.org/linux- iommu/20250407174408.GB1722458@nvidia.com/ In fact, tegra241_cmdqv_init_structures() only allocates memory resources which means any failure that it generates would be similar to -ENOMEM, so there is no point in having that falling back to standard SMMU routine, as the standard SMMU would likely fail to allocate memory too. Remove the unwind part in tegra241_cmdqv_init_structures(), and return a proper error code to ask SMMU driver to call tegra241_cmdqv_remove() via impl_ops->device_remove(). Then, drop tegra241_vintf_free_lvcmdq() since devres will take care of that. (CVE-2025-37837)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37837
https://ubuntu.com/security/CVE-2025-37837

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37837

Plugin Information
Published: 2025/08/09, Modified: 2025/11/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248656 - Linux Distros Unpatched Vulnerability : CVE-2025-37842
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- spi: fsl-qspi: use devm function instead of driver remove Driver use devm APIs to manage clk/irq/resources and register the spi controller, but the legacy remove function will be called first during device detach and trigger kernel panic. Drop the remove function and use devm_add_action_or_reset() for driver cleanup to ensure the release sequence. Trigger kernel panic on i.MX8MQ by echo 30bb0000.spi >/sys/bus/platform/drivers/fsl-quadspi/unbind (CVE-2025-37842)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37842
https://security-tracker.debian.org/tracker/CVE-2025-37842
https://ubuntu.com/security/CVE-2025-37842

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37842

Plugin Information
Published: 2025/08/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250263 - Linux Distros Unpatched Vulnerability : CVE-2025-37843
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: PCI: pciehp: Avoid unnecessary device replacement check Hot-removal of nested PCI hotplug ports suffers from a long-standing race condition which can lead to a deadlock: A parent hotplug port acquires pci_lock_rescan_remove(), then waits for pciehp to unbind from a child hotplug port. Meanwhile that child hotplug port tries to acquire pci_lock_rescan_remove() as well in order to remove its own children. The deadlock only occurs if the parent acquires pci_lock_rescan_remove() first, not if the child happens to acquire it first. Several workarounds to avoid the issue have been proposed and discarded over the years, e.g.:
https://lore.kernel.org/r/4c882e25194ba8282b78fe963fec8faae7cf23eb.1529173804.git.lukas@wunner.de/ A proper fix is being worked on, but needs more time as it is nontrivial and necessarily intrusive. Recent commit 9d573d19547b (PCI: pciehp: Detect device replacement during system sleep) provokes more frequent occurrence of the deadlock when removing more than one Thunderbolt device during system sleep. The commit sought to detect device replacement, but also triggered on device removal. Differentiating reliably between replacement and removal is impossible because pci_get_dsn() returns 0 both if the device was removed, as well as if it was replaced with one lacking a Device Serial Number. Avoid the more frequent occurrence of the deadlock by checking whether the hotplug port itself was hot-removed. If so, there's no sense in checking whether its child device was replaced. This works because the ->resume_noirq() callback is invoked in top-down order for the entire hierarchy: A parent hotplug port detecting device replacement (or removal) marks all children as removed using pci_dev_set_disconnected() and a child hotplug port can then reliably detect being removed. (CVE-2025-37843)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37843
https://ubuntu.com/security/CVE-2025-37843

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37843

Plugin Information
Published: 2025/08/15, Modified: 2025/11/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249812 - Linux Distros Unpatched Vulnerability : CVE-2025-37844
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cifs: avoid NULL pointer dereference in dbg call cifs_server_dbg() implies server to be non-NULL so move call under condition to avoid NULL pointer dereference. Found by Linux Verification Center (linuxtesting.org) with SVACE. (CVE-2025-37844)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37844
https://ubuntu.com/security/CVE-2025-37844

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37844

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249958 - Linux Distros Unpatched Vulnerability : CVE-2025-37848
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix PM related deadlocks in MS IOCTLs Prevent runtime resume/suspend while MS IOCTLs are in progress. Failed suspend will call ivpu_ms_cleanup() that would try to acquire file_priv->ms_lock, which is already held by the IOCTLs.
(CVE-2025-37848)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37848
https://ubuntu.com/security/CVE-2025-37848

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37848

Plugin Information
Published: 2025/08/15, Modified: 2025/11/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249930 - Linux Distros Unpatched Vulnerability : CVE-2025-37857
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: st: Fix array overflow in st_setup() Change the array size to follow parms size instead of a fixed value. (CVE-2025-37857)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37857
https://ubuntu.com/security/CVE-2025-37857

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37857

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244873 - Linux Distros Unpatched Vulnerability : CVE-2025-37859
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- page_pool: avoid infinite loop to schedule delayed worker We noticed the kworker in page_pool_release_retry() was waken up repeatedly and infinitely in production because of the buggy driver causing the inflight less than 0 and warning us in page_pool_inflight()[1]. Since the inflight value goes negative, it means we should not expect the whole page_pool to get back to work normally. This patch mitigates the adverse effect by not rescheduling the kworker when detecting the inflight negative in page_pool_release_retry(). [1] [Mon Feb 10 20:36:11 2025] ------------[ cut here ]------------ [Mon Feb 10 20:36:11 2025] Negative(-51446) inflight packet-pages ... [Mon Feb 10 20:36:11 2025] Call Trace: [Mon Feb 10 20:36:11 2025] page_pool_release_retry+0x23/0x70 [Mon Feb 10 20:36:11 2025] process_one_work+0x1b1/0x370 [Mon Feb 10 20:36:11 2025] worker_thread+0x37/0x3a0 [Mon Feb 10 20:36:11 2025] kthread+0x11a/0x140 [Mon Feb 10 20:36:11 2025] ? process_one_work+0x370/0x370 [Mon Feb 10 20:36:11 2025] ? __kthread_cancel_work+0x40/0x40 [Mon Feb 10 20:36:11 2025] ret_from_fork+0x35/0x40 [Mon Feb 10 20:36:11 2025] ---[ end trace ebffe800f33e7e34 ]--- Note: before this patch, the above calltrace would flood the dmesg due to repeated reschedule of release_dw kworker. (CVE-2025-37859)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37859
https://ubuntu.com/security/CVE-2025-37859

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37859

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247056 - Linux Distros Unpatched Vulnerability : CVE-2025-37860
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sfc: fix NULL dereferences in ef100_process_design_param() Since cited commit, ef100_probe_main() and hence also ef100_check_design_params() run before efx->net_dev is created; consequently, we cannot netif_set_tso_max_size() or _segs() at this point. Move those netif calls to ef100_probe_netdev(), and also replace netif_err within the design params code with pci_err. (CVE-2025-37860)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37860
https://security-tracker.debian.org/tracker/CVE-2025-37860
https://ubuntu.com/security/CVE-2025-37860

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37860

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243664 - Linux Distros Unpatched Vulnerability : CVE-2025-37862
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- HID: pidff: Fix null pointer dereference in pidff_find_fields This function triggered a null pointer dereference if used to search for a report that isn't implemented on the device. This happened both for optional and required reports alike. The same logic was applied to pidff_find_special_field and although pidff_init_fields should return an error earlier if one of the required reports is missing, future modifications could change this logic and resurface this possible null pointer dereference again. LKML bug report: https://lore.kernel.org/all/CAL-gK7f5=R0nrrQdPtaZZr1fd-cdAMbDMuZ_NLA8vM0SX+nGSw@mail.gmail.com (CVE-2025-37862)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37862
https://ubuntu.com/security/CVE-2025-37862

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37862

Plugin Information
Published: 2025/08/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250182 - Linux Distros Unpatched Vulnerability : CVE-2025-37867
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA/core: Silence oversized kvmalloc() warning syzkaller triggered an oversized kvmalloc() warning.
Silence it by adding __GFP_NOWARN. syzkaller log: WARNING: CPU: 7 PID: 518 at mm/util.c:665
__kvmalloc_node_noprof+0x175/0x180 CPU: 7 UID: 0 PID: 518 Comm: c_repro Not tainted 6.11.0-rc6+ #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:__kvmalloc_node_noprof+0x175/0x180 RSP: 0018:ffffc90001e67c10 EFLAGS: 00010246 RAX:
0000000000000100 RBX: 0000000000000400 RCX: ffffffff8149d46b RDX: 0000000000000000 RSI: ffff8881030fae80 RDI: 0000000000000002 RBP: 000000712c800000 R08: 0000000000000100 R09: 0000000000000000 R10:
ffffc90001e67c10 R11: 0030ae0601000000 R12: 0000000000000000 R13: 0000000000000000 R14: 00000000ffffffff R15: 0000000000000000 FS: 00007fde79159740(0000) GS:ffff88813bdc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000180 CR3: 0000000105eb4005 CR4: 00000000003706b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6:
00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ib_umem_odp_get+0x1f6/0x390 mlx5_ib_reg_user_mr+0x1e8/0x450 ib_uverbs_reg_mr+0x28b/0x440 ib_uverbs_write+0x7d3/0xa30 vfs_write+0x1ac/0x6c0 ksys_write+0x134/0x170 ? __sanitizer_cov_trace_pc+0x1c/0x50 do_syscall_64+0x50/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e (CVE-2025-37867)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37867
https://ubuntu.com/security/CVE-2025-37867

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37867

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243709 - Linux Distros Unpatched Vulnerability : CVE-2025-37873
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- eth: bnxt: fix missing ring index trim on error path Commit under Fixes converted tx_prod to be free running but missed masking it on the Tx error path. This crashes on error conditions, for example when DMA mapping fails. (CVE-2025-37873)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37873
https://ubuntu.com/security/CVE-2025-37873

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37873

Plugin Information
Published: 2025/08/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
253027 - Linux Distros Unpatched Vulnerability : CVE-2025-37875
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- igc: fix PTM cycle trigger logic Writing to clear the PTM status 'valid' bit while the PTM cycle is triggered results in unreliable PTM operation. To fix this, clear the PTM 'trigger' and status after each PTM transaction. The issue can be reproduced with the following: $ sudo phc2sys -R 1000 -O 0 -i tsn0 -m Note: 1000 Hz (-R 1000) is unrealistically large, but provides a way to quickly reproduce the issue.
PHC2SYS exits with: ioctl PTP_OFFSET_PRECISE: Connection timed out when the PTM transaction fails This patch also fixes a hang in igc_probe() when loading the igc driver in the kdump kernel on systems supporting PTM. The igc driver running in the base kernel enables PTM trigger in igc_probe(). Therefore the driver is always in PTM trigger mode, except in brief periods when manually triggering a PTM cycle.
When a crash occurs, the NIC is reset while PTM trigger is enabled. Due to a hardware problem, the NIC is subsequently in a bad busmaster state and doesn't handle register reads/writes. When running igc_probe() in the kdump kernel, the first register access to a NIC register hangs driver probing and ultimately breaks kdump. With this patch, igc has PTM trigger disabled most of the time, and the trigger is only enabled for very brief (10 - 100 us) periods when manually triggering a PTM cycle. Chances that a crash occurs during a PTM trigger are not 0, but extremely reduced. (CVE-2025-37875)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37875
https://ubuntu.com/security/CVE-2025-37875

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37875

Plugin Information
Published: 2025/08/20, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243826 - Linux Distros Unpatched Vulnerability : CVE-2025-37876
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS When testing a special config:
CONFIG_NETFS_SUPPORTS=y CONFIG_PROC_FS=n The system crashes with something like: [ 3.766197] ------------[ cut here ]------------ [ 3.766484] kernel BUG at mm/mempool.c:560! [ 3.766789] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 3.767123] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: G W [ 3.767777] Tainted: [W]=WARN [ 3.767968] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), [ 3.768523] RIP:
0010:mempool_alloc_slab.cold+0x17/0x19 [ 3.768847] Code: 50 fe ff 58 5b 5d 41 5c 41 5d 41 5e 41 5f e9 93 95 13 00 [ 3.769977] RSP: 0018:ffffc90000013998 EFLAGS: 00010286 [ 3.770315] RAX: 000000000000002f RBX:
ffff888100ba8640 RCX: 0000000000000000 [ 3.770749] RDX: 0000000000000000 RSI: 0000000000000003 RDI:
00000000ffffffff [ 3.771217] RBP: 0000000000092880 R08: 0000000000000000 R09: ffffc90000013828 [ 3.771664] R10: 0000000000000001 R11: 00000000ffffffea R12: 0000000000092cc0 [ 3.772117] R13: 0000000000000400 R14:
ffff8881004b1620 R15: ffffea0004ef7e40 [ 3.772554] FS: 0000000000000000(0000) GS:ffff8881b5f3c000(0000) knlGS:0000000000000000 [ 3.773061] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3.773443] CR2:
ffffffff830901b4 CR3: 0000000004296001 CR4: 0000000000770ef0 [ 3.773884] PKRU: 55555554 [ 3.774058] Call Trace: [ 3.774232] <TASK> [ 3.774371] mempool_alloc_noprof+0x6a/0x190 [ 3.774649] ? _printk+0x57/0x80 [ 3.774862] netfs_alloc_request+0x85/0x2ce [ 3.775147] netfs_readahead+0x28/0x170 [ 3.775395] read_pages+0x6c/0x350 [ 3.775623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 3.775928] page_cache_ra_unbounded+0x1bd/0x2a0 [ 3.776247] filemap_get_pages+0x139/0x970 [ 3.776510] ? srso_alias_return_thunk+0x5/0xfbef5 [ 3.776820] filemap_read+0xf9/0x580 [ 3.777054] ? srso_alias_return_thunk+0x5/0xfbef5 [ 3.777368] ? srso_alias_return_thunk+0x5/0xfbef5 [ 3.777674] ? find_held_lock+0x32/0x90 [ 3.777929] ? netfs_start_io_read+0x19/0x70 [ 3.778221] ? netfs_start_io_read+0x19/0x70 [ 3.778489] ? srso_alias_return_thunk+0x5/0xfbef5 [ 3.778800] ? lock_acquired+0x1e6/0x450 [ 3.779054] ? srso_alias_return_thunk+0x5/0xfbef5 [ 3.779379] netfs_buffered_read_iter+0x57/0x80 [ 3.779670] __kernel_read+0x158/0x2c0 [ 3.779927] bprm_execve+0x300/0x7a0 [ 3.780185] kernel_execve+0x10c/0x140 [ 3.780423] ? __pfx_kernel_init+0x10/0x10 [ 3.780690] kernel_init+0xd5/0x150 [ 3.780910] ret_from_fork+0x2d/0x50 [ 3.781156] ?
__pfx_kernel_init+0x10/0x10 [ 3.781414] ret_from_fork_asm+0x1a/0x30 [ 3.781677] </TASK> [ 3.781823] Modules linked in: [ 3.782065] ---[ end trace 0000000000000000 ]--- This is caused by the following error path in netfs_init(): if (!proc_mkdir(fs/netfs, NULL)) goto error_proc; Fix this by adding ifdef in netfs_main(), so that /proc/fs/netfs is only created with CONFIG_PROC_FS. (CVE-2025-37876)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37876
https://ubuntu.com/security/CVE-2025-37876

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37876

Plugin Information
Published: 2025/08/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245529 - Linux Distros Unpatched Vulnerability : CVE-2025-37877
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- iommu: Clear iommu-dma ops on cleanup If iommu_device_register() encounters an error, it can end up tearing down already-configured groups and default domains, however this currently still leaves devices hooked up to iommu-dma (and even historically the behaviour in this area was at best inconsistent across architectures/drivers...) Although in the case that an IOMMU is present whose driver has failed to probe, users cannot necessarily expect DMA to work anyway, it's still arguable that we should do our best to put things back as if the IOMMU driver was never there at all, and certainly the potential for crashing in iommu-dma itself is undesirable. Make sure we clean up the dev->dma_iommu flag along with everything else.
(CVE-2025-37877)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37877
https://ubuntu.com/security/CVE-2025-37877

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37877

Plugin Information
Published: 2025/08/07, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245957 - Linux Distros Unpatched Vulnerability : CVE-2025-37878
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init Move the get_ctx(child_ctx) call and the child_event->ctx assignment to occur immediately after the child event is allocated. Ensure that child_event->ctx is non-NULL before any subsequent error path within inherit_event calls free_event(), satisfying the assumptions of the cleanup code. Details: There's no clear Fixes tag, because this bug is a side-effect of multiple interacting commits over time (up to 15 years old), not a single regression. The code initially incremented refcount then assigned context immediately after the child_event was created.
Later, an early validity check for child_event was added before the refcount/assignment. Even later, a WARN_ON_ONCE() cleanup check was added, assuming event->ctx is valid if the pmu_ctx is valid. The problem is that the WARN_ON_ONCE() could trigger after the initial check passed but before child_event->ctx was assigned, violating its precondition. The solution is to assign child_event->ctx right after its initial validation. This ensures the context exists for any subsequent checks or cleanup routines, resolving the WARN_ON_ONCE(). To resolve it, defer the refcount update and child_event->ctx assignment directly after child_event->pmu_ctx is set but before checking if the parent event is orphaned. The cleanup routine depends on event->pmu_ctx being non-NULL before it verifies event->ctx is non-NULL. This also maintains the author's original intent of passing in child_ctx to find_get_pmu_context before its refcount/assignment. [ mingo: Expanded the changelog from another email by Gabriel Shahrouzi. ] (CVE-2025-37878)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37878
https://ubuntu.com/security/CVE-2025-37878

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37878

Plugin Information
Published: 2025/08/08, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248586 - Linux Distros Unpatched Vulnerability : CVE-2025-37883
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- s390/sclp: Add check for get_zeroed_page() Add check for the return value of get_zeroed_page() in sclp_console_init() to prevent null pointer dereference. Furthermore, to solve the memory leak caused by the loop allocation, add a free helper to do the free job. (CVE-2025-37883)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37883
https://security-tracker.debian.org/tracker/CVE-2025-37883
https://ubuntu.com/security/CVE-2025-37883

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37883

Plugin Information
Published: 2025/08/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246507 - Linux Distros Unpatched Vulnerability : CVE-2025-37884
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Fix deadlock between rcu_tasks_trace and event_mutex. Fix the following deadlock: CPU A _free_event() perf_kprobe_destroy() mutex_lock(&event_mutex) perf_trace_event_unreg() synchronize_rcu_tasks_trace() There are several paths where _free_event() grabs event_mutex and calls sync_rcu_tasks_trace. Above is one such case. CPU B bpf_prog_test_run_syscall() rcu_read_lock_trace() bpf_prog_run_pin_on_cpu() bpf_prog_load() bpf_tracing_func_proto() trace_set_clr_event() mutex_lock(&event_mutex) Delegate trace_set_clr_event() to workqueue to avoid such lock dependency. (CVE-2025-37884)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37884
https://ubuntu.com/security/CVE-2025-37884

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37884

Plugin Information
Published: 2025/08/09, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245489 - Linux Distros Unpatched Vulnerability : CVE-2025-37888
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() Add NULL check for mlx5_get_flow_namespace() returns in mlx5_create_inner_ttc_table() and mlx5_create_ttc_table() to prevent NULL pointer dereference.
(CVE-2025-37888)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37888
https://ubuntu.com/security/CVE-2025-37888

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37888

Plugin Information
Published: 2025/08/07, Modified: 2025/11/12
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244287 - Linux Distros Unpatched Vulnerability : CVE-2025-37889
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Consistently treat platform_max as control value This reverts commit 9bdd10d57a88 (ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min), and makes some additional related updates. There are two ways the platform_max could be interpreted; the maximum register value, or the maximum value the control can be set to. The patch moved from treating the value as a control value to a register one. When the patch was applied it was technically correct as snd_soc_limit_volume() also used the register interpretation.
However, even then most of the other usages treated platform_max as a control value, and snd_soc_limit_volume() has since been updated to also do so in commit fb9ad24485087 (ASoC: ops: add correct range check for limiting volume). That patch however, missed updating snd_soc_put_volsw() back to the control interpretation, and fixing snd_soc_info_volsw_range(). The control interpretation makes more sense as limiting is typically done from the machine driver, so it is appropriate to use the customer facing representation rather than the internal codec representation. Update all the code to consistently use this interpretation of platform_max. Finally, also add some comments to the soc_mixer_control struct to hopefully avoid further patches switching between the two approaches. (CVE-2025-37889)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37889
https://ubuntu.com/security/CVE-2025-37889

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37889

Plugin Information
Published: 2025/08/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248432 - Linux Distros Unpatched Vulnerability : CVE-2025-37895
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix error handling path in bnxt_init_chip() WARN_ON() is triggered in __flush_work() if bnxt_init_chip() fails because we call cancel_work_sync() on dim work that has not been initialized. WARNING: CPU: 37 PID: 5223 at kernel/workqueue.c:4201 __flush_work.isra.0+0x212/0x230 The driver relies on the BNXT_STATE_NAPI_DISABLED bit to check if dim work has already been cancelled. But in the bnxt_open() path, BNXT_STATE_NAPI_DISABLED is not set and this causes the error path to think that it needs to cancel the uninitalized dim work. Fix it by setting BNXT_STATE_NAPI_DISABLED during initialization. The bit will be cleared when we enable NAPI and initialize dim work. (CVE-2025-37895)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37895
https://ubuntu.com/security/CVE-2025-37895

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37895

Plugin Information
Published: 2025/08/11, Modified: 2025/11/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243713 - Linux Distros Unpatched Vulnerability : CVE-2025-37907
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- accel/ivpu: Fix locking order in ivpu_job_submit Fix deadlock in job submission and abort handling. When a thread aborts currently executing jobs due to a fault, it first locks the global lock protecting submitted_jobs (#1). After the last job is destroyed, it proceeds to release the related context and locks file_priv (#2). Meanwhile, in the job submission thread, the file_priv lock (#2) is taken first, and then the submitted_jobs lock (#1) is obtained when a job is added to the submitted jobs list. CPU0 CPU1 ----
---- (for example due to a fault) (jobs submissions keep coming) lock(&vdev->submitted_jobs_lock) #1 ivpu_jobs_abort_all() job_destroy() lock(&file_priv->lock) #2 lock(&vdev->submitted_jobs_lock) #1 file_priv_release() lock(&vdev->context_list_lock) lock(&file_priv->lock) #2 This order of locking causes a deadlock. To resolve this issue, change the order of locking in ivpu_job_submit(). (CVE-2025-37907)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37907
https://ubuntu.com/security/CVE-2025-37907

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37907

Plugin Information
Published: 2025/08/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260508 - Linux Distros Unpatched Vulnerability : CVE-2025-37911
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w When retrieving the FW coredump using ethtool, it can sometimes cause memory corruption: BUG: KFENCE: memory corruption in __bnxt_get_coredump+0x3ef/0x670 [bnxt_en] Corrupted memory at 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (in kfence-#45):
__bnxt_get_coredump+0x3ef/0x670 [bnxt_en] ethtool_get_dump_data+0xdc/0x1a0 __dev_ethtool+0xa1e/0x1af0 dev_ethtool+0xa8/0x170 dev_ioctl+0x1b5/0x580 sock_do_ioctl+0xab/0xf0 sock_ioctl+0x1ce/0x2e0
__x64_sys_ioctl+0x87/0xc0 do_syscall_64+0x5c/0xf0 entry_SYSCALL_64_after_hwframe+0x78/0x80 ... This happens when copying the coredump segment list in bnxt_hwrm_dbg_dma_data() with the HWRM_DBG_COREDUMP_LIST FW command. The info->dest_buf buffer is allocated based on the number of coredump segments returned by the FW. The segment list is then DMA'ed by the FW and the length of the DMA is returned by FW. The driver then copies this DMA'ed segment list to info->dest_buf. In some cases, this DMA length may exceed the info->dest_buf length and cause the above BUG condition. Fix it by capping the copy length to not exceed the length of info->dest_buf. The extra DMA data contains no useful information. This code path is shared for the HWRM_DBG_COREDUMP_LIST and the HWRM_DBG_COREDUMP_RETRIEVE FW commands. The buffering is different for these 2 FW commands. To simplify the logic, we need to move the line to adjust the buffer length for HWRM_DBG_COREDUMP_RETRIEVE up, so that the new check to cap the copy length will work for both commands.
(CVE-2025-37911)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37911
https://security-tracker.debian.org/tracker/CVE-2025-37911
https://ubuntu.com/security/CVE-2025-37911

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37911

Plugin Information
Published: 2025/09/02, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244521 - Linux Distros Unpatched Vulnerability : CVE-2025-37912
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() As mentioned in the commit baeb705fd6a7 (ice:
always check VF VSI pointer values), we need to perform a null pointer check on the return value of ice_get_vf_vsi() before using it. (CVE-2025-37912)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37912
https://ubuntu.com/security/CVE-2025-37912

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37912

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248889 - Linux Distros Unpatched Vulnerability : CVE-2025-37918
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() A NULL pointer dereference can occur in skb_dequeue() when processing a QCA firmware crash dump on WCN7851 (0489:e0f3). [ 93.672166] Bluetooth:
hci0: ACL memdump size(589824) [ 93.672475] BUG: kernel NULL pointer dereference, address:
0000000000000008 [ 93.672517] Workqueue: hci0 hci_devcd_rx [bluetooth] [ 93.672598] RIP:
0010:skb_dequeue+0x50/0x80 The issue stems from handle_dump_pkt_qca() returning 0 even when a dump packet is successfully processed. This is because it incorrectly forwards the return value of hci_devcd_init() (which returns 0 on success). As a result, the caller (btusb_recv_acl_qca() or btusb_recv_evt_qca()) assumes the packet was not handled and passes it to hci_recv_frame(), leading to premature kfree() of the skb. Later, hci_devcd_rx() attempts to dequeue the same skb from the dump queue, resulting in a NULL pointer dereference. Fix this by: 1. Making handle_dump_pkt_qca() return 0 on success and negative errno on failure, consistent with kernel conventions. 2. Splitting dump packet detection into separate functions for ACL and event packets for better structure and readability. This ensures dump packets are properly identified and consumed, avoiding double handling and preventing NULL pointer access. (CVE-2025-37918)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37918
https://ubuntu.com/security/CVE-2025-37918

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37918

Plugin Information
Published: 2025/08/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248761 - Linux Distros Unpatched Vulnerability : CVE-2025-37919
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot Update chip data using dev_get_drvdata(dev->parent) to fix NULL pointer deref in acp_i2s_set_tdm_slot. (CVE-2025-37919)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37919
https://ubuntu.com/security/CVE-2025-37919

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37919

Plugin Information
Published: 2025/08/12, Modified: 2025/11/12
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249081 - Linux Distros Unpatched Vulnerability : CVE-2025-37920
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xsk: Fix race condition in AF_XDP generic RX path Move rx_lock from xsk_socket to xsk_buff_pool. Fix synchronization for shared umem mode in generic RX path where multiple sockets share single xsk_buff_pool.
RX queue is exclusive to xsk_socket, while FILL queue can be shared between multiple sockets. This could result in race condition where two CPU cores access RX path of two different sockets sharing the same umem. Protect both queues by acquiring spinlock in shared xsk_buff_pool. Lock contention may be minimized in the future by some per-thread FQ buffering. It's safe and necessary to move spin_lock_bh(rx_lock) after xsk_rcv_check(): * xs->pool and spinlock_init is synchronized by xsk_bind() -> xsk_is_bound() memory barriers. * xsk_rcv_check() may return true at the moment of xsk_release() or xsk_unbind_dev(), however this will not cause any data races or race conditions. xsk_unbind_dev() removes xdp socket from all maps and waits for completion of all outstanding rx operations. Packets in RX path will either complete safely or drop. (CVE-2025-37920)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37920
https://security-tracker.debian.org/tracker/CVE-2025-37920
https://ubuntu.com/security/CVE-2025-37920

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37920

Plugin Information
Published: 2025/08/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247402 - Linux Distros Unpatched Vulnerability : CVE-2025-37922
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE A vmemmap altmap is a device-provided region used to provide backing storage for struct pages. For each namespace, the altmap should belong to that same namespace. If the namespaces are created unaligned, there is a chance that the section vmemmap start address could also be unaligned. If the section vmemmap start address is unaligned, the altmap page allocated from the current namespace might be used by the previous namespace also. During the free operation, since the altmap is shared between two namespaces, the previous namespace may detect that the page does not belong to its altmap and incorrectly assume that the page is a normal page. It then attempts to free the normal page, which leads to a kernel crash. Kernel attempted to read user page (18) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x00000018 Faulting instruction address:
0xc000000000530c7c Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries CPU: 32 PID: 2104 Comm: ndctl Kdump: loaded Tainted: G W NIP: c000000000530c7c LR: c000000000530e00 CTR: 0000000000007ffe REGS: c000000015e57040 TRAP: 0300 Tainted: G W MSR:
800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 84482404 CFAR: c000000000530dfc DAR:
0000000000000018 DSISR: 40000000 IRQMASK: 0 GPR00: c000000000530e00 c000000015e572e0 c000000002c5cb00 c00c000101008040 GPR04: 0000000000000000 0000000000000007 0000000000000001 000000000000001f GPR08:
0000000000000005 0000000000000000 0000000000000018 0000000000002000 GPR12: c0000000001d2fb0 c0000060de6b0080 0000000000000000 c0000060dbf90020 GPR16: c00c000101008000 0000000000000001 0000000000000000 c000000125b20f00 GPR20: 0000000000000001 0000000000000000 ffffffffffffffff c00c000101007fff GPR24: 0000000000000001 0000000000000000 0000000000000000 0000000000000000 GPR28:
0000000004040201 0000000000000001 0000000000000000 c00c000101008040 NIP [c000000000530c7c] get_pfnblock_flags_mask+0x7c/0xd0 LR [c000000000530e00] free_unref_page_prepare+0x130/0x4f0 Call Trace:
free_unref_page+0x50/0x1e0 free_reserved_page+0x40/0x68 free_vmemmap_pages+0x98/0xe0 remove_pte_table+0x164/0x1e8 remove_pmd_table+0x204/0x2c8 remove_pud_table+0x1c4/0x288 remove_pagetable+0x1c8/0x310 vmemmap_free+0x24/0x50 section_deactivate+0x28c/0x2a0
__remove_pages+0x84/0x110 arch_remove_memory+0x38/0x60 memunmap_pages+0x18c/0x3d0 devm_action_release+0x30/0x50 release_nodes+0x68/0x140 devres_release_group+0x100/0x190 dax_pmem_compat_release+0x44/0x80 [dax_pmem_compat] device_for_each_child+0x8c/0x100 [dax_pmem_compat_remove+0x2c/0x50 [dax_pmem_compat] nvdimm_bus_remove+0x78/0x140 [libnvdimm] device_remove+0x70/0xd0 Another issue is that if there is no altmap, a PMD-sized vmemmap page will be allocated from RAM, regardless of the alignment of the section start address. If the section start address is not aligned to the PMD size, a VM_BUG_ON will be triggered when setting the PMD-sized page to page table. In this patch, we are aligning the section vmemmap start address to PAGE_SIZE. After alignment, the start address will not be part of the current namespace, and a normal page will be allocated for the vmemmap mapping of the current section. For the remaining sections, altmaps will be allocated. During the free operation, the normal page will be correctly freed. In the same way, a PMD_SIZE vmemmap page will be allocated only if the section start address is PMD_SIZE-aligned; otherwise, it will fall back to a PAGE- sized vmemmap allocation. Without this patch ================== NS1 start NS2 start
_________________________________________________________ | NS1 | NS2 |
--------------------------------------------------------- | Altmap| Altmap | .....|Altmap| Altmap | ........... | NS1 | NS1 ---truncated--- (CVE-2025-37922)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37922
https://ubuntu.com/security/CVE-2025-37922

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37922

Plugin Information
Published: 2025/08/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260499 - Linux Distros Unpatched Vulnerability : CVE-2025-37932
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sch_htb: make htb_qlen_notify() idempotent htb_qlen_notify() always deactivates the HTB class and in fact could trigger a warning if it is already deactivated. Therefore, it is not idempotent and not friendly to its callers, like fq_codel_dequeue(). Let's make it idempotent to ease qdisc_tree_reduce_backlog() callers' life. (CVE-2025-37932)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37932
https://ubuntu.com/security/CVE-2025-37932

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37932

Plugin Information
Published: 2025/09/02, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247048 - Linux Distros Unpatched Vulnerability : CVE-2025-37933
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- octeon_ep: Fix host hang issue during device reboot When the host loses heartbeat messages from the device, the driver calls the device-specific ndo_stop function, which frees the resources. If the driver is unloaded in this scenario, it calls ndo_stop again, attempting to free resources that have already been freed, leading to a host hang issue. To resolve this, dev_close should be called instead of the device- specific stop function.dev_close internally calls ndo_stop to stop the network interface and performs additional cleanup tasks. During the driver unload process, if the device is already down, ndo_stop is not called. (CVE-2025-37933)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37933
https://ubuntu.com/security/CVE-2025-37933

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37933

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248222 - Linux Distros Unpatched Vulnerability : CVE-2025-37936
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. When generating the MSR_IA32_PEBS_ENABLE value that will be loaded on VM-Entry to a KVM guest, mask the value with the vCPU's desired PEBS_ENABLE value. Consulting only the host kernel's host vs. guest masks results in running the guest with PEBS enabled even when the guest doesn't want to use PEBS. Because KVM uses perf events to proxy the guest virtual PMU, simply looking at exclude_host can't differentiate between events created by host userspace, and events created by KVM on behalf of the guest. Running the guest with PEBS unexpectedly enabled typically manifests as crashes due to a near-infinite stream of #PFs. E.g. if the guest hasn't written MSR_IA32_DS_AREA, the CPU will hit page faults on address '0' when trying to record PEBS events.
The issue is most easily reproduced by running `perf kvm top` from before commit 7b100989b4f6 (perf evlist: Remove __evlist__add_default) (after which, `perf kvm top` effectively stopped using PEBS). The userspace side of perf creates a guest-only PEBS event, which intel_guest_get_msrs() misconstrues a guest-*owned* PEBS event. Arguably, this is a userspace bug, as enabling PEBS on guest-only events simply cannot work, and userspace can kill VMs in many other ways (there is no danger to the host). However, even if this is considered to be bad userspace behavior, there's zero downside to perf/KVM restricting PEBS to guest-owned events. Note, commit 854250329c02 (KVM: x86/pmu: Disable guest PEBS temporarily in two rare situations) fixed the case where host userspace is profiling KVM *and* userspace, but missed the case where userspace is profiling only KVM. (CVE-2025-37936)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37936
https://ubuntu.com/security/CVE-2025-37936

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.0 (CVSS2#AV:L/AC:H/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37936

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246961 - Linux Distros Unpatched Vulnerability : CVE-2025-37945
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY DSA has 2 kinds of drivers: 1. Those who call dsa_switch_suspend() and dsa_switch_resume() from their device PM ops:
qca8k-8xxx, bcm_sf2, microchip ksz 2. Those who don't: all others. The above methods should be optional.
For type 1, dsa_switch_suspend() calls dsa_user_suspend() -> phylink_stop(), and dsa_switch_resume() calls dsa_user_resume() -> phylink_start(). These seem good candidates for setting mac_managed_pm = true because that is essentially its definition [1], but that does not seem to be the biggest problem for now, and is not what this change focuses on. Talking strictly about the 2nd category of DSA drivers here (which do not have MAC managed PM, meaning that for their attached PHYs, mdio_bus_phy_suspend() and mdio_bus_phy_resume() should run in full), I have noticed that the following warning from mdio_bus_phy_resume() is triggered: WARN_ON(phydev->state != PHY_HALTED && phydev->state != PHY_READY &&
phydev->state != PHY_UP); because the PHY state machine is running. It's running as a result of a previous dsa_user_open() -> ... -> phylink_start() -> phy_start() having been initiated by the user. The previous mdio_bus_phy_suspend() was supposed to have called phy_stop_machine(), but it didn't. So this is why the PHY is in state PHY_NOLINK by the time mdio_bus_phy_resume() runs. mdio_bus_phy_suspend() did not call phy_stop_machine() because for phylink, the phydev->adjust_link function pointer is NULL. This seems a technicality introduced by commit fddd91016d16 (phylib: fix PAL state machine restart on resume). That commit was written before phylink existed, and was intended to avoid crashing with consumer drivers which don't use the PHY state machine - phylink always does, when using a PHY. But phylink itself has historically not been developed with suspend/resume in mind, and apparently not tested too much in that scenario, allowing this bug to exist unnoticed for so long. Plus, prior to the WARN_ON(), it would have likely been invisible. This issue is not in fact restricted to type 2 DSA drivers (according to the above ad-hoc classification), but can be extrapolated to any MAC driver with phylink and MDIO-bus-managed PHY PM ops. DSA is just where the issue was reported. Assuming mac_managed_pm is set correctly, a quick search indicates the following other drivers might be affected: $ grep -Zlr PHYLINK_NETDEV drivers/ | xargs -0 grep -L mac_managed_pm drivers/net/ethernet/atheros/ag71xx.c drivers/net/ethernet/microchip/sparx5/sparx5_main.c drivers/net/ethernet/microchip/lan966x/lan966x_main.c drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c drivers/net/ethernet/freescale/dpaa/dpaa_eth.c drivers/net/ethernet/freescale/ucc_geth.c drivers/net/ethernet/freescale/enetc/enetc_pf_common.c drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c drivers/net/ethernet/marvell/mvneta.c drivers/net/ethernet/marvell/prestera/prestera_main.c drivers/net/ethernet/mediatek/mtk_eth_soc.c drivers/net/ethernet/altera/altera_tse_main.c drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c drivers/net/ethernet/meta/fbnic/fbnic_phylink.c drivers/net/ethernet/tehuti/tn40_phy.c drivers/net/ethernet/mscc/ocelot_net.c Make the existing conditions dependent on the PHY device having a phydev->phy_link_change() implementation equal to the default phy_link_change() provided by phylib. Otherwise, we implicitly know that the phydev has the phylink- provided phylink_phy_change() callback, and when phylink is used, the PHY state machine always needs to be stopped/ started on the suspend/resume path. The code is structured as such that if phydev->phy_link_change() is absent, it is a matter of time until the kernel will crash - no need to further complicate the test. Thus, for the situation where the PM is not managed b ---truncated--- (CVE-2025-37945)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37945
https://security-tracker.debian.org/tracker/CVE-2025-37945
https://ubuntu.com/security/CVE-2025-37945

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37945

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246936 - Linux Distros Unpatched Vulnerability : CVE-2025-37949
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xenbus: Use kref to track req lifetime Marek reported seeing a NULL pointer fault in the xenbus_thread callstack: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP:
e030:__wake_up_common+0x4c/0x180 Call Trace: <TASK> __wake_up_common_lock+0x82/0xd0 process_msg+0x18e/0x2f0 xenbus_thread+0x165/0x1c0 process_msg+0x18e is req->cb(req). req->cb is set to xs_wake_up(), a thin wrapper around wake_up(), or xenbus_dev_queue_reply(). It seems like it was xs_wake_up() in this case. It seems like req may have woken up the xs_wait_for_reply(), which kfree()ed the req. When xenbus_thread resumes, it faults on the zero-ed data. Linux Device Drivers 2nd edition states: Normally, a wake_up call can cause an immediate reschedule to happen, meaning that other processes might run before wake_up returns. ... which would match the behaviour observed. Change to keeping two krefs on each request. One for the caller, and one for xenbus_thread. Each will kref_put() when finished, and the last will free it. This use of kref matches the description in Documentation/core- api/kref.rst (CVE-2025-37949)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37949
https://ubuntu.com/security/CVE-2025-37949

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37949

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245354 - Linux Distros Unpatched Vulnerability : CVE-2025-37954
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smb: client: Avoid race in open_cached_dir with lease breaks A pre-existing valid cfid returned from find_or_create_cached_dir might race with a lease break, meaning open_cached_dir doesn't consider it valid, and thinks it's newly-constructed. This leaks a dentry reference if the allocation occurs before the queued lease break work runs. Avoid the race by extending holding the cfid_list_lock across find_or_create_cached_dir and when the result is checked. (CVE-2025-37954)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37954
https://ubuntu.com/security/CVE-2025-37954

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37954

Plugin Information
Published: 2025/08/07, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245325 - Linux Distros Unpatched Vulnerability : CVE-2025-37960
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- memblock: Accept allocated memory before use in memblock_double_array() When increasing the array size in memblock_double_array() and the slab is not yet available, a call to memblock_find_in_range() is used to reserve/allocate memory. However, the range returned may not have been accepted, which can result in a crash when booting an SNP guest: RIP: 0010:memcpy_orig+0x68/0x130 Code: ... RSP: 0000:ffffffff9cc03ce8 EFLAGS: 00010006 RAX: ff11001ff83e5000 RBX: 0000000000000000 RCX: fffffffffffff000 RDX: 0000000000000bc0 RSI: ffffffff9dba8860 RDI: ff11001ff83e5c00 RBP: 0000000000002000 R08: 0000000000000000 R09:
0000000000002000 R10: 000000207fffe000 R11: 0000040000000000 R12: ffffffff9d06ef78 R13: ff11001ff83e5000 R14: ffffffff9dba7c60 R15: 0000000000000c00 memblock_double_array+0xff/0x310 memblock_add_range+0x1fb/0x2f0 memblock_reserve+0x4f/0xa0 memblock_alloc_range_nid+0xac/0x130 memblock_alloc_internal+0x53/0xc0 memblock_alloc_try_nid+0x3d/0xa0 swiotlb_init_remap+0x149/0x2f0 mem_init+0xb/0xb0 mm_core_init+0x8f/0x350 start_kernel+0x17e/0x5d0 x86_64_start_reservations+0x14/0x30 x86_64_start_kernel+0x92/0xa0 secondary_startup_64_no_verify+0x194/0x19b Mitigate this by calling accept_memory() on the memory range returned before the slab is available. Prior to v6.12, the accept_memory() interface used a 'start' and 'end' parameter instead of 'start' and 'size', therefore the accept_memory() call must be adjusted to specify 'start + size' for 'end' when applying to kernels prior to v6.12. (CVE-2025-37960)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37960
https://ubuntu.com/security/CVE-2025-37960

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37960

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244495 - Linux Distros Unpatched Vulnerability : CVE-2025-37961
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipvs: fix uninit-value for saddr in do_output_route4 syzbot reports for uninit-value for the saddr argument [1]. commit 4754957f04f5 (ipvs: do not use random local source address for tunnels) already implies that the input value of saddr should be ignored but the code is still reading it which can prevent to connect the route. Fix it by changing the argument to ret_saddr. [1] BUG: KMSAN: uninit-value in do_output_route4+0x42c/0x4d0 net/netfilter/ipvs/ip_vs_xmit.c:147 do_output_route4+0x42c/0x4d0 net/netfilter/ipvs/ip_vs_xmit.c:147 __ip_vs_get_out_rt+0x403/0x21d0 net/netfilter/ipvs/ip_vs_xmit.c:330 ip_vs_tunnel_xmit+0x205/0x2380 net/netfilter/ipvs/ip_vs_xmit.c:1136 ip_vs_in_hook+0x1aa5/0x35b0 net/netfilter/ipvs/ip_vs_core.c:2063 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf7/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline]
__ip_local_out+0x758/0x7e0 net/ipv4/ip_output.c:118 ip_local_out net/ipv4/ip_output.c:127 [inline] ip_send_skb+0x6a/0x3c0 net/ipv4/ip_output.c:1501 udp_send_skb+0xfda/0x1b70 net/ipv4/udp.c:1195 udp_sendmsg+0x2fe3/0x33c0 net/ipv4/udp.c:1483 inet_sendmsg+0x1fc/0x280 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x267/0x380 net/socket.c:727
____sys_sendmsg+0x91b/0xda0 net/socket.c:2566 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2620
__sys_sendmmsg+0x41d/0x880 net/socket.c:2702 __compat_sys_sendmmsg net/compat.c:360 [inline]
__do_compat_sys_sendmmsg net/compat.c:367 [inline] __se_compat_sys_sendmmsg net/compat.c:364 [inline]
__ia32_compat_sys_sendmmsg+0xc8/0x140 net/compat.c:364 ia32_sys_call+0x3ffa/0x41f0 arch/x86/include/generated/asm/syscalls_32.h:346 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/syscall_32.c:306 do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:369 entry_SYSENTER_compat_after_hwframe+0x84/0x8e Uninit was created at: slab_post_alloc_hook mm/slub.c:4167 [inline] slab_alloc_node mm/slub.c:4210 [inline] __kmalloc_cache_noprof+0x8fa/0xe00 mm/slub.c:4367 kmalloc_noprof include/linux/slab.h:905 [inline] ip_vs_dest_dst_alloc net/netfilter/ipvs/ip_vs_xmit.c:61 [inline] __ip_vs_get_out_rt+0x35d/0x21d0 net/netfilter/ipvs/ip_vs_xmit.c:323 ip_vs_tunnel_xmit+0x205/0x2380 net/netfilter/ipvs/ip_vs_xmit.c:1136 ip_vs_in_hook+0x1aa5/0x35b0 net/netfilter/ipvs/ip_vs_core.c:2063 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf7/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline]
__ip_local_out+0x758/0x7e0 net/ipv4/ip_output.c:118 ip_local_out net/ipv4/ip_output.c:127 [inline] ip_send_skb+0x6a/0x3c0 net/ipv4/ip_output.c:1501 udp_send_skb+0xfda/0x1b70 net/ipv4/udp.c:1195 udp_sendmsg+0x2fe3/0x33c0 net/ipv4/udp.c:1483 inet_sendmsg+0x1fc/0x280 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x267/0x380 net/socket.c:727
____sys_sendmsg+0x91b/0xda0 net/socket.c:2566 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2620
__sys_sendmmsg+0x41d/0x880 net/socket.c:2702 __compat_sys_sendmmsg net/compat.c:360 [inline]
__do_compat_sys_sendmmsg net/compat.c:367 [inline] __se_compat_sys_sendmmsg net/compat.c:364 [inline]
__ia32_compat_sys_sendmmsg+0xc8/0x140 net/compat.c:364 ia32_sys_call+0x3ffa/0x41f0 arch/x86/include/generated/asm/syscalls_32.h:346 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/syscall_32.c:306 do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:369 entry_SYSENTER_compat_after_hwframe+0x84/0x8e CPU: 0 UID: 0 PID: 22408 Comm: syz.4.5165 Not tainted 6.15.0-rc3-syzkaller-00019-gbc3372351d0c #0 PREEMPT(undef) Hardware name: Google Google Compute Engi
---truncated--- (CVE-2025-37961)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37961
https://security-tracker.debian.org/tracker/CVE-2025-37961
https://ubuntu.com/security/CVE-2025-37961

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37961

Plugin Information
Published: 2025/08/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248635 - Linux Distros Unpatched Vulnerability : CVE-2025-37967
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: typec: ucsi: displayport: Fix deadlock This patch introduces the ucsi_con_mutex_lock / ucsi_con_mutex_unlock functions to the UCSI driver. ucsi_con_mutex_lock ensures the connector mutex is only locked if a connection is established and the partner pointer is valid. This resolves a deadlock scenario where ucsi_displayport_remove_partner holds con->mutex waiting for dp_altmode_work to complete while dp_altmode_work attempts to acquire it. (CVE-2025-37967)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37967
https://security-tracker.debian.org/tracker/CVE-2025-37967
https://ubuntu.com/security/CVE-2025-37967

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37967

Plugin Information
Published: 2025/08/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247022 - Linux Distros Unpatched Vulnerability : CVE-2025-37974
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix missing check for zpci_create_device() error return The zpci_create_device() function returns an error pointer that needs to be checked before dereferencing it as a struct zpci_dev pointer. Add the missing check in __clp_add() where it was missed when adding the scan_list in the fixed commit. Simply not adding the device to the scan list results in the previous behavior. (CVE-2025-37974)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37974
https://ubuntu.com/security/CVE-2025-37974

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37974

Plugin Information
Published: 2025/08/09, Modified: 2025/11/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248912 - Linux Distros Unpatched Vulnerability : CVE-2025-37978
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- block: integrity: Do not call set_page_dirty_lock() Placing multiple protection information buffers inside the same page can lead to oopses because set_page_dirty_lock() can't be called from interrupt context.
Since a protection information buffer is not backed by a file there is no point in setting its page dirty, there is nothing to synchronize. Drop the call to set_page_dirty_lock() and remove the last argument to bio_integrity_unpin_bvec(). (CVE-2025-37978)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37978
https://ubuntu.com/security/CVE-2025-37978

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37978

Plugin Information
Published: 2025/08/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244275 - Linux Distros Unpatched Vulnerability : CVE-2025-37980
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- block: fix resource leak in blk_register_queue() error path When registering a queue fails after blk_mq_sysfs_register() is successful but the function later encounters an error, we need to clean up the blk_mq_sysfs resources. Add the missing blk_mq_sysfs_unregister() call in the error path to properly clean up these resources and prevent a memory leak. (CVE-2025-37980)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37980
https://security-tracker.debian.org/tracker/CVE-2025-37980
https://ubuntu.com/security/CVE-2025-37980

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37980

Plugin Information
Published: 2025/08/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246461 - Linux Distros Unpatched Vulnerability : CVE-2025-37984
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() Herbert notes that DIV_ROUND_UP() may overflow unnecessarily if an ecdsa implementation's ->key_size() callback returns an unusually large value. Herbert instead suggests (for a division by 8): X / 8 + !!(X & 7) Based on this formula, introduce a generic DIV_ROUND_UP_POW2() macro and use it in lieu of DIV_ROUND_UP() for ->key_size() return values.
Additionally, use the macro in ecc_digits_from_bytes(), whose nbytes parameter is a ->key_size() return value in some instances, or a user-specified ASN.1 length in the case of ecdsa_get_signature_rs().
(CVE-2025-37984)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37984
https://ubuntu.com/security/CVE-2025-37984

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37984

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246341 - Linux Distros Unpatched Vulnerability : CVE-2025-37985
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- USB: wdm: close race between wdm_open and wdm_wwan_port_stop Clearing WDM_WWAN_IN_USE must be the last action or we can open a chardev whose URBs are still poisoned (CVE-2025-37985)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37985
https://ubuntu.com/security/CVE-2025-37985

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37985

Plugin Information
Published: 2025/08/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249834 - Linux Distros Unpatched Vulnerability : CVE-2025-37986
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: typec: class: Invalidate USB device pointers on partner unregistration To avoid using invalid USB device pointers after a Type-C partner disconnects, this patch clears the pointers upon partner unregistration. This ensures a clean state for future connections. (CVE-2025-37986)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37986
https://ubuntu.com/security/CVE-2025-37986

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37986

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245600 - Linux Distros Unpatched Vulnerability : CVE-2025-37989
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: phy: leds: fix memory leak A network restart test on a router led to an out-of-memory condition, which was traced to a memory leak in the PHY LED trigger code. The root cause is misuse of the devm API.
The registration function (phy_led_triggers_register) is called from phy_attach_direct, not phy_probe, and the unregister function (phy_led_triggers_unregister) is called from phy_detach, not phy_remove. This means the register and unregister functions can be called multiple times for the same PHY device, but devm-allocated memory is not freed until the driver is unbound. This also prevents kmemleak from detecting the leak, as the devm API internally stores the allocated pointer. Fix this by replacing devm_kzalloc/devm_kcalloc with standard kzalloc/kcalloc, and add the corresponding kfree calls in the unregister path. (CVE-2025-37989)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37989
https://ubuntu.com/security/CVE-2025-37989

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37989

Plugin Information
Published: 2025/08/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247059 - Linux Distros Unpatched Vulnerability : CVE-2025-37992
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net_sched: Flush gso_skb list too during ->change() Previously, when reducing a qdisc's limit via the
->change() operation, only the main skb queue was trimmed, potentially leaving packets in the gso_skb list. This could result in NULL pointer dereference when we only check sch->limit against sch->q.qlen.
This patch introduces a new helper, qdisc_dequeue_internal(), which ensures both the gso_skb list and the main queue are properly flushed when trimming excess packets. All relevant qdiscs (codel, fq, fq_codel, fq_pie, hhf, pie) are updated to use this helper in their ->change() routines. (CVE-2025-37992)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37992
https://ubuntu.com/security/CVE-2025-37992

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37992

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248139 - Linux Distros Unpatched Vulnerability : CVE-2025-37995
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- module: ensure that kobject_put() is safe for module type kobjects In 'lookup_or_create_module_kobject()', an internal kobject is created using 'module_ktype'. So call to 'kobject_put()' on error handling path causes an attempt to use an uninitialized completion pointer in 'module_kobject_release()'. In this scenario, we just want to release kobject without an extra synchronization required for a regular module unloading process, so adding an extra check whether 'complete()' is actually required makes 'kobject_put()' safe. (CVE-2025-37995)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37995
https://ubuntu.com/security/CVE-2025-37995

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37995

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250109 - Linux Distros Unpatched Vulnerability : CVE-2025-37997
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix region locking in hash types Region locking introduced in v5.6-rc4 contained three macros to handle the region locks:
ahash_bucket_start(), ahash_bucket_end() which gave back the start and end hash bucket values belonging to a given region lock and ahash_region() which should give back the region lock belonging to a given hash bucket. The latter was incorrect which can lead to a race condition between the garbage collector and adding new elements when a hash type of set is defined with timeouts. (CVE-2025-37997)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37997
https://ubuntu.com/security/CVE-2025-37997

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37997

Plugin Information
Published: 2025/08/15, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250203 - Linux Distros Unpatched Vulnerability : CVE-2025-38010
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking The current implementation uses bias_pad_enable as a reference count to manage the shared bias pad for all UTMI PHYs. However, during system suspension with connected USB devices, multiple power-down requests for the UTMI pad result in a mismatch in the reference count, which in turn produces warnings such as: [ 237.762967] WARNING: CPU: 10 PID: 1618 at tegra186_utmi_pad_power_down+0x160/0x170 [ 237.763103] Call trace: [ 237.763104] tegra186_utmi_pad_power_down+0x160/0x170 [ 237.763107] tegra186_utmi_phy_power_off+0x10/0x30 [ 237.763110] phy_power_off+0x48/0x100 [ 237.763113] tegra_xusb_enter_elpg+0x204/0x500 [ 237.763119] tegra_xusb_suspend+0x48/0x140 [ 237.763122] platform_pm_suspend+0x2c/0xb0 [ 237.763125] dpm_run_callback.isra.0+0x20/0xa0 [ 237.763127] __device_suspend+0x118/0x330 [ 237.763129] dpm_suspend+0x10c/0x1f0 [ 237.763130] dpm_suspend_start+0x88/0xb0 [ 237.763132] suspend_devices_and_enter+0x120/0x500 [ 237.763135] pm_suspend+0x1ec/0x270 The root cause was traced back to the dynamic power-down changes introduced in commit a30951d31b25 (xhci: tegra: USB2 pad power controls), where the UTMI pad was being powered down without verifying its current state. This unbalanced behavior led to discrepancies in the reference count. To rectify this issue, this patch replaces the single reference counter with a bitmask, renamed to utmi_pad_enabled. Each bit in the mask corresponds to one of the four USB2 PHYs, allowing us to track each pad's enablement status individually. With this change: - The bias pad is powered on only when the mask is clear. - Each UTMI pad is powered on or down based on its corresponding bit in the mask, preventing redundant operations. - The overall power state of the shared bias pad is maintained correctly during suspend/resume cycles. The mutex used to prevent race conditions during UTMI pad enable/disable operations has been moved from the tegra186_utmi_bias_pad_power_on/off functions to the parent functions tegra186_utmi_pad_power_on/down.
This change ensures that there are no race conditions when updating the bitmask. (CVE-2025-38010)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38010
https://ubuntu.com/security/CVE-2025-38010

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38010

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245450 - Linux Distros Unpatched Vulnerability : CVE-2025-38014
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dmaengine: idxd: Refactor remove call with idxd_cleanup() helper The idxd_cleanup() helper cleans up perfmon, interrupts, internals and so on. Refactor remove call with the idxd_cleanup() helper to avoid code duplication. Note, this also fixes the missing put_device() for idxd groups, enginces and wqs.
(CVE-2025-38014)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38014
https://security-tracker.debian.org/tracker/CVE-2025-38014
https://ubuntu.com/security/CVE-2025-38014

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38014

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244977 - Linux Distros Unpatched Vulnerability : CVE-2025-38015
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dmaengine: idxd: fix memory leak in error handling path of idxd_alloc Memory allocated for idxd is not freed if an error occurs during idxd_alloc(). To fix it, free the allocated memory in the reverse order of allocation before exiting the function in case of an error. (CVE-2025-38015)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38015
https://ubuntu.com/security/CVE-2025-38015

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38015

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248592 - Linux Distros Unpatched Vulnerability : CVE-2025-38020
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mlx5e: Disable MACsec offload for uplink representor profile MACsec offload is not supported in switchdev mode for uplink representors. When switching to the uplink representor profile, the MACsec offload feature must be cleared from the netdevice's features. If left enabled, attempts to add offloads result in a null pointer dereference, as the uplink representor does not support MACsec offload even though the feature bit remains set. Clear NETIF_F_HW_MACSEC in mlx5e_fix_uplink_rep_features(). Kernel log: Oops: general protection fault, probably for non-canonical address 0xdffffc000000000f: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f] CPU: 29 UID: 0 PID: 4714 Comm: ip Not tainted 6.14.0-rc4_for_upstream_debug_2025_03_02_17_35 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP:
0010:__mutex_lock+0x128/0x1dd0 Code: d0 7c 08 84 d2 0f 85 ad 15 00 00 8b 35 91 5c fe 03 85 f6 75 29 49 8d 7e 60 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 a6 15 00 00 4d 3b 76 60 0f 85 fd 0b 00 00 65 ff RSP: 0018:ffff888147a4f160 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000001 RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000078 RBP:
ffff888147a4f2e0 R08: ffffffffa05d2c19 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: dffffc0000000000 R14: 0000000000000018 R15: ffff888152de0000 FS:
00007f855e27d800(0000) GS:ffff88881ee80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 CR2: 00000000004e5768 CR3: 000000013ae7c005 CR4: 0000000000372eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7:
0000000000000400 Call Trace: <TASK> ? die_addr+0x3d/0xa0 ? exc_general_protection+0x144/0x220 ? asm_exc_general_protection+0x22/0x30 ? mlx5e_macsec_add_secy+0xf9/0x700 [mlx5_core] ?
__mutex_lock+0x128/0x1dd0 ? lockdep_set_lock_cmp_fn+0x190/0x190 ? mlx5e_macsec_add_secy+0xf9/0x700 [mlx5_core] ? mutex_lock_io_nested+0x1ae0/0x1ae0 ? lock_acquire+0x1c2/0x530 ? macsec_upd_offload+0x145/0x380 ? lockdep_hardirqs_on_prepare+0x400/0x400 ? kasan_save_stack+0x30/0x40 ? kasan_save_stack+0x20/0x40 ? kasan_save_track+0x10/0x30 ? __kasan_kmalloc+0x77/0x90 ?
__kmalloc_noprof+0x249/0x6b0 ? genl_family_rcv_msg_attrs_parse.constprop.0+0xb5/0x240 ? mlx5e_macsec_add_secy+0xf9/0x700 [mlx5_core] mlx5e_macsec_add_secy+0xf9/0x700 [mlx5_core] ? mlx5e_macsec_add_rxsa+0x11a0/0x11a0 [mlx5_core] macsec_update_offload+0x26c/0x820 ? macsec_set_mac_address+0x4b0/0x4b0 ? lockdep_hardirqs_on_prepare+0x284/0x400 ?
_raw_spin_unlock_irqrestore+0x47/0x50 macsec_upd_offload+0x2c8/0x380 ? macsec_update_offload+0x820/0x820 ?
__nla_parse+0x22/0x30 ? genl_family_rcv_msg_attrs_parse.constprop.0+0x15e/0x240 genl_family_rcv_msg_doit+0x1cc/0x2a0 ? genl_family_rcv_msg_attrs_parse.constprop.0+0x240/0x240 ? cap_capable+0xd4/0x330 genl_rcv_msg+0x3ea/0x670 ? genl_family_rcv_msg_dumpit+0x2a0/0x2a0 ? lockdep_set_lock_cmp_fn+0x190/0x190 ? macsec_update_offload+0x820/0x820 netlink_rcv_skb+0x12b/0x390 ? genl_family_rcv_msg_dumpit+0x2a0/0x2a0 ? netlink_ack+0xd80/0xd80 ? rwsem_down_read_slowpath+0xf90/0xf90 ? netlink_deliver_tap+0xcd/0xac0 ? netlink_deliver_tap+0x155/0xac0 ? _copy_from_iter+0x1bb/0x12c0 genl_rcv+0x24/0x40 netlink_unicast+0x440/0x700 ? netlink_attachskb+0x760/0x760 ? lock_acquire+0x1c2/0x530 ? __might_fault+0xbb/0x170 netlink_sendmsg+0x749/0xc10 ? netlink_unicast+0x700/0x700 ?
__might_fault+0xbb/0x170 ? netlink_unicast+0x700/0x700 __sock_sendmsg+0xc5/0x190
____sys_sendmsg+0x53f/0x760 ? import_iovec+0x7/0x10 ? kernel_sendmsg+0x30/0x30 ? __copy_msghdr+0x3c0/0x3c0 ? filter_irq_stacks+0x90/0x90 ? stack_depot_save_flags+0x28/0xa30 ___sys_sen ---truncated--- (CVE-2025-38020)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38020
https://ubuntu.com/security/CVE-2025-38020

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38020

Plugin Information
Published: 2025/08/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247281 - Linux Distros Unpatched Vulnerability : CVE-2025-38031
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- padata: do not leak refcount in reorder_work A recent patch that addressed a UAF introduced a reference count leak: the parallel_data refcount is incremented unconditionally, regardless of the return value of queue_work(). If the work item is already queued, the incremented refcount is never decremented. Fix this by checking the return value of queue_work() and decrementing the refcount when necessary. Resolves:
Unreferenced object 0xffff9d9f421e3d80 (size 192): comm cryptomgr_probe, pid 157, jiffies 4294694003 hex dump (first 32 bytes): 80 8b cf 41 9f 9d ff ff b8 97 e0 89 ff ff ff ff ...A............ d0 97 e0 89 ff ff ff ff 19 00 00 00 1f 88 23 00 ..............#. backtrace (crc 838fb36): __kmalloc_cache_noprof+0x284/0x320 padata_alloc_pd+0x20/0x1e0 padata_alloc_shell+0x3b/0xa0 0xffffffffc040a54d cryptomgr_probe+0x43/0xc0 kthread+0xf6/0x1f0 ret_from_fork+0x2f/0x50 ret_from_fork_asm+0x1a/0x30 (CVE-2025-38031)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38031
https://ubuntu.com/security/CVE-2025-38031

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38031

Plugin Information
Published: 2025/08/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250216 - Linux Distros Unpatched Vulnerability : CVE-2025-38035
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nvmet-tcp: don't restore null sk_state_change queue->state_change is set as part of nvmet_tcp_set_queue_sock(), but if the TCP connection isn't established when nvmet_tcp_set_queue_sock() is called then queue->state_change isn't set and sock->sk->sk_state_change isn't replaced. As such we don't need to restore sock->sk->sk_state_change if queue->state_change is NULL. This avoids NULL pointer dereferences such as this: [ 286.462026][ C0] BUG: kernel NULL pointer dereference, address:
0000000000000000 [ 286.462814][ C0] #PF: supervisor instruction fetch in kernel mode [ 286.463796][ C0] #PF: error_code(0x0010) - not-present page [ 286.464392][ C0] PGD 8000000140620067 P4D 8000000140620067 PUD 114201067 PMD 0 [ 286.465086][ C0] Oops: Oops: 0010 [#1] SMP KASAN PTI [ 286.465559][ C0] CPU: 0 UID:
0 PID: 1628 Comm: nvme Not tainted 6.15.0-rc2+ #11 PREEMPT(voluntary) [ 286.466393][ C0] Hardware name:
QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 [ 286.467147][ C0] RIP: 0010:0x0 [ 286.467420][ C0] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 286.467977][ C0] RSP:
0018:ffff8883ae008580 EFLAGS: 00010246 [ 286.468425][ C0] RAX: 0000000000000000 RBX: ffff88813fd34100 RCX:
ffffffffa386cc43 [ 286.469019][ C0] RDX: 1ffff11027fa68b6 RSI: 0000000000000008 RDI: ffff88813fd34100 [ 286.469545][ C0] RBP: ffff88813fd34160 R08: 0000000000000000 R09: ffffed1027fa682c [ 286.470072][ C0] R10:
ffff88813fd34167 R11: 0000000000000000 R12: ffff88813fd344c3 [ 286.470585][ C0] R13: ffff88813fd34112 R14:
ffff88813fd34aec R15: ffff888132cdd268 [ 286.471070][ C0] FS: 00007fe3c04c7d80(0000) GS:ffff88840743f000(0000) knlGS:0000000000000000 [ 286.471644][ C0] CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 [ 286.472543][ C0] CR2: ffffffffffffffd6 CR3: 000000012daca000 CR4: 00000000000006f0 [ 286.473500][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 286.474467][ C0] DR3:
0000000000000000 DR6: 00000000ffff07f0 DR7: 0000000000000400 [ 286.475453][ C0] Call Trace: [ 286.476102][ C0] <IRQ> [ 286.476719][ C0] tcp_fin+0x2bb/0x440 [ 286.477429][ C0] tcp_data_queue+0x190f/0x4e60 [ 286.478174][ C0] ? __build_skb_around+0x234/0x330 [ 286.478940][ C0] ? rcu_is_watching+0x11/0xb0 [ 286.479659][ C0] ? __pfx_tcp_data_queue+0x10/0x10 [ 286.480431][ C0] ? tcp_try_undo_loss+0x640/0x6c0 [ 286.481196][ C0] ? seqcount_lockdep_reader_access.constprop.0+0x82/0x90 [ 286.482046][ C0] ? kvm_clock_get_cycles+0x14/0x30 [ 286.482769][ C0] ? ktime_get+0x66/0x150 [ 286.483433][ C0] ? rcu_is_watching+0x11/0xb0 [ 286.484146][ C0] tcp_rcv_established+0x6e4/0x2050 [ 286.484857][ C0] ? rcu_is_watching+0x11/0xb0 [ 286.485523][ C0] ? ipv4_dst_check+0x160/0x2b0 [ 286.486203][ C0] ?
__pfx_tcp_rcv_established+0x10/0x10 [ 286.486917][ C0] ? lock_release+0x217/0x2c0 [ 286.487595][ C0] tcp_v4_do_rcv+0x4d6/0x9b0 [ 286.488279][ C0] tcp_v4_rcv+0x2af8/0x3e30 [ 286.488904][ C0] ? raw_local_deliver+0x51b/0xad0 [ 286.489551][ C0] ? rcu_is_watching+0x11/0xb0 [ 286.490198][ C0] ?
__pfx_tcp_v4_rcv+0x10/0x10 [ 286.490813][ C0] ? __pfx_raw_local_deliver+0x10/0x10 [ 286.491487][ C0] ?
__pfx_nf_confirm+0x10/0x10 [nf_conntrack] [ 286.492275][ C0] ? rcu_is_watching+0x11/0xb0 [ 286.492900][ C0] ip_protocol_deliver_rcu+0x8f/0x370 [ 286.493579][ C0] ip_local_deliver_finish+0x297/0x420 [ 286.494268][ C0] ip_local_deliver+0x168/0x430 [ 286.494867][ C0] ? __pfx_ip_local_deliver+0x10/0x10 [ 286.495498][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 286.496204][ C0] ? ip_rcv_finish_core+0x19a/0x1f20 [ 286.496806][ C0] ? lock_release+0x217/0x2c0 [ 286.497414][ C0] ip_rcv+0x455/0x6e0 [ 286.497945][ C0] ? __pfx_ip_rcv+0x10/0x10 [ ---truncated--- (CVE-2025-38035)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38035
https://ubuntu.com/security/CVE-2025-38035

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38035

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248880 - Linux Distros Unpatched Vulnerability : CVE-2025-38039
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled When attempting to enable MQPRIO while HTB offload is already configured, the driver currently returns `-EINVAL` and triggers a `WARN_ON`, leading to an unnecessary call trace. Update the code to handle this case more gracefully by returning `-EOPNOTSUPP` instead, while also providing a helpful user message. (CVE-2025-38039)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38039
https://security-tracker.debian.org/tracker/CVE-2025-38039
https://ubuntu.com/security/CVE-2025-38039

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38039

Plugin Information
Published: 2025/08/12, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248343 - Linux Distros Unpatched Vulnerability : CVE-2025-38040
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- serial: mctrl_gpio: split disable_ms into sync and no_sync APIs The following splat has been observed on a SAMA5D27 platform using atmel_serial: BUG: sleeping function called from invalid context at kernel/irq/manage.c:738 in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 27, name: kworker/u5:0 preempt_count: 1, expected: 0 INFO: lockdep is turned off. irq event stamp: 0 hardirqs last enabled at (0): [<00000000>] 0x0 hardirqs last disabled at (0): [<c01588f0>] copy_process+0x1c4c/0x7bec softirqs last enabled at (0): [<c0158944>] copy_process+0x1ca0/0x7bec softirqs last disabled at (0): [<00000000>] 0x0 CPU: 0 UID: 0 PID: 27 Comm: kworker/u5:0 Not tainted 6.13.0-rc7+ #74 Hardware name: Atmel SAMA5 Workqueue:
hci0 hci_power_on [bluetooth] Call trace: unwind_backtrace from show_stack+0x18/0x1c show_stack from dump_stack_lvl+0x44/0x70 dump_stack_lvl from __might_resched+0x38c/0x598 __might_resched from disable_irq+0x1c/0x48 disable_irq from mctrl_gpio_disable_ms+0x74/0xc0 mctrl_gpio_disable_ms from atmel_disable_ms.part.0+0x80/0x1f4 atmel_disable_ms.part.0 from atmel_set_termios+0x764/0x11e8 atmel_set_termios from uart_change_line_settings+0x15c/0x994 uart_change_line_settings from uart_set_termios+0x2b0/0x668 uart_set_termios from tty_set_termios+0x600/0x8ec tty_set_termios from ttyport_set_flow_control+0x188/0x1e0 ttyport_set_flow_control from wilc_setup+0xd0/0x524 [hci_wilc] wilc_setup [hci_wilc] from hci_dev_open_sync+0x330/0x203c [bluetooth] hci_dev_open_sync [bluetooth] from hci_dev_do_open+0x40/0xb0 [bluetooth] hci_dev_do_open [bluetooth] from hci_power_on+0x12c/0x664 [bluetooth] hci_power_on [bluetooth] from process_one_work+0x998/0x1a38 process_one_work from worker_thread+0x6e0/0xfb4 worker_thread from kthread+0x3d4/0x484 kthread from ret_from_fork+0x14/0x28 This warning is emitted when trying to toggle, at the highest level, some flow control (with serdev_device_set_flow_control) in a device driver. At the lowest level, the atmel_serial driver is using serial_mctrl_gpio lib to enable/disable the corresponding IRQs accordingly. The warning emitted by CONFIG_DEBUG_ATOMIC_SLEEP is due to disable_irq (called in mctrl_gpio_disable_ms) being possibly called in some atomic context (some tty drivers perform modem lines configuration in regions protected by port lock). Split mctrl_gpio_disable_ms into two differents APIs, a non-blocking one and a blocking one.
Replace mctrl_gpio_disable_ms calls with the relevant version depending on whether the call is protected by some port lock. (CVE-2025-38040)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38040
https://security-tracker.debian.org/tracker/CVE-2025-38040
https://ubuntu.com/security/CVE-2025-38040

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.4 (CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:A/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38040

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245025 - Linux Distros Unpatched Vulnerability : CVE-2025-38047
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- x86/fred: Fix system hang during S4 resume with FRED enabled Upon a wakeup from S4, the restore kernel starts and initializes the FRED MSRs as needed from its perspective. It then loads a hibernation image, including the image kernel, and attempts to load image pages directly into their original page frames used before hibernation unless those frames are currently in use. Once all pages are moved to their original locations, it jumps to a trampoline page in the image kernel. At this point, the image kernel takes control, but the FRED MSRs still contain values set by the restore kernel, which may differ from those set by the image kernel before hibernation. Therefore, the image kernel must ensure the FRED MSRs have the same values as before hibernation. Since these values depend only on the location of the kernel text and data, they can be recomputed from scratch. (CVE-2025-38047)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38047
https://ubuntu.com/security/CVE-2025-38047

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38047

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246603 - Linux Distros Unpatched Vulnerability : CVE-2025-38049
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors Commit 6eac36bb9eb0 (x86/resctrl: Allocate the cleanest CLOSID by searching closid_num_dirty_rmid) added logic that causes resctrl to search for the CLOSID with the fewest dirty cache lines when creating a new control group, if requested by the arch code. This depends on the values read from the llc_occupancy counters. The logic is applicable to architectures where the CLOSID effectively forms part of the monitoring identifier and so do not allow complete freedom to choose an unused monitoring identifier for a given CLOSID. This support missed that some platforms may not have these counters. This causes a NULL pointer dereference when creating a new control group as the array was not allocated by dom_data_init(). As this feature isn't necessary on platforms that don't have cache occupancy monitors, add this to the check that occurs when a new control group is allocated.
(CVE-2025-38049)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38049
https://ubuntu.com/security/CVE-2025-38049

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38049

Plugin Information
Published: 2025/08/09, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244504 - Linux Distros Unpatched Vulnerability : CVE-2025-38057
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- espintcp: fix skb leaks A few error paths are missing a kfree_skb. (CVE-2025-38057)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38057
https://security-tracker.debian.org/tracker/CVE-2025-38057
https://ubuntu.com/security/CVE-2025-38057

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38057

Plugin Information
Published: 2025/08/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249573 - Linux Distros Unpatched Vulnerability : CVE-2025-38063
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dm: fix unconditional IO throttle caused by REQ_PREFLUSH When a bio with REQ_PREFLUSH is submitted to dm,
__send_empty_flush() generates a flush_bio with REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC, which causes the flush_bio to be throttled by wbt_wait(). An example from v5.4, similar problem also exists in upstream:
crash> bt 2091206 PID: 2091206 TASK: ffff2050df92a300 CPU: 109 COMMAND: kworker/u260:0 #0 [ffff800084a2f7f0] __switch_to at ffff80004008aeb8 #1 [ffff800084a2f820] __schedule at ffff800040bfa0c4 #2 [ffff800084a2f880] schedule at ffff800040bfa4b4 #3 [ffff800084a2f8a0] io_schedule at ffff800040bfa9c4 #4 [ffff800084a2f8c0] rq_qos_wait at ffff8000405925bc #5 [ffff800084a2f940] wbt_wait at ffff8000405bb3a0 #6 [ffff800084a2f9a0] __rq_qos_throttle at ffff800040592254 #7 [ffff800084a2f9c0] blk_mq_make_request at ffff80004057cf38 #8 [ffff800084a2fa60] generic_make_request at ffff800040570138 #9 [ffff800084a2fae0] submit_bio at ffff8000405703b4 #10 [ffff800084a2fb50] xlog_write_iclog at ffff800001280834 [xfs] #11 [ffff800084a2fbb0] xlog_sync at ffff800001280c3c [xfs] #12 [ffff800084a2fbf0] xlog_state_release_iclog at ffff800001280df4 [xfs] #13 [ffff800084a2fc10] xlog_write at ffff80000128203c [xfs] #14 [ffff800084a2fcd0] xlog_cil_push at ffff8000012846dc [xfs] #15 [ffff800084a2fda0] xlog_cil_push_work at ffff800001284a2c [xfs] #16 [ffff800084a2fdb0] process_one_work at ffff800040111d08 #17 [ffff800084a2fe00] worker_thread at ffff8000401121cc #18 [ffff800084a2fe70] kthread at ffff800040118de4 After commit 2def2845cc33 (xfs: don't allow log IO to be throttled), the metadata submitted by xlog_write_iclog() should not be throttled. But due to the existence of the dm layer, throttling flush_bio indirectly causes the metadata bio to be throttled. Fix this by conditionally adding REQ_IDLE to flush_bio.bi_opf, which makes wbt_should_throttle() return false to avoid wbt_wait(). (CVE-2025-38063)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38063
https://security-tracker.debian.org/tracker/CVE-2025-38063
https://ubuntu.com/security/CVE-2025-38063

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38063

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250060 - Linux Distros Unpatched Vulnerability : CVE-2025-38067
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- rseq: Fix segfault on registration when rseq_cs is non-zero The rseq_cs field is documented as being set to 0 by user-space prior to registration, however this is not currently enforced by the kernel. This can result in a segfault on return to user-space if the value stored in the rseq_cs field doesn't point to a valid struct rseq_cs. The correct solution to this would be to fail the rseq registration when the rseq_cs field is non-zero. However, some older versions of glibc will reuse the rseq area of previous threads without clearing the rseq_cs field and will also terminate the process if the rseq registration fails in a secondary thread. This wasn't caught in testing because in this case the leftover rseq_cs does point to a valid struct rseq_cs. What we can do is clear the rseq_cs field on registration when it's non-zero which will prevent segfaults on registration and won't break the glibc versions that reuse rseq areas on thread creation. (CVE-2025-38067)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38067
https://ubuntu.com/security/CVE-2025-38067

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38067

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249804 - Linux Distros Unpatched Vulnerability : CVE-2025-38072
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- libnvdimm/labels: Fix divide error in nd_label_data_init() If a faulty CXL memory device returns a broken zero LSA size in its memory device information (Identify Memory Device (Opcode 4000h), CXL spec. 3.1, 8.2.9.9.1.1), a divide error occurs in the libnvdimm driver: Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:nd_label_data_init+0x10e/0x800 [libnvdimm] Code and flow: 1) CXL Command 4000h returns LSA size = 0 2) config_size is assigned to zero LSA size (CXL pmem driver): drivers/cxl/pmem.c: .config_size = mds->lsa_size, 3) max_xfer is set to zero (nvdimm driver): drivers/nvdimm/label.c: max_xfer = min_t(size_t, ndd->nsarea.max_xfer, config_size); 4) A subsequent DIV_ROUND_UP() causes a division by zero: drivers/nvdimm/label.c: /* Make our initial read size a multiple of max_xfer size */ drivers/nvdimm/label.c: read_size = min(DIV_ROUND_UP(read_size, max_xfer) * max_xfer, drivers/nvdimm/label.c- config_size); Fix this by checking the config size parameter by extending an existing check. (CVE-2025-38072)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38072
https://ubuntu.com/security/CVE-2025-38072

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38072

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247255 - Linux Distros Unpatched Vulnerability : CVE-2025-38095
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dma-buf: insert memory barrier before updating num_fences smp_store_mb() inserts memory barrier after storing operation. It is different with what the comment is originally aiming so Null pointer dereference can be happened if memory update is reordered. (CVE-2025-38095)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38095
https://ubuntu.com/security/CVE-2025-38095

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38095

Plugin Information
Published: 2025/08/10, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245513 - Linux Distros Unpatched Vulnerability : CVE-2025-38096
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: iwlwifi: don't warn when if there is a FW error iwl_trans_reclaim is warning if it is called when the FW is not alive. But if it is called when there is a pending restart, i.e. after a FW error, there is no need to warn, instead - return silently. (CVE-2025-38096)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38096
https://security-tracker.debian.org/tracker/CVE-2025-38096
https://ubuntu.com/security/CVE-2025-38096

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38096

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247122 - Linux Distros Unpatched Vulnerability : CVE-2025-38097
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- espintcp: remove encap socket caching to avoid reference leak The current scheme for caching the encap socket can lead to reference leaks when we try to delete the netns. The reference chain is: xfrm_state ->
enacp_sk -> netns Since the encap socket is a userspace socket, it holds a reference on the netns. If we delete the espintcp state (through flush or individual delete) before removing the netns, the reference on the socket is dropped and the netns is correctly deleted. Otherwise, the netns may not be reachable anymore (if all processes within the ns have terminated), so we cannot delete the xfrm state to drop its reference on the socket. This patch results in a small (~2% in my tests) performance regression. A GC-type mechanism could be added for the socket cache, to clear references if the state hasn't been used recently, but it's a lot more complex than just not caching the socket. (CVE-2025-38097)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38097
https://security-tracker.debian.org/tracker/CVE-2025-38097
https://ubuntu.com/security/CVE-2025-38097

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H)
CVSS v3.0 Temporal Score
5.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38097

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246387 - Linux Distros Unpatched Vulnerability : CVE-2025-38099
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken A SCO connection without the proper voice_setting can cause the controller to lock up. (CVE-2025-38099)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38099
https://ubuntu.com/security/CVE-2025-38099

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38099

Plugin Information
Published: 2025/08/08, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247060 - Linux Distros Unpatched Vulnerability : CVE-2025-38100
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies io_bitmap_exit() is invoked from exit_thread() when a task exists or when a fork fails. In the latter case the exit_thread() cleans up resources which were allocated during fork(). io_bitmap_exit() invokes task_update_io_bitmap(), which in turn ends up in tss_update_io_bitmap(). tss_update_io_bitmap() operates on the current task. If current has TIF_IO_BITMAP set, but no bitmap installed, tss_update_io_bitmap() crashes with a NULL pointer dereference. There are two issues, which lead to that problem: 1) io_bitmap_exit() should not invoke task_update_io_bitmap() when the task, which is cleaned up, is not the current task. That's a clear indicator for a cleanup after a failed fork(). 2) A task should not have TIF_IO_BITMAP set and neither a bitmap installed nor IOPL emulation level 3 activated. This happens when a kernel thread is created in the context of a user space thread, which has TIF_IO_BITMAP set as the thread flags are copied and the IO bitmap pointer is cleared.
Other than in the failed fork() case this has no impact because kernel threads including IO workers never return to user space and therefore never invoke tss_update_io_bitmap(). Cure this by adding the missing cleanups and checks: 1) Prevent io_bitmap_exit() to invoke task_update_io_bitmap() if the to be cleaned up task is not the current task. 2) Clear TIF_IO_BITMAP in copy_thread() unconditionally. For user space forks it is set later, when the IO bitmap is inherited in io_bitmap_share(). For paranoia sake, add a warning into tss_update_io_bitmap() to catch the case, when that code is invoked with inconsistent state.
(CVE-2025-38100)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38100
https://ubuntu.com/security/CVE-2025-38100

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38100

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246047 - Linux Distros Unpatched Vulnerability : CVE-2025-38102
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify During our test, it is found that a warning can be trigger in try_grab_folio as follow: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1678 at mm/gup.c:147 try_grab_folio+0x106/0x130 Modules linked in: CPU: 0 UID: 0 PID: 1678 Comm:
syz.3.31 Not tainted 6.15.0-rc5 #163 PREEMPT(undef) RIP: 0010:try_grab_folio+0x106/0x130 Call Trace:
<TASK> follow_huge_pmd+0x240/0x8e0 follow_pmd_mask.constprop.0.isra.0+0x40b/0x5c0 follow_pud_mask.constprop.0.isra.0+0x14a/0x170 follow_page_mask+0x1c2/0x1f0 __get_user_pages+0x176/0x950
__gup_longterm_locked+0x15b/0x1060 ? gup_fast+0x120/0x1f0 gup_fast_fallback+0x17e/0x230 get_user_pages_fast+0x5f/0x80 vmci_host_unlocked_ioctl+0x21c/0xf80 RIP: 0033:0x54d2cd ---[ end trace 0000000000000000 ]--- Digging into the source, context->notify_page may init by get_user_pages_fast and can be seen in vmci_ctx_unset_notify which will try to put_page. However get_user_pages_fast is not finished here and lead to following try_grab_folio warning. The race condition is shown as follow: cpu0 cpu1 vmci_host_do_set_notify vmci_host_setup_notify get_user_pages_fast(uva, 1, FOLL_WRITE, &context->notify_page); lockless_pages_from_mm gup_pgd_range gup_huge_pmd // update &context->notify_page vmci_host_do_set_notify vmci_ctx_unset_notify notify_page = context->notify_page; if (notify_page) put_page(notify_page); // page is freed __gup_longterm_locked __get_user_pages follow_trans_huge_pmd try_grab_folio // warn here To slove this, use local variable page to make notify_page can be seen after finish get_user_pages_fast. (CVE-2025-38102)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38102
https://ubuntu.com/security/CVE-2025-38102

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
7.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38102

Plugin Information
Published: 2025/08/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244722 - Linux Distros Unpatched Vulnerability : CVE-2025-38105
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: usb-audio: Kill timer properly at removal The USB-audio MIDI code initializes the timer, but in a rare case, the driver might be freed without the disconnect call. This leaves the timer in an active state while the assigned object is released via snd_usbmidi_free(), which ends up with a kernel warning when the debug configuration is enabled, as spotted by fuzzer. For avoiding the problem, put timer_shutdown_sync() at snd_usbmidi_free(), so that the timer can be killed properly. While we're at it, replace the existing timer_delete_sync() at the disconnect callback with timer_shutdown_sync(), too. (CVE-2025-38105)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38105
https://security-tracker.debian.org/tracker/CVE-2025-38105
https://ubuntu.com/security/CVE-2025-38105

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38105

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245387 - Linux Distros Unpatched Vulnerability : CVE-2025-38112
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: Fix TOCTOU issue in sk_is_readable() sk->sk_prot->sock_is_readable is a valid function pointer when sk resides in a sockmap. After the last sk_psock_put() (which usually happens when socket is removed from sockmap), sk->sk_prot gets restored and sk->sk_prot->sock_is_readable becomes NULL. This makes sk_is_readable() racy, if the value of sk->sk_prot is reloaded after the initial check. Which in turn may lead to a null pointer dereference. Ensure the function pointer does not turn NULL after the check.
(CVE-2025-38112)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38112
https://ubuntu.com/security/CVE-2025-38112

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.1
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38112

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247972 - Linux Distros Unpatched Vulnerability : CVE-2025-38113
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used With nosmp in cmdline, other CPUs are not brought up, leaving their cpc_desc_ptr NULL. CPU0's iteration via for_each_possible_cpu() dereferences these NULL pointers, causing panic. Panic backtrace: [ 0.401123] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b8 ... [ 0.403255] [<ffffffff809a5818>] cppc_allow_fast_switch+0x6a/0xd4 ... Kernel panic - not syncing: Attempted to kill init! [ rjw: New subject ] (CVE-2025-38113)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38113
https://ubuntu.com/security/CVE-2025-38113

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38113

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247429 - Linux Distros Unpatched Vulnerability : CVE-2025-38115
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net_sched: sch_sfq: fix a potential crash on gso_skb handling SFQ has an assumption of always being able to queue at least one packet. However, after the blamed commit, sch->q.len can be inflated by packets in sch->gso_skb, and an enqueue() on an empty SFQ qdisc can be followed by an immediate drop. Fix sfq_drop() to properly clear q->tail in this situation. ip netns add lb ip link add dev to-lb type veth peer name in- lb netns lb ethtool -K to-lb tso off # force qdisc to requeue gso_skb ip netns exec lb ethtool -K in-lb gro on # enable NAPI ip link set dev to-lb up ip -netns lb link set dev in-lb up ip addr add dev to-lb 192.168.20.1/24 ip -netns lb addr add dev in-lb 192.168.20.2/24 tc qdisc replace dev to-lb root sfq limit 100 ip netns exec lb netserver netperf -H 192.168.20.2 -l 100 & netperf -H 192.168.20.2 -l 100 & netperf
-H 192.168.20.2 -l 100 & netperf -H 192.168.20.2 -l 100 & (CVE-2025-38115)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38115
https://ubuntu.com/security/CVE-2025-38115

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38115

Plugin Information
Published: 2025/08/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248399 - Linux Distros Unpatched Vulnerability : CVE-2025-38122
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO gve_alloc_pending_packet() can return NULL, but gve_tx_add_skb_dqo() did not check for this case before dereferencing the returned pointer. Add a missing NULL check to prevent a potential NULL pointer dereference when allocation fails. This improves robustness in low-memory scenarios. (CVE-2025-38122)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38122
https://ubuntu.com/security/CVE-2025-38122

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38122

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245494 - Linux Distros Unpatched Vulnerability : CVE-2025-38125
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST If the ptp_rate recorded earlier in the driver happens to be 0, this bogus value will propagate up to EST configuration, where it will trigger a division by 0. Prevent this division by 0 by adding the corresponding check and error code.
(CVE-2025-38125)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38125
https://security-tracker.debian.org/tracker/CVE-2025-38125
https://ubuntu.com/security/CVE-2025-38125

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38125

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249527 - Linux Distros Unpatched Vulnerability : CVE-2025-38126
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping The stmmac platform drivers that do not open-code the clk_ptp_rate value after having retrieved the default one from the device-tree can end up with 0 in clk_ptp_rate (as clk_get_rate can return 0). It will eventually propagate up to PTP initialization when bringing up the interface, leading to a divide by 0: Division by zero in kernel. CPU:
1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.30-00001-g48313bd5768a #22 Hardware name: STM32 (Device Tree Support) Call trace: unwind_backtrace from show_stack+0x18/0x1c show_stack from dump_stack_lvl+0x6c/0x8c dump_stack_lvl from Ldiv0_64+0x8/0x18 Ldiv0_64 from stmmac_init_tstamp_counter+0x190/0x1a4 stmmac_init_tstamp_counter from stmmac_hw_setup+0xc1c/0x111c stmmac_hw_setup from __stmmac_open+0x18c/0x434 __stmmac_open from stmmac_open+0x3c/0xbc stmmac_open from
__dev_open+0xf4/0x1ac __dev_open from __dev_change_flags+0x1cc/0x224 __dev_change_flags from dev_change_flags+0x24/0x60 dev_change_flags from ip_auto_config+0x2e8/0x11a0 ip_auto_config from do_one_initcall+0x84/0x33c do_one_initcall from kernel_init_freeable+0x1b8/0x214 kernel_init_freeable from kernel_init+0x24/0x140 kernel_init from ret_from_fork+0x14/0x28 Exception stack(0xe0815fb0 to 0xe0815ff8) Prevent this division by 0 by adding an explicit check and error log about the actual issue. While at it, remove the same check from stmmac_ptp_register, which then becomes duplicate (CVE-2025-38126)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38126
https://security-tracker.debian.org/tracker/CVE-2025-38126
https://ubuntu.com/security/CVE-2025-38126

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38126

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248881 - Linux Distros Unpatched Vulnerability : CVE-2025-38127
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ice: fix Tx scheduler error handling in XDP callback When the XDP program is loaded, the XDP callback adds new Tx queues. This means that the callback must update the Tx scheduler with the new queue number. In the event of a Tx scheduler failure, the XDP callback should also fail and roll back any changes previously made for XDP preparation. The previous implementation had a bug that not all changes made by the XDP callback were rolled back. This caused the crash with the following call trace: [ +9.549584] ice 0000:ca:00.0: Failed VSI LAN queue config for XDP, error: -5 [ +0.382335] Oops: general protection fault, probably for non-canonical address 0x50a2250a90495525: 0000 [#1] SMP NOPTI [ +0.010710] CPU: 103 UID: 0 PID: 0 Comm: swapper/103 Not tainted 6.14.0-net-next-mar-31+ #14 PREEMPT(voluntary) [ +0.010175] Hardware name: Intel Corporation M50CYP2SBSTD/M50CYP2SBSTD, BIOS SE5C620.86B.01.01.0005.2202160810 02/16/2022 [ +0.010946] RIP: 0010:__ice_update_sample+0x39/0xe0 [ice] [...] [ +0.002715] Call Trace: [ +0.002452] <IRQ>
[ +0.002021] ? __die_body.cold+0x19/0x29 [ +0.003922] ? die_addr+0x3c/0x60 [ +0.003319] ? exc_general_protection+0x17c/0x400 [ +0.004707] ? asm_exc_general_protection+0x26/0x30 [ +0.004879] ?
__ice_update_sample+0x39/0xe0 [ice] [ +0.004835] ice_napi_poll+0x665/0x680 [ice] [ +0.004320]
__napi_poll+0x28/0x190 [ +0.003500] net_rx_action+0x198/0x360 [ +0.003752] ? update_rq_clock+0x39/0x220 [ +0.004013] handle_softirqs+0xf1/0x340 [ +0.003840] ? sched_clock_cpu+0xf/0x1f0 [ +0.003925]
__irq_exit_rcu+0xc2/0xe0 [ +0.003665] common_interrupt+0x85/0xa0 [ +0.003839] </IRQ> [ +0.002098] <TASK> [ +0.002106] asm_common_interrupt+0x26/0x40 [ +0.004184] RIP: 0010:cpuidle_enter_state+0xd3/0x690 Fix this by performing the missing unmapping of XDP queues from q_vectors and setting the XDP rings pointer back to NULL after all those queues are released. Also, add an immediate exit from the XDP callback in case of ring preparation failure. (CVE-2025-38127)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38127
https://security-tracker.debian.org/tracker/CVE-2025-38127
https://ubuntu.com/security/CVE-2025-38127

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38127

Plugin Information
Published: 2025/08/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249606 - Linux Distros Unpatched Vulnerability : CVE-2025-38128
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject malformed HCI_CMD_SYNC commands In 'mgmt_hci_cmd_sync()', check whether the size of parameters passed in 'struct mgmt_cp_hci_cmd_sync' matches the total size of the data (i.e. 'sizeof(struct mgmt_cp_hci_cmd_sync)' plus trailing bytes). Otherwise, large invalid 'params_len' will cause 'hci_cmd_sync_alloc()' to do 'skb_put_data()' from an area beyond the one actually passed to 'mgmt_hci_cmd_sync()'. (CVE-2025-38128)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38128
https://ubuntu.com/security/CVE-2025-38128

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38128

Plugin Information
Published: 2025/08/15, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
252998 - Linux Distros Unpatched Vulnerability : CVE-2025-38134
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() As demonstrated by the fix for update_port_device_state, commit 12783c0b9e2c (usb: core: Prevent null pointer dereference in update_port_device_state), usb_hub_to_struct_hub() can return NULL in certain scenarios, such as during hub driver unbind or teardown race conditions, even if the underlying usb_device structure exists. Plus, all other places that call usb_hub_to_struct_hub() in the same file do check for NULL return values. If usb_hub_to_struct_hub() returns NULL, the subsequent access to hub->ports[udev->portnum - 1] will cause a null pointer dereference. (CVE-2025-38134)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38134
https://ubuntu.com/security/CVE-2025-38134

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38134

Plugin Information
Published: 2025/08/20, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249383 - Linux Distros Unpatched Vulnerability : CVE-2025-38140
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dm: limit swapping tables for devices with zone write plugs dm_revalidate_zones() only allowed new or previously unzoned devices to call blk_revalidate_disk_zones(). If the device was already zoned, disk->nr_zones would always equal md->nr_zones, so dm_revalidate_zones() returned without doing any work.
This would make the zoned settings for the device not match the new table. If the device had zone write plug resources, it could run into errors like bdev_zone_is_seq() reading invalid memory because disk->conv_zones_bitmap was the wrong size. If the device doesn't have any zone write plug resources, calling blk_revalidate_disk_zones() will always correctly update device. If blk_revalidate_disk_zones() fails, it can still overwrite or clear the current disk->nr_zones value. In this case, DM must restore the previous value of disk->nr_zones, so that the zoned settings will continue to match the previous value that it fell back to. If the device already has zone write plug resources, blk_revalidate_disk_zones() will not correctly update them, if it is called for arbitrary zoned device changes. Since there is not much need for this ability, the easiest solution is to disallow any table reloads that change the zoned settings, for devices that already have zone plug resources. Specifically, if a device already has zone plug resources allocated, it can only switch to another zoned table that also emulates zone append. Also, it cannot change the device size or the zone size. A device can switch to an error target.
(CVE-2025-38140)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38140
https://security-tracker.debian.org/tracker/CVE-2025-38140
https://ubuntu.com/security/CVE-2025-38140

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38140

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246451 - Linux Distros Unpatched Vulnerability : CVE-2025-38146
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: openvswitch: Fix the dead loop of MPLS parse The unexpected MPLS packet may not end with the bottom label stack. When there are many stacks, The label count value has wrapped around. A dead loop occurs, soft lockup/CPU stuck finally. stack backtrace: UBSAN: array-index-out-of-bounds in /build/linux-0Pa0xK/linux-5.15.0/net/openvswitch/flow.c:662:26 index -1 is out of range for type '__be32 [3]' CPU: 34 PID: 0 Comm: swapper/34 Kdump: loaded Tainted: G OE 5.15.0-121-generic #131-Ubuntu Hardware name: Dell Inc. PowerEdge C6420/0JP9TF, BIOS 2.12.2 07/14/2021 Call Trace: <IRQ> show_stack+0x52/0x5c dump_stack_lvl+0x4a/0x63 dump_stack+0x10/0x16 ubsan_epilogue+0x9/0x36
__ubsan_handle_out_of_bounds.cold+0x44/0x49 key_extract_l3l4+0x82a/0x840 [openvswitch] ? kfree_skbmem+0x52/0xa0 key_extract+0x9c/0x2b0 [openvswitch] ovs_flow_key_extract+0x124/0x350 [openvswitch] ovs_vport_receive+0x61/0xd0 [openvswitch] ? kernel_init_free_pages.part.0+0x4a/0x70 ? get_page_from_freelist+0x353/0x540 netdev_port_receive+0xc4/0x180 [openvswitch] ? netdev_port_receive+0x180/0x180 [openvswitch] netdev_frame_hook+0x1f/0x40 [openvswitch]
__netif_receive_skb_core.constprop.0+0x23a/0xf00 __netif_receive_skb_list_core+0xfa/0x240 netif_receive_skb_list_internal+0x18e/0x2a0 napi_complete_done+0x7a/0x1c0 bnxt_poll+0x155/0x1c0 [bnxt_en]
__napi_poll+0x30/0x180 net_rx_action+0x126/0x280 ? bnxt_msix+0x67/0x80 [bnxt_en] handle_softirqs+0xda/0x2d0 irq_exit_rcu+0x96/0xc0 common_interrupt+0x8e/0xa0 </IRQ> (CVE-2025-38146)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38146
https://ubuntu.com/security/CVE-2025-38146

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38146

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247741 - Linux Distros Unpatched Vulnerability : CVE-2025-38147
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- calipso: Don't call calipso functions for AF_INET sk. syzkaller reported a null-ptr-deref in txopt_get().
[0] The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6_pinfo was NULL there. However, this never happens for IPv6 sockets as inet_sk(sk)->pinet6 is always set in inet6_create(), meaning the socket was not IPv6 one. The root cause is missing validation in netlbl_conn_setattr(). netlbl_conn_setattr() switches branches based on struct sockaddr.sa_family, which is passed from userspace. However, netlbl_conn_setattr() does not check if the address family matches the socket. The syzkaller must have called connect() for an IPv6 address on an IPv4 socket. We have a proper validation in tcp_v[46]_connect(), but security_socket_connect() is called in the earlier stage. Let's copy the validation to netlbl_conn_setattr(). [0]: Oops: general protection fault, probably for non- canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 2 UID: 0 PID: 12928 Comm: syz.9.1677 Not tainted 6.12.0 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:txopt_get include/net/ipv6.h:390 [inline] RIP: 0010: Code: 02 00 00 49 8b ac 24 f8 02 00 00 e8 84 69 2a fd e8 ff 00 16 fd 48 8d 7d 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 53 02 00 00 48 8b 6d 70 48 85 ed 0f 84 ab 01 00 RSP: 0018:ffff88811b8afc48 EFLAGS: 00010212 RAX: dffffc0000000000 RBX:
1ffff11023715f8a RCX: ffffffff841ab00c RDX: 000000000000000e RSI: ffffc90007d9e000 RDI: 0000000000000070 RBP: 0000000000000000 R08: ffffed1023715f9d R09: ffffed1023715f9e R10: ffffed1023715f9d R11:
0000000000000003 R12: ffff888123075f00 R13: ffff88810245bd80 R14: ffff888113646780 R15: ffff888100578a80 FS: 00007f9019bd7640(0000) GS:ffff8882d2d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f901b927bac CR3: 0000000104788003 CR4: 0000000000770ef0 PKRU: 80000000 Call Trace: <TASK> calipso_sock_setattr+0x56/0x80 net/netlabel/netlabel_calipso.c:557 netlbl_conn_setattr+0x10c/0x280 net/netlabel/netlabel_kapi.c:1177 selinux_netlbl_socket_connect_helper+0xd3/0x1b0 security/selinux/netlabel.c:569 selinux_netlbl_socket_connect_locked security/selinux/netlabel.c:597 [inline] selinux_netlbl_socket_connect+0xb6/0x100 security/selinux/netlabel.c:615 selinux_socket_connect+0x5f/0x80 security/selinux/hooks.c:4931 security_socket_connect+0x50/0xa0 security/security.c:4598
__sys_connect_file+0xa4/0x190 net/socket.c:2067 __sys_connect+0x12c/0x170 net/socket.c:2088
__do_sys_connect net/socket.c:2098 [inline] __se_sys_connect net/socket.c:2095 [inline]
__x64_sys_connect+0x73/0xb0 net/socket.c:2095 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP:
0033:0x7f901b61a12d Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f9019bd6fa8 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX:
00007f901b925fa0 RCX: 00007f901b61a12d RDX: 000000000000001c RSI: 0000200000000140 RDI: 0000000000000003 RBP: 00007f901b701505 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11:
0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f901b5b62a0 R15: 00007f9019bb7000 </TASK> Modules linked in: (CVE-2025-38147)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38147
https://ubuntu.com/security/CVE-2025-38147

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38147

Plugin Information
Published: 2025/08/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244382 - Linux Distros Unpatched Vulnerability : CVE-2025-38148
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: phy: mscc: Fix memory leak when using one step timestamping Fix memory leak when running one-step timestamping. When running one-step sync timestamping, the HW is configured to insert the TX time into the frame, so there is no reason to keep the skb anymore. As in this case the HW will never generate an interrupt to say that the frame was timestamped, then the frame will never released. Fix this by freeing the frame in case of one-step timestamping. (CVE-2025-38148)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38148
https://security-tracker.debian.org/tracker/CVE-2025-38148
https://ubuntu.com/security/CVE-2025-38148

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38148

Plugin Information
Published: 2025/08/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247287 - Linux Distros Unpatched Vulnerability : CVE-2025-38149
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: phy: clear phydev->devlink when the link is deleted There is a potential crash issue when disabling and re-enabling the network port. When disabling the network port, phy_detach() calls device_link_del() to remove the device link, but it does not clear phydev->devlink, so phydev->devlink is not a NULL pointer.
Then the network port is re-enabled, but if phy_attach_direct() fails before calling device_link_add(), the code jumps to the error label and calls phy_detach(). Since phydev->devlink retains the old value from the previous attach/detach cycle, device_link_del() uses the old value, which accesses a NULL pointer and causes a crash. The simplified crash log is as follows. [ 24.702421] Call trace: [ 24.704856] device_link_put_kref+0x20/0x120 [ 24.709124] device_link_del+0x30/0x48 [ 24.712864] phy_detach+0x24/0x168 [ 24.716261] phy_attach_direct+0x168/0x3a4 [ 24.720352] phylink_fwnode_phy_connect+0xc8/0x14c [ 24.725140] phylink_of_phy_connect+0x1c/0x34 Therefore, phydev->devlink needs to be cleared when the device link is deleted. (CVE-2025-38149)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38149
https://ubuntu.com/security/CVE-2025-38149

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38149

Plugin Information
Published: 2025/08/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248495 - Linux Distros Unpatched Vulnerability : CVE-2025-38154
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf, sockmap: Avoid using sk_socket after free when sending The sk->sk_socket is not locked or referenced in backlog thread, and during the call to skb_send_sock(), there is a race condition with the release of sk_socket. All types of sockets(tcp/udp/unix/vsock) will be affected. Race conditions: ''' CPU0 CPU1 backlog::skb_send_sock sendmsg_unlocked sock_sendmsg sock_sendmsg_nosec close(fd): ... ops->release() ->
sock_map_close() sk_socket->ops = NULL free(socket) sock->ops->sendmsg ^ panic here ''' The ref of psock become 0 after sock_map_close() executed. ''' void sock_map_close() { ... if (likely(psock)) { ... // !! here we remove psock and the ref of psock become 0 sock_map_remove_links(sk, psock) psock = sk_psock_get(sk); if (unlikely(!psock)) goto no_psock; <=== Control jumps here via goto ...
cancel_delayed_work_sync(&psock->work); <=== not executed sk_psock_put(sk, psock); ... } ''' Based on the fact that we already wait for the workqueue to finish in sock_map_close() if psock is held, we simply increase the psock reference count to avoid race conditions. With this patch, if the backlog thread is running, sock_map_close() will wait for the backlog thread to complete and cancel all pending work. If no backlog running, any pending work that hasn't started by then will fail when invoked by sk_psock_get(), as the psock reference count have been zeroed, and sk_psock_drop() will cancel all jobs via cancel_delayed_work_sync(). In summary, we require synchronization to coordinate the backlog thread and close() thread. The panic I catched: ''' Workqueue: events sk_psock_backlog RIP:
0010:sock_sendmsg+0x21d/0x440 RAX: 0000000000000000 RBX: ffffc9000521fad8 RCX: 0000000000000001 ... Call Trace: <TASK> ? die_addr+0x40/0xa0 ? exc_general_protection+0x14c/0x230 ? asm_exc_general_protection+0x26/0x30 ? sock_sendmsg+0x21d/0x440 ? sock_sendmsg+0x3e0/0x440 ?
__pfx_sock_sendmsg+0x10/0x10 __skb_send_sock+0x543/0xb70 sk_psock_backlog+0x247/0xb80 ... '''
(CVE-2025-38154)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38154
https://ubuntu.com/security/CVE-2025-38154

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38154

Plugin Information
Published: 2025/08/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244318 - Linux Distros Unpatched Vulnerability : CVE-2025-38157
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath9k_htc: Abort software beacon handling if disabled A malicious USB device can send a WMI_SWBA_EVENTID event from an ath9k_htc-managed device before beaconing has been enabled. This causes a device-by-zero error in the driver, leading to either a crash or an out of bounds read. Prevent this by aborting the handling in ath9k_htc_swba() if beacons are not enabled. (CVE-2025-38157)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38157
https://ubuntu.com/security/CVE-2025-38157

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38157

Plugin Information
Published: 2025/08/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249707 - Linux Distros Unpatched Vulnerability : CVE-2025-38162
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation When calculating the lookup table size, ensure the following multiplication does not overflow: - desc->field_len[] maximum value is U8_MAX multiplied by NFT_PIPAPO_GROUPS_PER_BYTE(f) that can be 2, worst case. - NFT_PIPAPO_BUCKETS(f->bb) is 2^8, worst case. - sizeof(unsigned long), from sizeof(*f->lt), lt in struct nft_pipapo_field. Then, use check_mul_overflow() to multiply by bucket size and then use check_add_overflow() to the alignment for avx2 (if needed). Finally, add lt_size_check_overflow() helper and use it to consolidate this. While at it, replace leftover allocation using the GFP_KERNEL to GFP_KERNEL_ACCOUNT for consistency, in pipapo_resize(). (CVE-2025-38162)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38162
https://security-tracker.debian.org/tracker/CVE-2025-38162
https://ubuntu.com/security/CVE-2025-38162

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38162

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250259 - Linux Distros Unpatched Vulnerability : CVE-2025-38166
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: fix ktls panic with sockmap [ 2172.936997] ------------[ cut here ]------------ [ 2172.936999] kernel BUG at lib/iov_iter.c:629! ...... [ 2172.944996] PKRU: 55555554 [ 2172.945155] Call Trace: [ 2172.945299] <TASK> [ 2172.945428] ? die+0x36/0x90 [ 2172.945601] ? do_trap+0xdd/0x100 [ 2172.945795] ? iov_iter_revert+0x178/0x180 [ 2172.946031] ? iov_iter_revert+0x178/0x180 [ 2172.946267] ? do_error_trap+0x7d/0x110 [ 2172.946499] ? iov_iter_revert+0x178/0x180 [ 2172.946736] ? exc_invalid_op+0x50/0x70 [ 2172.946961] ? iov_iter_revert+0x178/0x180 [ 2172.947197] ? asm_exc_invalid_op+0x1a/0x20 [ 2172.947446] ? iov_iter_revert+0x178/0x180 [ 2172.947683] ? iov_iter_revert+0x5c/0x180 [ 2172.947913] tls_sw_sendmsg_locked.isra.0+0x794/0x840 [ 2172.948206] tls_sw_sendmsg+0x52/0x80 [ 2172.948420] ? inet_sendmsg+0x1f/0x70 [ 2172.948634] __sys_sendto+0x1cd/0x200 [ 2172.948848] ? find_held_lock+0x2b/0x80 [ 2172.949072] ? syscall_trace_enter+0x140/0x270 [ 2172.949330] ?
__lock_release.isra.0+0x5e/0x170 [ 2172.949595] ? find_held_lock+0x2b/0x80 [ 2172.949817] ? syscall_trace_enter+0x140/0x270 [ 2172.950211] ? lockdep_hardirqs_on_prepare+0xda/0x190 [ 2172.950632] ? ktime_get_coarse_real_ts64+0xc2/0xd0 [ 2172.951036] __x64_sys_sendto+0x24/0x30 [ 2172.951382] do_syscall_64+0x90/0x170 ...... After calling bpf_exec_tx_verdict(), the size of msg_pl->sg may increase, e.g., when the BPF program executes bpf_msg_push_data(). If the BPF program sets cork_bytes and sg.size is smaller than cork_bytes, it will return -ENOSPC and attempt to roll back to the non-zero copy logic.
However, during rollback, msg->msg_iter is reset, but since msg_pl->sg.size has been increased, subsequent executions will exceed the actual size of msg_iter. ''' iov_iter_revert(&msg->msg_iter, msg_pl->sg.size - orig_size); ''' The changes in this commit are based on the following considerations: 1. When cork_bytes is set, rolling back to non-zero copy logic is pointless and can directly go to zero-copy logic. 2. We can not calculate the correct number of bytes to revert msg_iter. Assume the original data is abcdefgh (8 bytes), and after 3 pushes by the BPF program, it becomes 11-byte data: abc?de?fgh?. Then, we set cork_bytes to 6, which means the first 6 bytes have been processed, and the remaining 5 bytes ?fgh? will be cached until the length meets the cork_bytes requirement. However, some data in ?fgh? is not within 'sg->msg_iter' (but in msg_pl instead), especially the data ? we pushed. So it doesn't seem as simple as just reverting through an offset of msg_iter. 3. For non-TLS sockets in tcp_bpf_sendmsg, when a cork situation occurs, the user-space send() doesn't return an error, and the returned length is the same as the input length parameter, even if some data is cached. Additionally, I saw that the current non-zero- copy logic for handling corking is written as: ''' line 1177 else if (ret != -EAGAIN) { if (ret ==
-ENOSPC) ret = 0; goto send_end; ''' So it's ok to just return 'copied' without error when a cork situation occurs. (CVE-2025-38166)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38166
https://security-tracker.debian.org/tracker/CVE-2025-38166
https://ubuntu.com/security/CVE-2025-38166

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38166

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247858 - Linux Distros Unpatched Vulnerability : CVE-2025-38168
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- perf: arm-ni: Unregister PMUs on probe failure When a resource allocation fails in one clock domain of an NI device, we need to properly roll back all previously registered perf PMUs in other clock domains of the same device. Otherwise, it can lead to kernel panics. Calling arm_ni_init+0x0/0xff8 [arm_ni] @ 2374 arm-ni ARMHCB70:00: Failed to request PMU region 0x1f3c13000 arm-ni ARMHCB70:00: probe with driver arm-ni failed with error -16 list_add corruption: next->prev should be prev (fffffd01e9698a18), but was 0000000000000000. (next=ffff10001a0decc8). pstate: 6340009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : list_add_valid_or_report+0x7c/0xb8 lr : list_add_valid_or_report+0x7c/0xb8 Call trace:
__list_add_valid_or_report+0x7c/0xb8 perf_pmu_register+0x22c/0x3a0 arm_ni_probe+0x554/0x70c [arm_ni] platform_probe+0x70/0xe8 really_probe+0xc6/0x4d8 driver_probe_device+0x48/0x170 __driver_attach+0x8e/0x1c0 bus_for_each_dev+0x64/0xf0 driver_add+0x138/0x260 bus_add_driver+0x68/0x138
__platform_driver_register+0x2c/0x40 arm_ni_init+0x14/0x2a [arm_ni] do_init_module+0x36/0x298 ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Oops - BUG: Fatal exception SMP: stopping secondary CPUs (CVE-2025-38168)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38168
https://ubuntu.com/security/CVE-2025-38168

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38168

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245509 - Linux Distros Unpatched Vulnerability : CVE-2025-38169
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP On system with SME, a thread's kernel FPSIMD state may be erroneously clobbered during a context switch immediately after that state is restored. Systems without SME are unaffected. If the CPU happens to be in streaming SVE mode before a context switch to a thread with kernel FPSIMD state, fpsimd_thread_switch() will restore the kernel FPSIMD state using fpsimd_load_kernel_state() while the CPU is still in streaming SVE mode. When fpsimd_thread_switch() subsequently calls fpsimd_flush_cpu_state(), this will execute an SMSTOP, causing an exit from streaming SVE mode. The exit from streaming SVE mode will cause the hardware to reset a number of FPSIMD/SVE/SME registers, clobbering the FPSIMD state. Fix this by calling fpsimd_flush_cpu_state() before restoring the kernel FPSIMD state. (CVE-2025-38169)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38169
https://ubuntu.com/security/CVE-2025-38169

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38169

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244583 - Linux Distros Unpatched Vulnerability : CVE-2025-38170
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- arm64/fpsimd: Discard stale CPU state when handling SME traps The logic for handling SME traps manipulates saved FPSIMD/SVE/SME state incorrectly, and a race with preemption can result in a task having TIF_SME set and TIF_FOREIGN_FPSTATE clear even though the live CPU state is stale (e.g. with SME traps enabled). This can result in warnings from do_sme_acc() where SME traps are not expected while TIF_SME is set: | /* With TIF_SME userspace shouldn't generate any traps */ | if (test_and_set_thread_flag(TIF_SME)) | WARN_ON(1);
This is very similar to the SVE issue we fixed in commit: 751ecf6afd6568ad (arm64/sve: Discard stale CPU state when handling SVE traps) The race can occur when the SME trap handler is preempted before and after manipulating the saved FPSIMD/SVE/SME state, starting and ending on the same CPU, e.g. | void do_sme_acc(unsigned long esr, struct pt_regs *regs) | { | // Trap on CPU 0 with TIF_SME clear, SME traps enabled | // task->fpsimd_cpu is 0. | // per_cpu_ptr(&fpsimd_last_state, 0) is task. | | ... | | // Preempted; migrated from CPU 0 to CPU 1. | // TIF_FOREIGN_FPSTATE is set. | | get_cpu_fpsimd_context(); | | /* With TIF_SME userspace shouldn't generate any traps */ | if (test_and_set_thread_flag(TIF_SME)) | WARN_ON(1); | | if (!test_thread_flag(TIF_FOREIGN_FPSTATE)) { | unsigned long vq_minus_one = | sve_vq_from_vl(task_get_sme_vl(current)) - 1; | sme_set_vq(vq_minus_one); | | fpsimd_bind_task_to_cpu(); | } | | put_cpu_fpsimd_context(); | | // Preempted; migrated from CPU 1 to CPU 0. | // task->fpsimd_cpu is still 0 | // If per_cpu_ptr(&fpsimd_last_state, 0) is still task then: | // - Stale HW state is reused (with SME traps enabled) | // - TIF_FOREIGN_FPSTATE is cleared | // - A return to userspace skips HW state restore | } Fix the case where the state is not live and TIF_FOREIGN_FPSTATE is set by calling fpsimd_flush_task_state() to detach from the saved CPU state. This ensures that a subsequent context switch will not reuse the stale CPU state, and will instead set TIF_FOREIGN_FPSTATE, forcing the new state to be reloaded from memory prior to a return to userspace. Note: this was originallly posted as [1]. [ Rutland: rewrite commit message ] (CVE-2025-38170)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38170
https://ubuntu.com/security/CVE-2025-38170

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.0 (CVSS2#AV:L/AC:H/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38170

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248274 - Linux Distros Unpatched Vulnerability : CVE-2025-38180
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: atm: fix /proc/net/atm/lec handling /proc/net/atm/lec must ensure safety against dev_lec[] changes.
It appears it had dev_put() calls without prior dev_hold(), leading to imbalance and UAF. (CVE-2025-38180)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38180
https://ubuntu.com/security/CVE-2025-38180

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38180

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246914 - Linux Distros Unpatched Vulnerability : CVE-2025-38181
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). syzkaller reported a null-ptr-deref in sock_omalloc() while allocating a CALIPSO option. [0] The NULL is of struct sock, which was fetched by sk_to_full_sk() in calipso_req_setattr(). Since commit a1a5344ddbe8 (tcp: avoid two atomic ops for syncookies), reqsk->rsk_listener could be NULL when SYN Cookie is returned to its client, as hinted by the leading SYN Cookie log. Here are 3 options to fix the bug: 1) Return 0 in calipso_req_setattr() 2) Return an error in calipso_req_setattr() 3) Alaways set rsk_listener 1) is no go as it bypasses LSM, but 2) effectively disables SYN Cookie for CALIPSO. 3) is also no go as there have been many efforts to reduce atomic ops and make TCP robust against DDoS. See also commit 3b24d854cb35 (tcp/dccp: do not touch listener sk_refcnt under synflood). As of the blamed commit, SYN Cookie already did not need refcounting, and no one has stumbled on the bug for 9 years, so no CALIPSO user will care about SYN Cookie. Let's return an error in calipso_req_setattr() and calipso_req_delattr() in the SYN Cookie case. This can be reproduced by [1] on Fedora and now connect() of nc times out. [0]: TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] CPU: 3 UID: 0 PID: 12262 Comm: syz.1.2611 Not tainted 6.14.0 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:read_pnet include/net/net_namespace.h:406 [inline] RIP: 0010:sock_net include/net/sock.h:655 [inline] RIP: 0010:sock_kmalloc+0x35/0x170 net/core/sock.c:2806 Code: 89 d5 41 54 55 89 f5 53 48 89 fb e8 25 e3 c6 fd e8 f0 91 e3 00 48 8d 7b 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 26 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b RSP: 0018:ffff88811af89038 EFLAGS: 00010216 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff888105266400 RDX: 0000000000000006 RSI: ffff88800c890000 RDI: 0000000000000030 RBP: 0000000000000050 R08: 0000000000000000 R09:
ffff88810526640e R10: ffffed1020a4cc81 R11: ffff88810526640f R12: 0000000000000000 R13: 0000000000000820 R14: ffff888105266400 R15: 0000000000000050 FS: 00007f0653a07640(0000) GS:ffff88811af80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f863ba096f4 CR3:
00000000163c0005 CR4: 0000000000770ef0 PKRU: 80000000 Call Trace: <IRQ> ipv6_renew_options+0x279/0x950 net/ipv6/exthdrs.c:1288 calipso_req_setattr+0x181/0x340 net/ipv6/calipso.c:1204 calipso_req_setattr+0x56/0x80 net/netlabel/netlabel_calipso.c:597 netlbl_req_setattr+0x18a/0x440 net/netlabel/netlabel_kapi.c:1249 selinux_netlbl_inet_conn_request+0x1fb/0x320 security/selinux/netlabel.c:342 selinux_inet_conn_request+0x1eb/0x2c0 security/selinux/hooks.c:5551 security_inet_conn_request+0x50/0xa0 security/security.c:4945 tcp_v6_route_req+0x22c/0x550 net/ipv6/tcp_ipv6.c:825 tcp_conn_request+0xec8/0x2b70 net/ipv4/tcp_input.c:7275 tcp_v6_conn_request+0x1e3/0x440 net/ipv6/tcp_ipv6.c:1328 tcp_rcv_state_process+0xafa/0x52b0 net/ipv4/tcp_input.c:6781 tcp_v6_do_rcv+0x8a6/0x1a40 net/ipv6/tcp_ipv6.c:1667 tcp_v6_rcv+0x505e/0x5b50 net/ipv6/tcp_ipv6.c:1904 ip6_protocol_deliver_rcu+0x17c/0x1da0 net/ipv6/ip6_input.c:436 ip6_input_finish+0x103/0x180 net/ipv6/ip6_input.c:480 NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] ip6_input+0x13c/0x6b0 net/ipv6/ip6_input.c:491 dst_input include/net/dst.h:469 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline] ip6_rcv_finish+0xb6/0x490 net/ipv6/ip6_input.c:69 NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netf
---truncated--- (CVE-2025-38181)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38181
https://ubuntu.com/security/CVE-2025-38181

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38181

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243885 - Linux Distros Unpatched Vulnerability : CVE-2025-38184
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer The reproduction steps: 1. create a tun interface 2. enable l2 bearer 3. TIPC_NL_UDP_GET_REMOTEIP with media name set to tun tipc: Started in network mode tipc: Node identity 8af312d38a21, cluster identity 4711 tipc: Enabled bearer <eth:syz_tun>, priority 1 Oops: general protection fault KASAN: null-ptr-deref in range CPU: 1 UID: 1000 PID: 559 Comm:
poc Not tainted 6.16.0-rc1+ #117 PREEMPT Hardware name: QEMU Ubuntu 24.04 PC RIP:
0010:tipc_udp_nl_dump_remoteip+0x4a4/0x8f0 the ub was in fact a struct dev. when bid != 0 && skip_cnt != 0, bearer_list[bid] may be NULL or other media when other thread changes it. fix this by checking media_id. (CVE-2025-38184)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38184
https://ubuntu.com/security/CVE-2025-38184

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38184

Plugin Information
Published: 2025/08/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247891 - Linux Distros Unpatched Vulnerability : CVE-2025-38186
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() Before the commit under the Fixes tag below, bnxt_ulp_stop() and bnxt_ulp_start() were always invoked in pairs. After that commit, the new bnxt_ulp_restart() can be invoked after bnxt_ulp_stop() has been called. This may result in the RoCE driver's aux driver .suspend() method being invoked twice. The 2nd bnxt_re_suspend() call will crash when it dereferences a NULL pointer:
(NULL ib_device): Handle device suspend call BUG: kernel NULL pointer dereference, address:
0000000000000b78 PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 20 UID: 0 PID: 181 Comm: kworker/u96:5 Tainted: G S 6.15.0-rc1 #4 PREEMPT(voluntary) Tainted: [S]=CPU_OUT_OF_SPEC Hardware name: Dell Inc.
PowerEdge R730/072T6D, BIOS 2.4.3 01/17/2017 Workqueue: bnxt_pf_wq bnxt_sp_task [bnxt_en] RIP:
0010:bnxt_re_suspend+0x45/0x1f0 [bnxt_re] Code: 8b 05 a7 3c 5b f5 48 89 44 24 18 31 c0 49 8b 5c 24 08 4d 8b 2c 24 e8 ea 06 0a f4 48 c7 c6 04 60 52 c0 48 89 df e8 1b ce f9 ff <48> 8b 83 78 0b 00 00 48 8b 80 38 03 00 00 a8 40 0f 85 b5 00 00 00 RSP: 0018:ffffa2e84084fd88 EFLAGS: 00010246 RAX: 0000000000000000 RBX:
0000000000000000 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffffffb4b6b934 RDI: 00000000ffffffff RBP: ffffa1760954c9c0 R08: 0000000000000000 R09: c0000000ffffdfff R10: 0000000000000001 R11:
ffffa2e84084fb50 R12: ffffa176031ef070 R13: ffffa17609775000 R14: ffffa17603adc180 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffffa17daa397000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000b78 CR3: 00000004aaa30003 CR4: 00000000003706f0 DR0:
0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> bnxt_ulp_stop+0x69/0x90 [bnxt_en] bnxt_sp_task+0x678/0x920 [bnxt_en] ? __schedule+0x514/0xf50 process_scheduled_works+0x9d/0x400 worker_thread+0x11c/0x260 ?
__pfx_worker_thread+0x10/0x10 kthread+0xfe/0x1e0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2b/0x40 ?
__pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 Check the BNXT_EN_FLAG_ULP_STOPPED flag and do not proceed if the flag is already set. This will preserve the original symmetrical bnxt_ulp_stop() and bnxt_ulp_start(). Also, inside bnxt_ulp_start(), clear the BNXT_EN_FLAG_ULP_STOPPED flag after taking the mutex to avoid any race condition. And for symmetry, only proceed in bnxt_ulp_start() if the BNXT_EN_FLAG_ULP_STOPPED is set. (CVE-2025-38186)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38186
https://ubuntu.com/security/CVE-2025-38186

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38186

Plugin Information
Published: 2025/08/11, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247011 - Linux Distros Unpatched Vulnerability : CVE-2025-38190
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. In vcc_sendmsg(), we account skb->truesize to sk->sk_wmem_alloc by atm_account_tx(). It is expected to be reverted by atm_pop_raw() later called by vcc->dev->ops->send(vcc, skb). However, vcc_sendmsg() misses the same revert when copy_from_iter_full() fails, and then we will leak a socket. Let's factorise the revert part as atm_return_tx() and call it in the failure path. Note that the corresponding sk_wmem_alloc operation can be found in alloc_tx() as of the blamed commit. $ git blame -L:alloc_tx net/atm/common.c c55fa3cccbc2c~ (CVE-2025-38190)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38190
https://ubuntu.com/security/CVE-2025-38190

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38190

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249374 - Linux Distros Unpatched Vulnerability : CVE-2025-38192
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: clear the dst when changing skb protocol A not-so-careful NAT46 BPF program can crash the kernel if it indiscriminately flips ingress packets from v4 to v6: BUG: kernel NULL pointer dereference, address:
0000000000000000 ip6_rcv_core (net/ipv6/ip6_input.c:190:20) ipv6_rcv (net/ipv6/ip6_input.c:306:8) process_backlog (net/core/dev.c:6186:4) napi_poll (net/core/dev.c:6906:9) net_rx_action (net/core/dev.c:7028:13) do_softirq (kernel/softirq.c:462:3) netif_rx (net/core/dev.c:5326:3) dev_loopback_xmit (net/core/dev.c:4015:2) ip_mc_finish_output (net/ipv4/ip_output.c:363:8) NF_HOOK (./include/linux/netfilter.h:314:9) ip_mc_output (net/ipv4/ip_output.c:400:5) dst_output (./include/net/dst.h:459:9) ip_local_out (net/ipv4/ip_output.c:130:9) ip_send_skb (net/ipv4/ip_output.c:1496:8) udp_send_skb (net/ipv4/udp.c:1040:8) udp_sendmsg (net/ipv4/udp.c:1328:10) The output interface has a 4->6 program attached at ingress. We try to loop the multicast skb back to the sending socket. Ingress BPF runs as part of netif_rx(), pushes a valid v6 hdr and changes skb->protocol to v6. We enter ip6_rcv_core which tries to use skb_dst(). But the dst is still an IPv4 one left after IPv4 mcast output. Clear the dst in all BPF helpers which change the protocol. Try to preserve metadata dsts, those may carry non-routing metadata. (CVE-2025-38192)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38192
https://security-tracker.debian.org/tracker/CVE-2025-38192
https://ubuntu.com/security/CVE-2025-38192

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38192

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249853 - Linux Distros Unpatched Vulnerability : CVE-2025-38197
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- platform/x86: dell_rbu: Fix list usage Pass the correct list head to list_for_each_entry*() when looping through the packet list. Without this patch, reading the packet data via sysfs will show the data incorrectly (because it starts at the wrong packet), and clearing the packet list will result in a NULL pointer dereference. (CVE-2025-38197)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38197
https://ubuntu.com/security/CVE-2025-38197

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38197

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244645 - Linux Distros Unpatched Vulnerability : CVE-2025-38199
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath12k: Fix memory leak due to multiple rx_stats allocation rx_stats for each arsta is allocated when adding a station. arsta->rx_stats will be freed when a station is removed. Redundant allocations are occurring when the same station is added multiple times. This causes ath12k_mac_station_add() to be called multiple times, and rx_stats is allocated each time. As a result there is memory leaks. Prevent multiple allocations of rx_stats when ath12k_mac_station_add() is called repeatedly by checking if rx_stats is already allocated before allocating again. Allocate arsta->rx_stats if arsta->rx_stats is NULL respectively. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 (CVE-2025-38199)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38199
https://security-tracker.debian.org/tracker/CVE-2025-38199
https://ubuntu.com/security/CVE-2025-38199

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38199

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249084 - Linux Distros Unpatched Vulnerability : CVE-2025-38202
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() bpf_map_lookup_percpu_elem() helper is also available for sleepable bpf program. When BPF JIT is disabled or under 32-bit host, bpf_map_lookup_percpu_elem() will not be inlined. Using it in a sleepable bpf program will trigger the warning in bpf_map_lookup_percpu_elem(), because the bpf program only holds rcu_read_lock_trace lock.
Therefore, add the missed check. (CVE-2025-38202)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38202
https://ubuntu.com/security/CVE-2025-38202

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38202

Plugin Information
Published: 2025/08/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246804 - Linux Distros Unpatched Vulnerability : CVE-2025-38208
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smb: client: add NULL check in automount_fullpath page is checked for null in
__build_path_from_dentry_optional_prefix when tcon->origin_fullpath is not set. However, the check is missing when it is set. Add a check to prevent a potential NULL pointer dereference. (CVE-2025-38208)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38208
https://ubuntu.com/security/CVE-2025-38208

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38208

Plugin Information
Published: 2025/08/09, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248055 - Linux Distros Unpatched Vulnerability : CVE-2025-38210
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- configfs-tsm-report: Fix NULL dereference of tsm_ops Unlike sysfs, the lifetime of configfs objects is controlled by userspace. There is no mechanism for the kernel to find and delete all created config-items.
Instead, the configfs-tsm-report mechanism has an expectation that tsm_unregister() can happen at any time and cause established config-item access to start failing. That expectation is not fully satisfied. While tsm_report_read(), tsm_report_{is,is_bin}_visible(), and tsm_report_make_item() safely fail if tsm_ops have been unregistered, tsm_report_privlevel_store() tsm_report_provider_show() fail to check for ops registration. Add the missing checks for tsm_ops having been removed. Now, in supporting the ability for tsm_unregister() to always succeed, it leaves the problem of what to do with lingering config-items. The expectation is that the admin that arranges for the ->remove() (unbind) of the ${tsm_arch}-guest driver is also responsible for deletion of all open config-items. Until that deletion happens, ->probe() (reload / bind) of the ${tsm_arch}-guest driver fails. This allows for emergency shutdown / revocation of attestation interfaces, and requires coordinated restart. (CVE-2025-38210)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38210
https://ubuntu.com/security/CVE-2025-38210

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38210

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249472 - Linux Distros Unpatched Vulnerability : CVE-2025-38214
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var If fb_add_videomode() in fb_set_var() fails to allocate memory for fb_videomode, later it may lead to a null-ptr dereference in fb_videomode_to_var(), as the fb_info is registered while not having the mode in modelist that is expected to be there, i.e. the one that is described in fb_info->var.
================================================================ general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 30371 Comm: syz-executor.1 Not tainted 5.10.226-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP:
0010:fb_videomode_to_var+0x24/0x610 drivers/video/fbdev/core/modedb.c:901 Call Trace:
display_to_var+0x3a/0x7c0 drivers/video/fbdev/core/fbcon.c:929 fbcon_resize+0x3e2/0x8f0 drivers/video/fbdev/core/fbcon.c:2071 resize_screen drivers/tty/vt/vt.c:1176 [inline] vc_do_resize+0x53a/0x1170 drivers/tty/vt/vt.c:1263 fbcon_modechanged+0x3ac/0x6e0 drivers/video/fbdev/core/fbcon.c:2720 fbcon_update_vcs+0x43/0x60 drivers/video/fbdev/core/fbcon.c:2776 do_fb_ioctl+0x6d2/0x740 drivers/video/fbdev/core/fbmem.c:1128 fb_ioctl+0xe7/0x150 drivers/video/fbdev/core/fbmem.c:1203 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 ================================================================ The reason is that fb_info->var is being modified in fb_set_var(), and then fb_videomode_to_var() is called. If it fails to add the mode to fb_info->modelist, fb_set_var() returns error, but does not restore the old value of fb_info->var. Restore fb_info->var on failure the same way it is done earlier in the function. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. (CVE-2025-38214)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38214
https://ubuntu.com/security/CVE-2025-38214

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38214

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245026 - Linux Distros Unpatched Vulnerability : CVE-2025-38215
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var If fb_add_videomode() in do_register_framebuffer() fails to allocate memory for fb_videomode, it will later lead to a null-ptr dereference in fb_videomode_to_var(), as the fb_info is registered while not having the mode in modelist that is expected to be there, i.e. the one that is described in fb_info->var.
================================================================ general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 30371 Comm: syz-executor.1 Not tainted 5.10.226-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP:
0010:fb_videomode_to_var+0x24/0x610 drivers/video/fbdev/core/modedb.c:901 Call Trace:
display_to_var+0x3a/0x7c0 drivers/video/fbdev/core/fbcon.c:929 fbcon_resize+0x3e2/0x8f0 drivers/video/fbdev/core/fbcon.c:2071 resize_screen drivers/tty/vt/vt.c:1176 [inline] vc_do_resize+0x53a/0x1170 drivers/tty/vt/vt.c:1263 fbcon_modechanged+0x3ac/0x6e0 drivers/video/fbdev/core/fbcon.c:2720 fbcon_update_vcs+0x43/0x60 drivers/video/fbdev/core/fbcon.c:2776 do_fb_ioctl+0x6d2/0x740 drivers/video/fbdev/core/fbmem.c:1128 fb_ioctl+0xe7/0x150 drivers/video/fbdev/core/fbmem.c:1203 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 ================================================================ Even though fbcon_init() checks beforehand if fb_match_mode() in var_to_display() fails, it can not prevent the panic because fbcon_init() does not return error code. Considering this and the comment in the code about fb_match_mode() returning NULL - This should not happen - it is better to prevent registering the fb_info if its mode was not set successfully. Also move fb_add_videomode() closer to the beginning of do_register_framebuffer() to avoid having to do the cleanup on fail. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
(CVE-2025-38215)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38215
https://security-tracker.debian.org/tracker/CVE-2025-38215
https://ubuntu.com/security/CVE-2025-38215

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38215

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250231 - Linux Distros Unpatched Vulnerability : CVE-2025-38231
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference In nfs4_state_start_net(), laundromat_work may access nfsd_ssc through nfs4_laundromat -> nfsd4_ssc_expire_umount. If nfsd_ssc isn't initialized, this can cause NULL pointer dereference. Normally the delayed start of laundromat_work allows sufficient time for nfsd_ssc initialization to complete. However, when the kernel waits too long for userspace responses (e.g. in nfs4_state_start_net -> nfsd4_end_grace -> nfsd4_record_grace_done ->
nfsd4_cld_grace_done -> cld_pipe_upcall -> __cld_pipe_upcall -> wait_for_completion path), the delayed work may start before nfsd_ssc initialization finishes. Fix this by moving nfsd_ssc initialization before starting laundromat_work. (CVE-2025-38231)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38231
https://ubuntu.com/security/CVE-2025-38231

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38231

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245291 - Linux Distros Unpatched Vulnerability : CVE-2025-38232
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NFSD: fix race between nfsd registration and exports_proc As of now nfsd calls create_proc_exports_entry() at start of init_nfsd and cleanup by remove_proc_entry() at last of exit_nfsd. Which causes kernel OOPs if there is race between below 2 operations: (i) exportfs -r (ii) mount -t nfsd none /proc/fs/nfsd for 5.4 kernel ARM64: CPU 1: el1_irq+0xbc/0x180 arch_counter_get_cntvct+0x14/0x18 running_clock+0xc/0x18 preempt_count_add+0x88/0x110 prep_new_page+0xb0/0x220 get_page_from_freelist+0x2d8/0x1778
__alloc_pages_nodemask+0x15c/0xef0 __vmalloc_node_range+0x28c/0x478 __vmalloc_node_flags_caller+0x8c/0xb0 kvmalloc_node+0x88/0xe0 nfsd_init_net+0x6c/0x108 [nfsd] ops_init+0x44/0x170 register_pernet_operations+0x114/0x270 register_pernet_subsys+0x34/0x50 init_nfsd+0xa8/0x718 [nfsd] do_one_initcall+0x54/0x2e0 CPU 2 : Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 PC is at : exports_net_open+0x50/0x68 [nfsd] Call trace: exports_net_open+0x50/0x68 [nfsd] exports_proc_open+0x2c/0x38 [nfsd] proc_reg_open+0xb8/0x198 do_dentry_open+0x1c4/0x418 vfs_open+0x38/0x48 path_openat+0x28c/0xf18 do_filp_open+0x70/0xe8 do_sys_open+0x154/0x248 Sometimes it crashes at exports_net_open() and sometimes cache_seq_next_rcu(). and same is happening on latest 6.14 kernel as well: [ 0.000000] Linux version 6.14.0-rc5-next-20250304-dirty ... [ 285.455918] Unable to handle kernel paging request at virtual address 00001f4800001f48 ... [ 285.464902] pc :
cache_seq_next_rcu+0x78/0xa4 ... [ 285.469695] Call trace: [ 285.470083] cache_seq_next_rcu+0x78/0xa4 (P) [ 285.470488] seq_read+0xe0/0x11c [ 285.470675] proc_reg_read+0x9c/0xf0 [ 285.470874] vfs_read+0xc4/0x2fc [ 285.471057] ksys_read+0x6c/0xf4 [ 285.471231] __arm64_sys_read+0x1c/0x28 [ 285.471428] invoke_syscall+0x44/0x100 [ 285.471633] el0_svc_common.constprop.0+0x40/0xe0 [ 285.471870] do_el0_svc_compat+0x1c/0x34 [ 285.472073] el0_svc_compat+0x2c/0x80 [ 285.472265] el0t_32_sync_handler+0x90/0x140 [ 285.472473] el0t_32_sync+0x19c/0x1a0 [ 285.472887] Code: f9400885 93407c23 937d7c27 11000421 (f86378a3) [ 285.473422] ---[ end trace 0000000000000000 ]--- It reproduced simply with below script: while [ 1 ] do /exportfs -r done & while [ 1 ] do insmod /nfsd.ko mount -t nfsd none /proc/fs/nfsd umount /proc/fs/nfsd rmmod nfsd done & So exporting interfaces to user space shall be done at last and cleanup at first place. With change there is no Kernel OOPs. (CVE-2025-38232)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38232
https://security-tracker.debian.org/tracker/CVE-2025-38232
https://ubuntu.com/security/CVE-2025-38232

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38232

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248032 - Linux Distros Unpatched Vulnerability : CVE-2025-38234
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sched/rt: Fix race in push_rt_task Overview ======== When a CPU chooses to call push_rt_task and picks a task to push to another CPU's runqueue then it will call find_lock_lowest_rq method which would take a double lock on both CPUs' runqueues. If one of the locks aren't readily available, it may lead to dropping the current runqueue lock and reacquiring both the locks at once. During this window it is possible that the task is already migrated and is running on some other CPU. These cases are already handled. However, if the task is migrated and has already been executed and another CPU is now trying to wake it up (ttwu) such that it is queued again on the runqeue (on_rq is 1) and also if the task was run by the same CPU, then the current checks will pass even though the task was migrated out and is no longer in the pushable tasks list. Crashes ======= This bug resulted in quite a few flavors of crashes triggering kernel panics with various crash signatures such as assert failures, page faults, null pointer dereferences, and queue corruption errors all coming from scheduler itself. Some of the crashes: -> kernel BUG at kernel/sched/rt.c:1616! BUG_ON(idx >= MAX_RT_PRIO) Call Trace: ? __die_body+0x1a/0x60 ? die+0x2a/0x50 ? do_trap+0x85/0x100 ? pick_next_task_rt+0x6e/0x1d0 ? do_error_trap+0x64/0xa0 ? pick_next_task_rt+0x6e/0x1d0 ? exc_invalid_op+0x4c/0x60 ? pick_next_task_rt+0x6e/0x1d0 ? asm_exc_invalid_op+0x12/0x20 ? pick_next_task_rt+0x6e/0x1d0 __schedule+0x5cb/0x790 ? update_ts_time_stats+0x55/0x70 schedule_idle+0x1e/0x40 do_idle+0x15e/0x200 cpu_startup_entry+0x19/0x20 start_secondary+0x117/0x160 secondary_startup_64_no_verify+0xb0/0xbb -> BUG: kernel NULL pointer dereference, address:
00000000000000c0 Call Trace: ? __die_body+0x1a/0x60 ? no_context+0x183/0x350 ? __warn+0x8a/0xe0 ? exc_page_fault+0x3d6/0x520 ? asm_exc_page_fault+0x1e/0x30 ? pick_next_task_rt+0xb5/0x1d0 ? pick_next_task_rt+0x8c/0x1d0 __schedule+0x583/0x7e0 ? update_ts_time_stats+0x55/0x70 schedule_idle+0x1e/0x40 do_idle+0x15e/0x200 cpu_startup_entry+0x19/0x20 start_secondary+0x117/0x160 secondary_startup_64_no_verify+0xb0/0xbb -> BUG: unable to handle page fault for address: ffff9464daea5900 kernel BUG at kernel/sched/rt.c:1861! BUG_ON(rq->cpu != task_cpu(p)) -> kernel BUG at kernel/sched/rt.c:1055! BUG_ON(!rq->nr_running) Call Trace: ? __die_body+0x1a/0x60 ? die+0x2a/0x50 ? do_trap+0x85/0x100 ? dequeue_top_rt_rq+0xa2/0xb0 ? do_error_trap+0x64/0xa0 ? dequeue_top_rt_rq+0xa2/0xb0 ? exc_invalid_op+0x4c/0x60 ? dequeue_top_rt_rq+0xa2/0xb0 ? asm_exc_invalid_op+0x12/0x20 ? dequeue_top_rt_rq+0xa2/0xb0 dequeue_rt_entity+0x1f/0x70 dequeue_task_rt+0x2d/0x70 __schedule+0x1a8/0x7e0 ? blk_finish_plug+0x25/0x40 schedule+0x3c/0xb0 futex_wait_queue_me+0xb6/0x120 futex_wait+0xd9/0x240 do_futex+0x344/0xa90 ? get_mm_exe_file+0x30/0x60 ? audit_exe_compare+0x58/0x70 ? audit_filter_rules.constprop.26+0x65e/0x1220 __x64_sys_futex+0x148/0x1f0 do_syscall_64+0x30/0x80 entry_SYSCALL_64_after_hwframe+0x62/0xc7 -> BUG: unable to handle page fault for address: ffff8cf3608bc2c0 Call Trace: ? __die_body+0x1a/0x60 ? no_context+0x183/0x350 ? spurious_kernel_fault+0x171/0x1c0 ? exc_page_fault+0x3b6/0x520 ? plist_check_list+0x15/0x40 ? plist_check_list+0x2e/0x40 ? asm_exc_page_fault+0x1e/0x30 ? _cond_resched+0x15/0x30 ? futex_wait_queue_me+0xc8/0x120 ? futex_wait+0xd9/0x240 ? try_to_wake_up+0x1b8/0x490 ? futex_wake+0x78/0x160 ? do_futex+0xcd/0xa90 ? plist_check_list+0x15/0x40 ? plist_check_list+0x2e/0x40 ? plist_del+0x6a/0xd0 ? plist_check_list+0x15/0x40 ? plist_check_list+0x2e/0x40 ? dequeue_pushable_task+0x20/0x70 ? __schedule+0x382/0x7e0 ? asm_sysvec_reschedule_i ---truncated--- (CVE-2025-38234)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38234
https://security-tracker.debian.org/tracker/CVE-2025-38234
https://ubuntu.com/security/CVE-2025-38234

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38234

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247690 - Linux Distros Unpatched Vulnerability : CVE-2025-38238
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out When both the RHBA and RPA FDMI requests time out, fnic reuses a frame to send ABTS for each of them. On send completion, this causes an attempt to free the same frame twice that leads to a crash. Fix crash by allocating separate frames for RHBA and RPA, and modify ABTS logic accordingly. Tested by checking MDS for FDMI information. Tested by using instrumented driver to: - Drop PLOGI response - Drop RHBA response - Drop RPA response - Drop RHBA and RPA response - Drop PLOGI response + ABTS response - Drop RHBA response + ABTS response - Drop RPA response + ABTS response - Drop RHBA and RPA response + ABTS response for both of them (CVE-2025-38238)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38238
https://ubuntu.com/security/CVE-2025-38238

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38238

Plugin Information
Published: 2025/08/10, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247739 - Linux Distros Unpatched Vulnerability : CVE-2025-38244
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smb: client: fix potential deadlock when reconnecting channels Fix cifs_signal_cifsd_for_reconnect() to take the correct lock order and prevent the following deadlock from happening ====================================================== WARNING: possible circular locking dependency detected 6.16.0-rc3-build2+ #1301 Tainted: G S W ------------------------------------------------------ cifsd/6055 is trying to acquire lock: ffff88810ad56038 (&tcp_ses->srv_lock){+.+.}-{3:3}, at:
cifs_signal_cifsd_for_reconnect+0x134/0x200 but task is already holding lock: ffff888119c64330 (&ret_buf->chan_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0xcf/0x200 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&ret_buf->chan_lock){+.+.}-{3:3}: validate_chain+0x1cf/0x270 __lock_acquire+0x60e/0x780 lock_acquire.part.0+0xb4/0x1f0 _raw_spin_lock+0x2f/0x40 cifs_setup_session+0x81/0x4b0 cifs_get_smb_ses+0x771/0x900 cifs_mount_get_session+0x7e/0x170 cifs_mount+0x92/0x2d0 cifs_smb3_do_mount+0x161/0x460 smb3_get_tree+0x55/0x90 vfs_get_tree+0x46/0x180 do_new_mount+0x1b0/0x2e0 path_mount+0x6ee/0x740 do_mount+0x98/0xe0 __do_sys_mount+0x148/0x180 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x76/0x7e -> #1 (&ret_buf->ses_lock){+.+.}-{3:3}:
validate_chain+0x1cf/0x270 __lock_acquire+0x60e/0x780 lock_acquire.part.0+0xb4/0x1f0
_raw_spin_lock+0x2f/0x40 cifs_match_super+0x101/0x320 sget+0xab/0x270 cifs_smb3_do_mount+0x1e0/0x460 smb3_get_tree+0x55/0x90 vfs_get_tree+0x46/0x180 do_new_mount+0x1b0/0x2e0 path_mount+0x6ee/0x740 do_mount+0x98/0xe0 __do_sys_mount+0x148/0x180 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x76/0x7e -> #0 (&tcp_ses->srv_lock){+.+.}-{3:3}:
check_noncircular+0x95/0xc0 check_prev_add+0x115/0x2f0 validate_chain+0x1cf/0x270
__lock_acquire+0x60e/0x780 lock_acquire.part.0+0xb4/0x1f0 _raw_spin_lock+0x2f/0x40 cifs_signal_cifsd_for_reconnect+0x134/0x200 __cifs_reconnect+0x8f/0x500 cifs_handle_standard+0x112/0x280 cifs_demultiplex_thread+0x64d/0xbc0 kthread+0x2f7/0x310 ret_from_fork+0x2a/0x230 ret_from_fork_asm+0x1a/0x30 other info that might help us debug this: Chain exists of: &tcp_ses->srv_lock
--> &ret_buf->ses_lock --> &ret_buf->chan_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&ret_buf->chan_lock); lock(&ret_buf->ses_lock); lock(&ret_buf->chan_lock); lock(&tcp_ses->srv_lock);
*** DEADLOCK *** 3 locks held by cifsd/6055: #0: ffffffff857de398 (&cifs_tcp_ses_lock){+.+.}-{3:3}, at:
cifs_signal_cifsd_for_reconnect+0x7b/0x200 #1: ffff888119c64060 (&ret_buf->ses_lock){+.+.}-{3:3}, at:
cifs_signal_cifsd_for_reconnect+0x9c/0x200 #2: ffff888119c64330 (&ret_buf->chan_lock){+.+.}-{3:3}, at:
cifs_signal_cifsd_for_reconnect+0xcf/0x200 (CVE-2025-38244)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38244
https://security-tracker.debian.org/tracker/CVE-2025-38244
https://ubuntu.com/security/CVE-2025-38244

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38244

Plugin Information
Published: 2025/08/10, Modified: 2025/11/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247584 - Linux Distros Unpatched Vulnerability : CVE-2025-38245
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). syzbot reported a warning below during atm_dev_register(). [0] Before creating a new device and procfs/sysfs for it, atm_dev_register() looks up a duplicated device by __atm_dev_lookup(). These operations are done under atm_dev_mutex.
However, when removing a device in atm_dev_deregister(), it releases the mutex just after removing the device from the list that __atm_dev_lookup() iterates over. So, there will be a small race window where the device does not exist on the device list but procfs/sysfs are still not removed, triggering the splat.
Let's hold the mutex until procfs/sysfs are removed in atm_dev_deregister(). [0]: proc_dir_entry 'atm/atmtcp:0' already registered WARNING: CPU: 0 PID: 5919 at fs/proc/generic.c:377 proc_register+0x455/0x5f0 fs/proc/generic.c:377 Modules linked in: CPU: 0 UID: 0 PID: 5919 Comm: syz- executor284 Not tainted 6.16.0-rc2-syzkaller-00047-g52da431bf03b #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:proc_register+0x455/0x5f0 fs/proc/generic.c:377 Code: 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 a2 01 00 00 48 8b 44 24 10 48 c7 c7 20 c0 c2 8b 48 8b b0 d8 00 00 00 e8 0c 02 1c ff 90 <0f> 0b 90 90 48 c7 c7 80 f2 82 8e e8 0b de 23 09 48 8b 4c 24 28 48 RSP: 0018:ffffc9000466fa30 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000000 RCX:
ffffffff817ae248 RDX: ffff888026280000 RSI: ffffffff817ae255 RDI: 0000000000000001 RBP: ffff8880232bed48 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12:
ffff888076ed2140 R13: dffffc0000000000 R14: ffff888078a61340 R15: ffffed100edda444 FS:
00007f38b3b0c6c0(0000) GS:ffff888124753000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 CR2: 00007f38b3bdf953 CR3: 0000000076d58000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400 Call Trace: <TASK> proc_create_data+0xbe/0x110 fs/proc/generic.c:585 atm_proc_dev_register+0x112/0x1e0 net/atm/proc.c:361 atm_dev_register+0x46d/0x890 net/atm/resources.c:113 atmtcp_create+0x77/0x210 drivers/atm/atmtcp.c:369 atmtcp_attach drivers/atm/atmtcp.c:403 [inline] atmtcp_ioctl+0x2f9/0xd60 drivers/atm/atmtcp.c:464 do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159 sock_do_ioctl+0x115/0x280 net/socket.c:1190 sock_ioctl+0x227/0x6b0 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline]
__x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP:
0033:0x7f38b3b74459 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f38b3b0c198 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX:
00007f38b3bfe318 RCX: 00007f38b3b74459 RDX: 0000000000000000 RSI: 0000000000006180 RDI: 0000000000000005 RBP: 00007f38b3bfe310 R08: 65732f636f72702f R09: 65732f636f72702f R10: 65732f636f72702f R11:
0000000000000246 R12: 00007f38b3bcb0ac R13: 00007f38b3b0c1a0 R14: 0000200000000200 R15: 00007f38b3bcb03b </TASK> (CVE-2025-38245)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38245
https://ubuntu.com/security/CVE-2025-38245

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38245

Plugin Information
Published: 2025/08/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247347 - Linux Distros Unpatched Vulnerability : CVE-2025-38246
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bnxt: properly flush XDP redirect lists We encountered following crash when testing a XDP_REDIRECT feature in production: [56251.579676] list_add corruption. next->prev should be prev (ffff93120dd40f30), but was ffffb301ef3a6740. (next=ffff93120dd 40f30). [56251.601413] ------------[ cut here ]------------ [56251.611357] kernel BUG at lib/list_debug.c:29! [56251.621082] Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [56251.632073] CPU: 111 UID: 0 PID: 0 Comm: swapper/111 Kdump: loaded Tainted: P O 6.12.33-cloudflare-2025.6. 3 #1 [56251.653155] Tainted: [P]=PROPRIETARY_MODULE, [O]=OOT_MODULE [56251.663877] Hardware name: MiTAC GC68B-B8032-G11P6-GPU/S8032GM-HE-CFR, BIOS V7.020.B10-sig 01/22/2025 [56251.682626] RIP: 0010:__list_add_valid_or_report+0x4b/0xa0 [56251.693203] Code: 0e 48 c7 c7 68 e7 d9 97 e8 42 16 fe ff 0f 0b 48 8b 52 08 48 39 c2 74 14 48 89 f1 48 c7 c7 90 e7 d9 97 48 89 c6 e8 25 16 fe ff <0f>
0b 4c 8b 02 49 39 f0 74 14 48 89 d1 48 c7 c7 e8 e7 d9 97 4c 89 [56251.725811] RSP: 0018:ffff93120dd40b80 EFLAGS: 00010246 [56251.736094] RAX: 0000000000000075 RBX: ffffb301e6bba9d8 RCX: 0000000000000000 [56251.748260] RDX: 0000000000000000 RSI: ffff9149afda0b80 RDI: ffff9149afda0b80 [56251.760349] RBP:
ffff9131e49c8000 R08: 0000000000000000 R09: ffff93120dd40a18 [56251.772382] R10: ffff9159cf2ce1a8 R11:
0000000000000003 R12: ffff911a80850000 [56251.784364] R13: ffff93120fbc7000 R14: 0000000000000010 R15:
ffff9139e7510e40 [56251.796278] FS: 0000000000000000(0000) GS:ffff9149afd80000(0000) knlGS:0000000000000000 [56251.809133] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [56251.819561] CR2:
00007f5e85e6f300 CR3: 00000038b85e2006 CR4: 0000000000770ef0 [56251.831365] PKRU: 55555554 [56251.838653] Call Trace: [56251.845560] <IRQ> [56251.851943] cpu_map_enqueue.cold+0x5/0xa [56251.860243] xdp_do_redirect+0x2d9/0x480 [56251.868388] bnxt_rx_xdp+0x1d8/0x4c0 [bnxt_en] [56251.877028] bnxt_rx_pkt+0x5f7/0x19b0 [bnxt_en] [56251.885665] ? cpu_max_write+0x1e/0x100 [56251.893510] ? srso_alias_return_thunk+0x5/0xfbef5 [56251.902276] __bnxt_poll_work+0x190/0x340 [bnxt_en] [56251.911058] bnxt_poll+0xab/0x1b0 [bnxt_en] [56251.919041] ? srso_alias_return_thunk+0x5/0xfbef5 [56251.927568] ? srso_alias_return_thunk+0x5/0xfbef5 [56251.935958] ? srso_alias_return_thunk+0x5/0xfbef5 [56251.944250]
__napi_poll+0x2b/0x160 [56251.951155] bpf_trampoline_6442548651+0x79/0x123 [56251.959262]
__napi_poll+0x5/0x160 [56251.966037] net_rx_action+0x3d2/0x880 [56251.973133] ? srso_alias_return_thunk+0x5/0xfbef5 [56251.981265] ? srso_alias_return_thunk+0x5/0xfbef5 [56251.989262] ?
__hrtimer_run_queues+0x162/0x2a0 [56251.996967] ? srso_alias_return_thunk+0x5/0xfbef5 [56252.004875] ? srso_alias_return_thunk+0x5/0xfbef5 [56252.012673] ? bnxt_msix+0x62/0x70 [bnxt_en] [56252.019903] handle_softirqs+0xcf/0x270 [56252.026650] irq_exit_rcu+0x67/0x90 [56252.032933] common_interrupt+0x85/0xa0 [56252.039498] </IRQ> [56252.044246] <TASK> [56252.048935] asm_common_interrupt+0x26/0x40 [56252.055727] RIP: 0010:cpuidle_enter_state+0xb8/0x420 [56252.063305] Code: dc 01 00 00 e8 f9 79 3b ff e8 64 f7 ff ff 49 89 c5 0f 1f 44 00 00 31 ff e8 a5 32 3a ff 45 84 ff 0f 85 ae 01 00 00 fb 45 85 f6 <0f> 88 88 01 00 00 48 8b 04 24 49 63 ce 4c 89 ea 48 6b f1 68 48 29 [56252.088911] RSP: 0018:ffff93120c97fe98 EFLAGS: 00000202 [56252.096912] RAX: ffff9149afd80000 RBX: ffff9141d3a72800 RCX: 0000000000000000 [56252.106844] RDX:
00003329176c6b98 RSI: ffffffe36db3fdc7 RDI: 0000000000000000 [56252.116733] RBP: 0000000000000002 R08:
0000000000000002 R09: 000000000000004e [56252.126652] R10: ffff9149afdb30c4 R11: 071c71c71c71c71c R12:
ffffffff985ff860 [56252.136637] R13: 00003329176c6b98 R14: 0000000000000002 R15: 0000000000000000 [56252.146667] ? cpuidle_enter_state+0xab/0x420 [56252.153909] cpuidle_enter+0x2d/0x40 [56252.160360] do_idle+0x176/0x1c0 [56252.166456 ---truncated--- (CVE-2025-38246)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38246
https://security-tracker.debian.org/tracker/CVE-2025-38246
https://ubuntu.com/security/CVE-2025-38246

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38246

Plugin Information
Published: 2025/08/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243886 - Linux Distros Unpatched Vulnerability : CVE-2025-38251
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- atm: clip: prevent NULL deref in clip_push() Blamed commit missed that vcc_destroy_socket() calls clip_push() with a NULL skb. If clip_devs is NULL, clip_push() then crashes when reading skb->truesize.
(CVE-2025-38251)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38251
https://ubuntu.com/security/CVE-2025-38251

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38251

Plugin Information
Published: 2025/08/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248063 - Linux Distros Unpatched Vulnerability : CVE-2025-38253
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- HID: wacom: fix crash in wacom_aes_battery_handler() Commit fd2a9b29dc9c (HID: wacom: Remove AES power_supply after extended inactivity) introduced wacom_aes_battery_handler() which is scheduled as a delayed work (aes_battery_work). In wacom_remove(), aes_battery_work is not canceled. Consequently, if the device is removed while aes_battery_work is still pending, then hard crashes or Oops: general protection fault... are experienced when wacom_aes_battery_handler() is finally called. E.g., this happens with built-in USB devices after resume from hibernate when aes_battery_work was still pending at the time of hibernation. So, take care to cancel aes_battery_work in wacom_remove(). (CVE-2025-38253)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38253
https://ubuntu.com/security/CVE-2025-38253

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38253

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245484 - Linux Distros Unpatched Vulnerability : CVE-2025-38255
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() While testing null_blk with configfs, echo 0 > poll_queues will trigger following panic: BUG: kernel NULL pointer dereference, address: 0000000000000010 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 27 UID: 0 PID: 920 Comm: bash Not tainted 6.15.0-02023-gadbdb95c8696-dirty #1238 PREEMPT(undef) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:__bitmap_or+0x48/0x70 Call Trace: <TASK>
__group_cpus_evenly+0x822/0x8c0 group_cpus_evenly+0x2d9/0x490 blk_mq_map_queues+0x1e/0x110 null_map_queues+0xc9/0x170 [null_blk] blk_mq_update_queue_map+0xdb/0x160 blk_mq_update_nr_hw_queues+0x22b/0x560 nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] nullb_device_poll_queues_store+0xa4/0x130 [null_blk] configfs_write_iter+0x109/0x1d0 vfs_write+0x26e/0x6f0 ksys_write+0x79/0x180 __x64_sys_write+0x1d/0x30 x64_sys_call+0x45c4/0x45f0 do_syscall_64+0xa5/0x240 entry_SYSCALL_64_after_hwframe+0x76/0x7e Root cause is that numgrps is set to 0, and ZERO_SIZE_PTR is returned from kcalloc(), and later ZERO_SIZE_PTR will be deferenced. Fix the problem by checking numgrps first in group_cpus_evenly(), and return NULL directly if numgrps is zero. [yukuai3@huawei.com: also fix the non-SMP version] (CVE-2025-38255)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38255
https://ubuntu.com/security/CVE-2025-38255

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38255

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246875 - Linux Distros Unpatched Vulnerability : CVE-2025-38258
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write memcg_path_store() assigns a newly allocated memory buffer to filter->memcg_path, without deallocating the previously allocated and assigned memory buffer. As a result, users can leak kernel memory by continuously writing a data to memcg_path DAMOS sysfs file. Fix the leak by deallocating the previously set memory buffer.
(CVE-2025-38258)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38258
https://ubuntu.com/security/CVE-2025-38258

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38258

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248257 - Linux Distros Unpatched Vulnerability : CVE-2025-38262
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tty: serial: uartlite: register uart driver in init When two instances of uart devices are probing, a concurrency race can occur. If one thread calls uart_register_driver function, which first allocates and assigns memory to 'uart_state' member of uart_driver structure, the other instance can bypass uart driver registration and call ulite_assign. This calls uart_add_one_port, which expects the uart driver to be fully initialized. This leads to a kernel panic due to a null pointer dereference: [ 8.143581] BUG: kernel NULL pointer dereference, address: 00000000000002b8 [ 8.156982] #PF: supervisor write access in kernel mode [ 8.156984] #PF: error_code(0x0002) - not-present page [ 8.156986] PGD 0 P4D 0 ... [ 8.180668] RIP:
0010:mutex_lock+0x19/0x30 [ 8.188624] Call Trace: [ 8.188629] ? __die_body.cold+0x1a/0x1f [ 8.195260] ? page_fault_oops+0x15c/0x290 [ 8.209183] ? __irq_resolve_mapping+0x47/0x80 [ 8.209187] ? exc_page_fault+0x64/0x140 [ 8.209190] ? asm_exc_page_fault+0x22/0x30 [ 8.209196] ? mutex_lock+0x19/0x30 [ 8.223116] uart_add_one_port+0x60/0x440 [ 8.223122] ? proc_tty_register_driver+0x43/0x50 [ 8.223126] ? tty_register_driver+0x1ca/0x1e0 [ 8.246250] ulite_probe+0x357/0x4b0 [uartlite] To prevent it, move uart driver registration in to init function. This will ensure that uart_driver is always registered when probe function is called. (CVE-2025-38262)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38262
https://security-tracker.debian.org/tracker/CVE-2025-38262
https://ubuntu.com/security/CVE-2025-38262

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38262

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244498 - Linux Distros Unpatched Vulnerability : CVE-2025-38265
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- serial: jsm: fix NPE during jsm_uart_port_init No device was set which caused serial_base_ctrl_add to crash. BUG: kernel NULL pointer dereference, address: 0000000000000050 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 16 UID: 0 PID: 368 Comm: (udev-worker) Not tainted 6.12.25-amd64 #1 Debian 6.12.25-1 RIP:
0010:serial_base_ctrl_add+0x96/0x120 Call Trace: <TASK> serial_core_register_port+0x1a0/0x580 ?
__setup_irq+0x39c/0x660 ? __kmalloc_cache_noprof+0x111/0x310 jsm_uart_port_init+0xe8/0x180 [jsm] jsm_probe_one+0x1f4/0x410 [jsm] local_pci_probe+0x42/0x90 pci_device_probe+0x22f/0x270 really_probe+0xdb/0x340 ? pm_runtime_barrier+0x54/0x90 ? __pfx___driver_attach+0x10/0x10
__driver_probe_device+0x78/0x110 driver_probe_device+0x1f/0xa0 __driver_attach+0xba/0x1c0 bus_for_each_dev+0x8c/0xe0 bus_add_driver+0x112/0x1f0 driver_register+0x72/0xd0 jsm_init_module+0x36/0xff0 [jsm] ? __pfx_jsm_init_module+0x10/0x10 [jsm] do_one_initcall+0x58/0x310 do_init_module+0x60/0x230 Tested with Digi Neo PCIe 8 port card. (CVE-2025-38265)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38265
https://ubuntu.com/security/CVE-2025-38265

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38265

Plugin Information
Published: 2025/08/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243622 - Linux Distros Unpatched Vulnerability : CVE-2025-38268
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work A state check was previously added to tcpm_queue_vdm_unlocked to prevent a deadlock where the DisplayPort Alt Mode driver would be executing work and attempting to grab the tcpm_lock while the TCPM was holding the lock and attempting to unregister the altmode, blocking on the altmode driver's cancel_work_sync call. Because the state check isn't protected, there is a small window where the Alt Mode driver could determine that the TCPM is in a ready state and attempt to grab the lock while the TCPM grabs the lock and changes the TCPM state to one that causes the deadlock. The callstack is provided below: [110121.667392][ C7] Call trace: [110121.667396][ C7] __switch_to+0x174/0x338 [110121.667406][ C7] __schedule+0x608/0x9f0 [110121.667414][ C7] schedule+0x7c/0xe8 [110121.667423][ C7] kernfs_drain+0xb0/0x114 [110121.667431][ C7] __kernfs_remove+0x16c/0x20c [110121.667436][ C7] kernfs_remove_by_name_ns+0x74/0xe8 [110121.667442][ C7] sysfs_remove_group+0x84/0xe8 [110121.667450][ C7] sysfs_remove_groups+0x34/0x58 [110121.667458][ C7] device_remove_groups+0x10/0x20 [110121.667464][ C7] device_release_driver_internal+0x164/0x2e4 [110121.667475][ C7] device_release_driver+0x18/0x28 [110121.667484][ C7] bus_remove_device+0xec/0x118 [110121.667491][ C7] device_del+0x1e8/0x4ac [110121.667498][ C7] device_unregister+0x18/0x38 [110121.667504][ C7] typec_unregister_altmode+0x30/0x44 [110121.667515][ C7] tcpm_reset_port+0xac/0x370 [110121.667523][ C7] tcpm_snk_detach+0x84/0xb8 [110121.667529][ C7] run_state_machine+0x4c0/0x1b68 [110121.667536][ C7] tcpm_state_machine_work+0x94/0xe4 [110121.667544][ C7] kthread_worker_fn+0x10c/0x244 [110121.667552][ C7] kthread+0x104/0x1d4 [110121.667557][ C7] ret_from_fork+0x10/0x20 [110121.667689][ C7] Workqueue: events dp_altmode_work [110121.667697][ C7] Call trace: [110121.667701][ C7] __switch_to+0x174/0x338 [110121.667710][ C7]
__schedule+0x608/0x9f0 [110121.667717][ C7] schedule+0x7c/0xe8 [110121.667725][ C7] schedule_preempt_disabled+0x24/0x40 [110121.667733][ C7] __mutex_lock+0x408/0xdac [110121.667741][ C7]
__mutex_lock_slowpath+0x14/0x24 [110121.667748][ C7] mutex_lock+0x40/0xec [110121.667757][ C7] tcpm_altmode_enter+0x78/0xb4 [110121.667764][ C7] typec_altmode_enter+0xdc/0x10c [110121.667769][ C7] dp_altmode_work+0x68/0x164 [110121.667775][ C7] process_one_work+0x1e4/0x43c [110121.667783][ C7] worker_thread+0x25c/0x430 [110121.667789][ C7] kthread+0x104/0x1d4 [110121.667794][ C7] ret_from_fork+0x10/0x20 Change tcpm_queue_vdm_unlocked to queue for tcpm_queue_vdm_work, which can perform the state check while holding the TCPM lock while the Alt Mode lock is no longer held. This requires a new struct to hold the vdm data, altmode_vdm_event. (CVE-2025-38268)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38268
https://ubuntu.com/security/CVE-2025-38268

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38268

Plugin Information
Published: 2025/08/05, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247646 - Linux Distros Unpatched Vulnerability : CVE-2025-38278
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback This patch addresses below issues, 1. Active traffic on the leaf node must be stopped before its send queue is reassigned to the parent. This patch resolves the issue by marking the node as 'Inner'. 2. During a system reboot, the interface receives TC_HTB_LEAF_DEL and TC_HTB_LEAF_DEL_LAST callbacks to delete its HTB queues. In the case of TC_HTB_LEAF_DEL_LAST, although the same send queue is reassigned to the parent, the current logic still attempts to update the real number of queues, leadning to below warnings New queues can't be registered after device unregistration. WARNING: CPU: 0 PID: 6475 at net/core/net-sysfs.c:1714 netdev_queue_update_kobjects+0x1e4/0x200 (CVE-2025-38278)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38278
https://ubuntu.com/security/CVE-2025-38278

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38278

Plugin Information
Published: 2025/08/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245613 - Linux Distros Unpatched Vulnerability : CVE-2025-38280
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Avoid __bpf_prog_ret0_warn when jit fails syzkaller reported an issue: WARNING: CPU: 3 PID: 217 at kernel/bpf/core.c:2357 __bpf_prog_ret0_warn+0xa/0x20 kernel/bpf/core.c:2357 Modules linked in: CPU: 3 UID:
0 PID: 217 Comm: kworker/u32:6 Not tainted 6.15.0-rc4-syzkaller-00040-g8bac8898fe39 RIP:
0010:__bpf_prog_ret0_warn+0xa/0x20 kernel/bpf/core.c:2357 Call Trace: <TASK> bpf_dispatcher_nop_func include/linux/bpf.h:1316 [inline] __bpf_prog_run include/linux/filter.h:718 [inline] bpf_prog_run include/linux/filter.h:725 [inline] cls_bpf_classify+0x74a/0x1110 net/sched/cls_bpf.c:105 ... When creating bpf program, 'fp->jit_requested' depends on bpf_jit_enable. This issue is triggered because of CONFIG_BPF_JIT_ALWAYS_ON is not set and bpf_jit_enable is set to 1, causing the arch to attempt JIT the prog, but jit failed due to FAULT_INJECTION. As a result, incorrectly treats the program as valid, when the program runs it calls `__bpf_prog_ret0_warn` and triggers the WARN_ON_ONCE(1). (CVE-2025-38280)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38280
https://security-tracker.debian.org/tracker/CVE-2025-38280
https://ubuntu.com/security/CVE-2025-38280

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38280

Plugin Information
Published: 2025/08/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248723 - Linux Distros Unpatched Vulnerability : CVE-2025-38282
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- kernfs: Relax constraint in draining guard The active reference lifecycle provides the break/unbreak mechanism but the active reference is not truly active after unbreak -- callers don't use it afterwards but it's important for proper pairing of kn->active counting. Assuming this mechanism is in place, the WARN check in kernfs_should_drain_open_files() is too sensitive -- it may transiently catch those (rightful) callers between kernfs_unbreak_active_protection() and kernfs_put_active() as found out by Chen Ridong: kernfs_remove_by_name_ns kernfs_get_active // active=1 __kernfs_remove // active=0x80000002 kernfs_drain ... wait_event //waiting (active == 0x80000001) kernfs_break_active_protection // active = 0x80000001 // continue kernfs_unbreak_active_protection // active = 0x80000002 ...
kernfs_should_drain_open_files // warning occurs kernfs_put_active To avoid the false positives (mind panic_on_warn) remove the check altogether. (This is meant as quick fix, I think active reference break/unbreak may be simplified with larger rework.) (CVE-2025-38282)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38282
https://ubuntu.com/security/CVE-2025-38282

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.4
EPSS Score
0.0002
References

CVE | CVE-2025-38282

Plugin Information
Published: 2025/08/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249434 - Linux Distros Unpatched Vulnerability : CVE-2025-38284
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: rtw89: pci: configure manual DAC mode via PCI config API only To support 36-bit DMA, configure chip proprietary bit via PCI config API or chip DBI interface. However, the PCI device mmap isn't set yet and the DBI is also inaccessible via mmap, so only if the bit can be accessible via PCI config API, chip can support 36-bit DMA. Otherwise, fallback to 32-bit DMA. With NULL mmap address, kernel throws trace: BUG:
unable to handle page fault for address: 0000000000001090 #PF: supervisor write access in kernel mode #PF:
error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: Oops: 0002 [#1] PREEMPT SMP PTI CPU: 1 UID: 0 PID:
71 Comm: irq/26-pciehp Tainted: G OE 6.14.2-061402-generic #202504101348 Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE RIP: 0010:rtw89_pci_ops_write16+0x12/0x30 [rtw89_pci] RSP: 0018:ffffb0ffc0acf9d8 EFLAGS: 00010206 RAX: ffffffffc158f9c0 RBX: ffff94865e702020 RCX: 0000000000000000 RDX: 0000000000000718 RSI: 0000000000001090 RDI: ffff94865e702020 RBP: ffffb0ffc0acf9d8 R08: 0000000000000000 R09:
0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000015 R13: 0000000000000719 R14: ffffb0ffc0acfa1f R15: ffffffffc1813060 FS: 0000000000000000(0000) GS:ffff9486f3480000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000001090 CR3:
0000000090440001 CR4: 00000000000626f0 Call Trace: <TASK> rtw89_pci_read_config_byte+0x6d/0x120 [rtw89_pci] rtw89_pci_cfg_dac+0x5b/0xb0 [rtw89_pci] rtw89_pci_probe+0xa96/0xbd0 [rtw89_pci] ?
__pfx___device_attach_driver+0x10/0x10 ? __pfx___device_attach_driver+0x10/0x10 local_pci_probe+0x47/0xa0 pci_call_probe+0x5d/0x190 pci_device_probe+0xa7/0x160 really_probe+0xf9/0x370 ? pm_runtime_barrier+0x55/0xa0 __driver_probe_device+0x8c/0x140 driver_probe_device+0x24/0xd0
__device_attach_driver+0xcd/0x170 bus_for_each_drv+0x99/0x100 __device_attach+0xb4/0x1d0 device_attach+0x10/0x20 pci_bus_add_device+0x59/0x90 pci_bus_add_devices+0x31/0x80 pciehp_configure_device+0xaa/0x170 pciehp_enable_slot+0xd6/0x240 pciehp_handle_presence_or_link_change+0xf1/0x180 pciehp_ist+0x162/0x1c0 irq_thread_fn+0x24/0x70 irq_thread+0xef/0x1c0 ? __pfx_irq_thread_fn+0x10/0x10 ? __pfx_irq_thread_dtor+0x10/0x10 ?
__pfx_irq_thread+0x10/0x10 kthread+0xfc/0x230 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x47/0x70 ?
__pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> (CVE-2025-38284)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38284
https://security-tracker.debian.org/tracker/CVE-2025-38284
https://ubuntu.com/security/CVE-2025-38284

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38284

Plugin Information
Published: 2025/08/15, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246953 - Linux Distros Unpatched Vulnerability : CVE-2025-38287
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: IB/cm: Drop lockdep assert and WARN when freeing old msg The send completion handler can run after cm_id has advanced to another message. The cm_id lock is not needed in this case, but a recent change re-used cm_free_priv_msg(), which asserts that the lock is held and WARNs if the cm_id's currently outstanding msg is different than the one being freed.
(CVE-2025-38287)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38287
https://ubuntu.com/security/CVE-2025-38287

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38287

Plugin Information
Published: 2025/08/09, Modified: 2025/11/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244646 - Linux Distros Unpatched Vulnerability : CVE-2025-38290
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath12k: fix node corruption in ar->arvifs list In current WLAN recovery code flow, ath12k_core_halt() only reinitializes the arvifs list head. This will cause the list node immediately following the list head to become an invalid list node. Because the prev of that node still points to the list head arvifs, but the next of the list head arvifs no longer points to that list node. When a WLAN recovery occurs during the execution of a vif removal, and it happens before the spin_lock_bh(&ar->data_lock) in ath12k_mac_vdev_delete(), list_del() will detect the previously mentioned situation, thereby triggering a kernel panic. The fix is to remove and reinitialize all vif list nodes from the list head arvifs during WLAN halt. The reinitialization is to make the list nodes valid, ensuring that the list_del() in ath12k_mac_vdev_delete() can execute normally. Call trace:
__list_del_entry_valid_or_report+0xd4/0x100 (P) ath12k_mac_remove_link_interface.isra.0+0xf8/0x2e4 [ath12k] ath12k_scan_vdev_clean_work+0x40/0x164 [ath12k] cfg80211_wiphy_work+0xfc/0x100 process_one_work+0x164/0x2d0 worker_thread+0x254/0x380 kthread+0xfc/0x100 ret_from_fork+0x10/0x20 The change is mostly copied from the ath11k patch:
https://lore.kernel.org/all/20250320053145.3445187-1-quic_stonez@quicinc.com/ Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 (CVE-2025-38290)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38290
https://ubuntu.com/security/CVE-2025-38290

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38290

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250158 - Linux Distros Unpatched Vulnerability : CVE-2025-38291
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Prevent sending WMI commands to firmware during firmware crash Currently, we encounter the following kernel call trace when a firmware crash occurs. This happens because the host sends WMI commands to the firmware while it is in recovery, causing the commands to fail and resulting in the kernel call trace. Set the ATH12K_FLAG_CRASH_FLUSH and ATH12K_FLAG_RECOVERY flags when the host driver receives the firmware crash notification from MHI. This prevents sending WMI commands to the firmware during recovery. Call Trace:
<TASK> dump_stack_lvl+0x75/0xc0 register_lock_class+0x6be/0x7a0 ? __lock_acquire+0x644/0x19a0
__lock_acquire+0x95/0x19a0 lock_acquire+0x265/0x310 ? ath12k_ce_send+0xa2/0x210 [ath12k] ? find_held_lock+0x34/0xa0 ? ath12k_ce_send+0x56/0x210 [ath12k] _raw_spin_lock_bh+0x33/0x70 ? ath12k_ce_send+0xa2/0x210 [ath12k] ath12k_ce_send+0xa2/0x210 [ath12k] ath12k_htc_send+0x178/0x390 [ath12k] ath12k_wmi_cmd_send_nowait+0x76/0xa0 [ath12k] ath12k_wmi_cmd_send+0x62/0x190 [ath12k] ath12k_wmi_pdev_bss_chan_info_request+0x62/0xc0 [ath1 ath12k_mac_op_get_survey+0x2be/0x310 [ath12k] ieee80211_dump_survey+0x99/0x240 [mac80211] nl80211_dump_survey+0xe7/0x470 [cfg80211] ? kmalloc_reserve+0x59/0xf0 genl_dumpit+0x24/0x70 netlink_dump+0x177/0x360 __netlink_dump_start+0x206/0x280 genl_family_rcv_msg_dumpit.isra.22+0x8a/0xe0 ? genl_family_rcv_msg_attrs_parse.isra.23+0xe0/0xe0 ? genl_op_lock.part.12+0x10/0x10 ? genl_dumpit+0x70/0x70 genl_rcv_msg+0x1d0/0x290 ? nl80211_del_station+0x330/0x330 [cfg80211] ? genl_get_cmd_both+0x50/0x50 netlink_rcv_skb+0x4f/0x100 genl_rcv+0x1f/0x30 netlink_unicast+0x1b6/0x260 netlink_sendmsg+0x31a/0x450 __sock_sendmsg+0xa8/0xb0
____sys_sendmsg+0x1e4/0x260 ___sys_sendmsg+0x89/0xe0 ? local_clock_noinstr+0xb/0xc0 ? rcu_is_watching+0xd/0x40 ? kfree+0x1de/0x370 ? __sys_sendmsg+0x7a/0xc0 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 (CVE-2025-38291)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38291
https://ubuntu.com/security/CVE-2025-38291

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38291

Plugin Information
Published: 2025/08/15, Modified: 2025/11/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246481 - Linux Distros Unpatched Vulnerability : CVE-2025-38294
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL access in assign channel context handler Currently, when ath12k_mac_assign_vif_to_vdev() fails, the radio handle (ar) gets accessed from the link VIF handle (arvif) for debug logging, This is incorrect. In the fail scenario, radio handle is NULL. Fix the NULL access, avoid radio handle access by moving to the hardware debug logging helper function (ath12k_hw_warn). Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 (CVE-2025-38294)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38294
https://ubuntu.com/security/CVE-2025-38294

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38294

Plugin Information
Published: 2025/08/09, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244961 - Linux Distros Unpatched Vulnerability : CVE-2025-38302
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work Bios queued up in the zone write plug have already gone through all all preparation in the submit_bio path, including the freeze protection. Submitting them through submit_bio_noacct_nocheck duplicates the work and can can cause deadlocks when freezing a queue with pending bio write plugs. Go straight to ->submit_bio or blk_mq_submit_bio to bypass the superfluous extra freeze protection and checks. (CVE-2025-38302)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38302
https://ubuntu.com/security/CVE-2025-38302

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38302

Plugin Information
Published: 2025/08/07, Modified: 2025/11/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243883 - Linux Distros Unpatched Vulnerability : CVE-2025-38303
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data eir_create_adv_data may attempt to add EIR_FLAGS and EIR_TX_POWER without checking if that would fit. (CVE-2025-38303)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38303
https://security-tracker.debian.org/tracker/CVE-2025-38303
https://ubuntu.com/security/CVE-2025-38303

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38303

Plugin Information
Published: 2025/08/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243986 - Linux Distros Unpatched Vulnerability : CVE-2025-38304
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: Fix NULL pointer deference on eir_get_service_data The len parameter is considered optional so it can be NULL so it cannot be used for skipping to next entry of EIR_SERVICE_DATA. (CVE-2025-38304)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38304
https://ubuntu.com/security/CVE-2025-38304

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38304

Plugin Information
Published: 2025/08/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248195 - Linux Distros Unpatched Vulnerability : CVE-2025-38305
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() There is no disagreement that we should check both ptp->is_virtual_clock and ptp->n_vclocks to check if the ptp virtual clock is in use. However, when we acquire ptp->n_vclocks_mux to read ptp->n_vclocks in ptp_vclock_in_use(), we observe a recursive lock in the call trace starting from n_vclocks_store(). ============================================ WARNING: possible recursive locking detected 6.15.0-rc6 #1 Not tainted
-------------------------------------------- syz.0.1540/13807 is trying to acquire lock: ffff888035a24868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at: ptp_vclock_in_use drivers/ptp/ptp_private.h:103 [inline] ffff888035a24868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at: ptp_clock_unregister+0x21/0x250 drivers/ptp/ptp_clock.c:415 but task is already holding lock: ffff888030704868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at: n_vclocks_store+0xf1/0x6d0 drivers/ptp/ptp_sysfs.c:215 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&ptp->n_vclocks_mux);
lock(&ptp->n_vclocks_mux); *** DEADLOCK *** .... ============================================ The best way to solve this is to remove the logic that checks ptp->n_vclocks in ptp_vclock_in_use(). The reason why this is appropriate is that any path that uses ptp->n_vclocks must unconditionally check if ptp->n_vclocks is greater than 0 before unregistering vclocks, and all functions are already written this way. And in the function that uses ptp->n_vclocks, we already get ptp->n_vclocks_mux before unregistering vclocks.
Therefore, we need to remove the redundant check for ptp->n_vclocks in ptp_vclock_in_use() to prevent recursive locking. (CVE-2025-38305)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38305
https://ubuntu.com/security/CVE-2025-38305

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38305

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245052 - Linux Distros Unpatched Vulnerability : CVE-2025-38307
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ASoC: Intel: avs: Verify content returned by parse_int_array() The first element of the returned array stores its length. If it is 0, any manipulation beyond the element at index 0 ends with null-ptr-deref.
(CVE-2025-38307)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38307
https://ubuntu.com/security/CVE-2025-38307

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38307

Plugin Information
Published: 2025/08/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249519 - Linux Distros Unpatched Vulnerability : CVE-2025-38311
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- iavf: get rid of the crit lock Get rid of the crit lock. That frees us from the error prone logic of try_locks. Thanks to netdev_lock() by Jakub it is now easy, and in most cases we were protected by it already - replace crit lock by netdev lock when it was not the case. Lockdep reports that we should cancel the work under crit_lock [splat1], and that was the scheme we have mostly followed since [1] by Slawomir.
But when that is done we still got into deadlocks [splat2]. So instead we should look at the bigger problem, namely weird locking/scheduling of the iavf. The first step to fix that is to remove the crit lock. I will followup with a -next series that simplifies scheduling/tasks. Cancel the work without netdev lock (weird unlock+lock scheme), to fix the [splat2] (which would be totally ugly if we would kept the crit lock). Extend protected part of iavf_watchdog_task() to include scheduling more work. Note that the removed comment in iavf_reset_task() was misplaced, it belonged to inside of the removed if condition, so it's gone now. [splat1] - w/o this patch - The deadlock during VF removal: WARNING: possible circular locking dependency detected sh/3825 is trying to acquire lock:
((work_completion)(&(&adapter->watchdog_task)->work)){+.+.}-{0:0}, at: start_flush_work+0x1a1/0x470 but task is already holding lock: (&adapter->crit_lock){+.+.}-{4:4}, at: iavf_remove+0xd1/0x690 [iavf] which lock already depends on the new lock. [splat2] - when cancelling work under crit lock, w/o this series, see [2] for the band aid attempt WARNING: possible circular locking dependency detected sh/3550 is trying to acquire lock: ((wq_completion)iavf){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x26/0x90 but task is already holding lock: (&dev->lock){+.+.}-{4:4}, at: iavf_remove+0xa6/0x6e0 [iavf] which lock already depends on the new lock. [1] fc2e6b3b132a (iavf: Rework mutexes for better synchronisation) [2] https://github.com/pkitszel/linux/commit/52dddbfc2bb60294083f5711a158a (CVE-2025-38311)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38311
https://security-tracker.debian.org/tracker/CVE-2025-38311
https://ubuntu.com/security/CVE-2025-38311

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38311

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250090 - Linux Distros Unpatched Vulnerability : CVE-2025-38315
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Check dsbr size from EFI variable Since the size of struct btintel_dsbr is already known, we can just start there instead of querying the EFI variable size. If the final result doesn't match what we expect also fail. This fixes a stack buffer overflow when the EFI variable is larger than struct btintel_dsbr. (CVE-2025-38315)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38315
https://ubuntu.com/security/CVE-2025-38315

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38315

Plugin Information
Published: 2025/08/15, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245642 - Linux Distros Unpatched Vulnerability : CVE-2025-38318
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: perf: arm-ni: Fix missing platform_set_drvdata() Add missing platform_set_drvdata in arm_ni_probe(), otherwise calling platform_get_drvdata() in remove returns NULL. (CVE-2025-38318)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38318
https://ubuntu.com/security/CVE-2025-38318

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38318

Plugin Information
Published: 2025/08/08, Modified: 2025/11/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246679 - Linux Distros Unpatched Vulnerability : CVE-2025-38320
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() KASAN reports a stack-out-of- bounds read in regs_get_kernel_stack_nth(). Call Trace: [ 97.283505] BUG: KASAN: stack-out-of-bounds in regs_get_kernel_stack_nth+0xa8/0xc8 [ 97.284677] Read of size 8 at addr ffff800089277c10 by task 1.sh/2550 [ 97.285732] [ 97.286067] CPU: 7 PID: 2550 Comm: 1.sh Not tainted 6.6.0+ #11 [ 97.287032] Hardware name:
linux,dummy-virt (DT) [ 97.287815] Call trace: [ 97.288279] dump_backtrace+0xa0/0x128 [ 97.288946] show_stack+0x20/0x38 [ 97.289551] dump_stack_lvl+0x78/0xc8 [ 97.290203] print_address_description.constprop.0+0x84/0x3c8 [ 97.291159] print_report+0xb0/0x280 [ 97.291792] kasan_report+0x84/0xd0 [ 97.292421] __asan_load8+0x9c/0xc0 [ 97.293042] regs_get_kernel_stack_nth+0xa8/0xc8 [ 97.293835] process_fetch_insn+0x770/0xa30 [ 97.294562] kprobe_trace_func+0x254/0x3b0 [ 97.295271] kprobe_dispatcher+0x98/0xe0 [ 97.295955] kprobe_breakpoint_handler+0x1b0/0x210 [ 97.296774] call_break_hook+0xc4/0x100 [ 97.297451] brk_handler+0x24/0x78 [ 97.298073] do_debug_exception+0xac/0x178 [ 97.298785] el1_dbg+0x70/0x90 [ 97.299344] el1h_64_sync_handler+0xcc/0xe8 [ 97.300066] el1h_64_sync+0x78/0x80 [ 97.300699] kernel_clone+0x0/0x500 [ 97.301331] __arm64_sys_clone+0x70/0x90 [ 97.302084] invoke_syscall+0x68/0x198 [ 97.302746] el0_svc_common.constprop.0+0x11c/0x150 [ 97.303569] do_el0_svc+0x38/0x50 [ 97.304164] el0_svc+0x44/0x1d8 [ 97.304749] el0t_64_sync_handler+0x100/0x130 [ 97.305500] el0t_64_sync+0x188/0x190 [ 97.306151] [ 97.306475] The buggy address belongs to stack of task 1.sh/2550 [ 97.307461] and is located at offset 0 in frame: [ 97.308257] __se_sys_clone+0x0/0x138 [ 97.308910] [ 97.309241] This frame has 1 object: [ 97.309873] [48, 184) 'args' [ 97.309876] [ 97.310749] The buggy address belongs to the virtual mapping at [ 97.310749] [ffff800089270000, ffff800089279000) created by: [ 97.310749] dup_task_struct+0xc0/0x2e8 [ 97.313347] [ 97.313674] The buggy address belongs to the physical page: [ 97.314604] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14f69a [ 97.315885] flags:
0x15ffffe00000000(node=1|zone=2|lastcpupid=0xfffff) [ 97.316957] raw: 015ffffe00000000 0000000000000000 dead000000000122 0000000000000000 [ 97.318207] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 97.319445] page dumped because: kasan: bad access detected [ 97.320371] [ 97.320694] Memory state around the buggy address: [ 97.321511] ffff800089277b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 97.322681] ffff800089277b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 97.323846] >ffff800089277c00: 00 00 f1 f1 f1 f1 f1 f1 00 00 00 00 00 00 00 00 [ 97.325023] ^ [ 97.325683] ffff800089277c80: 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 f3 f3 [ 97.326856] ffff800089277d00: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 This issue seems to be related to the behavior of some gcc compilers and was also fixed on the s390 architecture before: commit d93a855c31b7 (s390/ptrace: Avoid KASAN false positives in regs_get_kernel_stack_nth()) As described in that commit, regs_get_kernel_stack_nth() has confirmed that `addr` is on the stack, so reading the value at `*addr` should be allowed. Use READ_ONCE_NOCHECK() helper to silence the KASAN check for this case. [will: Use '*addr' as the argument to READ_ONCE_NOCHECK()] (CVE-2025-38320)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38320
https://ubuntu.com/security/CVE-2025-38320

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
3.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
3.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38320

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244117 - Linux Distros Unpatched Vulnerability : CVE-2025-38321
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smb: Log an error when close_all_cached_dirs fails Under low-memory conditions, close_all_cached_dirs() can't move the dentries to a separate list to dput() them once the locks are dropped. This will result in a Dentry still in use error, so add an error message that makes it clear this is what happened: [ 495.281119] CIFS: VFS: \\otters.example.com\share Out of memory while dropping dentries [ 495.281595]
------------[ cut here ]------------ [ 495.281887] BUG: Dentry ffff888115531138{i=78,n=/} still in use (2) [unmount of cifs cifs] [ 495.282391] WARNING: CPU: 1 PID: 2329 at fs/dcache.c:1536 umount_check+0xc8/0xf0 Also, bail out of looping through all tcons as soon as a single allocation fails, since we're already in trouble, and kmalloc() attempts for subseqeuent tcons are likely to fail just like the first one did.
(CVE-2025-38321)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38321
https://ubuntu.com/security/CVE-2025-38321

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38321

Plugin Information
Published: 2025/08/06, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249622 - Linux Distros Unpatched Vulnerability : CVE-2025-38322
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- perf/x86/intel: Fix crash in icl_update_topdown_event() The perf_fuzzer found a hard-lockup crash on a RaptorLake machine: Oops: general protection fault, maybe for address 0xffff89aeceab400: 0000 CPU: 23 UID:
0 PID: 0 Comm: swapper/23 Tainted: [W]=WARN Hardware name: Dell Inc. Precision 9660/0VJ762 RIP:
0010:native_read_pmc+0x7/0x40 Code: cc e8 8d a9 01 00 48 89 03 5b cd cc cc cc cc 0f 1f ... RSP:
000:fffb03100273de8 EFLAGS: 00010046 .... Call Trace: <TASK> icl_update_topdown_event+0x165/0x190 ? ktime_get+0x38/0xd0 intel_pmu_read_event+0xf9/0x210 __perf_event_read+0xf9/0x210 CPUs 16-23 are E-core CPUs that don't support the perf metrics feature. The icl_update_topdown_event() should not be invoked on these CPUs. It's a regression of commit: f9bdf1f95339 (perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read) The bug introduced by that commit is that the is_topdown_event() function is mistakenly used to replace the is_topdown_count() call to check if the topdown functions for the perf metrics feature should be invoked. Fix it. (CVE-2025-38322)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38322
https://ubuntu.com/security/CVE-2025-38322

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38322

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246535 - Linux Distros Unpatched Vulnerability : CVE-2025-38324
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). As syzbot reported [0], mpls_route_input_rcu() can be called from mpls_getroute(), where is under RTNL. net->mpls.platform_label is only updated under RTNL. Let's use rcu_dereference_rtnl() in mpls_route_input_rcu() to silence the splat. [0]: WARNING:
suspicious RCU usage 6.15.0-rc7-syzkaller-00082-g5cdb2c77c4c3 #0 Not tainted ---------------------------- net/mpls/af_mpls.c:84 suspicious rcu_dereference_check() usage! other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1 1 lock held by syz.2.4451/17730: #0: ffffffff9012a3e8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff9012a3e8 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x371/0xe90 net/core/rtnetlink.c:6961 stack backtrace:
CPU: 1 UID: 0 PID: 17730 Comm: syz.2.4451 Not tainted 6.15.0-rc7-syzkaller-00082-g5cdb2c77c4c3 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 lockdep_rcu_suspicious+0x166/0x260 kernel/locking/lockdep.c:6865 mpls_route_input_rcu+0x1d4/0x200 net/mpls/af_mpls.c:84 mpls_getroute+0x621/0x1ea0 net/mpls/af_mpls.c:2381 rtnetlink_rcv_msg+0x3c9/0xe90 net/core/rtnetlink.c:6964 netlink_rcv_skb+0x16d/0x440 net/netlink/af_netlink.c:2534 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] netlink_unicast+0x53a/0x7f0 net/netlink/af_netlink.c:1339 netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1883 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg net/socket.c:727 [inline] ____sys_sendmsg+0xa98/0xc70 net/socket.c:2566 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2620
__sys_sendmmsg+0x200/0x420 net/socket.c:2709 __do_sys_sendmmsg net/socket.c:2736 [inline]
__se_sys_sendmmsg net/socket.c:2733 [inline] __x64_sys_sendmmsg+0x9c/0x100 net/socket.c:2733 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x230 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f0a2818e969 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP:
002b:00007f0a28f52038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX:
00007f0a283b5fa0 RCX: 00007f0a2818e969 RDX: 0000000000000003 RSI: 0000200000000080 RDI: 0000000000000003 RBP: 00007f0a28210ab1 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11:
0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f0a283b5fa0 R15: 00007ffce5e9f268 </TASK> (CVE-2025-38324)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38324
https://ubuntu.com/security/CVE-2025-38324

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38324

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244388 - Linux Distros Unpatched Vulnerability : CVE-2025-38334
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- x86/sgx: Prevent attempts to reclaim poisoned pages TL;DR: SGX page reclaim touches the page to copy its contents to secondary storage. SGX instructions do not gracefully handle machine checks. Despite this, the existing SGX code will try to reclaim pages that it _knows_ are poisoned. Avoid even trying to reclaim poisoned pages. The longer story: Pages used by an enclave only get epc_page->poison set in arch_memory_failure() but they currently stay on sgx_active_page_list until sgx_encl_release(), with the SGX_EPC_PAGE_RECLAIMER_TRACKED flag untouched. epc_page->poison is not checked in the reclaimer logic meaning that, if other conditions are met, an attempt will be made to reclaim an EPC page that was poisoned. This is bad because 1. we don't want that page to end up added to another enclave and 2. it is likely to cause one core to shut down and the kernel to panic. Specifically, reclaiming uses microcode operations including EWB which accesses the EPC page contents to encrypt and write them out to non-SGX memory. Those operations cannot handle MCEs in their accesses other than by putting the executing core into a special shutdown state (affecting both threads with HT.) The kernel will subsequently panic on the remaining cores seeing the core didn't enter MCE handler(s) in time. Call sgx_unmark_page_reclaimable() to remove the affected EPC page from sgx_active_page_list on memory error to stop it being considered for reclaiming. Testing epc_page->poison in sgx_reclaim_pages() would also work but I assume it's better to add code in the less likely paths. The affected EPC page is not added to &node->sgx_poison_page_list until later in sgx_encl_release()->sgx_free_epc_page() when it is EREMOVEd. Membership on other lists doesn't change to avoid changing any of the lists' semantics except for sgx_active_page_list. There's a TBD comment in arch_memory_failure() about pre-emptive actions, the goal here is not to address everything that it may imply. This also doesn't completely close the time window when a memory error notification will be fatal (for a not previously poisoned EPC page) -- the MCE can happen after sgx_reclaim_pages() has selected its candidates or even *inside* a microcode operation (actually easy to trigger due to the amount of time spent in them.) The spinlock in sgx_unmark_page_reclaimable() is safe because memory_failure() runs in process context and no spinlocks are held, explicitly noted in a mm/memory-failure.c comment.
(CVE-2025-38334)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38334
https://ubuntu.com/security/CVE-2025-38334

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38334

Plugin Information
Published: 2025/08/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244560 - Linux Distros Unpatched Vulnerability : CVE-2025-38335
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT When enabling PREEMPT_RT, the gpio_keys_irq_timer() callback runs in hard irq context, but the input_event() takes a spin_lock, which isn't allowed there as it is converted to a rt_spin_lock(). [ 4054.289999] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 [ 4054.290028] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/0 ... [ 4054.290195] __might_resched+0x13c/0x1f4 [ 4054.290209] rt_spin_lock+0x54/0x11c [ 4054.290219] input_event+0x48/0x80 [ 4054.290230] gpio_keys_irq_timer+0x4c/0x78 [ 4054.290243] __hrtimer_run_queues+0x1a4/0x438 [ 4054.290257] hrtimer_interrupt+0xe4/0x240 [ 4054.290269] arch_timer_handler_phys+0x2c/0x44 [ 4054.290283] handle_percpu_devid_irq+0x8c/0x14c [ 4054.290297] handle_irq_desc+0x40/0x58 [ 4054.290307] generic_handle_domain_irq+0x1c/0x28 [ 4054.290316] gic_handle_irq+0x44/0xcc Considering the gpio_keys_irq_isr() can run in any context, e.g. it can be threaded, it seems there's no point in requesting the timer isr to run in hard irq context. Relax the hrtimer not to use the hard context. (CVE-2025-38335)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38335
https://ubuntu.com/security/CVE-2025-38335

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38335

Plugin Information
Published: 2025/08/07, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246181 - Linux Distros Unpatched Vulnerability : CVE-2025-38337
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() Since handle->h_transaction may be a NULL pointer, so we should change it to call is_handle_aborted(handle) first before dereferencing it.
And the following data-race was reported in my fuzzer:
================================================================== BUG: KCSAN: data-race in jbd2_journal_dirty_metadata / jbd2_journal_dirty_metadata write to 0xffff888011024104 of 4 bytes by task 10881 on cpu 1: jbd2_journal_dirty_metadata+0x2a5/0x770 fs/jbd2/transaction.c:1556
__ext4_handle_dirty_metadata+0xe7/0x4b0 fs/ext4/ext4_jbd2.c:358 ext4_do_update_inode fs/ext4/inode.c:5220 [inline] ext4_mark_iloc_dirty+0x32c/0xd50 fs/ext4/inode.c:5869 __ext4_mark_inode_dirty+0xe1/0x450 fs/ext4/inode.c:6074 ext4_dirty_inode+0x98/0xc0 fs/ext4/inode.c:6103 .... read to 0xffff888011024104 of 4 bytes by task 10880 on cpu 0: jbd2_journal_dirty_metadata+0xf2/0x770 fs/jbd2/transaction.c:1512
__ext4_handle_dirty_metadata+0xe7/0x4b0 fs/ext4/ext4_jbd2.c:358 ext4_do_update_inode fs/ext4/inode.c:5220 [inline] ext4_mark_iloc_dirty+0x32c/0xd50 fs/ext4/inode.c:5869 __ext4_mark_inode_dirty+0xe1/0x450 fs/ext4/inode.c:6074 ext4_dirty_inode+0x98/0xc0 fs/ext4/inode.c:6103 .... value changed: 0x00000000 ->
0x00000001 ================================================================== This issue is caused by missing data-race annotation for jh->b_modified. Therefore, the missing annotation needs to be added.
(CVE-2025-38337)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38337
https://ubuntu.com/security/CVE-2025-38337

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38337

Plugin Information
Published: 2025/08/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245735 - Linux Distros Unpatched Vulnerability : CVE-2025-38342
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- software node: Correct a OOB check in software_node_get_reference_args() software_node_get_reference_args() wants to get @index-th element, so the property value requires at least '(index + 1) * sizeof(*ref)' bytes but that can not be guaranteed by current OOB check, and may cause OOB for malformed property. Fix by using as OOB check '((index + 1) * sizeof(*ref) > prop->length)'.
(CVE-2025-38342)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38342
https://ubuntu.com/security/CVE-2025-38342

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38342

Plugin Information
Published: 2025/08/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
243651 - Linux Distros Unpatched Vulnerability : CVE-2025-38344
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ACPICA: fix acpi parse and parseext cache leaks ACPICA commit 8829e70e1360c81e7a5a901b5d4f48330e021ea5 I'm Seunghun Han, and I work for National Security Research Institute of South Korea. I have been doing a research on ACPI and found an ACPI cache leak in ACPI early abort cases. Boot log of ACPI cache leak is as follows: [ 0.352414] ACPI: Added _OSI(Module Device) [ 0.353182] ACPI: Added _OSI(Processor Device) [ 0.353182] ACPI: Added _OSI(3.0 _SCP Extensions) [ 0.353182] ACPI: Added _OSI(Processor Aggregator Device) [ 0.356028] ACPI: Unable to start the ACPI Interpreter [ 0.356799] ACPI Error: Could not remove SCI handler (20170303/evmisc-281) [ 0.360215] kmem_cache_destroy Acpi-State: Slab cache still has objects [ 0.360648] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W 4.12.0-rc4-next-20170608+ #10 [ 0.361273] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006 [ 0.361873] Call Trace: [ 0.362243] ? dump_stack+0x5c/0x81 [ 0.362591] ? kmem_cache_destroy+0x1aa/0x1c0 [ 0.362944] ? acpi_sleep_proc_init+0x27/0x27 [ 0.363296] ? acpi_os_delete_cache+0xa/0x10 [ 0.363646] ? acpi_ut_delete_caches+0x6d/0x7b [ 0.364000] ? acpi_terminate+0xa/0x14 [ 0.364000] ? acpi_init+0x2af/0x34f [ 0.364000] ? __class_create+0x4c/0x80 [ 0.364000] ? video_setup+0x7f/0x7f [ 0.364000] ? acpi_sleep_proc_init+0x27/0x27 [ 0.364000] ? do_one_initcall+0x4e/0x1a0 [ 0.364000] ? kernel_init_freeable+0x189/0x20a [ 0.364000] ? rest_init+0xc0/0xc0 [ 0.364000] ? kernel_init+0xa/0x100 [ 0.364000] ? ret_from_fork+0x25/0x30 I analyzed this memory leak in detail. I found that Acpi-State cache and Acpi-Parse cache were merged because the size of cache objects was same slab cache size. I finally found Acpi-Parse cache and Acpi-parse_ext cache were leaked using SLAB_NEVER_MERGE flag in kmem_cache_create() function. Real ACPI cache leak point is as follows: [ 0.360101] ACPI: Added
_OSI(Module Device) [ 0.360101] ACPI: Added _OSI(Processor Device) [ 0.360101] ACPI: Added _OSI(3.0 _SCP Extensions) [ 0.361043] ACPI: Added _OSI(Processor Aggregator Device) [ 0.364016] ACPI: Unable to start the ACPI Interpreter [ 0.365061] ACPI Error: Could not remove SCI handler (20170303/evmisc-281) [ 0.368174] kmem_cache_destroy Acpi-Parse: Slab cache still has objects [ 0.369332] CPU: 1 PID: 1 Comm:
swapper/0 Tainted: G W 4.12.0-rc4-next-20170608+ #8 [ 0.371256] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006 [ 0.372000] Call Trace: [ 0.372000] ? dump_stack+0x5c/0x81 [ 0.372000] ? kmem_cache_destroy+0x1aa/0x1c0 [ 0.372000] ? acpi_sleep_proc_init+0x27/0x27 [ 0.372000] ? acpi_os_delete_cache+0xa/0x10 [ 0.372000] ? acpi_ut_delete_caches+0x56/0x7b [ 0.372000] ? acpi_terminate+0xa/0x14 [ 0.372000] ? acpi_init+0x2af/0x34f [ 0.372000] ? __class_create+0x4c/0x80 [ 0.372000] ? video_setup+0x7f/0x7f [ 0.372000] ? acpi_sleep_proc_init+0x27/0x27 [ 0.372000] ? do_one_initcall+0x4e/0x1a0 [ 0.372000] ? kernel_init_freeable+0x189/0x20a [ 0.372000] ? rest_init+0xc0/0xc0 [ 0.372000] ? kernel_init+0xa/0x100 [ 0.372000] ? ret_from_fork+0x25/0x30 [ 0.388039] kmem_cache_destroy Acpi-parse_ext: Slab cache still has objects [ 0.389063] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W 4.12.0-rc4-next-20170608+ #8 [ 0.390557] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006 [ 0.392000] Call Trace:
[ 0.392000] ? dump_stack+0x5c/0x81 [ 0.392000] ? kmem_cache_destroy+0x1aa/0x1c0 [ 0.392000] ? acpi_sleep_proc_init+0x27/0x27 [ 0.392000] ? acpi_os_delete_cache+0xa/0x10 [ 0.392000] ? acpi_ut_delete_caches+0x6d/0x7b [ 0.392000] ? acpi_terminate+0xa/0x14 [ 0.392000] ? acpi_init+0x2af/0x3
---truncated--- (CVE-2025-38344)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38344
https://ubuntu.com/security/CVE-2025-38344

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38344

Plugin Information
Published: 2025/08/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247265 - Linux Distros Unpatched Vulnerability : CVE-2025-38345
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ACPICA: fix acpi operand cache leak in dswstate.c ACPICA commit 987a3b5cf7175916e2a4b6ea5b8e70f830dfe732 I found an ACPI cache leak in ACPI early termination and boot continuing case. When early termination occurs due to malicious ACPI table, Linux kernel terminates ACPI function and continues to boot process. While kernel terminates ACPI function, kmem_cache_destroy() reports Acpi-Operand cache leak. Boot log of ACPI operand cache leak is as follows: >[ 0.585957] ACPI: Added _OSI(Module Device) >[ 0.587218] ACPI: Added
_OSI(Processor Device) >[ 0.588530] ACPI: Added _OSI(3.0 _SCP Extensions) >[ 0.589790] ACPI: Added
_OSI(Processor Aggregator Device) >[ 0.591534] ACPI Error: Illegal I/O port address/length above 64K:
C806E00000004002/0x2 (20170303/hwvalid-155) >[ 0.594351] ACPI Exception: AE_LIMIT, Unable to initialize fixed events (20170303/evevent-88) >[ 0.597858] ACPI: Unable to start the ACPI Interpreter >[ 0.599162] ACPI Error: Could not remove SCI handler (20170303/evmisc-281) >[ 0.601836] kmem_cache_destroy Acpi- Operand: Slab cache still has objects >[ 0.603556] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.12.0-rc5 #26 >[ 0.605159] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006 >[ 0.609177] Call Trace: >[ 0.610063] ? dump_stack+0x5c/0x81 >[ 0.611118] ? kmem_cache_destroy+0x1aa/0x1c0 >[ 0.612632] ? acpi_sleep_proc_init+0x27/0x27 >[ 0.613906] ? acpi_os_delete_cache+0xa/0x10 >[ 0.617986] ? acpi_ut_delete_caches+0x3f/0x7b >[ 0.619293] ? acpi_terminate+0xa/0x14 >[ 0.620394] ? acpi_init+0x2af/0x34f >[ 0.621616] ? __class_create+0x4c/0x80 >[ 0.623412] ? video_setup+0x7f/0x7f >[ 0.624585] ? acpi_sleep_proc_init+0x27/0x27 >[ 0.625861] ? do_one_initcall+0x4e/0x1a0 >[ 0.627513] ? kernel_init_freeable+0x19e/0x21f >[ 0.628972] ? rest_init+0x80/0x80 >[ 0.630043] ? kernel_init+0xa/0x100 >[ 0.631084] ? ret_from_fork+0x25/0x30 >[ 0.633343] vgaarb: loaded >[ 0.635036] EDAC MC: Ver: 3.0.0 >[ 0.638601] PCI: Probing PCI hardware >[ 0.639833] PCI host bridge to bus 0000:00 >[ 0.641031] pci_bus 0000:00: root bus resource [io 0x0000-0xffff] > ... Continue to boot and log is omitted ... I analyzed this memory leak in detail and found acpi_ds_obj_stack_pop_and_ delete() function miscalculated the top of the stack. acpi_ds_obj_stack_push() function uses walk_state->operand_index for start position of the top, but acpi_ds_obj_stack_pop_and_delete() function considers index 0 for it. Therefore, this causes acpi operand memory leak. This cache leak causes a security threat because an old kernel (<= 4.9) shows memory locations of kernel functions in stack dump. Some malicious users could use this information to neutralize kernel ASLR. I made a patch to fix ACPI operand cache leak. (CVE-2025-38345)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38345
https://ubuntu.com/security/CVE-2025-38345

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38345

Plugin Information
Published: 2025/08/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247063 - Linux Distros Unpatched Vulnerability : CVE-2025-38346
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ftrace: Fix UAF when lookup kallsym after ftrace disabled The following issue happens with a buggy module:
BUG: unable to handle page fault for address: ffffffffc05d0218 PGD 1bd66f067 P4D 1bd66f067 PUD 1bd671067 PMD 101808067 PTE 0 Oops: Oops: 0000 [#1] SMP KASAN PTI Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS RIP: 0010:sized_strscpy+0x81/0x2f0 RSP:
0018:ffff88812d76fa08 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffffffc0601010 RCX: dffffc0000000000 RDX: 0000000000000038 RSI: dffffc0000000000 RDI: ffff88812608da2d RBP: 8080808080808080 R08:
ffff88812608da2d R09: ffff88812608da68 R10: ffff88812608d82d R11: ffff88812608d810 R12: 0000000000000038 R13: ffff88812608da2d R14: ffffffffc05d0218 R15: fefefefefefefeff FS: 00007fef552de740(0000) GS:ffff8884251c7000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
ffffffffc05d0218 CR3: 00000001146f0000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK>
ftrace_mod_get_kallsym+0x1ac/0x590 update_iter_mod+0x239/0x5b0 s_next+0x5b/0xa0 seq_read_iter+0x8c9/0x1070 seq_read+0x249/0x3b0 proc_reg_read+0x1b0/0x280 vfs_read+0x17f/0x920 ksys_read+0xf3/0x1c0 do_syscall_64+0x5f/0x2e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The above issue may happen as follows:
(1) Add kprobe tracepoint; (2) insmod test.ko; (3) Module triggers ftrace disabled; (4) rmmod test.ko; (5) cat /proc/kallsyms; --> Will trigger UAF as test.ko already removed; ftrace_mod_get_kallsym() ...
strscpy(module_name, mod_map->mod->name, MODULE_NAME_LEN); ... The problem is when a module triggers an issue with ftrace and sets ftrace_disable. The ftrace_disable is set when an anomaly is discovered and to prevent any more damage, ftrace stops all text modification. The issue that happened was that the ftrace_disable stops more than just the text modification. When a module is loaded, its init functions can also be traced. Because kallsyms deletes the init functions after a module has loaded, ftrace saves them when the module is loaded and function tracing is enabled. This allows the output of the function trace to show the init function names instead of just their raw memory addresses. When a module is removed, ftrace_release_mod() is called, and if ftrace_disable is set, it just returns without doing anything more.
The problem here is that it leaves the mod_list still around and if kallsyms is called, it will call into this code and access the module memory that has already been freed as it will return: strscpy(module_name, mod_map->mod->name, MODULE_NAME_LEN); Where the mod no longer exists and triggers a UAF bug.
(CVE-2025-38346)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38346
https://ubuntu.com/security/CVE-2025-38346

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38346

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248606 - Linux Distros Unpatched Vulnerability : CVE-2025-38353
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/xe: Fix taking invalid lock on wedge If device wedges on e.g. GuC upload, the submission is not yet enabled and the state is not even initialized. Protect the wedge call so it does nothing in this case. It fixes the following splat: [] xe 0000:bf:00.0: [drm] device wedged, needs recovery [] ------------[ cut here ]------------ [] DEBUG_LOCKS_WARN_ON(lock->magic != lock) [] WARNING: CPU: 48 PID: 312 at kernel/locking/mutex.c:564 __mutex_lock+0x8a1/0xe60 ... [] RIP: 0010:__mutex_lock+0x8a1/0xe60 [] mutex_lock_nested+0x1b/0x30 [] xe_guc_submit_wedge+0x80/0x2b0 [xe] (CVE-2025-38353)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38353
https://ubuntu.com/security/CVE-2025-38353

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38353

Plugin Information
Published: 2025/08/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
251346 - Linux Distros Unpatched Vulnerability : CVE-2025-38355
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/xe: Process deferred GGTT node removals on device unwind While we are indirectly draining our dedicated workqueue ggtt->wq that we use to complete asynchronous removal of some GGTT nodes, this happends as part of the managed-drm unwinding (ggtt_fini_early), which could be later then manage-device unwinding, where we could already unmap our MMIO/GMS mapping (mmio_fini). This was recently observed during unsuccessful VF initialization: [ ] xe 0000:00:02.1: probe with driver xe failed with error -62 [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747340
__xe_bo_unpin_map_no_vm (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747540
__xe_bo_unpin_map_no_vm (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747240
__xe_bo_unpin_map_no_vm (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747040 tiles_fini (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e746840 mmio_fini (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747f40 xe_bo_pinned_fini (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e746b40 devm_drm_dev_init_release (16 bytes) [ ] xe 0000:00:02.1: [drm:drm_managed_release] drmres release begin [ ] xe 0000:00:02.1: [drm:drm_managed_release] REL ffff88810ef81640 __fini_relay (8 bytes) [ ] xe 0000:00:02.1: [drm:drm_managed_release] REL ffff88810ef80d40 guc_ct_fini (8 bytes) [ ] xe 0000:00:02.1:
[drm:drm_managed_release] REL ffff88810ef80040 __drmm_mutex_release (8 bytes) [ ] xe 0000:00:02.1:
[drm:drm_managed_release] REL ffff88810ef80140 ggtt_fini_early (8 bytes) and this was leading to: [ ] BUG:
unable to handle page fault for address: ffffc900058162a0 [ ] #PF: supervisor write access in kernel mode [ ] #PF: error_code(0x0002) - not-present page [ ] Oops: Oops: 0002 [#1] SMP NOPTI [ ] Tainted: [W]=WARN [ ] Workqueue: xe-ggtt-wq ggtt_node_remove_work_func [xe] [ ] RIP: 0010:xe_ggtt_set_pte+0x6d/0x350 [xe] [ ] Call Trace: [ ] <TASK> [ ] xe_ggtt_clear+0xb0/0x270 [xe] [ ] ggtt_node_remove+0xbb/0x120 [xe] [ ] ggtt_node_remove_work_func+0x30/0x50 [xe] [ ] process_one_work+0x22b/0x6f0 [ ] worker_thread+0x1e8/0x3d Add managed-device action that will explicitly drain the workqueue with all pending node removals prior to releasing MMIO/GSM mapping. (cherry picked from commit 89d2835c3680ab1938e22ad81b1c9f8c686bd391) (CVE-2025-38355)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38355
https://ubuntu.com/security/CVE-2025-38355

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38355

Plugin Information
Published: 2025/08/18, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
252226 - Linux Distros Unpatched Vulnerability : CVE-2025-38356
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Explicitly exit CT safe mode on unwind During driver probe we might be briefly using CT safe mode, which is based on a delayed work, but usually we are able to stop this once we have IRQ fully operational. However, if we abort the probe quite early then during unwind we might try to destroy the workqueue while there is still a pending delayed work that attempts to restart itself which triggers a WARN. This was recently observed during unsuccessful VF initialization: [ ] xe 0000:00:02.1: probe with driver xe failed with error -62 [ ]
------------[ cut here ]------------ [ ] workqueue: cannot queue safe_mode_worker_func [xe] on wq xe-g2h-wq [ ] WARNING: CPU: 9 PID: 0 at kernel/workqueue.c:2257 __queue_work+0x287/0x710 [ ] RIP:
0010:__queue_work+0x287/0x710 [ ] Call Trace: [ ] delayed_work_timer_fn+0x19/0x30 [ ] call_timer_fn+0xa1/0x2a0 Exit the CT safe mode on unwind to avoid that warning. (cherry picked from commit 2ddbb73ec20b98e70a5200cb85deade22ccea2ec) (CVE-2025-38356)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38356
https://ubuntu.com/security/CVE-2025-38356

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38356

Plugin Information
Published: 2025/08/19, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244485 - Linux Distros Unpatched Vulnerability : CVE-2025-38359
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- s390/mm: Fix in_atomic() handling in do_secure_storage_access() Kernel user spaces accesses to not exported pages in atomic context incorrectly try to resolve the page fault. With debug options enabled call traces like this can be seen: BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1523 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 419074, name: qemu- system-s39 preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 INFO: lockdep is turned off.
Preemption disabled at: [<00000383ea47cfa2>] copy_page_from_iter_atomic+0xa2/0x8a0 CPU: 12 UID: 0 PID:
419074 Comm: qemu-system-s39 Tainted: G W 6.16.0-20250531.rc0.git0.69b3a602feac.63.fc42.s390x+debug #1 PREEMPT Tainted: [W]=WARN Hardware name: IBM 3931 A01 703 (LPAR) Call Trace: [<00000383e990d282>] dump_stack_lvl+0xa2/0xe8 [<00000383e99bf152>] __might_resched+0x292/0x2d0 [<00000383eaa7c374>] down_read+0x34/0x2d0 [<00000383e99432f8>] do_secure_storage_access+0x108/0x360 [<00000383eaa724b0>]
__do_pgm_check+0x130/0x220 [<00000383eaa842e4>] pgm_check_handler+0x114/0x160 [<00000383ea47d028>] copy_page_from_iter_atomic+0x128/0x8a0 ([<00000383ea47d016>] copy_page_from_iter_atomic+0x116/0x8a0) [<00000383e9c45eae>] generic_perform_write+0x16e/0x310 [<00000383e9eb87f4>] ext4_buffered_write_iter+0x84/0x160 [<00000383e9da0de4>] vfs_write+0x1c4/0x460 [<00000383e9da123c>] ksys_write+0x7c/0x100 [<00000383eaa7284e>] __do_syscall+0x15e/0x280 [<00000383eaa8417e>] system_call+0x6e/0x90 INFO: lockdep is turned off. It is not allowed to take the mmap_lock while in atomic context. Therefore handle such a secure storage access fault as if the accessed page is not mapped: the uaccess function will return -EFAULT, and the caller has to deal with this. Usually this means that the access is retried in process context, which allows to resolve the page fault (or in this case export the page). (CVE-2025-38359)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38359
https://security-tracker.debian.org/tracker/CVE-2025-38359
https://ubuntu.com/security/CVE-2025-38359

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38359

Plugin Information
Published: 2025/08/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247331 - Linux Distros Unpatched Vulnerability : CVE-2025-38363
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/tegra: Fix a possible null pointer dereference In tegra_crtc_reset(), new memory is allocated with kzalloc(), but no check is performed. Before calling __drm_atomic_helper_crtc_reset, state should be checked to prevent possible null pointer dereference. (CVE-2025-38363)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38363
https://ubuntu.com/security/CVE-2025-38363

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38363

Plugin Information
Published: 2025/08/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246071 - Linux Distros Unpatched Vulnerability : CVE-2025-38364
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() Temporarily clear the preallocation flag when explicitly requesting allocations. Pre-existing allocations are already counted against the request through mas_node_count_gfp(), but the allocations will not happen if the MA_STATE_PREALLOC flag is set.
This flag is meant to avoid re-allocating in bulk allocation mode, and to detect issues with preallocation calculations. The MA_STATE_PREALLOC flag should also always be set on zero allocations so that detection of underflow allocations will print a WARN_ON() during consumption. User visible effect of this flaw is a WARN_ON() followed by a null pointer dereference when subsequent requests for larger number of nodes is ignored, such as the vma merge retry in mmap_region() caused by drivers altering the vma flags (which happens in v6.6, at least) (CVE-2025-38364)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38364
https://ubuntu.com/security/CVE-2025-38364

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38364

Plugin Information
Published: 2025/08/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
252237 - Linux Distros Unpatched Vulnerability : CVE-2025-38372
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling __xa_store() and __xa_erase() were used without holding the proper lock, which led to a lockdep warning due to unsafe RCU usage. This patch replaces them with xa_store() and xa_erase(), which perform the necessary locking internally.
============================= WARNING: suspicious RCPU usage 6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1 Not tainted ----------------------------- ./include/linux/xarray.h:1211 suspicious rcu_dereference_protected() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 3 locks held by kworker/u136:0/219: at:
process_one_work+0xbe4/0x15f0 process_one_work+0x75c/0x15f0 pagefault_mr+0x9a5/0x1390 [mlx5_ib] stack backtrace: CPU: 14 UID: 0 PID: 219 Comm: kworker/u136:0 Not tainted 6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib] Call Trace: dump_stack_lvl+0xa8/0xc0 lockdep_rcu_suspicious+0x1e6/0x260 xas_create+0xb8a/0xee0 xas_store+0x73/0x14c0 __xa_store+0x13c/0x220 ? xa_store_range+0x390/0x390 ? spin_bug+0x1d0/0x1d0 pagefault_mr+0xcb5/0x1390 [mlx5_ib] ? _raw_spin_unlock+0x1f/0x30 mlx5_ib_eqe_pf_action+0x3be/0x2620 [mlx5_ib] ? lockdep_hardirqs_on_prepare+0x400/0x400 ? mlx5_ib_invalidate_range+0xcb0/0xcb0 [mlx5_ib] process_one_work+0x7db/0x15f0 ? pwq_dec_nr_in_flight+0xda0/0xda0 ? assign_work+0x168/0x240 worker_thread+0x57d/0xcd0 ? rescuer_thread+0xc40/0xc40 kthread+0x3b3/0x800 ? kthread_is_per_cpu+0xb0/0xb0 ? lock_downgrade+0x680/0x680 ? do_raw_spin_lock+0x12d/0x270 ? spin_bug+0x1d0/0x1d0 ? finish_task_switch.isra.0+0x284/0x9e0 ? lockdep_hardirqs_on_prepare+0x284/0x400 ? kthread_is_per_cpu+0xb0/0xb0 ret_from_fork+0x2d/0x70 ? kthread_is_per_cpu+0xb0/0xb0 ret_from_fork_asm+0x11/0x20 (CVE-2025-38372)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38372
https://ubuntu.com/security/CVE-2025-38372

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38372

Plugin Information
Published: 2025/08/19, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248319 - Linux Distros Unpatched Vulnerability : CVE-2025-38385
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect Remove redundant netif_napi_del() call from disconnect path. A WARN may be triggered in __netif_napi_del_locked() during USB device disconnect: WARNING: CPU: 0 PID: 11 at net/core/dev.c:7417 __netif_napi_del_locked+0x2b4/0x350 This happens because netif_napi_del() is called in the disconnect path while NAPI is still enabled. However, it is not necessary to call netif_napi_del() explicitly, since unregister_netdev() will handle NAPI teardown automatically and safely. Removing the redundant call avoids triggering the warning. Full trace: lan78xx 1-1:1.0 enu1: Failed to read register index 0x000000c4. ret = -ENODEV lan78xx 1-1:1.0 enu1: Failed to set MAC down with error -ENODEV lan78xx 1-1:1.0 enu1: Link is Down lan78xx 1-1:1.0 enu1: Failed to read register index 0x00000120. ret = -ENODEV ------------[ cut here ]------------ WARNING: CPU: 0 PID: 11 at net/core/dev.c:7417 __netif_napi_del_locked+0x2b4/0x350 Modules linked in: flexcan can_dev fuse CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 6.16.0-rc2-00624-ge926949dab03 #9 PREEMPT Hardware name: SKOV IMX8MP CPU revC - bd500 (DT) Workqueue: usb_hub_wq hub_event pstate: 60000005 (nZCv daif -PAN -UAO -TCO
-DIT -SSBS BTYPE=--) pc : __netif_napi_del_locked+0x2b4/0x350 lr : __netif_napi_del_locked+0x7c/0x350 sp :
ffffffc085b673c0 x29: ffffffc085b673c0 x28: ffffff800b7f2000 x27: ffffff800b7f20d8 x26: ffffff80110bcf58 x25: ffffff80110bd978 x24: 1ffffff0022179eb x23: ffffff80110bc000 x22: ffffff800b7f5000 x21:
ffffff80110bc000 x20: ffffff80110bcf38 x19: ffffff80110bcf28 x18: dfffffc000000000 x17: ffffffc081578940 x16: ffffffc08284cee0 x15: 0000000000000028 x14: 0000000000000006 x13: 0000000000040000 x12:
ffffffb0022179e8 x11: 1ffffff0022179e7 x10: ffffffb0022179e7 x9 : dfffffc000000000 x8 : 0000004ffdde8619 x7 : ffffff80110bcf3f x6 : 0000000000000001 x5 : ffffff80110bcf38 x4 : ffffff80110bcf38 x3 :
0000000000000000 x2 : 0000000000000000 x1 : 1ffffff0022179e7 x0 : 0000000000000000 Call trace:
__netif_napi_del_locked+0x2b4/0x350 (P) lan78xx_disconnect+0xf4/0x360 usb_unbind_interface+0x158/0x718 device_remove+0x100/0x150 device_release_driver_internal+0x308/0x478 device_release_driver+0x1c/0x30 bus_remove_device+0x1a8/0x368 device_del+0x2e0/0x7b0 usb_disable_device+0x244/0x540 usb_disconnect+0x220/0x758 hub_event+0x105c/0x35e0 process_one_work+0x760/0x17b0 worker_thread+0x768/0xce8 kthread+0x3bc/0x690 ret_from_fork+0x10/0x20 irq event stamp: 211604 hardirqs last enabled at (211603):
[<ffffffc0828cc9ec>] _raw_spin_unlock_irqrestore+0x84/0x98 hardirqs last disabled at (211604):
[<ffffffc0828a9a84>] el1_dbg+0x24/0x80 softirqs last enabled at (211296): [<ffffffc080095f10>] handle_softirqs+0x820/0xbc8 softirqs last disabled at (210993): [<ffffffc080010288>]
__do_softirq+0x18/0x20 ---[ end trace 0000000000000000 ]--- lan78xx 1-1:1.0 enu1: failed to kill vid 0081/0 (CVE-2025-38385)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38385
https://ubuntu.com/security/CVE-2025-38385

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38385

Plugin Information
Published: 2025/08/11, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248322 - Linux Distros Unpatched Vulnerability : CVE-2025-38386
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ACPICA: Refuse to evaluate a method if arguments are missing As reported in [1], a platform firmware update that increased the number of method parameters and forgot to update a least one of its callers, caused ACPICA to crash due to use-after-free. Since this a result of a clear AML issue that arguably cannot be fixed up by the interpreter (it cannot produce missing data out of thin air), address it by making ACPICA refuse to evaluate a method if the caller attempts to pass fewer arguments than expected to it. (CVE-2025-38386)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38386
https://ubuntu.com/security/CVE-2025-38386

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38386

Plugin Information
Published: 2025/08/11, Modified: 2025/12/24
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247379 - Linux Distros Unpatched Vulnerability : CVE-2025-38391
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: typec: altmodes/displayport: do not index invalid pin_assignments A poorly implemented DisplayPort Alt Mode port partner can indicate that its pin assignment capabilities are greater than the maximum value, DP_PIN_ASSIGN_F. In this case, calls to pin_assignment_show will cause a BRK exception due to an out of bounds array access. Prevent for loop in pin_assignment_show from accessing invalid values in pin_assignments by adding DP_PIN_ASSIGN_MAX value in typec_dp.h and using i < DP_PIN_ASSIGN_MAX as a loop condition. (CVE-2025-38391)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38391
https://ubuntu.com/security/CVE-2025-38391

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38391

Plugin Information
Published: 2025/08/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244443 - Linux Distros Unpatched Vulnerability : CVE-2025-38393
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN We found a few different systems hung up in writeback waiting on the same page lock, and one task waiting on the NFS_LAYOUT_DRAIN bit in pnfs_update_layout(), however the pnfs_layout_hdr's plh_outstanding count was zero. It seems most likely that this is another race between the waiter and waker similar to commit ed0172af5d6f (SUNRPC: Fix a race to wake a sync task). Fix it up by applying the advised barrier. (CVE-2025-38393)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38393
https://ubuntu.com/security/CVE-2025-38393

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.1
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38393

Plugin Information
Published: 2025/08/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248669 - Linux Distros Unpatched Vulnerability : CVE-2025-38399
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() The function core_scsi3_decode_spec_i_port(), in its error code path, unconditionally calls core_scsi3_lunacl_undepend_item() passing the dest_se_deve pointer, which may be NULL. This can lead to a NULL pointer dereference if dest_se_deve remains unset. SPC-3 PR SPEC_I_PT: Unable to locate dest_tpg Unable to handle kernel paging request at virtual address dfff800000000012 Call trace:
core_scsi3_lunacl_undepend_item+0x2c/0xf0 [target_core_mod] (P) core_scsi3_decode_spec_i_port+0x120c/0x1c30 [target_core_mod] core_scsi3_emulate_pro_register+0x6b8/0xcd8 [target_core_mod] target_scsi3_emulate_pr_out+0x56c/0x840 [target_core_mod] Fix this by adding a NULL check before calling core_scsi3_lunacl_undepend_item() (CVE-2025-38399)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38399
https://ubuntu.com/security/CVE-2025-38399

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38399

Plugin Information
Published: 2025/08/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
252213 - Linux Distros Unpatched Vulnerability : CVE-2025-38402
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- idpf: return 0 size for RSS key if not supported Returning -EOPNOTSUPP from function returning u32 is leading to cast and invalid size value as a result. -EOPNOTSUPP as a size probably will lead to allocation fail. Command: ethtool -x eth0 It is visible on all devices that don't have RSS caps set. [ 136.615917] Call Trace: [ 136.615921] <TASK> [ 136.615927] ? __warn+0x89/0x130 [ 136.615942] ?
__alloc_frozen_pages_noprof+0x322/0x330 [ 136.615953] ? report_bug+0x164/0x190 [ 136.615968] ? handle_bug+0x58/0x90 [ 136.615979] ? exc_invalid_op+0x17/0x70 [ 136.615987] ? asm_exc_invalid_op+0x1a/0x20 [ 136.616001] ? rss_prepare_get.constprop.0+0xb9/0x170 [ 136.616016] ?
__alloc_frozen_pages_noprof+0x322/0x330 [ 136.616028] __alloc_pages_noprof+0xe/0x20 [ 136.616038]
___kmalloc_large_node+0x80/0x110 [ 136.616072] __kmalloc_large_node_noprof+0x1d/0xa0 [ 136.616081]
__kmalloc_noprof+0x32c/0x4c0 [ 136.616098] ? rss_prepare_get.constprop.0+0xb9/0x170 [ 136.616105] rss_prepare_get.constprop.0+0xb9/0x170 [ 136.616114] ethnl_default_doit+0x107/0x3d0 [ 136.616131] genl_family_rcv_msg_doit+0x100/0x160 [ 136.616147] genl_rcv_msg+0x1b8/0x2c0 [ 136.616156] ?
__pfx_ethnl_default_doit+0x10/0x10 [ 136.616168] ? __pfx_genl_rcv_msg+0x10/0x10 [ 136.616176] netlink_rcv_skb+0x58/0x110 [ 136.616186] genl_rcv+0x28/0x40 [ 136.616195] netlink_unicast+0x19b/0x290 [ 136.616206] netlink_sendmsg+0x222/0x490 [ 136.616215] __sys_sendto+0x1fd/0x210 [ 136.616233]
__x64_sys_sendto+0x24/0x30 [ 136.616242] do_syscall_64+0x82/0x160 [ 136.616252] ? __sys_recvmsg+0x83/0xe0 [ 136.616265] ? syscall_exit_to_user_mode+0x10/0x210 [ 136.616275] ? do_syscall_64+0x8e/0x160 [ 136.616282] ? __count_memcg_events+0xa1/0x130 [ 136.616295] ? count_memcg_events.constprop.0+0x1a/0x30 [ 136.616306] ? handle_mm_fault+0xae/0x2d0 [ 136.616319] ? do_user_addr_fault+0x379/0x670 [ 136.616328] ? clear_bhb_loop+0x45/0xa0 [ 136.616340] ? clear_bhb_loop+0x45/0xa0 [ 136.616349] ? clear_bhb_loop+0x45/0xa0 [ 136.616359] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 136.616369] RIP: 0033:0x7fd30ba7b047 [ 136.616376] Code: 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 80 3d bd d5 0c 00 00 41 89 ca 74 10 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 71 c3 55 48 83 ec 30 44 89 4c 24 2c 4c 89 44 [ 136.616381] RSP: 002b:00007ffde1796d68 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 136.616388] RAX:
ffffffffffffffda RBX: 000055d7bd89f2a0 RCX: 00007fd30ba7b047 [ 136.616392] RDX: 0000000000000028 RSI:
000055d7bd89f3b0 RDI: 0000000000000003 [ 136.616396] RBP: 00007ffde1796e10 R08: 00007fd30bb4e200 R09:
000000000000000c [ 136.616399] R10: 0000000000000000 R11: 0000000000000202 R12: 000055d7bd89f340 [ 136.616403] R13: 000055d7bd89f3b0 R14: 000055d78943f200 R15: 0000000000000000 (CVE-2025-38402)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38402
https://ubuntu.com/security/CVE-2025-38402

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:M/Au:N/C:P/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38402

Plugin Information
Published: 2025/08/19, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
251347 - Linux Distros Unpatched Vulnerability : CVE-2025-38405
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nvmet: fix memory leak of bio integrity If nvmet receives commands with metadata there is a continuous memory leak of kmalloc-128 slab or more precisely bio->bi_integrity. Since commit bf4c89fc8797 (block:
don't call bio_uninit from bio_endio) each user of bio_init has to use bio_uninit as well. Otherwise the bio integrity is not getting free. Nvmet uses bio_init for inline bios. Uninit the inline bio to complete deallocation of integrity in bio. (CVE-2025-38405)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38405
https://ubuntu.com/security/CVE-2025-38405

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38405

Plugin Information
Published: 2025/08/18, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249923 - Linux Distros Unpatched Vulnerability : CVE-2025-38408
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- genirq/irq_sim: Initialize work context pointers properly Initialize `ops` member's pointers properly by using kzalloc() instead of kmalloc() when allocating the simulation work context. Otherwise the pointers contain random content leading to invalid dereferencing. (CVE-2025-38408)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38408
https://security-tracker.debian.org/tracker/CVE-2025-38408
https://ubuntu.com/security/CVE-2025-38408

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38408

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246990 - Linux Distros Unpatched Vulnerability : CVE-2025-38412
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks After retrieving WMI data blocks in sysfs callbacks, check for the validity of them before dereferencing their content.
(CVE-2025-38412)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38412
https://ubuntu.com/security/CVE-2025-38412

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)
CVSS v3.0 Temporal Score
5.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38412

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
252219 - Linux Distros Unpatched Vulnerability : CVE-2025-38414
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 GCC_GCC_PCIE_HOT_RST is wrongly defined for WCN7850, causing kernel crash on some specific platforms. Since this register is divergent for WCN7850 and QCN9274, move it to register table to allow different definitions. Then correct the register address for WCN7850 to fix this issue. Note IPQ5332 is not affected as it is not PCIe based device. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 (CVE-2025-38414)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38414
https://ubuntu.com/security/CVE-2025-38414

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38414

Plugin Information
Published: 2025/08/19, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246450 - Linux Distros Unpatched Vulnerability : CVE-2025-38415
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Squashfs: check return result of sb_min_blocksize Syzkaller reports an UBSAN: shift-out-of-bounds in squashfs_bio_read bug. Syzkaller forks multiple processes which after mounting the Squashfs filesystem, issues an ioctl(/dev/loop0, LOOP_SET_BLOCK_SIZE, 0x8000). Now if this ioctl occurs at the same time another process is in the process of mounting a Squashfs filesystem on /dev/loop0, the failure occurs.
When this happens the following code in squashfs_fill_super() fails. ---- msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE); msblk->devblksize_log2 = ffz(~msblk->devblksize); ---- sb_min_blocksize() returns 0, which means msblk->devblksize is set to 0. As a result, ffz(~msblk->devblksize) returns 64, and msblk->devblksize_log2 is set to 64. This subsequently causes the UBSAN: shift-out-of-bounds in fs/squashfs/block.c:195:36 shift exponent 64 is too large for 64-bit type 'u64' (aka 'unsigned long long') This commit adds a check for a 0 return by sb_min_blocksize().
(CVE-2025-38415)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38415
https://ubuntu.com/security/CVE-2025-38415

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38415

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249807 - Linux Distros Unpatched Vulnerability : CVE-2025-38424
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- perf: Fix sample vs do_exit() Baisheng Gao reported an ARM64 crash, which Mark decoded as being a synchronous external abort -- most likely due to trying to access MMIO in bad ways. The crash further shows perf trying to do a user stack sample while in exit_mmap()'s tlb_finish_mmu() -- i.e. while tearing down the address space it is trying to access. It turns out that we stop perf after we tear down the userspace mm; a receipie for disaster, since perf likes to access userspace for various reasons. Flip this order by moving up where we stop perf in do_exit(). Additionally, harden PERF_SAMPLE_CALLCHAIN and PERF_SAMPLE_STACK_USER to abort when the current task does not have an mm (exit_mm() makes sure to set current->mm = NULL; before commencing with the actual teardown). Such that CPU wide events don't trip on this same problem. (CVE-2025-38424)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38424
https://ubuntu.com/security/CVE-2025-38424

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38424

Plugin Information
Published: 2025/08/15, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
252207 - Linux Distros Unpatched Vulnerability : CVE-2025-38427
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- video: screen_info: Relocate framebuffers behind PCI bridges Apply PCI host-bridge window offsets to screen_info framebuffers. Fixes invalid access to I/O memory. Resources behind a PCI host bridge can be relocated by a certain offset in the kernel's CPU address range used for I/O. The framebuffer memory range stored in screen_info refers to the CPU addresses as seen during boot (where the offset is 0). During boot up, firmware may assign a different memory offset to the PCI host bridge and thereby relocating the framebuffer address of the PCI graphics device as seen by the kernel. The information in screen_info must be updated as well. The helper pcibios_bus_to_resource() performs the relocation of the screen_info's framebuffer resource (given in PCI bus addresses). The result matches the I/O-memory resource of the PCI graphics device (given in CPU addresses). As before, we store away the information necessary to later update the information in screen_info itself. Commit 78aa89d1dfba (firmware/sysfb: Update screen_info for relocated EFI framebuffers) added the code for updating screen_info. It is based on similar functionality that pre-existed in efifb. Efifb uses a pointer to the PCI resource, while the newer code does a memcpy of the region. Hence efifb sees any updates to the PCI resource and avoids the issue. v3: - Only use struct pci_bus_region for PCI bus addresses (Bjorn) - Clarify address semantics in commit messages and comments (Bjorn) v2: - Fixed tags (Takashi, Ivan) - Updated information on efifb (CVE-2025-38427)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38427
https://ubuntu.com/security/CVE-2025-38427

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38427

Plugin Information
Published: 2025/08/19, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
251333 - Linux Distros Unpatched Vulnerability : CVE-2025-38431
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: smb: client: fix regression with native SMB symlinks Some users and customers reported that their backup/copy tools started to fail when the directory being copied contained symlink targets that the client couldn't parse - even when those symlinks weren't followed. Fix this by allowing lstat(2) and readlink(2) to succeed even when the client can't resolve the symlink target, restoring old behavior. (CVE-2025-38431)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38431
https://ubuntu.com/security/CVE-2025-38431

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38431

Plugin Information
Published: 2025/08/18, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246531 - Linux Distros Unpatched Vulnerability : CVE-2025-38436
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/scheduler: signal scheduled fence when kill job When an entity from application B is killed, drm_sched_entity_kill() removes all jobs belonging to that entity through drm_sched_entity_kill_jobs_work(). If application A's job depends on a scheduled fence from application B's job, and that fence is not properly signaled during the killing process, application A's dependency cannot be cleared. This leads to application A hanging indefinitely while waiting for a dependency that will never be resolved. Fix this issue by ensuring that scheduled fences are properly signaled when an entity is killed, allowing dependent applications to continue execution. (CVE-2025-38436)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38436
https://security-tracker.debian.org/tracker/CVE-2025-38436
https://ubuntu.com/security/CVE-2025-38436

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38436

Plugin Information
Published: 2025/08/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245537 - Linux Distros Unpatched Vulnerability : CVE-2025-38438
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. sof_pdata->tplg_filename can have address allocated by kstrdup() and can be overwritten. Memory leak was detected with kmemleak: unreferenced object 0xffff88812391ff60 (size 16): comm kworker/4:1, pid 161, jiffies 4294802931 hex dump (first 16 bytes):
73 6f 66 2d 68 64 61 2d 67 65 6e 65 72 69 63 00 sof-hda-generic. backtrace (crc 4bf1675c):
__kmalloc_node_track_caller_noprof+0x49c/0x6b0 kstrdup+0x46/0xc0 hda_machine_select.cold+0x1de/0x12cf [snd_sof_intel_hda_generic] sof_init_environment+0x16f/0xb50 [snd_sof] sof_probe_continue+0x45/0x7c0 [snd_sof] sof_probe_work+0x1e/0x40 [snd_sof] process_one_work+0x894/0x14b0 worker_thread+0x5e5/0xfb0 kthread+0x39d/0x760 ret_from_fork+0x31/0x70 ret_from_fork_asm+0x1a/0x30 (CVE-2025-38438)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38438
https://security-tracker.debian.org/tracker/CVE-2025-38438
https://ubuntu.com/security/CVE-2025-38438

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38438

Plugin Information
Published: 2025/08/07, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
246888 - Linux Distros Unpatched Vulnerability : CVE-2025-38440
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mlx5e: Fix race between DIM disable and net_dim() There's a race between disabling DIM and NAPI callbacks using the dim pointer on the RQ or SQ. If NAPI checks the DIM state bit and sees it still set, it assumes `rq->dim` or `sq->dim` is valid. But if DIM gets disabled right after that check, the pointer might already be set to NULL, leading to a NULL pointer dereference in net_dim(). Fix this by calling `synchronize_net()` before freeing the DIM context. This ensures all in-progress NAPI callbacks are finished before the pointer is cleared. Kernel log: BUG: kernel NULL pointer dereference, address:
0000000000000000 ... RIP: 0010:net_dim+0x23/0x190 ... Call Trace: <TASK> ? __die+0x20/0x60 ? page_fault_oops+0x150/0x3e0 ? common_interrupt+0xf/0xa0 ? sysvec_call_function_single+0xb/0x90 ? exc_page_fault+0x74/0x130 ? asm_exc_page_fault+0x22/0x30 ? net_dim+0x23/0x190 ? mlx5e_poll_ico_cq+0x41/0x6f0 [mlx5_core] ? sysvec_apic_timer_interrupt+0xb/0x90 mlx5e_handle_rx_dim+0x92/0xd0 [mlx5_core] mlx5e_napi_poll+0x2cd/0xac0 [mlx5_core] ? mlx5e_poll_ico_cq+0xe5/0x6f0 [mlx5_core] busy_poll_stop+0xa2/0x200 ? mlx5e_napi_poll+0x1d9/0xac0 [mlx5_core] ? mlx5e_trigger_irq+0x130/0x130 [mlx5_core] __napi_busy_loop+0x345/0x3b0 ? sysvec_call_function_single+0xb/0x90 ? asm_sysvec_call_function_single+0x16/0x20 ? sysvec_apic_timer_interrupt+0xb/0x90 ? pcpu_free_area+0x1e4/0x2e0 napi_busy_loop+0x11/0x20 xsk_recvmsg+0x10c/0x130 sock_recvmsg+0x44/0x70 __sys_recvfrom+0xbc/0x130 ? __schedule+0x398/0x890
__x64_sys_recvfrom+0x20/0x30 do_syscall_64+0x4c/0x100 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ... ---[ end trace 0000000000000000 ]--- ... ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- (CVE-2025-38440)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38440
https://ubuntu.com/security/CVE-2025-38440

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38440

Plugin Information
Published: 2025/08/09, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
249597 - Linux Distros Unpatched Vulnerability : CVE-2025-38441
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() syzbot found a potential access to uninit-value in nf_flow_pppoe_proto() Blamed commit forgot the Ethernet header. BUG: KMSAN: uninit- value in nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27 nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27 nf_hook_entry_hookfn include/linux/netfilter.h:157 [inline] nf_hook_slow+0xe1/0x3d0 net/netfilter/core.c:623 nf_hook_ingress include/linux/netfilter_netdev.h:34 [inline] nf_ingress net/core/dev.c:5742 [inline]
__netif_receive_skb_core+0x4aff/0x70c0 net/core/dev.c:5837 __netif_receive_skb_one_core net/core/dev.c:5975 [inline] __netif_receive_skb+0xcc/0xac0 net/core/dev.c:6090 netif_receive_skb_internal net/core/dev.c:6176 [inline] netif_receive_skb+0x57/0x630 net/core/dev.c:6235 tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485 tun_get_user+0x4ee0/0x6b40 drivers/net/tun.c:1938 tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1984 new_sync_write fs/read_write.c:593 [inline] vfs_write+0xb4b/0x1580 fs/read_write.c:686 ksys_write fs/read_write.c:738 [inline] __do_sys_write fs/read_write.c:749 [inline] (CVE-2025-38441)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38441
https://ubuntu.com/security/CVE-2025-38441

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38441

Plugin Information
Published: 2025/08/15, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260486 - Linux Distros Unpatched Vulnerability : CVE-2025-38444
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- raid10: cleanup memleak at raid10_make_request If raid10_read_request or raid10_write_request registers a new request and the REQ_NOWAIT flag is set, the code does not free the malloc from the mempool.
unreferenced object 0xffff8884802c3200 (size 192): comm fio, pid 9197, jiffies 4298078271 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 88 41 02 00 00 00 00 00 .........A...... 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc c1a049a2): __kmalloc+0x2bb/0x450 mempool_alloc+0x11b/0x320 raid10_make_request+0x19e/0x650 [raid10] md_handle_request+0x3b3/0x9e0
__submit_bio+0x394/0x560 __submit_bio_noacct+0x145/0x530 submit_bio_noacct_nocheck+0x682/0x830
__blkdev_direct_IO_async+0x4dc/0x6b0 blkdev_read_iter+0x1e5/0x3b0 __io_read+0x230/0x1110 io_read+0x13/0x30 io_issue_sqe+0x134/0x1180 io_submit_sqes+0x48c/0xe90 __do_sys_io_uring_enter+0x574/0x8b0 do_syscall_64+0x5c/0xe0 entry_SYSCALL_64_after_hwframe+0x76/0x7e V4: changing backing tree to see if CKI tests will pass. The patch code has not changed between any versions. (CVE-2025-38444)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38444
https://ubuntu.com/security/CVE-2025-38444

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38444

Plugin Information
Published: 2025/09/02, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245542 - Linux Distros Unpatched Vulnerability : CVE-2025-38450
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() Add a NULL check for msta->vif before accessing its members to prevent a kernel panic in AP mode deployment. This also fix the issue reported in [1]. The crash occurs when this function is triggered before the station is fully initialized. The call trace shows a page fault at mt7925_sta_set_decap_offload() due to accessing resources when msta->vif is NULL. Fix this by adding an early return if msta->vif is NULL and also check wcid.sta is ready. This ensures we only proceed with decap offload configuration when the station's state is properly initialized. [14739.655703] Unable to handle kernel paging request at virtual address ffffffffffffffa0 [14739.811820] CPU: 0 UID: 0 PID: 895854 Comm: hostapd Tainted: G [14739.821394] Tainted: [C]=CRAP, [O]=OOT_MODULE [14739.825746] Hardware name: Raspberry Pi 4 Model B Rev 1.1 (DT) [14739.831577] pstate: 60000005 (nZCv daif -PAN -UAO
-TCO -DIT -SSBS BTYPE=--) [14739.838538] pc : mt7925_sta_set_decap_offload+0xc0/0x1b8 [mt7925_common] [14739.845271] lr : mt7925_sta_set_decap_offload+0x58/0x1b8 [mt7925_common] [14739.851985] sp :
ffffffc085efb500 [14739.855295] x29: ffffffc085efb500 x28: 0000000000000000 x27: ffffff807803a158 [14739.862436] x26: ffffff8041ececb8 x25: 0000000000000001 x24: 0000000000000001 [14739.869577] x23:
0000000000000001 x22: 0000000000000008 x21: ffffff8041ecea88 [14739.876715] x20: ffffff8041c19ca0 x19:
ffffff8078031fe0 x18: 0000000000000000 [14739.883853] x17: 0000000000000000 x16: ffffffe2aeac1110 x15:
000000559da48080 [14739.890991] x14: 0000000000000001 x13: 0000000000000000 x12: 0000000000000000 [14739.898130] x11: 0a10020001008e88 x10: 0000000000001a50 x9 : ffffffe26457bfa0 [14739.905269] x8 :
ffffff8042013bb0 x7 : ffffff807fb6cbf8 x6 : dead000000000100 [14739.912407] x5 : dead000000000122 x4 :
ffffff80780326c8 x3 : 0000000000000000 [14739.919546] x2 : 0000000000000000 x1 : 0000000000000000 x0 :
ffffff8041ececb8 [14739.926686] Call trace: [14739.929130] mt7925_sta_set_decap_offload+0xc0/0x1b8 [mt7925_common] [14739.935505] ieee80211_check_fast_rx+0x19c/0x510 [mac80211] [14739.941344]
_sta_info_move_state+0xe4/0x510 [mac80211] [14739.946860] sta_info_move_state+0x1c/0x30 [mac80211] [14739.952116] sta_apply_auth_flags.constprop.0+0x90/0x1b0 [mac80211] [14739.958708] sta_apply_parameters+0x234/0x5e0 [mac80211] [14739.964332] ieee80211_add_station+0xdc/0x190 [mac80211] [14739.969950] nl80211_new_station+0x46c/0x670 [cfg80211] [14739.975516] genl_family_rcv_msg_doit+0xdc/0x150 [14739.980158] genl_rcv_msg+0x218/0x298 [14739.983830] netlink_rcv_skb+0x64/0x138 [14739.987670] genl_rcv+0x40/0x60 [14739.990816] netlink_unicast+0x314/0x380 [14739.994742] netlink_sendmsg+0x198/0x3f0 [14739.998664] __sock_sendmsg+0x64/0xc0 [14740.002324]
____sys_sendmsg+0x260/0x298 [14740.006242] ___sys_sendmsg+0xb4/0x110 (CVE-2025-38450)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38450
https://ubuntu.com/security/CVE-2025-38450

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38450

Plugin Information
Published: 2025/08/07, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244006 - Linux Distros Unpatched Vulnerability : CVE-2025-38458
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() atmarpd_dev_ops does not implement the send method, which may cause crash as bellow. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: Oops: 0010 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted 6.15.0-rc6-syzkaller-00346-g5723cc3450bc #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. RSP: 0018:ffffc9000d3cf778 EFLAGS: 00010246 RAX: 1ffffffff1910dd1 RBX:
00000000000000c0 RCX: dffffc0000000000 RDX: ffffc9000dc82000 RSI: ffff88803e4c4640 RDI: ffff888052cd0000 RBP: ffffc9000d3cf8d0 R08: ffff888052c9143f R09: 1ffff1100a592287 R10: dffffc0000000000 R11:
0000000000000000 R12: 1ffff92001a79f00 R13: ffff888052cd0000 R14: ffff88803e4c4640 R15: ffffffff8c886e88 FS: 00007fbc762566c0(0000) GS:ffff88808d6c2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 0000000041f1b000 CR4: 0000000000352ef0 DR0:
0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> vcc_sendmsg+0xa10/0xc50 net/atm/common.c:644 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:727 ____sys_sendmsg+0x52d/0x830 net/socket.c:2566 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2620 __sys_sendmmsg+0x227/0x430 net/socket.c:2709 __do_sys_sendmmsg net/socket.c:2736 [inline] __se_sys_sendmmsg net/socket.c:2733 [inline] __x64_sys_sendmmsg+0xa0/0xc0 net/socket.c:2733 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f (CVE-2025-38458)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38458
https://ubuntu.com/security/CVE-2025-38458

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38458

Plugin Information
Published: 2025/08/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247424 - Linux Distros Unpatched Vulnerability : CVE-2025-38459
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- atm: clip: Fix infinite recursive call of clip_push(). syzbot reported the splat below. [0] This happens if we call ioctl(ATMARP_MKIP) more than once. During the first call, clip_mkip() sets clip_push() to vcc->push(), and the second call copies it to clip_vcc->old_push(). Later, when the socket is close()d, vcc_destroy_socket() passes NULL skb to clip_push(), which calls clip_vcc->old_push(), triggering the infinite recursion. Let's prevent the second ioctl(ATMARP_MKIP) by checking vcc->user_back, which is allocated by the first call as clip_vcc. Note also that we use lock_sock() to prevent racy calls. [0]:
BUG: TASK stack guard page was hit at ffffc9000d66fff8 (stack is ffffc9000d670000..ffffc9000d678000) Oops:
stack guard page: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted 6.16.0-rc4-syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:clip_push+0x5/0x720 net/atm/clip.c:191 Code: e0 8f aa 8c e8 1c ad 5b fa eb ae 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 <41> 57 41 56 41 55 41 54 53 48 83 ec 20 48 89 f3 49 89 fd 48 bd 00 RSP: 0018:ffffc9000d670000 EFLAGS: 00010246 RAX: 1ffff1100235a4a5 RBX: ffff888011ad2508 RCX: ffff8880003c0000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888037f01000 RBP: dffffc0000000000 R08: ffffffff8fa104f7 R09:
1ffffffff1f4209e R10: dffffc0000000000 R11: ffffffff8a99b300 R12: ffffffff8a99b300 R13: ffff888037f01000 R14: ffff888011ad2500 R15: ffff888037f01578 FS: 000055557ab6d500(0000) GS:ffff88808d250000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000d66fff8 CR3:
0000000043172000 CR4: 0000000000352ef0 Call Trace: <TASK> clip_push+0x6dc/0x720 net/atm/clip.c:200 clip_push+0x6dc/0x720 net/atm/clip.c:200 clip_push+0x6dc/0x720 net/atm/clip.c:200 ...
clip_push+0x6dc/0x720 net/atm/clip.c:200 clip_push+0x6dc/0x720 net/atm/clip.c:200 clip_push+0x6dc/0x720 net/atm/clip.c:200 vcc_destroy_socket net/atm/common.c:183 [inline] vcc_release+0x157/0x460 net/atm/common.c:205 __sock_release net/socket.c:647 [inline] sock_close+0xc0/0x240 net/socket.c:1391
__fput+0x449/0xa70 fs/file_table.c:465 task_work_run+0x1d1/0x260 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:114 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff31c98e929 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fffb5aa1f78 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 0000000000012747 RCX: 00007ff31c98e929 RDX:
0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007ff31cbb7ba0 R08: 0000000000000001 R09: 0000000db5aa226f R10: 00007ff31c7ff030 R11: 0000000000000246 R12: 00007ff31cbb608c R13:
00007ff31cbb6080 R14: ffffffffffffffff R15: 00007fffb5aa2090 </TASK> Modules linked in: (CVE-2025-38459)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38459
https://ubuntu.com/security/CVE-2025-38459

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38459

Plugin Information
Published: 2025/08/10, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
250252 - Linux Distros Unpatched Vulnerability : CVE-2025-38460
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). atmarpd is protected by RTNL since commit f3a0592b37b8 ([ATM]: clip causes unregister hang). However, it is not enough because to_atmarpd() is called without RTNL, especially clip_neigh_solicit() / neigh_ops->solicit() is unsleepable. Also, there is no RTNL dependency around atmarpd. Let's use a private mutex and RCU to protect access to atmarpd in to_atmarpd(). (CVE-2025-38460)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38460
https://ubuntu.com/security/CVE-2025-38460

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38460

Plugin Information
Published: 2025/08/15, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
248553 - Linux Distros Unpatched Vulnerability : CVE-2025-38462
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vsock: Fix transport_{g2h,h2g} TOCTOU vsock_find_cid() and vsock_dev_do_ioctl() may race with module unload. transport_{g2h,h2g} may become NULL after the NULL check. Introduce vsock_transport_local_cid() to protect from a potential null-ptr-deref. KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] RIP: 0010:vsock_find_cid+0x47/0x90 Call Trace:
__vsock_bind+0x4b2/0x720 vsock_bind+0x90/0xe0 __sys_bind+0x14d/0x1e0 __x64_sys_bind+0x6e/0xc0 do_syscall_64+0x92/0x1c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] RIP: 0010:vsock_dev_do_ioctl.isra.0+0x58/0xf0 Call Trace:
__x64_sys_ioctl+0x12d/0x190 do_syscall_64+0x92/0x1c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 (CVE-2025-38462)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38462
https://ubuntu.com/security/CVE-2025-38462

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.1
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38462

Plugin Information
Published: 2025/08/12, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
251319 - Linux Distros Unpatched Vulnerability : CVE-2025-38468
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree htb_lookup_leaf has a BUG_ON that can trigger with the following: tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid 1:1 htb rate 64bit tc qdisc add dev lo parent 1:1 handle 2: netem tc qdisc add dev lo parent 2:1 handle 3: blackhole ping -I lo -c1 -W0.001 127.0.0.1 The root cause is the following: 1. htb_dequeue calls htb_dequeue_tree which calls the dequeue handler on the selected leaf qdisc 2. netem_dequeue calls enqueue on the child qdisc 3. blackhole_enqueue drops the packet and returns a value that is not just NET_XMIT_SUCCESS 4. Because of this, netem_dequeue calls qdisc_tree_reduce_backlog, and since qlen is now 0, it calls htb_qlen_notify -> htb_deactivate ->
htb_deactiviate_prios -> htb_remove_class_from_row -> htb_safe_rb_erase 5. As this is the only class in the selected hprio rbtree, __rb_change_child in __rb_erase_augmented sets the rb_root pointer to NULL 6.
Because blackhole_dequeue returns NULL, netem_dequeue returns NULL, which causes htb_dequeue_tree to call htb_lookup_leaf with the same hprio rbtree, and fail the BUG_ON The function graph for this scenario is shown here: 0) | htb_enqueue() { 0) + 13.635 us | netem_enqueue(); 0) 4.719 us | htb_activate_prios(); 0) # 2249.199 us | } 0) | htb_dequeue() { 0) 2.355 us | htb_lookup_leaf(); 0) | netem_dequeue() { 0) + 11.061 us | blackhole_enqueue(); 0) | qdisc_tree_reduce_backlog() { 0) | qdisc_lookup_rcu() { 0) 1.873 us | qdisc_match_from_root(); 0) 6.292 us | } 0) 1.894 us | htb_search(); 0) | htb_qlen_notify() { 0) 2.655 us | htb_deactivate_prios(); 0) 6.933 us | } 0) + 25.227 us | } 0) 1.983 us | blackhole_dequeue(); 0) + 86.553 us | } 0) # 2932.761 us | qdisc_warn_nonwc(); 0) | htb_lookup_leaf() { 0) | BUG_ON();
------------------------------------------ The full original bug report can be seen here [1]. We can fix this just by returning NULL instead of the BUG_ON, as htb_dequeue_tree returns NULL when htb_lookup_leaf returns NULL. [1] https://lore.kernel.org/netdev/pF5XOOIim0IuEfhI- SOxTgRvNoDwuux7UHKnE_Y5-zVd4wmGvNk2ceHjKb8ORnzw0cGwfmVu42g9dL7XyJLf1NEzaztboTWcm0Ogxuojoeo=@willsroot.io/ (CVE-2025-38468)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38468
https://ubuntu.com/security/CVE-2025-38468

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38468

Plugin Information
Published: 2025/08/18, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
252211 - Linux Distros Unpatched Vulnerability : CVE-2025-38489
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again Commit 7ded842b356d (s390/bpf: Fix bpf_plt pointer arithmetic) has accidentally removed the critical piece of commit c730fce7c70c (s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL), causing intermittent kernel panics in e.g. perf's on_switch() prog to reappear. Restore the fix and add a comment. (CVE-2025-38489)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38489
https://ubuntu.com/security/CVE-2025-38489

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38489

Plugin Information
Published: 2025/08/19, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
251344 - Linux Distros Unpatched Vulnerability : CVE-2025-38491
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mptcp: make fallback action and fallback decision atomic Syzkaller reported the following splat: WARNING:
CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 __mptcp_do_fallback net/mptcp/protocol.h:1223 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_do_fallback net/mptcp/protocol.h:1244 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 check_fully_established net/mptcp/options.c:982 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153 Modules linked in: CPU: 1 UID: 0 PID: 7704 Comm: syz.3.1419 Not tainted 6.16.0-rc3-gbd5ce2324dba #20 PREEMPT(voluntary) Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__mptcp_do_fallback net/mptcp/protocol.h:1223 [inline] RIP: 0010:mptcp_do_fallback net/mptcp/protocol.h:1244 [inline] RIP:
0010:check_fully_established net/mptcp/options.c:982 [inline] RIP:
0010:mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153 Code: 24 18 e8 bb 2a 00 fd e9 1b df ff ff e8 b1 21 0f 00 e8 ec 5f c4 fc 44 0f b7 ac 24 b0 00 00 00 e9 54 f1 ff ff e8 d9 5f c4 fc 90 <0f> 0b 90 e9 b8 f4 ff ff e8 8b 2a 00 fd e9 8d e6 ff ff e8 81 2a 00 RSP: 0018:ffff8880a3f08448 EFLAGS: 00010246 RAX:
0000000000000000 RBX: ffff8880180a8000 RCX: ffffffff84afcf45 RDX: ffff888090223700 RSI: ffffffff84afdaa7 RDI: 0000000000000001 RBP: ffff888017955780 R08: 0000000000000001 R09: 0000000000000000 R10:
0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff8880180a8910 R14: ffff8880a3e9d058 R15: 0000000000000000 FS: 00005555791b8500(0000) GS:ffff88811c495000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c2800b7 CR3: 0000000058e44000 CR4: 0000000000350ef0 Call Trace: <IRQ> tcp_reset+0x26f/0x2b0 net/ipv4/tcp_input.c:4432 tcp_validate_incoming+0x1057/0x1b60 net/ipv4/tcp_input.c:5975 tcp_rcv_established+0x5b5/0x21f0 net/ipv4/tcp_input.c:6166 tcp_v4_do_rcv+0x5dc/0xa70 net/ipv4/tcp_ipv4.c:1925 tcp_v4_rcv+0x3473/0x44a0 net/ipv4/tcp_ipv4.c:2363 ip_protocol_deliver_rcu+0xba/0x480 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2f1/0x500 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:317 [inline] NF_HOOK include/linux/netfilter.h:311 [inline] ip_local_deliver+0x1be/0x560 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:469 [inline] ip_rcv_finish net/ipv4/ip_input.c:447 [inline] NF_HOOK include/linux/netfilter.h:317 [inline] NF_HOOK include/linux/netfilter.h:311 [inline] ip_rcv+0x514/0x810 net/ipv4/ip_input.c:567 __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:5975
__netif_receive_skb+0x1f/0x120 net/core/dev.c:6088 process_backlog+0x301/0x1360 net/core/dev.c:6440
__napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7453 napi_poll net/core/dev.c:7517 [inline] net_rx_action+0xb44/0x1010 net/core/dev.c:7644 handle_softirqs+0x1d0/0x770 kernel/softirq.c:579 do_softirq+0x3f/0x90 kernel/softirq.c:480 </IRQ> <TASK> __local_bh_enable_ip+0xed/0x110 kernel/softirq.c:407 local_bh_enable include/linux/bottom_half.h:33 [inline] inet_csk_listen_stop+0x2c5/0x1070 net/ipv4/inet_connection_sock.c:1524 mptcp_check_listen_stop.part.0+0x1cc/0x220 net/mptcp/protocol.c:2985 mptcp_check_listen_stop net/mptcp/mib.h:118 [inline] __mptcp_close+0x9b9/0xbd0 net/mptcp/protocol.c:3000 mptcp_close+0x2f/0x140 net/mptcp/protocol.c:3066 inet_release+0xed/0x200 net/ipv4/af_inet.c:435 inet6_release+0x4f/0x70 net/ipv6/af_inet6.c:487 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439
__fput+0x402/0xb70 fs/file_table.c:465 task_work_run+0x150/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xd4
---truncated--- (CVE-2025-38491)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38491
https://security-tracker.debian.org/tracker/CVE-2025-38491
https://ubuntu.com/security/CVE-2025-38491

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38491

Plugin Information
Published: 2025/08/18, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
259981 - Linux Distros Unpatched Vulnerability : CVE-2025-38505
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: discard erroneous disassoc frames on STA interface When operating in concurrent STA/AP mode with host MLME enabled, the firmware incorrectly sends disassociation frames to the STA interface when clients disconnect from the AP interface. This causes kernel warnings as the STA interface processes disconnect events that don't apply to it: [ 1303.240540] WARNING: CPU: 0 PID: 513 at net/wireless/mlme.c:141 cfg80211_process_disassoc+0x78/0xec [cfg80211] [ 1303.250861] Modules linked in: 8021q garp stp mrp llc rfcomm bnep btnxpuart nls_iso8859_1 nls_cp437 onboard_us [ 1303.327651] CPU: 0 UID: 0 PID: 513 Comm:
kworker/u9:2 Not tainted 6.16.0-rc1+ #3 PREEMPT [ 1303.335937] Hardware name: Toradex Verdin AM62 WB on Verdin Development Board (DT) [ 1303.343588] Workqueue: MWIFIEX_RX_WORK_QUEUE mwifiex_rx_work_queue [mwifiex] [ 1303.350856] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 1303.357904] pc : cfg80211_process_disassoc+0x78/0xec [cfg80211] [ 1303.364065] lr : cfg80211_process_disassoc+0x70/0xec [cfg80211] [ 1303.370221] sp : ffff800083053be0 [ 1303.373590] x29: ffff800083053be0 x28: 0000000000000000 x27: 0000000000000000 [ 1303.380855] x26: 0000000000000000 x25: 00000000ffffffff x24: ffff000002c5b8ae [ 1303.388120] x23: ffff000002c5b884 x22: 0000000000000001 x21: 0000000000000008 [ 1303.395382] x20:
ffff000002c5b8ae x19: ffff0000064dd408 x18: 0000000000000006 [ 1303.402646] x17: 3a36333a61623a30 x16:
32206d6f72662063 x15: ffff800080bfe048 [ 1303.409910] x14: ffff000003625300 x13: 0000000000000001 x12:
0000000000000000 [ 1303.417173] x11: 0000000000000002 x10: ffff000003958600 x9 : ffff000003625300 [ 1303.424434] x8 : ffff00003fd9ef40 x7 : ffff0000039fc280 x6 : 0000000000000002 [ 1303.431695] x5 :
ffff0000038976d4 x4 : 0000000000000000 x3 : 0000000000003186 [ 1303.438956] x2 : 000000004836ba20 x1 :
0000000000006986 x0 : 00000000d00479de [ 1303.446221] Call trace: [ 1303.448722] cfg80211_process_disassoc+0x78/0xec [cfg80211] (P) [ 1303.454894] cfg80211_rx_mlme_mgmt+0x64/0xf8 [cfg80211] [ 1303.460362] mwifiex_process_mgmt_packet+0x1ec/0x460 [mwifiex] [ 1303.466380] mwifiex_process_sta_rx_packet+0x1bc/0x2a0 [mwifiex] [ 1303.472573] mwifiex_handle_rx_packet+0xb4/0x13c [mwifiex] [ 1303.478243] mwifiex_rx_work_queue+0x158/0x198 [mwifiex] [ 1303.483734] process_one_work+0x14c/0x28c [ 1303.487845] worker_thread+0x2cc/0x3d4 [ 1303.491680] kthread+0x12c/0x208 [ 1303.495014] ret_from_fork+0x10/0x20 Add validation in the STA receive path to verify that disassoc/deauth frames originate from the connected AP. Frames that fail this check are discarded early, preventing them from reaching the MLME layer and triggering WARN_ON(). This filtering logic is similar with that used in the ieee80211_rx_mgmt_disassoc() function in mac80211, which drops disassoc frames that don't match the current BSSID (!ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr)), ensuring only relevant frames are processed. Tested on: - 8997 with FW 16.68.1.p197 (CVE-2025-38505)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38505
https://ubuntu.com/security/CVE-2025-38505

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38505

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260069 - Linux Distros Unpatched Vulnerability : CVE-2025-38509
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject VHT opmode for unsupported channel widths VHT operating mode notifications are not defined for channel widths below 20 MHz. In particular, 5 MHz and 10 MHz are not valid under the VHT specification and must be rejected.
Without this check, malformed notifications using these widths may reach ieee80211_chan_width_to_rx_bw(), leading to a WARN_ON due to invalid input. This issue was reported by syzbot. Reject these unsupported widths early in sta_link_apply_parameters() when opmode_notif is used. The accepted set includes 20, 40, 80, 160, and 80+80 MHz, which are valid for VHT. While 320 MHz is not defined for VHT, it is allowed to avoid rejecting HE or EHT clients that may still send a VHT opmode notification. (CVE-2025-38509)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38509
https://ubuntu.com/security/CVE-2025-38509

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38509

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
259966 - Linux Distros Unpatched Vulnerability : CVE-2025-38510
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- kasan: remove kasan_find_vm_area() to prevent possible deadlock find_vm_area() couldn't be called in atomic_context. If find_vm_area() is called to reports vm area information, kasan can trigger deadlock like: CPU0 CPU1 vmalloc(); alloc_vmap_area(); spin_lock(&vn->busy.lock) spin_lock_bh(&some_lock);
<interrupt occurs> <in softirq> spin_lock(&some_lock); <access invalid address> kasan_report();
print_report(); print_address_description(); kasan_find_vm_area(); find_vm_area();
spin_lock(&vn->busy.lock) // deadlock! To prevent possible deadlock while kasan reports, remove kasan_find_vm_area(). (CVE-2025-38510)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38510
https://ubuntu.com/security/CVE-2025-38510

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38510

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
259950 - Linux Distros Unpatched Vulnerability : CVE-2025-38511
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/xe/pf: Clear all LMTT pages on alloc Our LMEM buffer objects are not cleared by default on alloc and during VF provisioning we only setup LMTT PTEs for the actually provisioned LMEM range. But beyond that valid range we might leave some stale data that could either point to some other VFs allocations or even to the PF pages. Explicitly clear all new LMTT page to avoid the risk that a malicious VF would try to exploit that gap. While around add asserts to catch any undesired PTE overwrites and low-level debug traces to track LMTT PT life-cycle. (cherry picked from commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d) (CVE-2025-38511)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38511
https://ubuntu.com/security/CVE-2025-38511

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38511

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
259960 - Linux Distros Unpatched Vulnerability : CVE-2025-38512
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: prevent A-MSDU attacks in mesh networks This patch is a mitigation to prevent the A-MSDU spoofing vulnerability for mesh networks. The initial update to the IEEE 802.11 standard, in response to the FragAttacks, missed this case (CVE-2025-27558). It can be considered a variant of CVE-2020-24588 but for mesh networks. This patch tries to detect if a standard MSDU was turned into an A-MSDU by an adversary.
This is done by parsing a received A-MSDU as a standard MSDU, calculating the length of the Mesh Control header, and seeing if the 6 bytes after this header equal the start of an rfc1042 header. If equal, this is a strong indication of an ongoing attack attempt. This defense was tested with mac80211_hwsim against a mesh network that uses an empty Mesh Address Extension field, i.e., when four addresses are used, and when using a 12-byte Mesh Address Extension field, i.e., when six addresses are used. Functionality of normal MSDUs and A-MSDUs was also tested, and confirmed working, when using both an empty and 12-byte Mesh Address Extension field. It was also tested with mac80211_hwsim that A-MSDU attacks in non-mesh networks keep being detected and prevented. Note that the vulnerability being patched, and the defense being implemented, was also discussed in the following paper and in the following IEEE 802.11 presentation:
https://papers.mathyvanhoef.com/wisec2025.pdf https://mentor.ieee.org/802.11/dcn/25/11-25-0949-00-000m-a- msdu-mesh-spoof-protection.docx (CVE-2025-38512)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38512
https://ubuntu.com/security/CVE-2025-38512

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.7 (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.9 (CVSS2#AV:A/AC:M/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
2.5 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38512

Plugin Information
Published: 2025/08/31, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
259984 - Linux Distros Unpatched Vulnerability : CVE-2025-38514
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- rxrpc: Fix oops due to non-existence of prealloc backlog struct If an AF_RXRPC service socket is opened and bound, but calls are preallocated, then rxrpc_alloc_incoming_call() will oops because the rxrpc_backlog struct doesn't get allocated until the first preallocation is made. Fix this by returning NULL from rxrpc_alloc_incoming_call() if there is no backlog struct. This will cause the incoming call to be aborted. (CVE-2025-38514)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38514
https://ubuntu.com/security/CVE-2025-38514

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38514

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
259952 - Linux Distros Unpatched Vulnerability : CVE-2025-38524
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- rxrpc: Fix recv-recv race of completed call If a call receives an event (such as incoming data), the call gets placed on the socket's queue and a thread in recvmsg can be awakened to go and process it. Once the thread has picked up the call off of the queue, further events will cause it to be requeued, and once the socket lock is dropped (recvmsg uses call->user_mutex to allow the socket to be used in parallel), a second thread can come in and its recvmsg can pop the call off the socket queue again. In such a case, the first thread will be receiving stuff from the call and the second thread will be blocked on call->user_mutex. The first thread can, at this point, process both the event that it picked call for and the event that the second thread picked the call for and may see the call terminate - in which case the call will be released, decoupling the call from the user call ID assigned to it (RXRPC_USER_CALL_ID in the control message). The first thread will return okay, but then the second thread will wake up holding the user_mutex and, if it sees that the call has been released by the first thread, it will BUG thusly:
kernel BUG at net/rxrpc/recvmsg.c:474! Fix this by just dequeuing the call and ignoring it if it is seen to be already released. We can't tell userspace about it anyway as the user call ID has become stale.
(CVE-2025-38524)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38524
https://security-tracker.debian.org/tracker/CVE-2025-38524
https://ubuntu.com/security/CVE-2025-38524

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38524

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
259961 - Linux Distros Unpatched Vulnerability : CVE-2025-38526
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ice: add NULL check in eswitch lag check The function ice_lag_is_switchdev_running() is being called from outside of the LAG event handler code. This results in the lag->upper_netdev being NULL sometimes. To avoid a NULL-pointer dereference, there needs to be a check before it is dereferenced. (CVE-2025-38526)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38526
https://ubuntu.com/security/CVE-2025-38526

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38526

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
259982 - Linux Distros Unpatched Vulnerability : CVE-2025-38528
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Reject %p% format string in bprintf-like helpers static const char fmt[] = %p%;
bpf_trace_printk(fmt, sizeof(fmt)); The above BPF program isn't rejected and causes a kernel warning at runtime: Please remove unsupported %\x00 in format string WARNING: CPU: 1 PID: 7244 at lib/vsprintf.c:2680 format_decode+0x49c/0x5d0 This happens because bpf_bprintf_prepare skips over the second %, detected as punctuation, while processing %p. This patch fixes it by not skipping over punctuation. %\x00 is then processed in the next iteration and rejected. (CVE-2025-38528)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38528
https://ubuntu.com/security/CVE-2025-38528

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38528

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
259948 - Linux Distros Unpatched Vulnerability : CVE-2025-38537
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: phy: Don't register LEDs for genphy If a PHY has no driver, the genphy driver is probed/removed directly in phy_attach/detach. If the PHY's ofnode has an leds subnode, then the LEDs will be (un)registered when probing/removing the genphy driver. This could occur if the leds are for a non-generic driver that isn't loaded for whatever reason. Synchronously removing the PHY device in phy_detach leads to the following deadlock: rtnl_lock() ndo_close() ... phy_detach() phy_remove() phy_leds_unregister() led_classdev_unregister() led_trigger_set() netdev_trigger_deactivate() unregister_netdevice_notifier() rtnl_lock() There is a corresponding deadlock on the open/register side of things (and that one is reported by lockdep), but it requires a race while this one is deterministic. Generic PHYs do not support LEDs anyway, so don't bother registering them. (CVE-2025-38537)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38537
https://ubuntu.com/security/CVE-2025-38537

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38537

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
259987 - Linux Distros Unpatched Vulnerability : CVE-2025-38543
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/tegra: nvdec: Fix dma_alloc_coherent error check Check for NULL return value with dma_alloc_coherent, in line with Robin's fix for vic.c in 'drm/tegra: vic: Fix DMA API misuse'. (CVE-2025-38543)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38543
https://ubuntu.com/security/CVE-2025-38543

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38543

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
259954 - Linux Distros Unpatched Vulnerability : CVE-2025-38544
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- rxrpc: Fix bug due to prealloc collision When userspace is using AF_RXRPC to provide a server, it has to preallocate incoming calls and assign to them call IDs that will be used to thread related recvmsg() and sendmsg() together. The preallocated call IDs will automatically be attached to calls as they come in until the pool is empty. To the kernel, the call IDs are just arbitrary numbers, but userspace can use the call ID to hold a pointer to prepared structs. In any case, the user isn't permitted to create two calls with the same call ID (call IDs become available again when the call ends) and EBADSLT should result from sendmsg() if an attempt is made to preallocate a call with an in-use call ID. However, the cleanup in the error handling will trigger both assertions in rxrpc_cleanup_call() because the call isn't marked complete and isn't marked as having been released. Fix this by setting the call state in rxrpc_service_prealloc_one() and then marking it as being released before calling the cleanup function.
(CVE-2025-38544)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38544
https://security-tracker.debian.org/tracker/CVE-2025-38544
https://ubuntu.com/security/CVE-2025-38544

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38544

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
259970 - Linux Distros Unpatched Vulnerability : CVE-2025-38546
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- atm: clip: Fix memory leak of struct clip_vcc. ioctl(ATMARP_MKIP) allocates struct clip_vcc and set it to vcc->user_back. The code assumes that vcc_destroy_socket() passes NULL skb to vcc->push() when the socket is close()d, and then clip_push() frees clip_vcc. However, ioctl(ATMARPD_CTRL) sets NULL to vcc->push() in atm_init_atmarp(), resulting in memory leak. Let's serialise two ioctl() by lock_sock() and check vcc->push() in atm_init_atmarp() to prevent memleak. (CVE-2025-38546)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38546
https://ubuntu.com/security/CVE-2025-38546

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38546

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260138 - Linux Distros Unpatched Vulnerability : CVE-2025-38553
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree netem_enqueue's duplication prevention logic breaks when a netem resides in a qdisc tree with other netems - this can lead to a soft lockup and OOM loop in netem_dequeue, as seen in [1]. Ensure that a duplicating netem cannot exist in a tree with other netems. Previous approaches suggested in discussions in chronological order: 1) Track duplication status or ttl in the sk_buff struct. Considered too specific a use case to extend such a struct, though this would be a resilient fix and address other previous and potential future DOS bugs like the one described in loopy fun [2]. 2) Restrict netem_enqueue recursion depth like in act_mirred with a per cpu variable. However, netem_dequeue can call enqueue on its child, and the depth restriction could be bypassed if the child is a netem. 3) Use the same approach as in 2, but add metadata in netem_skb_cb to handle the netem_dequeue case and track a packet's involvement in duplication. This is an overly complex approach, and Jamal notes that the skb cb can be overwritten to circumvent this safeguard. 4) Prevent the addition of a netem to a qdisc tree if its ancestral path contains a netem. However, filters and actions can cause a packet to change paths when re-enqueued to the root from netem duplication, leading us to the current solution: prevent a duplicating netem from inhabiting the same tree as other netems. [1] https://l ore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdU fZQrwjcQhdinnMis_0G7VEk=@willsroot.io/ [2] https://lwn.net/Articles/719297/ (CVE-2025-38553)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38553
https://ubuntu.com/security/CVE-2025-38553

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38553

Plugin Information
Published: 2025/09/01, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260097 - Linux Distros Unpatched Vulnerability : CVE-2025-38557
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: HID: apple: validate feature-report field count to prevent NULL pointer dereference A malicious HID device with quirk APPLE_MAGIC_BACKLIGHT can trigger a NULL pointer dereference whilst the power feature-report is toggled and sent to the device in apple_magic_backlight_report_set(). The power feature-report is expected to have two data fields, but if the descriptor declares one field then accessing field[1] and dereferencing it in apple_magic_backlight_report_set() becomes invalid since field[1] will be NULL. An example of a minimal descriptor which can cause the crash is something like the following where the report with ID 3 (power report) only references a single 1-byte field. When hid core parses the descriptor it will encounter the final feature tag, allocate a hid_report (all members of field[] will be zeroed out), create field structure and populate it, increasing the maxfield to 1. The subsequent field[1] access and dereference causes the crash. Usage Page (Vendor Defined 0xFF00) Usage (0x0F) Collection (Application) Report ID (1) Usage (0x01) Logical Minimum (0) Logical Maximum (255) Report Size (8) Report Count (1) Feature (Data,Var,Abs) Usage (0x02) Logical Maximum (32767) Report Size (16) Report Count (1) Feature (Data,Var,Abs) Report ID (3) Usage (0x03) Logical Minimum (0) Logical Maximum (1) Report Size (8) Report Count (1) Feature (Data,Var,Abs) End Collection Here we see the KASAN splat when the kernel dereferences the NULL pointer and crashes: [ 15.164723] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN NOPTI [ 15.165691] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [ 15.165691] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.15.0 #31 PREEMPT(voluntary) [ 15.165691] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 15.165691] RIP: 0010:apple_magic_backlight_report_set+0xbf/0x210 [ 15.165691] Call Trace: [ 15.165691] <TASK> [ 15.165691] apple_probe+0x571/0xa20 [ 15.165691] hid_device_probe+0x2e2/0x6f0 [ 15.165691] really_probe+0x1ca/0x5c0 [ 15.165691]
__driver_probe_device+0x24f/0x310 [ 15.165691] driver_probe_device+0x4a/0xd0 [ 15.165691]
__device_attach_driver+0x169/0x220 [ 15.165691] bus_for_each_drv+0x118/0x1b0 [ 15.165691]
__device_attach+0x1d5/0x380 [ 15.165691] device_initial_probe+0x12/0x20 [ 15.165691] bus_probe_device+0x13d/0x180 [ 15.165691] device_add+0xd87/0x1510 [...] To fix this issue we should validate the number of fields that the backlight and power reports have and if they do not have the required number of fields then bail. (CVE-2025-38557)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38557
https://ubuntu.com/security/CVE-2025-38557

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38557

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260080 - Linux Distros Unpatched Vulnerability : CVE-2025-38559
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/pmt: fix a crashlog NULL pointer access Usage of the intel_pmt_read() for binary sysfs, requires a pcidev. The current use of the endpoint value is only valid for telemetry endpoint usage. Without the ep, the crashlog usage causes the following NULL pointer exception: BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:intel_pmt_read+0x3b/0x70 [pmt_class] Code: Call Trace: <TASK> ? sysfs_kf_bin_read+0xc0/0xe0 kernfs_fop_read_iter+0xac/0x1a0 vfs_read+0x26d/0x350 ksys_read+0x6b/0xe0
__x64_sys_read+0x1d/0x30 x64_sys_call+0x1bc8/0x1d70 do_syscall_64+0x6d/0x110 Augment struct intel_pmt_entry with a pointer to the pcidev to avoid the NULL pointer exception. (CVE-2025-38559)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38559
https://ubuntu.com/security/CVE-2025-38559

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38559

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260113 - Linux Distros Unpatched Vulnerability : CVE-2025-38560
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- x86/sev: Evict cache lines during SNP memory validation An SNP cache coherency vulnerability requires a cache line eviction mitigation when validating memory after a page state change to private. The specific mitigation is to touch the first and last byte of each 4K page that is being validated. There is no need to perform the mitigation when performing a page state change to shared and rescinding validation. CPUID bit Fn8000001F_EBX[31] defines the COHERENCY_SFW_NO CPUID bit that, when set, indicates that the software mitigation for this vulnerability is not needed. Implement the mitigation and invoke it when validating memory (making it private) and the COHERENCY_SFW_NO bit is not set, indicating the SNP guest is vulnerable. (CVE-2025-38560)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38560
https://ubuntu.com/security/CVE-2025-38560

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38560

Plugin Information
Published: 2025/08/31, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260134 - Linux Distros Unpatched Vulnerability : CVE-2025-38565
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- perf/core: Exit early on perf_mmap() fail When perf_mmap() fails to allocate a buffer, it still invokes the event_mapped() callback of the related event. On X86 this might increase the perf_rdpmc_allowed reference counter. But nothing undoes this as perf_mmap_close() is never called in this case, which causes another reference count leak. Return early on failure to prevent that. (CVE-2025-38565)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38565
https://ubuntu.com/security/CVE-2025-38565

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38565

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260091 - Linux Distros Unpatched Vulnerability : CVE-2025-38569
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- benet: fix BUG when creating VFs benet crashes as soon as SRIOV VFs are created: kernel BUG at mm/vmalloc.c:3457! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 4 UID: 0 PID: 7408 Comm: test.sh Kdump: loaded Not tainted 6.16.0+ #1 PREEMPT(voluntary) [...] RIP: 0010:vunmap+0x5f/0x70 [...] Call Trace:
<TASK> __iommu_dma_free+0xe8/0x1c0 be_cmd_set_mac_list+0x3fe/0x640 [be2net] be_cmd_set_mac+0xaf/0x110 [be2net] be_vf_eth_addr_config+0x19f/0x330 [be2net] be_vf_setup+0x4f7/0x990 [be2net] be_pci_sriov_configure+0x3a1/0x470 [be2net] sriov_numvfs_store+0x20b/0x380 kernfs_fop_write_iter+0x354/0x530 vfs_write+0x9b9/0xf60 ksys_write+0xf3/0x1d0 do_syscall_64+0x8c/0x3d0 be_cmd_set_mac_list() calls dma_free_coherent() under a spin_lock_bh. Fix it by freeing only after the lock has been released. (CVE-2025-38569)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38569
https://ubuntu.com/security/CVE-2025-38569

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38569

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260122 - Linux Distros Unpatched Vulnerability : CVE-2025-38576
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- powerpc/eeh: Make EEH driver device hotplug safe Multiple race conditions existed between the PCIe hotplug driver and the EEH driver, leading to a variety of kernel oopses of the same general nature: <pcie device unplug> <eeh driver trigger> <hotplug removal trigger> <pcie tree reconfiguration> <eeh recovery next step> <oops in EEH driver bus iteration loop> A second class of oops is also seen when the underlying bus disappears during device recovery. Refactor the EEH module to be PCI rescan and remove safe. Also clean up a few minor formatting / readability issues. (CVE-2025-38576)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38576
https://security-tracker.debian.org/tracker/CVE-2025-38576
https://ubuntu.com/security/CVE-2025-38576

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38576

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260093 - Linux Distros Unpatched Vulnerability : CVE-2025-38581
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko When CONFIG_CRYPTO_DEV_CCP_DEBUGFS is enabled, rebinding the ccp device causes the following crash: $ echo '0000:0a:00.2' >
/sys/bus/pci/drivers/ccp/unbind $ echo '0000:0a:00.2' > /sys/bus/pci/drivers/ccp/bind [ 204.976930] BUG:
kernel NULL pointer dereference, address: 0000000000000098 [ 204.978026] #PF: supervisor write access in kernel mode [ 204.979126] #PF: error_code(0x0002) - not-present page [ 204.980226] PGD 0 P4D 0 [ 204.981317] Oops: Oops: 0002 [#1] SMP NOPTI ... [ 204.997852] Call Trace: [ 204.999074] <TASK> [ 205.000297] start_creating+0x9f/0x1c0 [ 205.001533] debugfs_create_dir+0x1f/0x170 [ 205.002769] ? srso_return_thunk+0x5/0x5f [ 205.004000] ccp5_debugfs_setup+0x87/0x170 [ccp] [ 205.005241] ccp5_init+0x8b2/0x960 [ccp] [ 205.006469] ccp_dev_init+0xd4/0x150 [ccp] [ 205.007709] sp_init+0x5f/0x80 [ccp] [ 205.008942] sp_pci_probe+0x283/0x2e0 [ccp] [ 205.010165] ? srso_return_thunk+0x5/0x5f [ 205.011376] local_pci_probe+0x4f/0xb0 [ 205.012584] pci_device_probe+0xdb/0x230 [ 205.013810] really_probe+0xed/0x380 [ 205.015024] __driver_probe_device+0x7e/0x160 [ 205.016240] device_driver_attach+0x2f/0x60 [ 205.017457] bind_store+0x7c/0xb0 [ 205.018663] drv_attr_store+0x28/0x40 [ 205.019868] sysfs_kf_write+0x5f/0x70 [ 205.021065] kernfs_fop_write_iter+0x145/0x1d0 [ 205.022267] vfs_write+0x308/0x440 [ 205.023453] ksys_write+0x6d/0xe0 [ 205.024616] __x64_sys_write+0x1e/0x30 [ 205.025778] x64_sys_call+0x16ba/0x2150 [ 205.026942] do_syscall_64+0x56/0x1e0 [ 205.028108] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 205.029276] RIP: 0033:0x7fbc36f10104 [ 205.030420] Code: 89 02 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 8d 05 e1 08 2e 00 8b 00 85 c0 75 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 f3 c3 66 90 41 54 55 49 89 d4 53 48 89 f5 This patch sets ccp_debugfs_dir to NULL after destroying it in ccp5_debugfs_destroy, allowing the directory dentry to be recreated when rebinding the ccp device. Tested on AMD Ryzen 7 1700X. (CVE-2025-38581)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38581
https://ubuntu.com/security/CVE-2025-38581

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38581

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260104 - Linux Distros Unpatched Vulnerability : CVE-2025-38586
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix fp initialization for exception boundary In the ARM64 BPF JIT when prog->aux->exception_boundary is set for a BPF program, find_used_callee_regs() is not called because for a program acting as exception boundary, all callee saved registers are saved. find_used_callee_regs() sets `ctx->fp_used = true;` when it sees FP being used in any of the instructions. For programs acting as exception boundary, ctx->fp_used remains false even if frame pointer is used by the program and therefore, FP is not set-up for such programs in the prologue. This can cause the kernel to crash due to a pagefault. Fix it by setting ctx->fp_used = true for exception boundary programs as fp is always saved in such programs. (CVE-2025-38586)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38586
https://ubuntu.com/security/CVE-2025-38586

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38586

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260083 - Linux Distros Unpatched Vulnerability : CVE-2025-38587
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipv6: fix possible infinite loop in fib6_info_uses_dev() fib6_info_uses_dev() seems to rely on RCU without an explicit protection. Like the prior fix in rt6_nlmsg_size(), we need to make sure fib6_del_route() or fib6_add_rt2node() have not removed the anchor from the list, or we risk an infinite loop.
(CVE-2025-38587)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38587
https://ubuntu.com/security/CVE-2025-38587

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38587

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260111 - Linux Distros Unpatched Vulnerability : CVE-2025-38588
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipv6: prevent infinite loop in rt6_nlmsg_size() While testing prior patch, I was able to trigger an infinite loop in rt6_nlmsg_size() in the following place: list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, fib6_siblings) { rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len); } This is because fib6_del_route() and fib6_add_rt2node() uses list_del_rcu(), which can confuse rcu readers, because they might no longer see the head of the list. Restart the loop if f6i->fib6_nsiblings is zero.
(CVE-2025-38588)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38588
https://ubuntu.com/security/CVE-2025-38588

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38588

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260107 - Linux Distros Unpatched Vulnerability : CVE-2025-38591
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Reject narrower access to pointer ctx fields The following BPF program, simplified from a syzkaller repro, causes a kernel warning: r0 = *(u8 *)(r1 + 169); exit; With pointer field sk being at offset 168 in
__sk_buff. This access is detected as a narrower read in bpf_skb_is_valid_access because it doesn't match offsetof(struct __sk_buff, sk). It is therefore allowed and later proceeds to bpf_convert_ctx_access. Note that for the is_narrower_load case in the convert_ctx_accesses(), the insn->off is aligned, so the cnt may not be 0 because it matches the offsetof(struct __sk_buff, sk) in the bpf_convert_ctx_access. However, the target_size stays 0 and the verifier errors with a kernel warning: verifier bug: error during ctx access conversion(1) This patch fixes that to return a proper invalid bpf_context access off=X size=Y error on the load instruction. The same issue affects multiple other fields in context structures that allow narrow access. Some other non-affected fields (for sk_msg, sk_lookup, and sockopt) were also changed to use bpf_ctx_range_ptr for consistency. Note this syzkaller crash was reported in the Closes link below, which used to be about a different bug, fixed in commit fce7bd8e385a (bpf/verifier: Handle BPF_LOAD_ACQ instructions in insn_def_regno()). Because syzbot somehow confused the two bugs, the new crash and repro didn't get reported to the mailing list. (CVE-2025-38591)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38591
https://security-tracker.debian.org/tracker/CVE-2025-38591
https://ubuntu.com/security/CVE-2025-38591

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38591

Plugin Information
Published: 2025/08/31, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260121 - Linux Distros Unpatched Vulnerability : CVE-2025-38601
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath11k: clear initialized flag for deinit-ed srng lists In a number of cases we see kernel panics on resume due to ath11k kernel page fault, which happens under the following circumstances: 1) First ath11k_hal_dump_srng_stats() call Last interrupt received for each group: ath11k_pci 0000:01:00.0:
group_id 0 22511ms before ath11k_pci 0000:01:00.0: group_id 1 14440788ms before [..] ath11k_pci 0000:01:00.0: failed to receive control response completion, polling.. ath11k_pci 0000:01:00.0: Service connect timeout ath11k_pci 0000:01:00.0: failed to connect to HTT: -110 ath11k_pci 0000:01:00.0: failed to start core: -110 ath11k_pci 0000:01:00.0: firmware crashed: MHI_CB_EE_RDDM ath11k_pci 0000:01:00.0:
already resetting count 2 ath11k_pci 0000:01:00.0: failed to wait wlan mode request (mode 4): -110 ath11k_pci 0000:01:00.0: qmi failed to send wlan mode off: -110 ath11k_pci 0000:01:00.0: failed to reconfigure driver on crash recovery [..] 2) At this point reconfiguration fails (we have 2 resets) and ath11k_core_reconfigure_on_crash() calls ath11k_hal_srng_deinit() which destroys srng lists. However, it does not reset per-list ->initialized flag. 3) Second ath11k_hal_dump_srng_stats() call sees stale
->initialized flag and attempts to dump srng stats: Last interrupt received for each group: ath11k_pci 0000:01:00.0: group_id 0 66785ms before ath11k_pci 0000:01:00.0: group_id 1 14485062ms before ath11k_pci 0000:01:00.0: group_id 2 14485062ms before ath11k_pci 0000:01:00.0: group_id 3 14485062ms before ath11k_pci 0000:01:00.0: group_id 4 14780845ms before ath11k_pci 0000:01:00.0: group_id 5 14780845ms before ath11k_pci 0000:01:00.0: group_id 6 14485062ms before ath11k_pci 0000:01:00.0: group_id 7 66814ms before ath11k_pci 0000:01:00.0: group_id 8 68997ms before ath11k_pci 0000:01:00.0: group_id 9 67588ms before ath11k_pci 0000:01:00.0: group_id 10 69511ms before BUG: unable to handle page fault for address:
ffffa007404eb010 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 100000067 P4D 100000067 PUD 10022d067 PMD 100b01067 PTE 0 Oops: 0000 [#1] PREEMPT SMP NOPTI RIP:
0010:ath11k_hal_dump_srng_stats+0x2b4/0x3b0 [ath11k] Call Trace: <TASK> ? __die_body+0xae/0xb0 ? page_fault_oops+0x381/0x3e0 ? exc_page_fault+0x69/0xa0 ? asm_exc_page_fault+0x22/0x30 ? ath11k_hal_dump_srng_stats+0x2b4/0x3b0 [ath11k (HASH:6cea 4)] ath11k_qmi_driver_event_work+0xbd/0x1050 [ath11k (HASH:6cea 4)] worker_thread+0x389/0x930 kthread+0x149/0x170 Clear per-list ->initialized flag in ath11k_hal_srng_deinit(). (CVE-2025-38601)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38601
https://ubuntu.com/security/CVE-2025-38601

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38601

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260123 - Linux Distros Unpatched Vulnerability : CVE-2025-38602
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- iwlwifi: Add missing check for alloc_ordered_workqueue Add check for the return value of alloc_ordered_workqueue since it may return NULL pointer. (CVE-2025-38602)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38602
https://ubuntu.com/security/CVE-2025-38602

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38602

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260088 - Linux Distros Unpatched Vulnerability : CVE-2025-38605
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() In ath12k_dp_tx_get_encap_type(), the arvif parameter is only used to retrieve the ab pointer. In vdev delete sequence the arvif->ar could become NULL and that would trigger kernel panic. Since the caller ath12k_dp_tx() already has a valid ab pointer, pass it directly to avoid panic and unnecessary dereferencing. PC points to ath12k_dp_tx+0x228/0x988 [ath12k] LR points to ath12k_dp_tx+0xc8/0x988 [ath12k]. The Backtrace obtained is as follows: ath12k_dp_tx+0x228/0x988 [ath12k] ath12k_mac_tx_check_max_limit+0x608/0x920 [ath12k] ieee80211_process_measurement_req+0x320/0x348 [mac80211] ieee80211_tx_dequeue+0x9ac/0x1518 [mac80211] ieee80211_tx_dequeue+0xb14/0x1518 [mac80211] ieee80211_tx_prepare_skb+0x224/0x254 [mac80211] ieee80211_xmit+0xec/0x100 [mac80211] __ieee80211_subif_start_xmit+0xc50/0xf40 [mac80211] ieee80211_subif_start_xmit+0x2e8/0x308 [mac80211] netdev_start_xmit+0x150/0x18c dev_hard_start_xmit+0x74/0xc0 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 (CVE-2025-38605)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38605
https://security-tracker.debian.org/tracker/CVE-2025-38605
https://ubuntu.com/security/CVE-2025-38605

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38605

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260105 - Linux Distros Unpatched Vulnerability : CVE-2025-38606
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Avoid accessing uninitialized arvif->ar during beacon miss During beacon miss handling, ath12k driver iterates over active virtual interfaces (vifs) and attempts to access the radio object (ar) via arvif->deflink->ar. However, after commit aa80f12f3bed (wifi: ath12k: defer vdev creation for MLO), arvif is linked to a radio only after vdev creation, typically when a channel is assigned or a scan is requested. For P2P capable devices, a default P2P interface is created by wpa_supplicant along with regular station interfaces, these serve as dummy interfaces for P2P-capable stations, lack an associated netdev and initiate frequent scans to discover neighbor p2p devices. When a scan is initiated on such P2P vifs, driver selects destination radio (ar) based on scan frequency, creates a scan vdev, and attaches arvif to the radio. Once the scan completes or is aborted, the scan vdev is deleted, detaching arvif from the radio and leaving arvif->ar uninitialized. While handling beacon miss for station interfaces, P2P interface is also encountered in the vif iteration and ath12k_mac_handle_beacon_miss_iter() tries to dereference the uninitialized arvif->deflink->ar. Fix this by verifying that vdev is created for the arvif before accessing its ar during beacon miss handling and similar vif iterator callbacks.
========================================================================== wlp6s0: detected beacon loss from AP (missed 7 beacons) - probing KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 5 UID: 0 PID: 0 Comm: swapper/5 Not tainted 6.16.0-rc1-wt- ath+ #2 PREEMPT(full) RIP: 0010:ath12k_mac_handle_beacon_miss_iter+0xb5/0x1a0 [ath12k] Call Trace:
__iterate_interfaces+0x11a/0x410 [mac80211] ieee80211_iterate_active_interfaces_atomic+0x61/0x140 [mac80211] ath12k_mac_handle_beacon_miss+0xa1/0xf0 [ath12k] ath12k_roam_event+0x393/0x560 [ath12k] ath12k_wmi_op_rx+0x1486/0x28c0 [ath12k] ath12k_htc_process_trailer.isra.0+0x2fb/0x620 [ath12k] ath12k_htc_rx_completion_handler+0x448/0x830 [ath12k] ath12k_ce_recv_process_cb+0x549/0x9e0 [ath12k] ath12k_ce_per_engine_service+0xbe/0xf0 [ath12k] ath12k_pci_ce_workqueue+0x69/0x120 [ath12k] process_one_work+0xe3a/0x1430 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 (CVE-2025-38606)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38606
https://ubuntu.com/security/CVE-2025-38606

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38606

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260124 - Linux Distros Unpatched Vulnerability : CVE-2025-38609
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- PM / devfreq: Check governor before using governor->name Commit 96ffcdf239de (PM / devfreq: Remove redundant governor_name from struct devfreq) removes governor_name and uses governor->name to replace it.
But devfreq->governor may be NULL and directly using devfreq->governor->name may cause null pointer exception. Move the check of governor to before using governor->name. (CVE-2025-38609)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38609
https://ubuntu.com/security/CVE-2025-38609

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38609

Plugin Information
Published: 2025/08/31, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260243 - Linux Distros Unpatched Vulnerability : CVE-2025-38617
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/packet: fix a race in packet_set_ring() and packet_notifier() When packet_set_ring() releases po->bind_lock, another thread can run packet_notifier() and process an NETDEV_UP event. This race and the fix are both similar to that of commit 15fe076edea7 (net/packet: fix a race in packet_bind() and packet_notifier()). There too the packet_notifier NETDEV_UP event managed to run while a po->bind_lock critical section had to be temporarily released. And the fix was similarly to temporarily set po->num to zero to keep the socket unhooked until the lock is retaken. The po->bind_lock in packet_set_ring and packet_notifier precede the introduction of git history. (CVE-2025-38617)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38617
https://ubuntu.com/security/CVE-2025-38617

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38617

Plugin Information
Published: 2025/09/02, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260278 - Linux Distros Unpatched Vulnerability : CVE-2025-38621
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- md: make rdev_addable usable for rcu mode Our testcase trigger panic: BUG: kernel NULL pointer dereference, address: 00000000000000e0 ... Oops: Oops: 0000 [#1] SMP NOPTI CPU: 2 UID: 0 PID: 85 Comm:
kworker/2:1 Not tainted 6.16.0+ #94 PREEMPT(none) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Workqueue: md_misc md_start_sync RIP: 0010:rdev_addable+0x4d/0xf0 ... Call Trace: <TASK> md_start_sync+0x329/0x480 process_one_work+0x226/0x6d0 worker_thread+0x19e/0x340 kthread+0x10f/0x250 ret_from_fork+0x14d/0x180 ret_from_fork_asm+0x1a/0x30 </TASK> Modules linked in:
raid10 CR2: 00000000000000e0 ---[ end trace 0000000000000000 ]--- RIP: 0010:rdev_addable+0x4d/0xf0 md_spares_need_change in md_start_sync will call rdev_addable which protected by rcu_read_lock/rcu_read_unlock. This rcu context will help protect rdev won't be released, but rdev->mddev will be set to NULL before we call synchronize_rcu in md_kick_rdev_from_array. Fix this by using READ_ONCE and check does rdev->mddev still alive. (CVE-2025-38621)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38621
https://security-tracker.debian.org/tracker/CVE-2025-38621
https://ubuntu.com/security/CVE-2025-38621

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38621

Plugin Information
Published: 2025/09/02, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260252 - Linux Distros Unpatched Vulnerability : CVE-2025-38622
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: drop UFO packets in udp_rcv_segment() When sending a packet with virtio_net_hdr to tun device, if the gso_type in virtio_net_hdr is SKB_GSO_UDP and the gso_size is less than udphdr size, below crash may happen. ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:4572! Oops: invalid opcode:
0000 [#1] SMP NOPTI CPU: 0 UID: 0 PID: 62 Comm: mytest Not tainted 6.16.0-rc7 #203 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP:
0010:skb_pull_rcsum+0x8e/0xa0 Code: 00 00 5b c3 cc cc cc cc 8b 93 88 00 00 00 f7 da e8 37 44 38 00 f7 d8 89 83 88 00 00 00 48 8b 83 c8 00 00 00 5b c3 cc cc cc cc <0f> 0b 0f 0b 66 66 2e 0f 1f 84 00 000 RSP:
0018:ffffc900001fba38 EFLAGS: 00000297 RAX: 0000000000000004 RBX: ffff8880040c1000 RCX: ffffc900001fb948 RDX: ffff888003e6d700 RSI: 0000000000000008 RDI: ffff88800411a062 RBP: ffff8880040c1000 R08:
0000000000000000 R09: 0000000000000001 R10: ffff888003606c00 R11: 0000000000000001 R12: 0000000000000000 R13: ffff888004060900 R14: ffff888004050000 R15: ffff888004060900 FS: 000000002406d3c0(0000) GS:ffff888084a19000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
0000000020000040 CR3: 0000000004007000 CR4: 00000000000006f0 Call Trace: <TASK>
udp_queue_rcv_one_skb+0x176/0x4b0 net/ipv4/udp.c:2445 udp_queue_rcv_skb+0x155/0x1f0 net/ipv4/udp.c:2475 udp_unicast_rcv_skb+0x71/0x90 net/ipv4/udp.c:2626 __udp4_lib_rcv+0x433/0xb00 net/ipv4/udp.c:2690 ip_protocol_deliver_rcu+0xa6/0x160 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x72/0x90 net/ipv4/ip_input.c:233 ip_sublist_rcv_finish+0x5f/0x70 net/ipv4/ip_input.c:579 ip_sublist_rcv+0x122/0x1b0 net/ipv4/ip_input.c:636 ip_list_rcv+0xf7/0x130 net/ipv4/ip_input.c:670
__netif_receive_skb_list_core+0x21d/0x240 net/core/dev.c:6067 netif_receive_skb_list_internal+0x186/0x2b0 net/core/dev.c:6210 napi_complete_done+0x78/0x180 net/core/dev.c:6580 tun_get_user+0xa63/0x1120 drivers/net/tun.c:1909 tun_chr_write_iter+0x65/0xb0 drivers/net/tun.c:1984 vfs_write+0x300/0x420 fs/read_write.c:593 ksys_write+0x60/0xd0 fs/read_write.c:686 do_syscall_64+0x50/0x1c0 arch/x86/entry/syscall_64.c:63 </TASK> To trigger gso segment in udp_queue_rcv_skb(), we should also set option UDP_ENCAP_ESPINUDP to enable udp_sk(sk)->encap_rcv. When the encap_rcv hook return 1 in udp_queue_rcv_one_skb(), udp_csum_pull_header() will try to pull udphdr, but the skb size has been segmented to gso size, which leads to this crash. Previous commit cf329aa42b66 (udp: cope with UDP GRO packet misdirection) introduces segmentation in UDP receive path only for GRO, which was never intended to be used for UFO, so drop UFO packets in udp_rcv_segment(). (CVE-2025-38622)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38622
https://ubuntu.com/security/CVE-2025-38622

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38622

Plugin Information
Published: 2025/09/02, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260264 - Linux Distros Unpatched Vulnerability : CVE-2025-38623
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- PCI: pnv_php: Fix surprise plug detection and recovery The existing PowerNV hotplug code did not handle surprise plug events correctly, leading to a complete failure of the hotplug system after device removal and a required reboot to detect new devices. This comes down to two issues: 1) When a device is surprise removed, often the bridge upstream port will cause a PE freeze on the PHB. If this freeze is not cleared, the MSI interrupts from the bridge hotplug notification logic will not be received by the kernel, stalling all plug events on all slots associated with the PE. 2) When a device is removed from a slot, regardless of surprise or programmatic removal, the associated PHB/PE ls left frozen. If this freeze is not cleared via a fundamental reset, skiboot is unable to clear the freeze and cannot retrain / rescan the slot. This also requires a reboot to clear the freeze and redetect the device in the slot. Issue the appropriate unfreeze and rescan commands on hotplug events, and don't oops on hotplug if pci_bus_to_OF_node() returns NULL. [bhelgaas: tidy comments] (CVE-2025-38623)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38623
https://security-tracker.debian.org/tracker/CVE-2025-38623
https://ubuntu.com/security/CVE-2025-38623

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38623

Plugin Information
Published: 2025/09/02, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260280 - Linux Distros Unpatched Vulnerability : CVE-2025-38624
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- PCI: pnv_php: Clean up allocated IRQs on unplug When the root of a nested PCIe bridge configuration is unplugged, the pnv_php driver leaked the allocated IRQ resources for the child bridges' hotplug event notifications, resulting in a panic. Fix this by walking all child buses and deallocating all its IRQ resources before calling pci_hp_remove_devices(). Also modify the lifetime of the workqueue at struct pnv_php_slot::wq so that it is only destroyed in pnv_php_free_slot(), instead of pnv_php_disable_irq().
This is required since pnv_php_disable_irq() will now be called by workers triggered by hot unplug interrupts, so the workqueue needs to stay allocated. The abridged kernel panic that occurs without this patch is as follows: WARNING: CPU: 0 PID: 687 at kernel/irq/msi.c:292 msi_device_data_release+0x6c/0x9c CPU: 0 UID: 0 PID: 687 Comm: bash Not tainted 6.14.0-rc5+ #2 Call Trace: msi_device_data_release+0x34/0x9c (unreliable) release_nodes+0x64/0x13c devres_release_all+0xc0/0x140 device_del+0x2d4/0x46c pci_destroy_dev+0x5c/0x194 pci_hp_remove_devices+0x90/0x128 pci_hp_remove_devices+0x44/0x128 pnv_php_disable_slot+0x54/0xd4 power_write_file+0xf8/0x18c pci_slot_attr_store+0x40/0x5c sysfs_kf_write+0x64/0x78 kernfs_fop_write_iter+0x1b0/0x290 vfs_write+0x3bc/0x50c ksys_write+0x84/0x140 system_call_exception+0x124/0x230 system_call_vectored_common+0x15c/0x2ec [bhelgaas: tidy comments] (CVE-2025-38624)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38624
https://security-tracker.debian.org/tracker/CVE-2025-38624
https://ubuntu.com/security/CVE-2025-38624

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38624

Plugin Information
Published: 2025/09/02, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260284 - Linux Distros Unpatched Vulnerability : CVE-2025-38629
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: scarlett2: Fix missing NULL check scarlett2_input_select_ctl_info() sets up the string arrays allocated via kasprintf(), but it misses NULL checks, which may lead to NULL dereference Oops. Let's add the proper NULL check. (CVE-2025-38629)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38629
https://ubuntu.com/security/CVE-2025-38629

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38629

Plugin Information
Published: 2025/09/02, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260257 - Linux Distros Unpatched Vulnerability : CVE-2025-38632
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- pinmux: fix race causing mux_owner NULL with active mux_usecount commit 5a3e85c3c397 (pinmux: Use sequential access to access desc->pinmux data) tried to address the issue when two client of the same gpio calls pinctrl_select_state() for the same functionality, was resulting in NULL pointer issue while accessing desc->mux_owner. However, issue was not completely fixed due to the way it was handled and it can still result in the same NULL pointer. The issue occurs due to the following interleaving: cpu0 (process A) cpu1 (process B) pin_request() { pin_free() { mutex_lock() desc->mux_usecount--; //becomes 0 .. mutex_unlock() mutex_lock(desc->mux) desc->mux_usecount++; // becomes 1 desc->mux_owner = owner;
mutex_unlock(desc->mux) mutex_lock(desc->mux) desc->mux_owner = NULL; mutex_unlock(desc->mux) This sequence leads to a state where the pin appears to be in use (`mux_usecount == 1`) but has no owner (`mux_owner == NULL`), which can cause NULL pointer on next pin_request on the same pin. Ensure that updates to mux_usecount and mux_owner are performed atomically under the same lock. Only clear mux_owner when mux_usecount reaches zero and no new owner has been assigned. (CVE-2025-38632)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38632
https://ubuntu.com/security/CVE-2025-38632

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38632

Plugin Information
Published: 2025/09/02, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260283 - Linux Distros Unpatched Vulnerability : CVE-2025-38640
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Disable migration in nf_hook_run_bpf(). syzbot reported that the netfilter bpf prog can be called without migration disabled in xmit path. Then the assertion in __bpf_prog_run() fails, triggering the splat below. [0] Let's use bpf_prog_run_pin_on_cpu() in nf_hook_run_bpf(). [0]: BUG: assuming non migratable context at ./include/linux/filter.h:703 in_atomic(): 0, irqs_disabled(): 0, migration_disabled() 0 pid: 5829, name: sshd-session 3 locks held by sshd-session/5829: #0:
ffff88807b4e4218 (sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1667 [inline] #0:
ffff88807b4e4218 (sk_lock-AF_INET){+.+.}-{0:0}, at: tcp_sendmsg+0x20/0x50 net/ipv4/tcp.c:1395 #1:
ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #1: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline] #1: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x69/0x26c0 net/ipv4/ip_output.c:470 #2: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #2: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline] #2: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: nf_hook+0xb2/0x680 include/linux/netfilter.h:241 CPU: 0 UID: 0 PID: 5829 Comm: sshd-session Not tainted 6.16.0-rc6-syzkaller-00002-g155a3c003e55 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 __cant_migrate kernel/sched/core.c:8860 [inline]
__cant_migrate+0x1c7/0x250 kernel/sched/core.c:8834 __bpf_prog_run include/linux/filter.h:703 [inline] bpf_prog_run include/linux/filter.h:725 [inline] nf_hook_run_bpf+0x83/0x1e0 net/netfilter/nf_bpf_link.c:20 nf_hook_entry_hookfn include/linux/netfilter.h:157 [inline] nf_hook_slow+0xbb/0x200 net/netfilter/core.c:623 nf_hook+0x370/0x680 include/linux/netfilter.h:272 NF_HOOK_COND include/linux/netfilter.h:305 [inline] ip_output+0x1bc/0x2a0 net/ipv4/ip_output.c:433 dst_output include/net/dst.h:459 [inline] ip_local_out net/ipv4/ip_output.c:129 [inline]
__ip_queue_xmit+0x1d7d/0x26c0 net/ipv4/ip_output.c:527 __tcp_transmit_skb+0x2686/0x3e90 net/ipv4/tcp_output.c:1479 tcp_transmit_skb net/ipv4/tcp_output.c:1497 [inline] tcp_write_xmit+0x1274/0x84e0 net/ipv4/tcp_output.c:2838 __tcp_push_pending_frames+0xaf/0x390 net/ipv4/tcp_output.c:3021 tcp_push+0x225/0x700 net/ipv4/tcp.c:759 tcp_sendmsg_locked+0x1870/0x42b0 net/ipv4/tcp.c:1359 tcp_sendmsg+0x2e/0x50 net/ipv4/tcp.c:1396 inet_sendmsg+0xb9/0x140 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg net/socket.c:727 [inline] sock_write_iter+0x4aa/0x5b0 net/socket.c:1131 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x6c7/0x1150 fs/read_write.c:686 ksys_write+0x1f8/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe7d365d407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: (CVE-2025-38640)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38640
https://ubuntu.com/security/CVE-2025-38640

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38640

Plugin Information
Published: 2025/09/02, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260254 - Linux Distros Unpatched Vulnerability : CVE-2025-38641
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: Fix potential NULL dereference on kmalloc failure Avoid potential NULL pointer dereference by checking the return value of kmalloc and handling allocation failure properly. (CVE-2025-38641)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38641
https://ubuntu.com/security/CVE-2025-38641

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38641

Plugin Information
Published: 2025/09/02, Modified: 2025/11/21
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260300 - Linux Distros Unpatched Vulnerability : CVE-2025-38642
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix WARN_ON for monitor mode on some devices On devices without WANT_MONITOR_VIF (and probably without channel context support) we get a WARN_ON for changing the per-link setting of a monitor interface. Since we already skip AP_VLAN interfaces and MONITOR with WANT_MONITOR_VIF and/or NO_VIRTUAL_MONITOR should update the settings, catch this in the link change code instead of the warning. (CVE-2025-38642)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38642
https://ubuntu.com/security/CVE-2025-38642

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38642

Plugin Information
Published: 2025/09/02, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260267 - Linux Distros Unpatched Vulnerability : CVE-2025-38643
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() Callers of wdev_chandef() must hold the wiphy mutex. But the worker cfg80211_propagate_cac_done_wk() never takes the lock. Which triggers the warning below with the mesh_peer_connected_dfs test from hostapd and not (yet) released mac80211 code changes: WARNING: CPU: 0 PID: 495 at net/wireless/chan.c:1552 wdev_chandef+0x60/0x165 Modules linked in:
CPU: 0 UID: 0 PID: 495 Comm: kworker/u4:2 Not tainted 6.14.0-rc5-wt-g03960e6f9d47 #33 13c287eeabfe1efea01c0bcc863723ab082e17cf Workqueue: cfg80211 cfg80211_propagate_cac_done_wk Stack:
00000000 00000001 ffffff00 6093267c 00000000 6002ec30 6d577c50 60037608 00000000 67e8d108 6063717b 00000000 Call Trace: [<6002ec30>] ? _printk+0x0/0x98 [<6003c2b3>] show_stack+0x10e/0x11a [<6002ec30>] ?
_printk+0x0/0x98 [<60037608>] dump_stack_lvl+0x71/0xb8 [<6063717b>] ? wdev_chandef+0x60/0x165 [<6003766d>] dump_stack+0x1e/0x20 [<6005d1b7>] __warn+0x101/0x20f [<6005d3a8>] warn_slowpath_fmt+0xe3/0x15d [<600b0c5c>] ? mark_lock.part.0+0x0/0x4ec [<60751191>] ? __this_cpu_preempt_check+0x0/0x16 [<600b11a2>] ? mark_held_locks+0x5a/0x6e [<6005d2c5>] ? warn_slowpath_fmt+0x0/0x15d [<60052e53>] ? unblock_signals+0x3a/0xe7 [<60052f2d>] ? um_set_signals+0x2d/0x43 [<60751191>] ?
__this_cpu_preempt_check+0x0/0x16 [<607508b2>] ? lock_is_held_type+0x207/0x21f [<6063717b>] wdev_chandef+0x60/0x165 [<605f89b4>] regulatory_propagate_dfs_state+0x247/0x43f [<60052f00>] ? um_set_signals+0x0/0x43 [<605e6bfd>] cfg80211_propagate_cac_done_wk+0x3a/0x4a [<6007e460>] process_scheduled_works+0x3bc/0x60e [<6007d0ec>] ? move_linked_works+0x4d/0x81 [<6007d120>] ? assign_work+0x0/0xaa [<6007f81f>] worker_thread+0x220/0x2dc [<600786ef>] ? set_pf_worker+0x0/0x57 [<60087c96>] ? to_kthread+0x0/0x43 [<6008ab3c>] kthread+0x2d3/0x2e2 [<6007f5ff>] ? worker_thread+0x0/0x2dc [<6006c05b>] ? calculate_sigpending+0x0/0x56 [<6003b37d>] new_thread_handler+0x4a/0x64 irq event stamp:
614611 hardirqs last enabled at (614621): [<00000000600bc96b>] __up_console_sem+0x82/0xaf hardirqs last disabled at (614630): [<00000000600bc92c>] __up_console_sem+0x43/0xaf softirqs last enabled at (614268):
[<00000000606c55c6>] __ieee80211_wake_queue+0x933/0x985 softirqs last disabled at (614266):
[<00000000606c52d6>] __ieee80211_wake_queue+0x643/0x985 (CVE-2025-38643)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38643
https://security-tracker.debian.org/tracker/CVE-2025-38643
https://ubuntu.com/security/CVE-2025-38643

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38643

Plugin Information
Published: 2025/09/02, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260276 - Linux Distros Unpatched Vulnerability : CVE-2025-38644
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: mac80211: reject TDLS operations when station is not associated syzbot triggered a WARN in ieee80211_tdls_oper() by sending NL80211_TDLS_ENABLE_LINK immediately after NL80211_CMD_CONNECT, before association completed and without prior TDLS setup. This left internal state like sdata->u.mgd.tdls_peer uninitialized, leading to a WARN_ON() in code paths that assumed it was valid. Reject the operation early if not in station mode or not associated. (CVE-2025-38644)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38644
https://security-tracker.debian.org/tracker/CVE-2025-38644
https://ubuntu.com/security/CVE-2025-38644

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38644

Plugin Information
Published: 2025/09/02, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260240 - Linux Distros Unpatched Vulnerability : CVE-2025-38645
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mlx5: Check device memory pointer before usage Add a NULL check before accessing device memory to prevent a crash if dev->dm allocation in mlx5_init_once() fails. (CVE-2025-38645)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38645
https://security-tracker.debian.org/tracker/CVE-2025-38645
https://ubuntu.com/security/CVE-2025-38645

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38645

Plugin Information
Published: 2025/09/02, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260274 - Linux Distros Unpatched Vulnerability : CVE-2025-38646
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band With a quite rare chance, RX report might be problematic to make SW think a packet is received on 6 GHz band even if the chip does not support 6 GHz band actually. Since SW won't initialize stuffs for unsupported bands, NULL dereference will happen then in the sequence, rtw89_vif_rx_stats_iter() ->
rtw89_core_cancel_6ghz_probe_tx(). So, add a check to avoid it. The following is a crash log for this case. BUG: kernel NULL pointer dereference, address: 0000000000000032 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU:
1 PID: 1907 Comm: irq/131-rtw89_p Tainted: G U 6.6.56-05896-g89f5fb0eb30b #1 (HASH:1400 4) Hardware name:
Google Telith/Telith, BIOS Google_Telith.15217.747.0 11/12/2024 RIP:
0010:rtw89_vif_rx_stats_iter+0xd2/0x310 [rtw89_core] Code: 4c 89 7d c8 48 89 55 c0 49 8d 44 24 02 48 89 45 b8 45 31 ff eb 11 41 c6 45 3a 01 41 b7 01 4d 8b 6d 00 4d 39 f5 74 42 8b 43 10 <41> 33 45 32 0f b7 4b 14 66 41 33 4d 36 0f b7 c9 09 c1 74 d8 4d 85 RSP: 0018:ffff9f3080138ca0 EFLAGS: 00010246 RAX: 00000000b8bf5770 RBX: ffff91b5e8c639c0 RCX: 0000000000000011 RDX: ffff91b582de1be8 RSI: 0000000000000000 RDI:
ffff91b5e8c639e6 RBP: ffff9f3080138d00 R08: 0000000000000000 R09: 0000000000000000 R10: ffff91b59de70000 R11: ffffffffc069be50 R12: ffff91b5e8c639e4 R13: 0000000000000000 R14: ffff91b5828020b8 R15:
0000000000000000 FS: 0000000000000000(0000) GS:ffff91b8efa40000(0000) knlGS:0000000000000000 CS: 0010 DS:
0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000032 CR3: 00000002bf838000 CR4: 0000000000750ee0 PKRU: 55555554 Call Trace: <IRQ> ? __die_body+0x68/0xb0 ? page_fault_oops+0x379/0x3e0 ? exc_page_fault+0x4f/0xa0 ? asm_exc_page_fault+0x22/0x30 ? __pfx_rtw89_vif_rx_stats_iter+0x10/0x10 [rtw89_core (HASH:1400 5)] ? rtw89_vif_rx_stats_iter+0xd2/0x310 [rtw89_core (HASH:1400 5)]
__iterate_interfaces+0x59/0x110 [mac80211 (HASH:1400 6)] ? __pfx_rtw89_vif_rx_stats_iter+0x10/0x10 [rtw89_core (HASH:1400 5)] ? __pfx_rtw89_vif_rx_stats_iter+0x10/0x10 [rtw89_core (HASH:1400 5)] ieee80211_iterate_active_interfaces_atomic+0x36/0x50 [mac80211 (HASH:1400 6)] rtw89_core_rx_to_mac80211+0xfd/0x1b0 [rtw89_core (HASH:1400 5)] rtw89_core_rx+0x43a/0x980 [rtw89_core (HASH:1400 5)] (CVE-2025-38646)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38646
https://ubuntu.com/security/CVE-2025-38646

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38646

Plugin Information
Published: 2025/09/02, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260233 - Linux Distros Unpatched Vulnerability : CVE-2025-38659
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- gfs2: No more self recovery When a node withdraws and it turns out that it is the only node that has the filesystem mounted, gfs2 currently tries to replay the local journal to bring the filesystem back into a consistent state. Not only is that a very bad idea, it has also never worked because gfs2_recover_func() will refuse to do anything during a withdraw. However, before even getting to this point, gfs2_recover_func() dereferences sdp->sd_jdesc->jd_inode. This was a use-after-free before commit 04133b607a78 (gfs2: Prevent double iput for journal on error) and is a NULL pointer dereference since then. Simply get rid of self recovery to fix that. (CVE-2025-38659)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38659
https://security-tracker.debian.org/tracker/CVE-2025-38659
https://ubuntu.com/security/CVE-2025-38659

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38659

Plugin Information
Published: 2025/09/02, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260255 - Linux Distros Unpatched Vulnerability : CVE-2025-38660
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- [ceph] parse_longname(): strrchr() expects NUL-terminated string ... and parse_longname() is not guaranteed that. That's the reason why it uses kmemdup_nul() to build the argument for kstrtou64(); the problem is, kstrtou64() is not the only thing that need it. Just get a NUL-terminated copy of the entire thing and be done with that... (CVE-2025-38660)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38660
https://ubuntu.com/security/CVE-2025-38660

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38660

Plugin Information
Published: 2025/09/02, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260261 - Linux Distros Unpatched Vulnerability : CVE-2025-38664
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() Add check for the return value of devm_kmemdup() to prevent potential null pointer dereference. (CVE-2025-38664)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38664
https://ubuntu.com/security/CVE-2025-38664

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38664

Plugin Information
Published: 2025/09/02, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260253 - Linux Distros Unpatched Vulnerability : CVE-2025-38665
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode Andrei Lalaev reported a NULL pointer deref when a CAN device is restarted from Bus Off and the driver does not implement the struct can_priv::do_set_mode callback. There are 2 code path that call struct can_priv::do_set_mode: - directly by a manual restart from the user space, via can_changelink() - delayed automatic restart after bus off (deactivated by default) To prevent the NULL pointer deference, refuse a manual restart or configure the automatic restart delay in can_changelink() and report the error via extack to user space. As an additional safety measure let can_restart() return an error if can_priv::do_set_mode is not set instead of dereferencing it unchecked. (CVE-2025-38665)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38665
https://security-tracker.debian.org/tracker/CVE-2025-38665
https://ubuntu.com/security/CVE-2025-38665

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38665

Plugin Information
Published: 2025/09/02, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260271 - Linux Distros Unpatched Vulnerability : CVE-2025-38668
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- regulator: core: fix NULL dereference on unbind due to stale coupling data Failing to reset coupling_desc.n_coupled after freeing coupled_rdevs can lead to NULL pointer dereference when regulators are accessed post-unbind. This can happen during runtime PM or other regulator operations that rely on coupling metadata. For example, on ridesx4, unbinding the 'reg-dummy' platform device triggers a panic in regulator_lock_recursive() due to stale coupling state. Ensure n_coupled is set to 0 to prevent access to invalid pointers. (CVE-2025-38668)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38668
https://ubuntu.com/security/CVE-2025-38668

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38668

Plugin Information
Published: 2025/09/02, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260299 - Linux Distros Unpatched Vulnerability : CVE-2025-38669
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Revert drm/gem-shmem: Use dma_buf from GEM object instance This reverts commit 1a148af06000e545e714fe3210af3d77ff903c11. The dma_buf field in struct drm_gem_object is not stable over the object instance's lifetime. The field becomes NULL when user space releases the final GEM handle on the buffer object. This resulted in a NULL-pointer deref. Workarounds in commit 5307dce878d4 (drm/gem:
Acquire references on GEM handles for framebuffers) and commit f6bfc9afc751 (drm/framebuffer: Acquire internal references on GEM handles) only solved the problem partially. They especially don't work for buffer objects without a DRM framebuffer associated. Hence, this revert to going back to using .import_attach->dmabuf. v3: - cc stable (CVE-2025-38669)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38669
https://ubuntu.com/security/CVE-2025-38669

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38669

Plugin Information
Published: 2025/09/02, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260265 - Linux Distros Unpatched Vulnerability : CVE-2025-38671
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- i2c: qup: jump out of the loop in case of timeout Original logic only sets the return value but doesn't jump out of the loop if the bus is kept active by a client. This is not expected. A malicious or buggy i2c client can hang the kernel in this case and should be avoided. This is observed during a long time test with a PCA953x GPIO extender. Fix it by changing the logic to not only sets the return value, but also jumps out of the loop and return to the caller with -ETIMEDOUT. (CVE-2025-38671)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38671
https://ubuntu.com/security/CVE-2025-38671

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38671

Plugin Information
Published: 2025/09/02, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260424 - Linux Distros Unpatched Vulnerability : CVE-2025-38673
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Revert drm/gem-framebuffer: Use dma_buf from GEM object instance This reverts commit cce16fcd7446dcff7480cd9d2b6417075ed81065. The dma_buf field in struct drm_gem_object is not stable over the object instance's lifetime. The field becomes NULL when user space releases the final GEM handle on the buffer object. This resulted in a NULL-pointer deref. Workarounds in commit 5307dce878d4 (drm/gem:
Acquire references on GEM handles for framebuffers) and commit f6bfc9afc751 (drm/framebuffer: Acquire internal references on GEM handles) only solved the problem partially. They especially don't work for buffer objects without a DRM framebuffer associated. Hence, this revert to going back to using .import_attach->dmabuf. v3: - cc stable (CVE-2025-38673)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38673
https://ubuntu.com/security/CVE-2025-38673

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38673

Plugin Information
Published: 2025/09/02, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260427 - Linux Distros Unpatched Vulnerability : CVE-2025-38674
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Revert drm/prime: Use dma_buf from GEM object instance This reverts commit f83a9b8c7fd0557b0c50784bfdc1bbe9140c9bf8. The dma_buf field in struct drm_gem_object is not stable over the object instance's lifetime. The field becomes NULL when user space releases the final GEM handle on the buffer object. This resulted in a NULL-pointer deref. Workarounds in commit 5307dce878d4 (drm/gem:
Acquire references on GEM handles for framebuffers) and commit f6bfc9afc751 (drm/framebuffer: Acquire internal references on GEM handles) only solved the problem partially. They especially don't work for buffer objects without a DRM framebuffer associated. Hence, this revert to going back to using .import_attach->dmabuf. v3: - cc stable (CVE-2025-38674)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38674
https://ubuntu.com/security/CVE-2025-38674

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38674

Plugin Information
Published: 2025/09/02, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261539 - Linux Distros Unpatched Vulnerability : CVE-2025-38678
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfilter: nf_tables: reject duplicate device on updates A chain/flowtable update with duplicated devices in the same batch is possible. Unfortunately, netdev event path only removes the first device that is found, leaving unregistered the hook of the duplicated device. Check if a duplicated device exists in the transaction batch, bail out with EEXIST in such case. WARNING is hit when unregistering the hook:
[49042.221275] WARNING: CPU: 4 PID: 8425 at net/netfilter/core.c:340 nf_hook_entry_head+0xaa/0x150 [49042.221375] CPU: 4 UID: 0 PID: 8425 Comm: nft Tainted: G S 6.16.0+ #170 PREEMPT(full) [...] [49042.221382] RIP: 0010:nf_hook_entry_head+0xaa/0x150 (CVE-2025-38678)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38678
https://security-tracker.debian.org/tracker/CVE-2025-38678
https://ubuntu.com/security/CVE-2025-38678

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.5 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-38678

Plugin Information
Published: 2025/09/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261568 - Linux Distros Unpatched Vulnerability : CVE-2025-38681
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() Memory hot remove unmaps and tears down various kernel page table regions as required. The ptdump code can race with concurrent modifications of the kernel page tables. When leaf entries are modified concurrently, the dump code may log stale or inconsistent information for a VA range, but this is otherwise not harmful. But when intermediate levels of kernel page table are freed, the dump code will continue to use memory that has been freed and potentially reallocated for another purpose. In such cases, the ptdump code may dereference bogus addresses, leading to a number of potential problems. To avoid the above mentioned race condition, platforms such as arm64, riscv and s390 take memory hotplug lock, while dumping kernel page table via the sysfs interface /sys/kernel/debug/kernel_page_tables. Similar race condition exists while checking for pages that might have been marked W+X via /sys/kernel/debug/kernel_page_tables/check_wx_pages which in turn calls ptdump_check_wx(). Instead of solving this race condition again, let's just move the memory hotplug lock inside generic ptdump_check_wx() which will benefit both the scenarios. Drop get_online_mems() and put_online_mems() combination from all existing platform ptdump code paths.
(CVE-2025-38681)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38681
https://ubuntu.com/security/CVE-2025-38681

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38681

Plugin Information
Published: 2025/09/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261587 - Linux Distros Unpatched Vulnerability : CVE-2025-38683
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- hv_netvsc: Fix panic during namespace deletion with VF The existing code move the VF NIC to new namespace when NETDEV_REGISTER is received on netvsc NIC. During deletion of the namespace, default_device_exit_batch() >> default_device_exit_net() is called. When netvsc NIC is moved back and registered to the default namespace, it automatically brings VF NIC back to the default namespace. This will cause the default_device_exit_net() >> for_each_netdev_safe loop unable to detect the list end, and hit NULL ptr: [ 231.449420] mana 7870:00:00.0 enP30832s1: Moved VF to namespace with: eth0 [ 231.449656] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 231.450246] #PF: supervisor read access in kernel mode [ 231.450579] #PF: error_code(0x0000) - not-present page [ 231.450916] PGD 17b8a8067 P4D 0 [ 231.451163] Oops: Oops: 0000 [#1] SMP NOPTI [ 231.451450] CPU: 82 UID: 0 PID: 1394 Comm: kworker/u768:1 Not tainted 6.16.0-rc4+ #3 VOLUNTARY [ 231.452042] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 11/21/2024 [ 231.452692] Workqueue: netns cleanup_net [ 231.452947] RIP: 0010:default_device_exit_batch+0x16c/0x3f0 [ 231.453326] Code: c0 0c f5 b3 e8 d5 db fe ff 48 85 c0 74 15 48 c7 c2 f8 fd ca b2 be 10 00 00 00 48 8d 7d c0 e8 7b 77 25 00 49 8b 86 28 01 00 00 <48> 8b 50 10 4c 8b 2a 4c 8d 62 f0 49 83 ed 10 4c 39 e0 0f 84 d6 00 [ 231.454294] RSP:
0018:ff75fc7c9bf9fd00 EFLAGS: 00010246 [ 231.454610] RAX: 0000000000000000 RBX: 0000000000000002 RCX:
61c8864680b583eb [ 231.455094] RDX: ff1fa9f71462d800 RSI: ff75fc7c9bf9fd38 RDI: 0000000030766564 [ 231.455686] RBP: ff75fc7c9bf9fd78 R08: 0000000000000000 R09: 0000000000000000 [ 231.456126] R10:
0000000000000001 R11: 0000000000000004 R12: ff1fa9f70088e340 [ 231.456621] R13: ff1fa9f70088e340 R14:
ffffffffb3f50c20 R15: ff1fa9f7103e6340 [ 231.457161] FS: 0000000000000000(0000) GS:ff1faa6783a08000(0000) knlGS:0000000000000000 [ 231.457707] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 231.458031] CR2:
0000000000000010 CR3: 0000000179ab2006 CR4: 0000000000b73ef0 [ 231.458434] Call Trace: [ 231.458600] <TASK> [ 231.458777] ops_undo_list+0x100/0x220 [ 231.459015] cleanup_net+0x1b8/0x300 [ 231.459285] process_one_work+0x184/0x340 To fix it, move the ns change to a workqueue, and take rtnl_lock to avoid changing the netdev list when default_device_exit_net() is using it. (CVE-2025-38683)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38683
https://ubuntu.com/security/CVE-2025-38683

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38683

Plugin Information
Published: 2025/09/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261584 - Linux Distros Unpatched Vulnerability : CVE-2025-38691
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- pNFS: Fix uninited ptr deref in block/scsi layout The error occurs on the third attempt to encode extents.
When function ext_tree_prepare_commit() reallocates a larger buffer to retry encoding extents, the layoutupdate_pages page array is initialized only after the retry loop. But ext_tree_free_commitdata() is called on every iteration and tries to put pages in the array, thus dereferencing uninitialized pointers. An additional problem is that there is no limit on the maximum possible buffer_size. When there are too many extents, the client may create a layoutcommit that is larger than the maximum possible RPC size accepted by the server. During testing, we observed two typical scenarios. First, one memory page for extents is enough when we work with small files, append data to the end of the file, or preallocate extents before writing. But when we fill a new large file without preallocating, the number of extents can be huge, and counting the number of written extents in ext_tree_encode_commit() does not help much. Since this number increases even more between unlocking and locking of ext_tree, the reallocated buffer may not be large enough again and again. (CVE-2025-38691)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38691
https://ubuntu.com/security/CVE-2025-38691

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38691

Plugin Information
Published: 2025/09/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261553 - Linux Distros Unpatched Vulnerability : CVE-2025-38692
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- exfat: add cluster chain loop check for dir An infinite loop may occur if the following conditions occur due to file system corruption. (1) Condition for exfat_count_dir_entries() to loop infinitely. - The cluster chain includes a loop. - There is no UNUSED entry in the cluster chain. (2) Condition for exfat_create_upcase_table() to loop infinitely. - The cluster chain of the root directory includes a loop.
- There are no UNUSED entry and up-case table entry in the cluster chain of the root directory. (3) Condition for exfat_load_bitmap() to loop infinitely. - The cluster chain of the root directory includes a loop. - There are no UNUSED entry and bitmap entry in the cluster chain of the root directory. (4) Condition for exfat_find_dir_entry() to loop infinitely. - The cluster chain includes a loop. - The unused directory entries were exhausted by some operation. (5) Condition for exfat_check_dir_empty() to loop infinitely. - The cluster chain includes a loop. - The unused directory entries were exhausted by some operation. - All files and sub-directories under the directory are deleted. This commit adds checks to break the above infinite loop. (CVE-2025-38692)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38692
https://security-tracker.debian.org/tracker/CVE-2025-38692
https://ubuntu.com/security/CVE-2025-38692

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38692

Plugin Information
Published: 2025/09/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261589 - Linux Distros Unpatched Vulnerability : CVE-2025-38694
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() In dib7090p_rw_on_apb, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add check on msg[0].len to prevent crash. Similar issue occurs when access msg[1].buf[0] and msg[1].buf[1]. Similar commit: commit 0ed554fd769a (media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()) (CVE-2025-38694)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38694
https://ubuntu.com/security/CVE-2025-38694

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38694

Plugin Information
Published: 2025/09/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261582 - Linux Distros Unpatched Vulnerability : CVE-2025-38700
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated In case of an ib_fast_reg_mr allocation failure during iSER setup, the machine hits a panic because iscsi_conn->dd_data is initialized unconditionally, even when no memory is allocated (dd_size == 0). This leads invalid pointer dereference during connection teardown. Fix by setting iscsi_conn->dd_data only if memory is actually allocated. Panic trace: ------------ iser: iser_create_fastreg_desc: Failed to allocate ib_fast_reg_mr err=-12 iser:
iser_alloc_rx_descriptors: failed allocating rx descriptors / data buffers BUG: unable to handle page fault for address: fffffffffffffff8 RIP: 0010:swake_up_locked.part.5+0xa/0x40 Call Trace:
complete+0x31/0x40 iscsi_iser_conn_stop+0x88/0xb0 [ib_iser] iscsi_stop_conn+0x66/0xc0 [scsi_transport_iscsi] iscsi_if_stop_conn+0x14a/0x150 [scsi_transport_iscsi] iscsi_if_rx+0x1135/0x1834 [scsi_transport_iscsi] ? netlink_lookup+0x12f/0x1b0 ? netlink_deliver_tap+0x2c/0x200 netlink_unicast+0x1ab/0x280 netlink_sendmsg+0x257/0x4f0 ? _copy_from_user+0x29/0x60 sock_sendmsg+0x5f/0x70 (CVE-2025-38700)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38700
https://ubuntu.com/security/CVE-2025-38700

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38700

Plugin Information
Published: 2025/09/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261585 - Linux Distros Unpatched Vulnerability : CVE-2025-38706
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() snd_soc_remove_pcm_runtime() might be called with rtd == NULL which will leads to null pointer dereference. This was reproduced with topology loading and marking a link as ignore due to missing hardware component on the system. On module removal the soc_tplg_remove_link() would call snd_soc_remove_pcm_runtime() with rtd == NULL since the link was ignored, no runtime was created. (CVE-2025-38706)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38706
https://ubuntu.com/security/CVE-2025-38706

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38706

Plugin Information
Published: 2025/09/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261541 - Linux Distros Unpatched Vulnerability : CVE-2025-38709
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- loop: Avoid updating block size under exclusive owner Syzbot came up with a reproducer where a loop device block size is changed underneath a mounted filesystem. This causes a mismatch between the block device block size and the block size stored in the superblock causing confusion in various places such as fs/buffer.c. The particular issue triggered by syzbot was a warning in __getblk_slow() due to requested buffer size not matching block device block size. Fix the problem by getting exclusive hold of the loop device to change its block size. This fails if somebody (such as filesystem) has already an exclusive ownership of the block device and thus prevents modifying the loop device under some exclusive owner which doesn't expect it. (CVE-2025-38709)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38709
https://security-tracker.debian.org/tracker/CVE-2025-38709
https://ubuntu.com/security/CVE-2025-38709

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38709

Plugin Information
Published: 2025/09/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261578 - Linux Distros Unpatched Vulnerability : CVE-2025-38710
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- gfs2: Validate i_depth for exhash directories A fuzzer test introduced corruption that ends up with a depth of 0 in dir_e_read(), causing an undefined shift by 32 at: index = hash >> (32 - dip->i_depth); As calculated in an open-coded way in dir_make_exhash(), the minimum depth for an exhash directory is ilog2(sdp->sd_hash_ptrs) and 0 is invalid as sdp->sd_hash_ptrs is fixed as sdp->bsize / 16 at mount time.
So we can avoid the undefined behaviour by checking for depth values lower than the minimum in gfs2_dinode_in(). Values greater than the maximum are already being checked for there. Also switch the calculation in dir_make_exhash() to use ilog2() to clarify how the depth is calculated. Tested with the syzkaller repro.c and xfstests '-g quick'. (CVE-2025-38710)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38710
https://security-tracker.debian.org/tracker/CVE-2025-38710
https://ubuntu.com/security/CVE-2025-38710

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38710

Plugin Information
Published: 2025/09/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261579 - Linux Distros Unpatched Vulnerability : CVE-2025-38721
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfilter: ctnetlink: fix refcount leak on table dump There is a reference count leak in ctnetlink_dump_table(): if (res < 0) { nf_conntrack_get(&ct->ct_general); // HERE cb->args[1] = (unsigned long)ct; ... While its very unlikely, its possible that ct == last. If this happens, then the refcount of ct was already incremented. This 2nd increment is never undone. This prevents the conntrack object from being released, which in turn keeps prevents cnet->count from dropping back to 0. This will then block the netns dismantle (or conntrack rmmod) as nf_conntrack_cleanup_net_list() will wait forever. This can be reproduced by running conntrack_resize.sh selftest in a loop. It takes ~20 minutes for me on a preemptible kernel on average before I see a runaway kworker spinning in nf_conntrack_cleanup_net_list. One fix would to change this to: if (res < 0) { if (ct != last) nf_conntrack_get(&ct->ct_general); But this reference counting isn't needed in the first place. We can just store a cookie value instead. A followup patch will do the same for ctnetlink_exp_dump_table, it looks to me as if this has the same problem and like ctnetlink_dump_table, we only need a 'skip hint', not the actual object so we can apply the same cookie strategy there as well. (CVE-2025-38721)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38721
https://ubuntu.com/security/CVE-2025-38721

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38721

Plugin Information
Published: 2025/09/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261557 - Linux Distros Unpatched Vulnerability : CVE-2025-38725
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus Without setting phy_mask for ax88772 mdio bus, current driver may create at most 32 mdio phy devices with phy address range from 0x00 ~ 0x1f. DLink DUB-E100 H/W Ver B1 is such a device. However, only one main phy device will bind to net phy driver. This is creating issue during system suspend/resume since phy_polling_mode() in phy_state_machine() will directly deference member of phydev->drv for non-main phy devices. Then NULL pointer dereference issue will occur. Due to only external phy or internal phy is necessary, add phy_mask for ax88772 mdio bus to workarnoud the issue. (CVE-2025-38725)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38725
https://ubuntu.com/security/CVE-2025-38725

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38725

Plugin Information
Published: 2025/09/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261546 - Linux Distros Unpatched Vulnerability : CVE-2025-38728
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smb3: fix for slab out of bounds on mount to ksmbd With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to missing check in parse_server_interfaces() (see below): BUG: KASAN:
slab-out-of-bounds in parse_server_interfaces+0x14ee/0x1880 [cifs] Read of size 4 at addr ffff8881433dba98 by task mount/9827 CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G OE 6.16.0-rc2-kasan #2 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. Precision Tower 3620/0MWYPT, BIOS 2.13.1 06/14/2019 Call Trace: <TASK> dump_stack_lvl+0x9f/0xf0 print_report+0xd1/0x670
__virt_addr_valid+0x22c/0x430 ? parse_server_interfaces+0x14ee/0x1880 [cifs] ? kasan_complete_mode_report_info+0x2a/0x1f0 ? parse_server_interfaces+0x14ee/0x1880 [cifs] kasan_report+0xd6/0x110 parse_server_interfaces+0x14ee/0x1880 [cifs]
__asan_report_load_n_noabort+0x13/0x20 parse_server_interfaces+0x14ee/0x1880 [cifs] ?
__pfx_parse_server_interfaces+0x10/0x10 [cifs] ? trace_hardirqs_on+0x51/0x60 SMB3_request_interfaces+0x1ad/0x3f0 [cifs] ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs] ? SMB2_tcon+0x23c/0x15d0 [cifs] smb3_qfs_tcon+0x173/0x2b0 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] ? cifs_get_tcon+0x105d/0x2120 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_get_tcon+0x105d/0x2120 [cifs] ?
__pfx_smb3_qfs_tcon+0x10/0x10 [cifs] cifs_mount_get_tcon+0x369/0xb90 [cifs] ? dfs_cache_find+0xe7/0x150 [cifs] dfs_mount_share+0x985/0x2970 [cifs] ? check_path.constprop.0+0x28/0x50 ? save_trace+0x54/0x370 ?
__pfx_dfs_mount_share+0x10/0x10 [cifs] ? __lock_acquire+0xb82/0x2ba0 ? __kasan_check_write+0x18/0x20 cifs_mount+0xbc/0x9e0 [cifs] ? __pfx_cifs_mount+0x10/0x10 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_setup_cifs_sb+0x29d/0x810 [cifs] cifs_smb3_do_mount+0x263/0x1990 [cifs] (CVE-2025-38728)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38728
https://security-tracker.debian.org/tracker/CVE-2025-38728
https://ubuntu.com/security/CVE-2025-38728

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38728

Plugin Information
Published: 2025/09/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261644 - Linux Distros Unpatched Vulnerability : CVE-2025-38733
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- s390/mm: Do not map lowcore with identity mapping Since the identity mapping is pinned to address zero the lowcore is always also mapped to address zero, this happens regardless of the relocate_lowcore command line option. If the option is specified the lowcore is mapped twice, instead of only once. This means that NULL pointer accesses will succeed instead of causing an exception (low address protection still applies, but covers only parts). To fix this never map the first two pages of physical memory with the identity mapping. (CVE-2025-38733)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38733
https://ubuntu.com/security/CVE-2025-38733

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38733

Plugin Information
Published: 2025/09/06, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261626 - Linux Distros Unpatched Vulnerability : CVE-2025-39676
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: qla4xxx: Prevent a potential error pointer dereference The qla4xxx_get_ep_fwdb() function is supposed to return NULL on error, but qla4xxx_ep_connect() returns error pointers. Propagating the error pointers will lead to an Oops in the caller, so change the error pointers to NULL. (CVE-2025-39676)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39676
https://ubuntu.com/security/CVE-2025-39676

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39676

Plugin Information
Published: 2025/09/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261622 - Linux Distros Unpatched Vulnerability : CVE-2025-39677
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/sched: Fix backlog accounting in qdisc_dequeue_internal This issue applies for the following qdiscs:
hhf, fq, fq_codel, and fq_pie, and occurs in their change handlers when adjusting to the new limit. The problem is the following in the values passed to the subsequent qdisc_tree_reduce_backlog call given a tbf parent: When the tbf parent runs out of tokens, skbs of these qdiscs will be placed in gso_skb. Their peek handlers are qdisc_peek_dequeued, which accounts for both qlen and backlog. However, in the case of qdisc_dequeue_internal, ONLY qlen is accounted for when pulling from gso_skb. This means that these qdiscs are missing a qdisc_qstats_backlog_dec when dropping packets to satisfy the new limit in their change handlers. One can observe this issue with the following (with tc patched to support a limit of 0): export TARGET=fq tc qdisc del dev lo root tc qdisc add dev lo root handle 1: tbf rate 8bit burst 100b latency 1ms tc qdisc replace dev lo handle 3: parent 1:1 $TARGET limit 1000 echo ''; echo 'add child'; tc -s -d qdisc show dev lo ping -I lo -f -c2 -s32 -W0.001 127.0.0.1 2>&1 >/dev/null echo ''; echo 'after ping'; tc -s -d qdisc show dev lo tc qdisc change dev lo handle 3: parent 1:1 $TARGET limit 0 echo ''; echo 'after limit drop'; tc -s -d qdisc show dev lo tc qdisc replace dev lo handle 2: parent 1:1 sfq echo ''; echo 'post graft'; tc -s -d qdisc show dev lo The second to last show command shows 0 packets but a positive number (74) of backlog bytes. The problem becomes clearer in the last show command, where qdisc_purge_queue triggers qdisc_tree_reduce_backlog with the positive backlog and causes an underflow in the tbf parent's backlog (4096 Mb instead of 0). To fix this issue, the codepath for all clients of qdisc_dequeue_internal has been simplified: codel, pie, hhf, fq, fq_pie, and fq_codel. qdisc_dequeue_internal handles the backlog adjustments for all cases that do not directly use the dequeue handler. The old fq_codel_change limit adjustment loop accumulated the arguments to the subsequent qdisc_tree_reduce_backlog call through the cstats field. However, this is confusing and error prone as fq_codel_dequeue could also potentially mutate this field (which qdisc_dequeue_internal calls in the non gso_skb case), so we have unified the code here with other qdiscs. (CVE-2025-39677)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39677
https://security-tracker.debian.org/tracker/CVE-2025-39677
https://ubuntu.com/security/CVE-2025-39677

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39677

Plugin Information
Published: 2025/09/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261608 - Linux Distros Unpatched Vulnerability : CVE-2025-39678
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL If metric table address is not allocated, accessing metrics_bin will result in a NULL pointer dereference, so add a check. (CVE-2025-39678)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39678
https://ubuntu.com/security/CVE-2025-39678

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39678

Plugin Information
Published: 2025/09/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261651 - Linux Distros Unpatched Vulnerability : CVE-2025-39681
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper Since 923f3a2b48bd (x86/resctrl: Query LLC monitoring properties once during boot) resctrl_cpu_detect() has been moved from common CPU initialization code to the vendor-specific BSP init helper, while Hygon didn't put that call in their code. This triggers a division by zero fault during early booting stage on our machines with X86_FEATURE_CQM* supported, where get_rdt_mon_resources() tries to calculate mon_l3_config with uninitialized boot_cpu_data.x86_cache_occ_scale. Add the missing resctrl_cpu_detect() in the Hygon BSP init helper. [ bp: Massage commit message. ] (CVE-2025-39681)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39681
https://ubuntu.com/security/CVE-2025-39681

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39681

Plugin Information
Published: 2025/09/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
245414 - Linux Distros Unpatched Vulnerability : CVE-2025-39688
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() The pynfs DELEG8 test fails when run against nfsd. It acquires a delegation and then lets the lease time out. It then tries to use the deleg stateid and expects to see NFS4ERR_DELEG_REVOKED, but it gets bad NFS4ERR_BAD_STATEID instead. When a delegation is revoked, it's initially marked with SC_STATUS_REVOKED, or SC_STATUS_ADMIN_REVOKED and later, it's marked with the SC_STATUS_FREEABLE flag, which denotes that it is waiting for s FREE_STATEID call. nfs4_lookup_stateid() accepts a statusmask that includes the status flags that a found stateid is allowed to have. Currently, that mask never includes SC_STATUS_FREEABLE, which means that revoked delegations are (almost) never found. Add SC_STATUS_FREEABLE to the always-allowed status flags, and remove it from nfsd4_delegreturn() since it's now always implied. (CVE-2025-39688)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39688
https://ubuntu.com/security/CVE-2025-39688

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39688

Plugin Information
Published: 2025/08/07, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261633 - Linux Distros Unpatched Vulnerability : CVE-2025-39721
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- crypto: qat - flush misc workqueue during device shutdown Repeated loading and unloading of a device specific QAT driver, for example qat_4xxx, in a tight loop can lead to a crash due to a use-after-free scenario. This occurs when a power management (PM) interrupt triggers just before the device-specific driver (e.g., qat_4xxx.ko) is unloaded, while the core driver (intel_qat.ko) remains loaded. Since the driver uses a shared workqueue (`qat_misc_wq`) across all devices and owned by intel_qat.ko, a deferred routine from the device-specific driver may still be pending in the queue. If this routine executes after the driver is unloaded, it can dereference freed memory, resulting in a page fault and kernel crash like the following: BUG: unable to handle page fault for address: ffa000002e50a01c #PF: supervisor read access in kernel mode RIP: 0010:pm_bh_handler+0x1d2/0x250 [intel_qat] Call Trace: pm_bh_handler+0x1d2/0x250 [intel_qat] process_one_work+0x171/0x340 worker_thread+0x277/0x3a0 kthread+0xf0/0x120 ret_from_fork+0x2d/0x50 To prevent this, flush the misc workqueue during device shutdown to ensure that all pending work items are completed before the driver is unloaded. Note: This approach may slightly increase shutdown latency if the workqueue contains jobs from other devices, but it ensures correctness and stability. (CVE-2025-39721)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39721
https://security-tracker.debian.org/tracker/CVE-2025-39721
https://ubuntu.com/security/CVE-2025-39721

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39721

Plugin Information
Published: 2025/09/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261631 - Linux Distros Unpatched Vulnerability : CVE-2025-39724
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- serial: 8250: fix panic due to PSLVERR When the PSLVERR_RESP_EN parameter is set to 1, the device generates an error response if an attempt is made to read an empty RBR (Receive Buffer Register) while the FIFO is enabled. In serial8250_do_startup(), calling serial_port_out(port, UART_LCR, UART_LCR_WLEN8) triggers dw8250_check_lcr(), which invokes dw8250_force_idle() and serial8250_clear_and_reinit_fifos().
The latter function enables the FIFO via serial_out(p, UART_FCR, p->fcr). Execution proceeds to the serial_port_in(port, UART_RX). This satisfies the PSLVERR trigger condition. When another CPU (e.g., using printk()) is accessing the UART (UART is busy), the current CPU fails the check (value & ~UART_LCR_SPAR) == (lcr & ~UART_LCR_SPAR) in dw8250_check_lcr(), causing it to enter dw8250_force_idle(). Put serial_port_out(port, UART_LCR, UART_LCR_WLEN8) under the port->lock to fix this issue. Panic backtrace: [ 0.442336] Oops - unknown exception [#1] [ 0.442343] epc : dw8250_serial_in32+0x1e/0x4a [ 0.442351] ra :
serial8250_do_startup+0x2c8/0x88e ... [ 0.442416] console_on_rootfs+0x26/0x70 (CVE-2025-39724)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39724
https://ubuntu.com/security/CVE-2025-39724

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39724

Plugin Information
Published: 2025/09/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261634 - Linux Distros Unpatched Vulnerability : CVE-2025-39726
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- s390/ism: fix concurrency management in ism_cmd() The s390x ISM device data sheet clearly states that only one request-response sequence is allowable per ISM function at any point in time. Unfortunately as of today the s390/ism driver in Linux does not honor that requirement. This patch aims to rectify that. This problem was discovered based on Aliaksei's bug report which states that for certain workloads the ISM functions end up entering error state (with PEC 2 as seen from the logs) after a while and as a consequence connections handled by the respective function break, and for future connection requests the ISM device is not considered -- given it is in a dysfunctional state. During further debugging PEC 3A was observed as well. A kernel message like [ 1211.244319] zpci: 061a:00:00.0: Event 0x2 reports an error for PCI function 0x61a is a reliable indicator of the stated function entering error state with PEC 2. Let me also point out that a kernel message like [ 1211.244325] zpci: 061a:00:00.0: The ism driver bound to the device does not support error recovery is a reliable indicator that the ISM function won't be auto- recovered because the ISM driver currently lacks support for it. On a technical level, without this synchronization, commands (inputs to the FW) may be partially or fully overwritten (corrupted) by another CPU trying to issue commands on the same function. There is hard evidence that this can lead to DMB token values being used as DMB IOVAs, leading to PEC 2 PCI events indicating invalid DMA. But this is only one of the failure modes imaginable. In theory even completely losing one command and executing another one twice and then trying to interpret the outputs as if the command we intended to execute was actually executed and not the other one is also possible. Frankly, I don't feel confident about providing an exhaustive list of possible consequences. (CVE-2025-39726)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39726
https://security-tracker.debian.org/tracker/CVE-2025-39726
https://ubuntu.com/security/CVE-2025-39726

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39726

Plugin Information
Published: 2025/09/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261690 - Linux Distros Unpatched Vulnerability : CVE-2025-39732
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() ath11k_mac_disable_peer_fixed_rate() is passed as the iterator to ieee80211_iterate_stations_atomic().
Note in this case the iterator is required to be atomic, however ath11k_mac_disable_peer_fixed_rate() does not follow it as it might sleep. Consequently below warning is seen: BUG: sleeping function called from invalid context at wmi.c:304 Call Trace: <TASK> dump_stack_lvl __might_resched.cold ath11k_wmi_cmd_send ath11k_wmi_set_peer_param ath11k_mac_disable_peer_fixed_rate ieee80211_iterate_stations_atomic ath11k_mac_op_set_bitrate_mask.cold Change to ieee80211_iterate_stations_mtx() to fix this issue. Tested- on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30 (CVE-2025-39732)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39732
https://security-tracker.debian.org/tracker/CVE-2025-39732
https://ubuntu.com/security/CVE-2025-39732

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39732

Plugin Information
Published: 2025/09/08, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264719 - Linux Distros Unpatched Vulnerability : CVE-2025-39736
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock When netpoll is enabled, calling pr_warn_once() while holding kmemleak_lock in mem_pool_alloc() can cause a deadlock due to lock inversion with the netconsole subsystem. This occurs because pr_warn_once() may trigger netpoll, which eventually leads to __alloc_skb() and back into kmemleak code, attempting to reacquire kmemleak_lock. This is the path for the deadlock. mem_pool_alloc() -> raw_spin_lock_irqsave(&kmemleak_lock, flags); -> pr_warn_once()
-> netconsole subsystem -> netpoll -> __alloc_skb -> __create_object ->
raw_spin_lock_irqsave(&kmemleak_lock, flags); Fix this by setting a flag and issuing the pr_warn_once() after kmemleak_lock is released. (CVE-2025-39736)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39736
https://ubuntu.com/security/CVE-2025-39736

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39736

Plugin Information
Published: 2025/09/14, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264742 - Linux Distros Unpatched Vulnerability : CVE-2025-39737
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() A soft lockup warning was observed on a relative small system x86-64 system with 16 GB of memory when running a debug kernel with kmemleak enabled.
watchdog: BUG: soft lockup - CPU#8 stuck for 33s! [kworker/8:1:134] The test system was running a workload with hot unplug happening in parallel. Then kemleak decided to disable itself due to its inability to allocate more kmemleak objects. The debug kernel has its CONFIG_DEBUG_KMEMLEAK_MEM_POOL_SIZE set to 40,000. The soft lockup happened in kmemleak_do_cleanup() when the existing kmemleak objects were being removed and deleted one-by-one in a loop via a workqueue. In this particular case, there are at least 40,000 objects that need to be processed and given the slowness of a debug kernel and the fact that a raw_spinlock has to be acquired and released in __delete_object(), it could take a while to properly handle all these objects. As kmemleak has been disabled in this case, the object removal and deletion process can be further optimized as locking isn't really needed. However, it is probably not worth the effort to optimize for such an edge case that should rarely happen. So the simple solution is to call cond_resched() at periodic interval in the iteration loop to avoid soft lockup. (CVE-2025-39737)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39737
https://ubuntu.com/security/CVE-2025-39737

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39737

Plugin Information
Published: 2025/09/14, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264750 - Linux Distros Unpatched Vulnerability : CVE-2025-39742
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() The function divides number of online CPUs by num_core_siblings, and later checks the divider by zero. This implies a possibility to get and divide-by-zero runtime error. Fix it by moving the check prior to division. This also helps to save one indentation level. (CVE-2025-39742)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39742
https://ubuntu.com/security/CVE-2025-39742

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39742

Plugin Information
Published: 2025/09/14, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264721 - Linux Distros Unpatched Vulnerability : CVE-2025-39745
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- rcutorture: Fix rcutorture_one_extend_check() splat in RT kernels For built with CONFIG_PREEMPT_RT=y kernels, running rcutorture tests resulted in the following splat: [ 68.797425] rcutorture_one_extend_check during change: Current 0x1 To add 0x1 To remove 0x0 preempt_count() 0x0 [ 68.797533] WARNING: CPU: 2 PID: 512 at kernel/rcu/rcutorture.c:1993 rcutorture_one_extend_check+0x419/0x560 [rcutorture] [ 68.797601] Call Trace: [ 68.797602] <TASK> [ 68.797619] ? lockdep_softirqs_off+0xa5/0x160 [ 68.797631] rcutorture_one_extend+0x18e/0xcc0 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c] [ 68.797646] ? local_clock+0x19/0x40 [ 68.797659] rcu_torture_one_read+0xf0/0x280 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c] [ 68.797678] ?
__pfx_rcu_torture_one_read+0x10/0x10 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c] [ 68.797804] ?
__pfx_rcu_torture_timer+0x10/0x10 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c] [ 68.797815] rcu- torture: rcu_torture_reader task started [ 68.797824] rcu-torture: Creating rcu_torture_reader task [ 68.797824] rcu_torture_reader+0x238/0x580 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c] [ 68.797836] ? kvm_sched_clock_read+0x15/0x30 Disable BH does not change the SOFTIRQ corresponding bits in preempt_count() for RT kernels, this commit therefore use softirq_count() to check the if BH is disabled.
(CVE-2025-39745)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39745
https://ubuntu.com/security/CVE-2025-39745

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39745

Plugin Information
Published: 2025/09/14, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264741 - Linux Distros Unpatched Vulnerability : CVE-2025-39746
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath10k: shutdown driver when hardware is unreliable In rare cases, ath10k may lose connection with the PCIe bus due to some unknown reasons, which could further lead to system crashes during resuming due to watchdog timeout: ath10k_pci 0000:01:00.0: wmi command 20486 timeout, restarting hardware ath10k_pci 0000:01:00.0: already restarting ath10k_pci 0000:01:00.0: failed to stop WMI vdev 0: -11 ath10k_pci 0000:01:00.0: failed to stop vdev 0: -11 ieee80211 phy0: PM: **** DPM device timeout **** Call Trace:
panic+0x125/0x315 dpm_watchdog_set+0x54/0x54 dpm_watchdog_handler+0x57/0x57 call_timer_fn+0x31/0x13c At this point, all WMI commands will timeout and attempt to restart device. So set a threshold for consecutive restart failures. If the threshold is exceeded, consider the hardware is unreliable and all ath10k operations should be skipped to avoid system crash. fail_cont_count and pending_recovery are atomic variables, and do not involve complex conditional logic. Therefore, even if recovery check and reconfig complete are executed concurrently, the recovery mechanism will not be broken. Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00288-QCARMSWPZ-1 (CVE-2025-39746)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39746
https://security-tracker.debian.org/tracker/CVE-2025-39746
https://ubuntu.com/security/CVE-2025-39746

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39746

Plugin Information
Published: 2025/09/14, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264755 - Linux Distros Unpatched Vulnerability : CVE-2025-39748
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Forget ranges when refining tnum after JSET Syzbot reported a kernel warning due to a range invariant violation on the following BPF program. 0: call bpf_get_netns_cookie 1: if r0 == 0 goto <exit> 2: if r0 &
Oxffffffff goto <exit> The issue is on the path where we fall through both jumps. That path is unreachable at runtime: after insn 1, we know r0 != 0, but with the sign extension on the jset, we would only fallthrough insn 2 if r0 == 0. Unfortunately, is_branch_taken() isn't currently able to figure this out, so the verifier walks all branches. The verifier then refines the register bounds using the second condition and we end up with inconsistent bounds on this unreachable path: 1: if r0 == 0 goto <exit> r0:
u64=[0x1, 0xffffffffffffffff] var_off=(0, 0xffffffffffffffff) 2: if r0 & 0xffffffff goto <exit> r0 before reg_bounds_sync: u64=[0x1, 0xffffffffffffffff] var_off=(0, 0) r0 after reg_bounds_sync: u64=[0x1, 0] var_off=(0, 0) Improving the range refinement for JSET to cover all cases is tricky. We also don't expect many users to rely on JSET given LLVM doesn't generate those instructions. So instead of improving the range refinement for JSETs, Eduard suggested we forget the ranges whenever we're narrowing tnums after a JSET. This patch implements that approach. (CVE-2025-39748)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39748
https://security-tracker.debian.org/tracker/CVE-2025-39748
https://ubuntu.com/security/CVE-2025-39748

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39748

Plugin Information
Published: 2025/09/14, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264770 - Linux Distros Unpatched Vulnerability : CVE-2025-39753
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops Clears up the warning added in 7ee3647243e5 (migrate:
Remove call to ->writepage) that occurs in various xfstests, causing something found in dmesg failures.
[ 341.136573] gfs2_meta_aops does not implement migrate_folio [ 341.136953] WARNING: CPU: 1 PID: 36 at mm/migrate.c:944 move_to_new_folio+0x2f8/0x300 (CVE-2025-39753)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39753
https://ubuntu.com/security/CVE-2025-39753

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39753

Plugin Information
Published: 2025/09/14, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264758 - Linux Distros Unpatched Vulnerability : CVE-2025-39754
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm/smaps: fix race between smaps_hugetlb_range and migration smaps_hugetlb_range() handles the pte without holdling ptl, and may be concurrenct with migration, leaing to BUG_ON in pfn_swap_entry_to_page(). The race is as follows. smaps_hugetlb_range migrate_pages huge_ptep_get remove_migration_ptes folio_unlock pfn_swap_entry_folio BUG_ON To fix it, hold ptl lock in smaps_hugetlb_range(). (CVE-2025-39754)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39754
https://security-tracker.debian.org/tracker/CVE-2025-39754
https://ubuntu.com/security/CVE-2025-39754

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39754

Plugin Information
Published: 2025/09/14, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264737 - Linux Distros Unpatched Vulnerability : CVE-2025-39756
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fs: Prevent file descriptor table allocations exceeding INT_MAX When sysctl_nr_open is set to a very high value (for example, 1073741816 as set by systemd), processes attempting to use file descriptors near the limit can trigger massive memory allocation attempts that exceed INT_MAX, resulting in a WARNING in mm/slub.c: WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288 This happens because kvmalloc_array() and kvmalloc() check if the requested size exceeds INT_MAX and emit a warning when the allocation is not flagged with __GFP_NOWARN. Specifically, when nr_open is set to 1073741816 (0x3ffffff8) and a process calls dup2(oldfd, 1073741880), the kernel attempts to allocate: - File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes - Multiple bitmaps: ~400MB - Total allocation size: > 8GB (exceeding INT_MAX = 2,147,483,647) Reproducer: 1. Set /proc/sys/fs/nr_open to 1073741816: # echo 1073741816 > /proc/sys/fs/nr_open 2. Run a program that uses a high file descriptor: #include <unistd.h> #include <sys/resource.h> int main() { struct rlimit rlim = {1073741824, 1073741824};
setrlimit(RLIMIT_NOFILE, &rlim); dup2(2, 1073741880); // Triggers the warning return 0; } 3. Observe WARNING in dmesg at mm/slub.c:5027 systemd commit a8b627a introduced automatic bumping of fs.nr_open to the maximum possible value. The rationale was that systems with memory control groups (memcg) no longer need separate file descriptor limits since memory is properly accounted. However, this change overlooked that: 1. The kernel's allocation functions still enforce INT_MAX as a maximum size regardless of memcg accounting 2. Programs and tests that legitimately test file descriptor limits can inadvertently trigger massive allocations 3. The resulting allocations (>8GB) are impractical and will always fail systemd's algorithm starts with INT_MAX and keeps halving the value until the kernel accepts it. On most systems, this results in nr_open being set to 1073741816 (0x3ffffff8), which is just under 1GB of file descriptors.
While processes rarely use file descriptors near this limit in normal operation, certain selftests (like tools/testing/selftests/core/unshare_test.c) and programs that test file descriptor limits can trigger this issue. Fix this by adding a check in alloc_fdtable() to ensure the requested allocation size does not exceed INT_MAX. This causes the operation to fail with -EMFILE instead of triggering a kernel warning and avoids the impractical >8GB memory allocation request. (CVE-2025-39756)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39756
https://ubuntu.com/security/CVE-2025-39756

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39756

Plugin Information
Published: 2025/09/14, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264761 - Linux Distros Unpatched Vulnerability : CVE-2025-39763
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered If a synchronous error is detected as a result of user-space process triggering a 2-bit uncorrected error, the CPU will take a synchronous error exception such as Synchronous External Abort (SEA) on Arm64. The kernel will queue a memory_failure() work which poisons the related page, unmaps the page, and then sends a SIGBUS to the process, so that a system wide panic can be avoided. However, no memory_failure() work will be queued when abnormal synchronous errors occur. These errors can include situations like invalid PA, unexpected severity, no memory failure config support, invalid GUID section, etc. In such a case, the user-space process will trigger SEA again. This loop can potentially exceed the platform firmware threshold or even trigger a kernel hard lockup, leading to a system reboot. Fix it by performing a force kill if no memory_failure() work is queued for synchronous errors. [ rjw: Changelog edits ] (CVE-2025-39763)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39763
https://security-tracker.debian.org/tracker/CVE-2025-39763
https://ubuntu.com/security/CVE-2025-39763

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39763

Plugin Information
Published: 2025/09/14, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264746 - Linux Distros Unpatched Vulnerability : CVE-2025-39764
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfilter: ctnetlink: remove refcounting in expectation dumpers Same pattern as previous patch: do not keep the expectation object alive via refcount, only store a cookie value and then use that as the skip hint for dump resumption. AFAICS this has the same issue as the one resolved in the conntrack dumper, when we do if (!refcount_inc_not_zero(&exp->use)) to increment the refcount, there is a chance that exp == last, which causes a double-increment of the refcount and subsequent memory leak. (CVE-2025-39764)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39764
https://security-tracker.debian.org/tracker/CVE-2025-39764
https://ubuntu.com/security/CVE-2025-39764

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39764

Plugin Information
Published: 2025/09/14, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264732 - Linux Distros Unpatched Vulnerability : CVE-2025-39766
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit The following setup can trigger a WARNING in htb_activate due to the condition: !cl->leaf.q->q.qlen tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid 1:1 \ htb rate 64bit tc qdisc add dev lo parent 1:1 handle f: \ cake memlimit 1b ping -I lo -f -c1 -s64 -W0.001 127.0.0.1 This is because the low memlimit leads to a low buffer_limit, which causes packet dropping. However, cake_enqueue still returns NET_XMIT_SUCCESS, causing htb_enqueue to call htb_activate with an empty child qdisc. We should return NET_XMIT_CN when packets are dropped from the same tin and flow. I do not believe return value of NET_XMIT_CN is necessary for packet drops in the case of ack filtering, as that is meant to optimize performance, not to signal congestion. (CVE-2025-39766)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39766
https://ubuntu.com/security/CVE-2025-39766

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39766

Plugin Information
Published: 2025/09/14, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264739 - Linux Distros Unpatched Vulnerability : CVE-2025-39772
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug When hibmc loaded failed, the driver use hibmc_unload to free the resource, but the mutexes in mode.config are not init, which will access an NULL pointer. Just change goto statement to return, because hibnc_hw_init() doesn't need to free anything. (CVE-2025-39772)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39772
https://security-tracker.debian.org/tracker/CVE-2025-39772
https://ubuntu.com/security/CVE-2025-39772

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39772

Plugin Information
Published: 2025/09/14, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264769 - Linux Distros Unpatched Vulnerability : CVE-2025-39773
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: bridge: fix soft lockup in br_multicast_query_expired() When set multicast_query_interval to a large value, the local variable 'time' in br_multicast_send_query() may overflow. If the time is smaller than jiffies, the timer will expire immediately, and then call mod_timer() again, which creates a loop and may trigger the following soft lockup issue. watchdog: BUG: soft lockup - CPU#1 stuck for 221s! [rb_consumer:66] CPU: 1 UID: 0 PID: 66 Comm: rb_consumer Not tainted 6.16.0+ #259 PREEMPT(none) Call Trace: <IRQ> __netdev_alloc_skb+0x2e/0x3a0 br_ip6_multicast_alloc_query+0x212/0x1b70
__br_multicast_send_query+0x376/0xac0 br_multicast_send_query+0x299/0x510 br_multicast_query_expired.constprop.0+0x16d/0x1b0 call_timer_fn+0x3b/0x2a0 __run_timers+0x619/0x950 run_timer_softirq+0x11c/0x220 handle_softirqs+0x18e/0x560 __irq_exit_rcu+0x158/0x1a0 sysvec_apic_timer_interrupt+0x76/0x90 </IRQ> This issue can be reproduced with: ip link add br0 type bridge echo 1 > /sys/class/net/br0/bridge/multicast_querier echo 0xffffffffffffffff >
/sys/class/net/br0/bridge/multicast_query_interval ip link set dev br0 up The multicast_startup_query_interval can also cause this issue. Similar to the commit 99b40610956a (net:
bridge: mcast: add and enforce query interval minimum), add check for the query interval maximum to fix this issue. (CVE-2025-39773)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39773
https://security-tracker.debian.org/tracker/CVE-2025-39773
https://ubuntu.com/security/CVE-2025-39773

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39773

Plugin Information
Published: 2025/09/14, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264764 - Linux Distros Unpatched Vulnerability : CVE-2025-39775
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm/mremap: fix WARN with uffd that has remap events disabled Registering userfaultd on a VMA that spans at least one PMD and then mremap()'ing that VMA can trigger a WARN when recovering from a failed page table move due to a page table allocation error. The code ends up doing the right thing (recurse, avoiding moving actual page tables), but triggering that WARN is unpleasant: WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_normal_pmd mm/mremap.c:357 [inline] WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_pgt_entry mm/mremap.c:595 [inline] WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_page_tables+0x3832/0x44a0 mm/mremap.c:852 Modules linked in: CPU: 2 UID: 0 PID: 6133 Comm: syz.0.19 Not tainted 6.17.0-rc1-syzkaller-00004-g53e760d89498 #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:move_normal_pmd mm/mremap.c:357 [inline] RIP: 0010:move_pgt_entry mm/mremap.c:595 [inline] RIP: 0010:move_page_tables+0x3832/0x44a0 mm/mremap.c:852 Code: ... RSP: 0018:ffffc900037a76d8 EFLAGS: 00010293 RAX: 0000000000000000 RBX:
0000000032930007 RCX: ffffffff820c6645 RDX: ffff88802e56a440 RSI: ffffffff820c7201 RDI: 0000000000000007 RBP: ffff888037728fc0 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000032930007 R11:
0000000000000000 R12: 0000000000000000 R13: ffffc900037a79a8 R14: 0000000000000001 R15: dffffc0000000000 FS: 000055556316a500(0000) GS:ffff8880d68bc000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b30863fff CR3: 0000000050171000 CR4: 0000000000352ef0 Call Trace: <TASK>
copy_vma_and_data+0x468/0x790 mm/mremap.c:1215 move_vma+0x548/0x1780 mm/mremap.c:1282 mremap_to+0x1b7/0x450 mm/mremap.c:1406 do_mremap+0xfad/0x1f80 mm/mremap.c:1921 __do_sys_mremap+0x119/0x170 mm/mremap.c:1977 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f00d0b8ebe9 Code: ...
RSP: 002b:00007ffe5ea5ee98 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 RAX: ffffffffffffffda RBX:
00007f00d0db5fa0 RCX: 00007f00d0b8ebe9 RDX: 0000000000400000 RSI: 0000000000c00000 RDI: 0000200000000000 RBP: 00007ffe5ea5eef0 R08: 0000200000c00000 R09: 0000000000000000 R10: 0000000000000003 R11:
0000000000000246 R12: 0000000000000002 R13: 00007f00d0db5fa0 R14: 00007f00d0db5fa0 R15: 0000000000000005 </TASK> The underlying issue is that we recurse during the original page table move, but not during the recovery move. Fix it by checking for both VMAs and performing the check before the pmd_none() sanity check. Add a new helper where we perform+document that check for the PMD and PUD level. Thanks to Harry for bisecting. (CVE-2025-39775)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39775
https://security-tracker.debian.org/tracker/CVE-2025-39775
https://ubuntu.com/security/CVE-2025-39775

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:H/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39775

Plugin Information
Published: 2025/09/14, Modified: 2025/11/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264718 - Linux Distros Unpatched Vulnerability : CVE-2025-39776
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm/debug_vm_pgtable: clear page table entries at destroy_args() The mm/debug_vm_pagetable test allocates manually page table entries for the tests it runs, using also its manually allocated mm_struct. That in itself is ok, but when it exits, at destroy_args() it fails to clear those entries with the *_clear functions. The problem is that leaves stale entries. If another process allocates an mm_struct with a pgd at the same address, it may end up running into the stale entry. This is happening in practice on a debug kernel with CONFIG_DEBUG_VM_PGTABLE=y, for example this is the output with some extra debugging I added (it prints a warning trace if pgtables_bytes goes negative, in addition to the warning at check_mm() function): [ 2.539353] debug_vm_pgtable: [get_random_vaddr ]: random_vaddr is 0x7ea247140000 [ 2.539366] kmem_cache info [ 2.539374] kmem_cachep 0x000000002ce82385 - freelist 0x0000000000000000 - offset 0x508 [ 2.539447] debug_vm_pgtable: [init_args ]: args->mm is 0x000000002267cc9e (...) [ 2.552800] WARNING: CPU: 5 PID: 116 at include/linux/mm.h:2841 free_pud_range+0x8bc/0x8d0 [ 2.552816] Modules linked in: [ 2.552843] CPU: 5 UID: 0 PID: 116 Comm: modprobe Not tainted 6.12.0-105.debug_vm2.el10.ppc64le+debug #1 VOLUNTARY [ 2.552859] Hardware name: IBM,9009-41A POWER9 (architected) 0x4e0202 0xf000005 of:IBM,FW910.00 (VL910_062) hv:phyp pSeries [ 2.552872] NIP: c0000000007eef3c LR: c0000000007eef30 CTR: c0000000003d8c90 [ 2.552885] REGS: c0000000622e73b0 TRAP: 0700 Not tainted (6.12.0-105.debug_vm2.el10.ppc64le+debug) [ 2.552899] MSR:
800000000282b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 24002822 XER: 0000000a [ 2.552954] CFAR:
c0000000008f03f0 IRQMASK: 0 [ 2.552954] GPR00: c0000000007eef30 c0000000622e7650 c000000002b1ac00 0000000000000001 [ 2.552954] GPR04: 0000000000000008 0000000000000000 c0000000007eef30 ffffffffffffffff [ 2.552954] GPR08: 00000000ffff00f5 0000000000000001 0000000000000048 0000000000004000 [ 2.552954] GPR12:
00000003fa440000 c000000017ffa300 c0000000051d9f80 ffffffffffffffdb [ 2.552954] GPR16: 0000000000000000 0000000000000008 000000000000000a 60000000000000e0 [ 2.552954] GPR20: 4080000000000000 c0000000113af038 00007fffcf130000 0000700000000000 [ 2.552954] GPR24: c000000062a6a000 0000000000000001 8000000062a68000 0000000000000001 [ 2.552954] GPR28: 000000000000000a c000000062ebc600 0000000000002000 c000000062ebc760 [ 2.553170] NIP [c0000000007eef3c] free_pud_range+0x8bc/0x8d0 [ 2.553185] LR [c0000000007eef30] free_pud_range+0x8b0/0x8d0 [ 2.553199] Call Trace: [ 2.553207] [c0000000622e7650] [c0000000007eef30] free_pud_range+0x8b0/0x8d0 (unreliable) [ 2.553229] [c0000000622e7750] [c0000000007f40b4] free_pgd_range+0x284/0x3b0 [ 2.553248] [c0000000622e7800] [c0000000007f4630] free_pgtables+0x450/0x570 [ 2.553274] [c0000000622e78e0] [c0000000008161c0] exit_mmap+0x250/0x650 [ 2.553292] [c0000000622e7a30] [c0000000001b95b8] __mmput+0x98/0x290 [ 2.558344] [c0000000622e7a80] [c0000000001d1018] exit_mm+0x118/0x1b0 [ 2.558361] [c0000000622e7ac0] [c0000000001d141c] do_exit+0x2ec/0x870 [ 2.558376] [c0000000622e7b60] [c0000000001d1ca8] do_group_exit+0x88/0x150 [ 2.558391] [c0000000622e7bb0] [c0000000001d1db8] sys_exit_group+0x48/0x50 [ 2.558407] [c0000000622e7be0] [c00000000003d810] system_call_exception+0x1e0/0x4c0 [ 2.558423] [c0000000622e7e50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec (...) [ 2.558892] ---[ end trace 0000000000000000 ]--- [ 2.559022] BUG: Bad rss-counter state mm:000000002267cc9e type:MM_ANONPAGES val:1 [ 2.559037] BUG: non-zero pgtables_bytes on freeing mm: -6144 Here the modprobe process ended up with an allocated mm_struct from the mm_struct slab that was used before by the debug_vm_pgtable test. That is not a problem, since the mm_stru ---truncated--- (CVE-2025-39776)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39776
https://ubuntu.com/security/CVE-2025-39776

Solution
There is no known solution at this time.
Risk Factor
Medium
VPR Score
4.4
EPSS Score
0.0002
References

CVE | CVE-2025-39776

Plugin Information
Published: 2025/09/14, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264753 - Linux Distros Unpatched Vulnerability : CVE-2025-39782
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() Both jbd2_log_do_checkpoint() and jbd2_journal_shrink_checkpoint_list() periodically release j_list_lock after processing a batch of buffers to avoid long hold times on the j_list_lock. However, since both functions contend for j_list_lock, the combined time spent waiting and processing can be significant. jbd2_journal_shrink_checkpoint_list() explicitly calls cond_resched() when need_resched() is true to avoid softlockups during prolonged operations. But jbd2_log_do_checkpoint() only exits its loop when need_resched() is true, relying on potentially sleeping functions like __flush_batch() or wait_on_buffer() to trigger rescheduling. If those functions do not sleep, the kernel may hit a softlockup. watchdog: BUG: soft lockup - CPU#3 stuck for 156s! [kworker/u129:2:373] CPU: 3 PID: 373 Comm: kworker/u129:2 Kdump: loaded Not tainted 6.6.0+ #10 Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.27 06/13/2017 Workqueue: writeback wb_workfn (flush-7:2) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc :
native_queued_spin_lock_slowpath+0x358/0x418 lr : jbd2_log_do_checkpoint+0x31c/0x438 [jbd2] Call trace:
native_queued_spin_lock_slowpath+0x358/0x418 jbd2_log_do_checkpoint+0x31c/0x438 [jbd2]
__jbd2_log_wait_for_space+0xfc/0x2f8 [jbd2] add_transaction_credits+0x3bc/0x418 [jbd2] start_this_handle+0xf8/0x560 [jbd2] jbd2__journal_start+0x118/0x228 [jbd2]
__ext4_journal_start_sb+0x110/0x188 [ext4] ext4_do_writepages+0x3dc/0x740 [ext4] ext4_writepages+0xa4/0x190 [ext4] do_writepages+0x94/0x228 __writeback_single_inode+0x48/0x318 writeback_sb_inodes+0x204/0x590 __writeback_inodes_wb+0x54/0xf8 wb_writeback+0x2cc/0x3d8 wb_do_writeback+0x2e0/0x2f8 wb_workfn+0x80/0x2a8 process_one_work+0x178/0x3e8 worker_thread+0x234/0x3b8 kthread+0xf0/0x108 ret_from_fork+0x10/0x20 So explicitly call cond_resched() in jbd2_log_do_checkpoint() to avoid softlockup. (CVE-2025-39782)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39782
https://ubuntu.com/security/CVE-2025-39782

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39782

Plugin Information
Published: 2025/09/14, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264757 - Linux Distros Unpatched Vulnerability : CVE-2025-39784
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- PCI: Fix link speed calculation on retrain failure When pcie_failed_link_retrain() fails to retrain, it tries to revert to the previous link speed. However it calculates that speed from the Link Control 2 register without masking out non-speed bits first. PCIE_LNKCTL2_TLS2SPEED() converts such incorrect values to PCI_SPEED_UNKNOWN (0xff), which in turn causes a WARN splat in pcie_set_target_speed(): pci 0000:00:01.1: [1022:14ed] type 01 class 0x060400 PCIe Root Port pci 0000:00:01.1: broken device, retraining non-functional downstream link at 2.5GT/s pci 0000:00:01.1: retraining failed WARNING: CPU: 1 PID: 1 at drivers/pci/pcie/bwctrl.c:168 pcie_set_target_speed RDX: 0000000000000001 RSI: 00000000000000ff RDI: ffff9acd82efa000 pcie_failed_link_retrain pci_device_add pci_scan_single_device Mask out the non- speed bits in PCIE_LNKCTL2_TLS2SPEED() and PCIE_LNKCAP_SLS2SPEED() so they don't incorrectly return PCI_SPEED_UNKNOWN. [bhelgaas: commit log, add details from https://lore.kernel.org/r/1c92ef6bcb314ee6977839b46b393282e4f52e74.1750684771.git.lukas@wunner.de] (CVE-2025-39784)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39784
https://ubuntu.com/security/CVE-2025-39784

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39784

Plugin Information
Published: 2025/09/14, Modified: 2025/11/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265252 - Linux Distros Unpatched Vulnerability : CVE-2025-39792
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dm: Always split write BIOs to zoned device limits Any zoned DM target that requires zone append emulation will use the block layer zone write plugging. In such case, DM target drivers must not split BIOs using dm_accept_partial_bio() as doing so can potentially lead to deadlocks with queue freeze operations.
Regular write operations used to emulate zone append operations also cannot be split by the target driver as that would result in an invalid writen sector value return using the BIO sector. In order for zoned DM target drivers to avoid such incorrect BIO splitting, we must ensure that large BIOs are split before being passed to the map() function of the target, thus guaranteeing that the limits for the mapped device are not exceeded. dm-crypt and dm-flakey are the only target drivers supporting zoned devices and using dm_accept_partial_bio(). In the case of dm-crypt, this function is used to split BIOs to the internal max_write_size limit (which will be suppressed in a different patch). However, since crypt_alloc_buffer() uses a bioset allowing only up to BIO_MAX_VECS (256) vectors in a BIO. The dm-crypt device max_segments limit, which is not set and so default to BLK_MAX_SEGMENTS (128), must thus be respected and write BIOs split accordingly. In the case of dm-flakey, since zone append emulation is not required, the block layer zone write plugging is not used and no splitting of BIOs required. Modify the function dm_zone_bio_needs_split() to use the block layer helper function bio_needs_zone_write_plugging() to force a call to bio_split_to_limits() in dm_split_and_process_bio(). This allows DM target drivers to avoid using dm_accept_partial_bio() for write operations on zoned DM devices. (CVE-2025-39792)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39792
https://ubuntu.com/security/CVE-2025-39792

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39792

Plugin Information
Published: 2025/09/17, Modified: 2025/11/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264707 - Linux Distros Unpatched Vulnerability : CVE-2025-39798
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NFS: Fix the setting of capabilities when automounting a new filesystem Capabilities cannot be inherited when we cross into a new filesystem. They need to be reset to the minimal defaults, and then probed for again. (CVE-2025-39798)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39798
https://ubuntu.com/security/CVE-2025-39798

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39798

Plugin Information
Published: 2025/09/14, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265041 - Linux Distros Unpatched Vulnerability : CVE-2025-39801
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts This commit addresses a rarely observed endpoint command timeout which causes kernel panic due to warn when 'panic_on_warn' is enabled and unnecessary call trace prints when 'panic_on_warn' is disabled. It is seen during fast software-controlled connect/disconnect testcases. The following is one such endpoint command timeout that we observed: 1.
Connect ======= ->dwc3_thread_interrupt ->dwc3_ep0_interrupt ->configfs_composite_setup ->composite_setup
->usb_ep_queue ->dwc3_gadget_ep0_queue ->__dwc3_gadget_ep0_queue ->__dwc3_ep0_do_control_data
->dwc3_send_gadget_ep_cmd 2. Disconnect ========== ->dwc3_thread_interrupt
->dwc3_gadget_disconnect_interrupt ->dwc3_ep0_reset_state ->dwc3_ep0_end_control_data
->dwc3_send_gadget_ep_cmd In the issue scenario, in Exynos platforms, we observed that control transfers for the previous connect have not yet been completed and end transfer command sent as a part of the disconnect sequence and processing of USB_ENDPOINT_HALT feature request from the host timeout. This maybe an expected scenario since the controller is processing EP commands sent as a part of the previous connect. It maybe better to remove WARN_ON in all places where device endpoint commands are sent to avoid unnecessary kernel panic due to warn. (CVE-2025-39801)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39801
https://security-tracker.debian.org/tracker/CVE-2025-39801
https://ubuntu.com/security/CVE-2025-39801

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39801

Plugin Information
Published: 2025/09/16, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265215 - Linux Distros Unpatched Vulnerability : CVE-2025-39808
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() in ntrig_report_version(), hdev parameter passed from hid_probe(). sending descriptor to /dev/uhid can make hdev->dev.parent->parent to null if hdev->dev.parent->parent is null, usb_dev has invalid address(0xffffffffffffff58) that hid_to_usb_dev(hdev) returned when usb_rcvctrlpipe() use usb_dev,it trigger page fault error for address(0xffffffffffffff58) add null check logic to ntrig_report_version() before calling hid_to_usb_dev() (CVE-2025-39808)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39808
https://ubuntu.com/security/CVE-2025-39808

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39808

Plugin Information
Published: 2025/09/17, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265242 - Linux Distros Unpatched Vulnerability : CVE-2025-39811
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/xe/vm: Clear the scratch_pt pointer on error Avoid triggering a dereference of an error pointer on cleanup in xe_vm_free_scratch() by clearing any scratch_pt error pointer. (cherry picked from commit 358ee50ab565f3c8ea32480e9d03127a81ba32f8) (CVE-2025-39811)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39811
https://ubuntu.com/security/CVE-2025-39811

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39811

Plugin Information
Published: 2025/09/17, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265231 - Linux Distros Unpatched Vulnerability : CVE-2025-39813
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump When calling ftrace_dump_one() concurrently with reading trace_pipe, a WARN_ON_ONCE() in trace_printk_seq() can be triggered due to a race condition. The issue occurs because: CPU0 (ftrace_dump) CPU1 (reader) echo z > /proc/sysrq-trigger !trace_empty(&iter) trace_iterator_reset(&iter) <- len = size = 0 cat /sys/kernel/tracing/trace_pipe trace_find_next_entry_inc(&iter) __find_next_entry ring_buffer_empty_cpu <- all empty return NULL trace_printk_seq(&iter.seq) WARN_ON_ONCE(s->seq.len >= s->seq.size) In the context between trace_empty() and trace_find_next_entry_inc() during ftrace_dump, the ring buffer data was consumed by other readers.
This caused trace_find_next_entry_inc to return NULL, failing to populate `iter.seq`. At this point, due to the prior trace_iterator_reset, both `iter.seq.len` and `iter.seq.size` were set to 0. Since they are equal, the WARN_ON_ONCE condition is triggered. Move the trace_printk_seq() into the if block that checks to make sure the return value of trace_find_next_entry_inc() is non-NULL in ftrace_dump_one(), ensuring the 'iter.seq' is properly populated before subsequent operations. (CVE-2025-39813)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39813
https://ubuntu.com/security/CVE-2025-39813

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39813

Plugin Information
Published: 2025/09/17, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265232 - Linux Distros Unpatched Vulnerability : CVE-2025-39824
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation After hid_hw_start() is called hidinput_connect() will eventually be called to set up the device with the input layer since the HID_CONNECT_DEFAULT connect mask is used. During hidinput_connect() all input and output reports are processed and corresponding hid_inputs are allocated and configured via hidinput_configure_usages(). This process involves slot tagging report fields and configuring usages by setting relevant bits in the capability bitmaps. However it is possible that the capability bitmaps are not set at all leading to the subsequent hidinput_has_been_populated() check to fail leading to the freeing of the hid_input and the underlying input device. This becomes problematic because a malicious HID device like a ASUS ROG N-Key keyboard can trigger the above scenario via a specially crafted descriptor which then leads to a user-after-free when the name of the freed input device is written to later on after hid_hw_start(). Below, report 93 intentionally utilises the HID_UP_UNDEFINED Usage Page which is skipped during usage configuration, leading to the frees. 0x05, 0x0D, // Usage Page (Digitizer) 0x09, 0x05, // Usage (Touch Pad) 0xA1, 0x01, // Collection (Application) 0x85, 0x0D, // Report ID (13) 0x06, 0x00, 0xFF, // Usage Page (Vendor Defined 0xFF00) 0x09, 0xC5, // Usage (0xC5) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x04, // Report Count (4) 0xB1, 0x02, // Feature (Data,Var,Abs) 0x85, 0x5D, // Report ID (93) 0x06, 0x00, 0x00, // Usage Page (Undefined) 0x09, 0x01, // Usage (0x01) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x1B, // Report Count (27) 0x81, 0x02, // Input (Data,Var,Abs) 0xC0, // End Collection Below is the KASAN splat after triggering the UAF: [ 21.672709] ================================================================== [ 21.673700] BUG: KASAN: slab-use-after-free in asus_probe+0xeeb/0xf80 [ 21.673700] Write of size 8 at addr ffff88810a0ac000 by task kworker/1:2/54 [ 21.673700] [ 21.673700] CPU: 1 UID: 0 PID: 54 Comm:
kworker/1:2 Not tainted 6.16.0-rc4-g9773391cf4dd-dirty #36 PREEMPT(voluntary) [ 21.673700] Hardware name:
QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 21.673700] Call Trace: [ 21.673700] <TASK> [ 21.673700] dump_stack_lvl+0x5f/0x80 [ 21.673700] print_report+0xd1/0x660 [ 21.673700] kasan_report+0xe5/0x120 [ 21.673700] __asan_report_store8_noabort+0x1b/0x30 [ 21.673700] asus_probe+0xeeb/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Allocated by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_alloc_info+0x3b/0x50 [ 21.673700]
__kasan_kmalloc+0x9c/0xa0 [ 21.673700] __kmalloc_cache_noprof+0x139/0x340 [ 21.673700] input_allocate_device+0x44/0x370 [ 21.673700] hidinput_connect+0xcb6/0x2630 [ 21.673700] hid_connect+0xf74/0x1d60 [ 21.673700] hid_hw_start+0x8c/0x110 [ 21.673700] asus_probe+0x5a3/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700]
__driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Freed by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_free_info+0x3f/0x60 [ 21.673700]
__kasan_slab_free+0x3c/0x50 [ 21.673700] kfre ---truncated--- (CVE-2025-39824)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39824
https://ubuntu.com/security/CVE-2025-39824

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.0 (CVSS2#AV:L/AC:H/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39824

Plugin Information
Published: 2025/09/17, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265142 - Linux Distros Unpatched Vulnerability : CVE-2025-39829
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- trace/fgraph: Fix the warning caused by missing unregister notifier This warning was triggered during testing on v6.16: notifier callback ftrace_suspend_notifier_call already registered WARNING: CPU: 2 PID:
86 at kernel/notifier.c:23 notifier_chain_register+0x44/0xb0 ... Call Trace: <TASK>
blocking_notifier_chain_register+0x34/0x60 register_ftrace_graph+0x330/0x410 ftrace_profile_write+0x1e9/0x340 vfs_write+0xf8/0x420 ? filp_flush+0x8a/0xa0 ? filp_close+0x1f/0x30 ? do_dup2+0xaf/0x160 ksys_write+0x65/0xe0 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f When writing to the function_profile_enabled interface, the notifier was not unregistered after start_graph_tracing failed, causing a warning the next time function_profile_enabled was written. Fixed by adding unregister_pm_notifier in the exception path. (CVE-2025-39829)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39829
https://security-tracker.debian.org/tracker/CVE-2025-39829
https://ubuntu.com/security/CVE-2025-39829

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39829

Plugin Information
Published: 2025/09/17, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265217 - Linux Distros Unpatched Vulnerability : CVE-2025-39830
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path In the error path of hws_pool_buddy_init(), the buddy allocator cleanup doesn't free the allocator structure itself, causing a memory leak. Add the missing kfree() to properly release all allocated memory. (CVE-2025-39830)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39830
https://security-tracker.debian.org/tracker/CVE-2025-39830
https://ubuntu.com/security/CVE-2025-39830

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39830

Plugin Information
Published: 2025/09/17, Modified: 2025/11/21
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265270 - Linux Distros Unpatched Vulnerability : CVE-2025-39832
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mlx5: Fix lockdep assertion on sync reset unload event Fix lockdep assertion triggered during sync reset unload event. When the sync reset flow is initiated using the devlink reload fw_activate option, the PF already holds the devlink lock while handling unload event. In this case, delegate sync reset unload event handling back to the devlink callback process to avoid double-locking and resolve the lockdep warning. Kernel log: WARNING: CPU: 9 PID: 1578 at devl_assert_locked+0x31/0x40 [...] Call Trace: <TASK>
mlx5_unload_one_devl_locked+0x2c/0xc0 [mlx5_core] mlx5_sync_reset_unload_event+0xaf/0x2f0 [mlx5_core] process_one_work+0x222/0x640 worker_thread+0x199/0x350 kthread+0x10b/0x230 ? __pfx_worker_thread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x8e/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> (CVE-2025-39832)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39832
https://ubuntu.com/security/CVE-2025-39832

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39832

Plugin Information
Published: 2025/09/17, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265185 - Linux Distros Unpatched Vulnerability : CVE-2025-39834
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow When an invalid stc_type is provided, the function allocates memory for shared_stc but jumps to unlock_and_out without freeing it, causing a memory leak. Fix by jumping to free_shared_stc label instead to ensure proper cleanup.
(CVE-2025-39834)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39834
https://security-tracker.debian.org/tracker/CVE-2025-39834
https://ubuntu.com/security/CVE-2025-39834

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39834

Plugin Information
Published: 2025/09/17, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265198 - Linux Distros Unpatched Vulnerability : CVE-2025-39835
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xfs: do not propagate ENODATA disk errors into xattr code ENODATA (aka ENOATTR) has a very specific meaning in the xfs xattr code; namely, that the requested attribute name could not be found. However, a medium error from disk may also return ENODATA. At best, this medium error may escape to userspace as attribute not found when in fact it's an IO (disk) error. At worst, we may oops in xfs_attr_leaf_get() when we do: error = xfs_attr_leaf_hasname(args, &bp); if (error == -ENOATTR) { xfs_trans_brelse(args->trans, bp); return error; } because an ENODATA/ENOATTR error from disk leaves us with a null bp, and the xfs_trans_brelse will then null-deref it. As discussed on the list, we really need to modify the lower level IO functions to trap all disk errors and ensure that we don't let unique errors like this leak up into higher xfs functions - many like this should be remapped to EIO. However, this patch directly addresses a reported bug in the xattr code, and should be safe to backport to stable kernels. A larger-scope patch to handle more unique errors at lower levels can follow later. (Note, prior to 07120f1abdff we did not oops, but we did return the wrong error code to userspace.) (CVE-2025-39835)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39835
https://ubuntu.com/security/CVE-2025-39835

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
3.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
3.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39835

Plugin Information
Published: 2025/09/17, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265467 - Linux Distros Unpatched Vulnerability : CVE-2025-39838
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cifs: prevent NULL pointer dereference in UTF16 conversion There can be a NULL pointer dereference bug here. NULL is passed to __cifs_sfu_make_node without checks, which passes it unchecked to cifs_strndup_to_utf16, which in turn passes it to cifs_local_to_utf16_bytes where '*from' is dereferenced, causing a crash. This patch adds a check for NULL 'src' in cifs_strndup_to_utf16 and returns NULL early to prevent dereferencing NULL pointer. Found by Linux Verification Center (linuxtesting.org) with SVACE (CVE-2025-39838)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39838
https://ubuntu.com/security/CVE-2025-39838

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39838

Plugin Information
Published: 2025/09/19, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265465 - Linux Distros Unpatched Vulnerability : CVE-2025-39847
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ppp: fix memory leak in pad_compress_skb If alloc_skb() fails in pad_compress_skb(), it returns NULL without releasing the old skb. The caller does: skb = pad_compress_skb(ppp, skb); if (!skb) goto drop;
drop: kfree_skb(skb); When pad_compress_skb() returns NULL, the reference to the old skb is lost and kfree_skb(skb) ends up doing nothing, leading to a memory leak. Align pad_compress_skb() semantics with realloc(): only free the old skb if allocation and compression succeed. At the call site, use the new_skb variable so the original skb is not lost when pad_compress_skb() fails. (CVE-2025-39847)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39847
https://ubuntu.com/security/CVE-2025-39847

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39847

Plugin Information
Published: 2025/09/19, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265479 - Linux Distros Unpatched Vulnerability : CVE-2025-39850
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects When the proxy option is enabled on a VXLAN device, the device will suppress ARP requests and IPv6 Neighbor Solicitation messages if it is able to reply on behalf of the remote host. That is, if a matching and valid neighbor entry is configured on the VXLAN device whose MAC address is not behind the any remote (0.0.0.0 / ::). The code currently assumes that the FDB entry for the neighbor's MAC address points to a valid remote destination, but this is incorrect if the entry is associated with an FDB nexthop group. This can result in a NPD [1][3] which can be reproduced using [2][4]. Fix by checking that the remote destination exists before dereferencing it. [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] CPU: 4 UID: 0 PID: 365 Comm:
arping Not tainted 6.17.0-rc2-virtme-g2a89cb21162c #2 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 RIP: 0010:vxlan_xmit+0xb58/0x15f0 [...] Call Trace:
<TASK> dev_hard_start_xmit+0x5d/0x1c0 __dev_queue_xmit+0x246/0xfd0 packet_sendmsg+0x113a/0x1850
__sock_sendmsg+0x38/0x70 __sys_sendto+0x126/0x180 __x64_sys_sendto+0x24/0x30 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [2] #!/bin/bash ip address add 192.0.2.1/32 dev lo ip nexthop add id 1 via 192.0.2.2 fdb ip nexthop add id 10 group 1 fdb ip link add name vx0 up type vxlan id 10010 local 192.0.2.1 dstport 4789 proxy ip neigh add 192.0.2.3 lladdr 00:11:22:33:44:55 nud perm dev vx0 bridge fdb add 00:11:22:33:44:55 dev vx0 self static nhid 10 arping -b -c 1 -s 192.0.2.1 -I vx0 192.0.2.3 [3] BUG:
kernel NULL pointer dereference, address: 0000000000000000 [...] CPU: 13 UID: 0 PID: 372 Comm: ndisc6 Not tainted 6.17.0-rc2-virtmne-g6ee90cb26014 #3 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1v996), BIOS 1.17.0-4.fc41 04/01/2x014 RIP: 0010:vxlan_xmit+0x803/0x1600 [...] Call Trace: <TASK>
dev_hard_start_xmit+0x5d/0x1c0 __dev_queue_xmit+0x246/0xfd0 ip6_finish_output2+0x210/0x6c0 ip6_finish_output+0x1af/0x2b0 ip6_mr_output+0x92/0x3e0 ip6_send_skb+0x30/0x90 rawv6_sendmsg+0xe6e/0x12e0
__sock_sendmsg+0x38/0x70 __sys_sendto+0x126/0x180 __x64_sys_sendto+0x24/0x30 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f383422ec77 [4] #!/bin/bash ip address add 2001:db8:1::1/128 dev lo ip nexthop add id 1 via 2001:db8:1::1 fdb ip nexthop add id 10 group 1 fdb ip link add name vx0 up type vxlan id 10010 local 2001:db8:1::1 dstport 4789 proxy ip neigh add 2001:db8:1::3 lladdr 00:11:22:33:44:55 nud perm dev vx0 bridge fdb add 00:11:22:33:44:55 dev vx0 self static nhid 10 ndisc6 -r 1 -s 2001:db8:1::1 -w 1 2001:db8:1::3 vx0 (CVE-2025-39850)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39850
https://security-tracker.debian.org/tracker/CVE-2025-39850
https://ubuntu.com/security/CVE-2025-39850

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39850

Plugin Information
Published: 2025/09/19, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265480 - Linux Distros Unpatched Vulnerability : CVE-2025-39851
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object VXLAN FDB entries can point to either a remote destination or an FDB nexthop group. The latter is usually used in EVPN deployments where learning is disabled. However, when learning is enabled, an incoming packet might try to refresh an FDB entry that points to an FDB nexthop group and therefore does not have a remote. Such packets should be dropped, but they are only dropped after dereferencing the non-existent remote, resulting in a NPD [1] which can be reproduced using [2]. Fix by dropping such packets earlier. Remove the misleading comment from first_remote_rcu(). [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] CPU: 13 UID:
0 PID: 361 Comm: mausezahn Not tainted 6.17.0-rc1-virtme-g9f6b606b6b37 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 RIP:
0010:vxlan_snoop+0x98/0x1e0 [...] Call Trace: <TASK> vxlan_encap_bypass+0x209/0x240 encap_bypass_if_local+0xb1/0x100 vxlan_xmit_one+0x1375/0x17e0 vxlan_xmit+0x6b4/0x15f0 dev_hard_start_xmit+0x5d/0x1c0 __dev_queue_xmit+0x246/0xfd0 packet_sendmsg+0x113a/0x1850
__sock_sendmsg+0x38/0x70 __sys_sendto+0x126/0x180 __x64_sys_sendto+0x24/0x30 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [2] #!/bin/bash ip address add 192.0.2.1/32 dev lo ip address add 192.0.2.2/32 dev lo ip nexthop add id 1 via 192.0.2.3 fdb ip nexthop add id 10 group 1 fdb ip link add name vx0 up type vxlan id 10010 local 192.0.2.1 dstport 12345 localbypass ip link add name vx1 up type vxlan id 10020 local 192.0.2.2 dstport 54321 learning bridge fdb add 00:11:22:33:44:55 dev vx0 self static dst 192.0.2.2 port 54321 vni 10020 bridge fdb add 00:aa:bb:cc:dd:ee dev vx1 self static nhid 10 mausezahn vx0 -a 00:aa:bb:cc:dd:ee -b 00:11:22:33:44:55 -c 1 -q (CVE-2025-39851)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39851
https://security-tracker.debian.org/tracker/CVE-2025-39851
https://ubuntu.com/security/CVE-2025-39851

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39851

Plugin Information
Published: 2025/09/19, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265488 - Linux Distros Unpatched Vulnerability : CVE-2025-39855
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL access of tx->in_use in ice_ptp_ts_irq The E810 device has support for a low latency firmware interface to access and read the Tx timestamps. This interface does not use the standard Tx timestamp logic, due to the latency overhead of proxying sideband command requests over the firmware AdminQ. The logic still makes use of the Tx timestamp tracking structure, ice_ptp_tx, as it uses the same ready bitmap to track which Tx timestamps complete.
Unfortunately, the ice_ptp_ts_irq() function does not check if the tracker is initialized before its first access. This results in NULL dereference or use-after-free bugs similar to the following: [245977.278756] BUG: kernel NULL pointer dereference, address: 0000000000000000 [245977.278774] RIP:
0010:_find_first_bit+0x19/0x40 [245977.278796] Call Trace: [245977.278809] ? ice_misc_intr+0x364/0x380 [ice] This can occur if a Tx timestamp interrupt races with the driver reset logic. Fix this by only checking the in_use bitmap (and other fields) if the tracker is marked as initialized. The reset flow will clear the init field under lock before it tears the tracker down, thus preventing any use-after-free or NULL access. (CVE-2025-39855)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39855
https://ubuntu.com/security/CVE-2025-39855

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39855

Plugin Information
Published: 2025/09/19, Modified: 2025/11/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265456 - Linux Distros Unpatched Vulnerability : CVE-2025-39857
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() BUG: kernel NULL pointer dereference, address: 00000000000002ec PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 28 UID: 0 PID: 343 Comm: kworker/28:1 Kdump: loaded Tainted: G OE 6.17.0-rc2+ #9 NONE Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 Workqueue: smc_hs_wq smc_listen_work [smc] RIP: 0010:smc_ib_is_sg_need_sync+0x9e/0xd0 [smc] ... Call Trace: <TASK> smcr_buf_map_link+0x211/0x2a0 [smc] __smc_buf_create+0x522/0x970 [smc] smc_buf_create+0x3a/0x110 [smc] smc_find_rdma_v2_device_serv+0x18f/0x240 [smc] ? smc_vlan_by_tcpsk+0x7e/0xe0 [smc] smc_listen_find_device+0x1dd/0x2b0 [smc] smc_listen_work+0x30f/0x580 [smc] process_one_work+0x18c/0x340 worker_thread+0x242/0x360 kthread+0xe7/0x220 ret_from_fork+0x13a/0x160 ret_from_fork_asm+0x1a/0x30 </TASK> If the software RoCE device is used, ibdev->dma_device is a null pointer. As a result, the problem occurs. Null pointer detection is added to prevent problems.
(CVE-2025-39857)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39857
https://ubuntu.com/security/CVE-2025-39857

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39857

Plugin Information
Published: 2025/09/19, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265457 - Linux Distros Unpatched Vulnerability : CVE-2025-39858
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring Replace NULL check with IS_ERR() check after calling page_pool_create() since this function returns error pointers (ERR_PTR). Using NULL check could lead to invalid pointer dereference. (CVE-2025-39858)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39858
https://ubuntu.com/security/CVE-2025-39858

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39858

Plugin Information
Published: 2025/09/19, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265466 - Linux Distros Unpatched Vulnerability : CVE-2025-39865
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tee: fix NULL pointer dereference in tee_shm_put tee_shm_put have NULL pointer dereference:
__optee_disable_shm_cache --> shm = reg_pair_to_ptr(...);//shm maybe return NULL tee_shm_free(shm); -->
tee_shm_put(shm);//crash Add check in tee_shm_put to fix it. panic log: Unable to handle kernel paging request at virtual address 0000000000100cca Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000002049d07000 [0000000000100cca] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP CPU: 2 PID: 14442 Comm: systemd-sleep Tainted: P OE ------- ---- 6.6.0-39-generic #38 Source Version:
938b255f6cb8817c95b0dd5c8c2944acfce94b07 Hardware name: greatwall GW-001Y1A-FTH, BIOS Great Wall BIOS V3.0 10/26/2022 pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : tee_shm_put+0x24/0x188 lr : tee_shm_free+0x14/0x28 sp : ffff001f98f9faf0 x29: ffff001f98f9faf0 x28: ffff0020df543cc0 x27:
0000000000000000 x26: ffff001f811344a0 x25: ffff8000818dac00 x24: ffff800082d8d048 x23: ffff001f850fcd18 x22: 0000000000000001 x21: ffff001f98f9fb88 x20: ffff001f83e76218 x19: ffff001f83e761e0 x18:
000000000000ffff x17: 303a30303a303030 x16: 0000000000000000 x15: 0000000000000003 x14: 0000000000000001 x13: 0000000000000000 x12: 0101010101010101 x11: 0000000000000001 x10: 0000000000000001 x9 :
ffff800080e08d0c x8 : ffff001f98f9fb88 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffff001f83e761e0 x1 : 00000000ffff001f x0 :
0000000000100cca Call trace: tee_shm_put+0x24/0x188 tee_shm_free+0x14/0x28
__optee_disable_shm_cache+0xa8/0x108 optee_shutdown+0x28/0x38 platform_shutdown+0x28/0x40 device_shutdown+0x144/0x2b0 kernel_power_off+0x3c/0x80 hibernate+0x35c/0x388 state_store+0x64/0x80 kobj_attr_store+0x14/0x28 sysfs_kf_write+0x48/0x60 kernfs_fop_write_iter+0x128/0x1c0 vfs_write+0x270/0x370 ksys_write+0x6c/0x100 __arm64_sys_write+0x20/0x30 invoke_syscall+0x4c/0x120 el0_svc_common.constprop.0+0x44/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x24/0x88 el0t_64_sync_handler+0x134/0x150 el0t_64_sync+0x14c/0x15 (CVE-2025-39865)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39865
https://ubuntu.com/security/CVE-2025-39865

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39865

Plugin Information
Published: 2025/09/19, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265867 - Linux Distros Unpatched Vulnerability : CVE-2025-39875
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- igb: Fix NULL pointer dereference in ethtool loopback test The igb driver currently causes a NULL pointer dereference when executing the ethtool loopback test. This occurs because there is no associated q_vector for the test ring when it is set up, as interrupts are typically not added to the test rings. Since commit 5ef44b3cb43b removed the napi_id assignment in __xdp_rxq_info_reg(), there is no longer a need to pass a napi_id to it. Therefore, simply use 0 as the last parameter. (CVE-2025-39875)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39875
https://ubuntu.com/security/CVE-2025-39875

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39875

Plugin Information
Published: 2025/09/25, Modified: 2025/11/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265877 - Linux Distros Unpatched Vulnerability : CVE-2025-39886
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() Currently, calling bpf_map_kmalloc_node() from __bpf_async_init() can cause various locking issues; see the following stack trace (edited for style) as one example: ... [10.011566] do_raw_spin_lock.cold [10.011570] try_to_wake_up (5) double-acquiring the same [10.011575] kick_pool rq_lock, causing a hardlockup [10.011579] __queue_work [10.011582] queue_work_on [10.011585] kernfs_notify [10.011589] cgroup_file_notify [10.011593] try_charge_memcg (4) memcg accounting raises an [10.011597] obj_cgroup_charge_pages MEMCG_MAX event [10.011599] obj_cgroup_charge_account [10.011600] __memcg_slab_post_alloc_hook [10.011603]
__kmalloc_node_noprof ... [10.011611] bpf_map_kmalloc_node [10.011612] __bpf_async_init [10.011615] bpf_timer_init (3) BPF calls bpf_timer_init() [10.011617] bpf_prog_xxxxxxxxxxxxxxxx_fcg_runnable [10.011619] bpf__sched_ext_ops_runnable [10.011620] enqueue_task_scx (2) BPF runs with rq_lock held [10.011622] enqueue_task [10.011626] ttwu_do_activate [10.011629] sched_ttwu_pending (1) grabs rq_lock ...
The above was reproduced on bpf-next (b338cf849ec8) by modifying ./tools/sched_ext/scx_flatcg.bpf.c to call bpf_timer_init() during ops.runnable(), and hacking the memcg accounting code a bit to make a bpf_timer_init() call more likely to raise an MEMCG_MAX event. We have also run into other similar variants (both internally and on bpf-next), including double-acquiring cgroup_file_kn_lock, the same worker_pool::lock, etc. As suggested by Shakeel, fix this by using __GFP_HIGH instead of GFP_ATOMIC in
__bpf_async_init(), so that e.g. if try_charge_memcg() raises an MEMCG_MAX event, we call
__memcg_memory_event() with @allow_spinning=false and avoid calling cgroup_file_notify() there. Depends on mm patch memcg: skip cgroup_file_notify if spinning is not allowed:
https://lore.kernel.org/bpf/20250905201606.66198-1-shakeel.butt@linux.dev/ v0 approach s/bpf_map_kmalloc_node/bpf_mem_alloc/ https://lore.kernel.org/bpf/20250905061919.439648-1-yepeilin@google.com/ v1 approach:
https://lore.kernel.org/bpf/20250905234547.862249-1-yepeilin@google.com/ (CVE-2025-39886)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39886
https://security-tracker.debian.org/tracker/CVE-2025-39886
https://ubuntu.com/security/CVE-2025-39886

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39886

Plugin Information
Published: 2025/09/25, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265883 - Linux Distros Unpatched Vulnerability : CVE-2025-39887
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Fix null-ptr-deref in bitmap_parselist() A crash was observed with the following output: BUG: kernel NULL pointer dereference, address: 0000000000000010 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 2 UID: 0 PID: 92 Comm: osnoise_cpus Not tainted 6.17.0-rc4-00201-gd69eb204c255 #138 PREEMPT(voluntary) RIP: 0010:bitmap_parselist+0x53/0x3e0 Call Trace: <TASK> osnoise_cpus_write+0x7a/0x190 vfs_write+0xf8/0x410 ? do_sys_openat2+0x88/0xd0 ksys_write+0x60/0xd0 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> This issue can be reproduced by below code: fd=open(/sys/kernel/debug/tracing/osnoise/cpus, O_WRONLY); write(fd, 0-2, 0); When user pass 'count=0' to osnoise_cpus_write(), kmalloc() will return ZERO_SIZE_PTR (16) and cpulist_parse() treat it as a normal value, which trigger the null pointer dereference. Add check for the parameter 'count'. (CVE-2025-39887)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39887
https://ubuntu.com/security/CVE-2025-39887

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39887

Plugin Information
Published: 2025/09/25, Modified: 2025/11/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
266030 - Linux Distros Unpatched Vulnerability : CVE-2025-39889
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: l2cap: Check encryption key size on incoming connection This is required for passing GAP/SEC/SEM/BI-04-C PTS test case: Security Mode 4 Level 4, Responder - Invalid Encryption Key Size - 128 bit This tests the security key with size from 1 to 15 bytes while the Security Mode 4 Level 4 requests 16 bytes key size. Currently PTS fails with the following logs: - expected:Connection Response: Code: [3 (0x03)] Code Identifier: (lt)WildCard: Exists(gt) Length: [8 (0x0008)] Destination CID: (lt)WildCard:
Exists(gt) Source CID: [64 (0x0040)] Result: [3 (0x0003)] Connection refused - Security block Status:
(lt)WildCard: Exists(gt), but received:Connection Response: Code: [3 (0x03)] Code Identifier: [1 (0x01)] Length: [8 (0x0008)] Destination CID: [64 (0x0040)] Source CID: [64 (0x0040)] Result: [0 (0x0000)] Connection Successful Status: [0 (0x0000)] No further information available And HCI logs: < HCI Command:
Read Encrypti.. (0x05|0x0008) plen 2 Handle: 14 Address: 00:1B:DC:F2:24:10 (Vencer Co., Ltd.) > HCI Event:
Command Complete (0x0e) plen 7 Read Encryption Key Size (0x05|0x0008) ncmd 1 Status: Success (0x00) Handle: 14 Address: 00:1B:DC:F2:24:10 (Vencer Co., Ltd.) Key size: 7 > ACL Data RX: Handle 14 flags 0x02 dlen 12 L2CAP: Connection Request (0x02) ident 1 len 4 PSM: 4097 (0x1001) Source CID: 64 < ACL Data TX:
Handle 14 flags 0x00 dlen 16 L2CAP: Connection Response (0x03) ident 1 len 8 Destination CID: 64 Source CID: 64 Result: Connection successful (0x0000) Status: No further information available (0x0000) (CVE-2025-39889)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39889
https://ubuntu.com/security/CVE-2025-39889

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39889

Plugin Information
Published: 2025/09/29, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
266077 - Linux Distros Unpatched Vulnerability : CVE-2025-39890
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event Currently, in ath12k_service_ready_ext_event(), svc_rdy_ext.mac_phy_caps is not freed in the failure case, causing a memory leak. The following trace is observed in kmemleak: unreferenced object 0xffff8b3eb5789c00 (size 1024): comm softirq, pid 0, jiffies 4294942577 hex dump (first 32 bytes): 00 00 00 00 01 00 00 00 00 00 00 00 7b 00 00 10 ............{... 01 00 00 00 00 00 00 00 01 00 00 00 1f 38 00 00 .............8..
backtrace (crc 44e1c357): __kmalloc_noprof+0x30b/0x410 ath12k_wmi_mac_phy_caps_parse+0x84/0x100 [ath12k] ath12k_wmi_tlv_iter+0x5e/0x140 [ath12k] ath12k_wmi_svc_rdy_ext_parse+0x308/0x4c0 [ath12k] ath12k_wmi_tlv_iter+0x5e/0x140 [ath12k] ath12k_service_ready_ext_event.isra.0+0x44/0xd0 [ath12k] ath12k_wmi_op_rx+0x2eb/0xd70 [ath12k] ath12k_htc_rx_completion_handler+0x1f4/0x330 [ath12k] ath12k_ce_recv_process_cb+0x218/0x300 [ath12k] ath12k_pci_ce_workqueue+0x1b/0x30 [ath12k] process_one_work+0x219/0x680 bh_worker+0x198/0x1f0 tasklet_action+0x13/0x30 handle_softirqs+0xca/0x460
__irq_exit_rcu+0xbe/0x110 irq_exit_rcu+0x9/0x30 Free svc_rdy_ext.mac_phy_caps in the error case to fix this memory leak. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 (CVE-2025-39890)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39890
https://ubuntu.com/security/CVE-2025-39890

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39890

Plugin Information
Published: 2025/09/29, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269256 - Linux Distros Unpatched Vulnerability : CVE-2025-39891
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: mwifiex: Initialize the chan_stats array to zero The adapter->chan_stats[] array is initialized in mwifiex_init_channel_scan_gap() with vmalloc(), which doesn't zero out memory. The array is filled in mwifiex_update_chan_statistics() and then the user can query the data in mwifiex_cfg80211_dump_survey().
There are two potential issues here. What if the user calls mwifiex_cfg80211_dump_survey() before the data has been filled in. Also the mwifiex_update_chan_statistics() function doesn't necessarily initialize the whole array. Since the array was not initialized at the start that could result in an information leak.
Also this array is pretty small. It's a maximum of 900 bytes so it's more appropriate to use kcalloc() instead vmalloc(). (CVE-2025-39891)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39891
https://ubuntu.com/security/CVE-2025-39891

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39891

Plugin Information
Published: 2025/10/07, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269669 - Linux Distros Unpatched Vulnerability : CVE-2025-39894
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm When send a broadcast packet to a tap device, which was added to a bridge, br_nf_local_in() is called to confirm the conntrack. If another conntrack with the same hash value is added to the hash table, which can be triggered by a normal packet to a non-bridge device, the below warning may happen. ------------[ cut here ]------------ WARNING: CPU: 1 PID: 96 at net/bridge/br_netfilter_hooks.c:632 br_nf_local_in+0x168/0x200 CPU: 1 UID: 0 PID: 96 Comm: tap_send Not tainted 6.17.0-rc2-dirty #44 PREEMPT(voluntary) RIP:
0010:br_nf_local_in+0x168/0x200 Call Trace: <TASK> nf_hook_slow+0x3e/0xf0 br_pass_frame_up+0x103/0x180 br_handle_frame_finish+0x2de/0x5b0 br_nf_hook_thresh+0xc0/0x120 br_nf_pre_routing_finish+0x168/0x3a0 br_nf_pre_routing+0x237/0x5e0 br_handle_frame+0x1ec/0x3c0 __netif_receive_skb_core+0x225/0x1210
__netif_receive_skb_one_core+0x37/0xa0 netif_receive_skb+0x36/0x160 tun_get_user+0xa54/0x10c0 tun_chr_write_iter+0x65/0xb0 vfs_write+0x305/0x410 ksys_write+0x60/0xd0 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> ---[ end trace 0000000000000000 ]--- To solve the hash conflict, nf_ct_resolve_clash() try to merge the conntracks, and update skb->_nfct. However, br_nf_local_in() still use the old ct from local variable 'nfct' after confirm(), which leads to this warning. If confirm() does not insert the conntrack entry and return NF_DROP, the warning may also occur.
There is no need to reserve the WARN_ON_ONCE, just remove it. (CVE-2025-39894)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39894
https://ubuntu.com/security/CVE-2025-39894

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39894

Plugin Information
Published: 2025/10/08, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269254 - Linux Distros Unpatched Vulnerability : CVE-2025-39902
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() object_err() reports details of an object for further debugging, such as the freelist pointer, redzone, etc. However, if the pointer is invalid, attempting to access object metadata can lead to a crash since it does not point to a valid object. One known path to the crash is when alloc_consistency_checks() determines the pointer to the allocated object is invalid because of a freelist corruption, and calls object_err() to report it. The debug code should report and handle the corruption gracefully and not crash in the process. In case the pointer is NULL or check_valid_pointer() returns false for the pointer, only print the pointer value and skip accessing metadata. (CVE-2025-39902)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39902
https://ubuntu.com/security/CVE-2025-39902

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39902

Plugin Information
Published: 2025/10/07, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269648 - Linux Distros Unpatched Vulnerability : CVE-2025-39913
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. syzbot reported the splat below. [0] The repro does the following: 1. Load a sk_msg prog that calls bpf_msg_cork_bytes(msg, cork_bytes) 2. Attach the prog to a SOCKMAP 3. Add a socket to the SOCKMAP 4. Activate fault injection 5.
Send data less than cork_bytes At 5., the data is carried over to the next sendmsg() as it is smaller than the cork_bytes specified by bpf_msg_cork_bytes(). Then, tcp_bpf_send_verdict() tries to allocate psock->cork to hold the data, but this fails silently due to fault injection + __GFP_NOWARN. If the allocation fails, we need to revert the sk->sk_forward_alloc change done by sk_msg_alloc(). Let's call sk_msg_free() when tcp_bpf_send_verdict fails to allocate psock->cork. The *copied also needs to be updated such that a proper error can be returned to the caller, sendmsg. It fails to allocate psock->cork.
Nothing has been corked so far, so this patch simply sets *copied to 0. [0]: WARNING:
net/ipv4/af_inet.c:156 at inet_sock_destruct+0x623/0x730 net/ipv4/af_inet.c:156, CPU#1: syz-executor/5983 Modules linked in: CPU: 1 UID: 0 PID: 5983 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP:
0010:inet_sock_destruct+0x623/0x730 net/ipv4/af_inet.c:156 Code: 0f 0b 90 e9 62 fe ff ff e8 7a db b5 f7 90 0f 0b 90 e9 95 fe ff ff e8 6c db b5 f7 90 0f 0b 90 e9 bb fe ff ff e8 5e db b5 f7 90 <0f> 0b 90 e9 e1 fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 9f fc RSP: 0018:ffffc90000a08b48 EFLAGS: 00010246 RAX:
ffffffff8a09d0b2 RBX: dffffc0000000000 RCX: ffff888024a23c80 RDX: 0000000000000100 RSI: 0000000000000fff RDI: 0000000000000000 RBP: 0000000000000fff R08: ffff88807e07c627 R09: 1ffff1100fc0f8c4 R10:
dffffc0000000000 R11: ffffed100fc0f8c5 R12: ffff88807e07c380 R13: dffffc0000000000 R14: ffff88807e07c60c R15: 1ffff1100fc0f872 FS: 00005555604c4500(0000) GS:ffff888125af1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005555604df5c8 CR3: 0000000032b06000 CR4: 00000000003526f0 Call Trace: <IRQ> __sk_destruct+0x86/0x660 net/core/sock.c:2339 rcu_do_batch kernel/rcu/tree.c:2605 [inline] rcu_core+0xca8/0x1770 kernel/rcu/tree.c:2861 handle_softirqs+0x286/0x870 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline] invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1052 </IRQ> (CVE-2025-39913)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39913
https://security-tracker.debian.org/tracker/CVE-2025-39913
https://ubuntu.com/security/CVE-2025-39913

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.6 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
CVSS v3.0 Temporal Score
6.3 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
5.5
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-39913

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269681 - Linux Distros Unpatched Vulnerability : CVE-2025-39916
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() When creating a new scheme of DAMON_RECLAIM, the calculation of 'min_age_region' uses 'aggr_interval' as the divisor, which may lead to division-by-zero errors. Fix it by directly returning -EINVAL when such a case occurs. (CVE-2025-39916)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39916
https://ubuntu.com/security/CVE-2025-39916

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39916

Plugin Information
Published: 2025/10/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269670 - Linux Distros Unpatched Vulnerability : CVE-2025-39926
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- genetlink: fix genl_bind() invoking bind() after -EPERM Per family bind/unbind callbacks were introduced to allow families to track multicast group consumer presence, e.g. to start or stop producing events depending on listeners. However, in genl_bind() the bind() callback was invoked even if capability checks failed and ret was set to -EPERM. This means that callbacks could run on behalf of unauthorized callers while the syscall still returned failure to user space. Fix this by only invoking bind() after if (ret) break; check i.e. after permission checks have succeeded. (CVE-2025-39926)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39926
https://ubuntu.com/security/CVE-2025-39926

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39926

Plugin Information
Published: 2025/10/08, Modified: 2025/11/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269253 - Linux Distros Unpatched Vulnerability : CVE-2025-39927
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ceph: fix race condition validating r_parent before applying state Add validation to ensure the cached parent directory inode matches the directory info in MDS replies. This prevents client-side race conditions where concurrent operations (e.g. rename) cause r_parent to become stale between request initiation and reply processing, which could lead to applying state changes to incorrect directory inodes.
[ idryomov: folded a kerneldoc fixup and a follow-up fix from Alex to move CEPH_CAP_PIN reference when r_parent is updated: When the parent directory lock is not held, req->r_parent can become stale and is updated to point to the correct inode. However, the associated CEPH_CAP_PIN reference was not being adjusted. The CEPH_CAP_PIN is a reference on an inode that is tracked for accounting purposes. Moving this pin is important to keep the accounting balanced. When the pin was not moved from the old parent to the new one, it created two problems: The reference on the old, stale parent was never released, causing a reference leak. A reference for the new parent was never acquired, creating the risk of a reference underflow later in ceph_mdsc_release_request(). This patch corrects the logic by releasing the pin from the old parent and acquiring it for the new parent when r_parent is switched. This ensures reference accounting stays balanced. ] (CVE-2025-39927)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39927
https://security-tracker.debian.org/tracker/CVE-2025-39927
https://ubuntu.com/security/CVE-2025-39927

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.1
EPSS Score
0.0002
CVSS v2.0 Base Score
3.3 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
2.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39927

Plugin Information
Published: 2025/10/07, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269452 - Linux Distros Unpatched Vulnerability : CVE-2025-39929
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path During tests of another unrelated patch I was able to trigger this error: Objects remaining on __kmem_cache_shutdown() (CVE-2025-39929)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39929
https://security-tracker.debian.org/tracker/CVE-2025-39929
https://ubuntu.com/security/CVE-2025-39929

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39929

Plugin Information
Published: 2025/10/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269453 - Linux Distros Unpatched Vulnerability : CVE-2025-39931
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg If an error causes af_alg_sendmsg to abort, ctx->merge may contain a garbage value from the previous loop. This may then trigger a crash on the next entry into af_alg_sendmsg when it attempts to do a merge that can't be done. Fix this by setting ctx->merge to zero near the start of the loop. (CVE-2025-39931)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39931
https://security-tracker.debian.org/tracker/CVE-2025-39931
https://ubuntu.com/security/CVE-2025-39931

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39931

Plugin Information
Published: 2025/10/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269459 - Linux Distros Unpatched Vulnerability : CVE-2025-39932
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) In smbd_destroy() we may destroy the memory so we better wait until post_send_credits_work is no longer pending and will never be started again. I actually just hit the case using rxe: WARNING: CPU: 0 PID: 138 at drivers/infiniband/sw/rxe/rxe_verbs.c:1032 rxe_post_recv+0x1ee/0x480 [rdma_rxe] ... [ 5305.686979] [ T138] smbd_post_recv+0x445/0xc10 [cifs] [ 5305.687135] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687149] [ T138] ? __kasan_check_write+0x14/0x30 [ 5305.687185] [ T138] ?
__pfx_smbd_post_recv+0x10/0x10 [cifs] [ 5305.687329] [ T138] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 5305.687356] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687368] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687378] [ T138] ? _raw_spin_unlock_irqrestore+0x11/0x60 [ 5305.687389] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687399] [ T138] ? get_receive_buffer+0x168/0x210 [cifs] [ 5305.687555] [ T138] smbd_post_send_credits+0x382/0x4b0 [cifs] [ 5305.687701] [ T138] ? __pfx_smbd_post_send_credits+0x10/0x10 [cifs] [ 5305.687855] [ T138] ?
__pfx___schedule+0x10/0x10 [ 5305.687865] [ T138] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 5305.687875] [ T138] ? queue_delayed_work_on+0x8e/0xa0 [ 5305.687889] [ T138] process_one_work+0x629/0xf80 [ 5305.687908] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687917] [ T138] ? __kasan_check_write+0x14/0x30 [ 5305.687933] [ T138] worker_thread+0x87f/0x1570 ... It means rxe_post_recv was called after rdma_destroy_qp(). This happened because put_receive_buffer() was triggered by ib_drain_qp() and called:
queue_work(info->workqueue, &info->post_send_credits_work); (CVE-2025-39932)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39932
https://security-tracker.debian.org/tracker/CVE-2025-39932
https://ubuntu.com/security/CVE-2025-39932

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39932

Plugin Information
Published: 2025/10/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269442 - Linux Distros Unpatched Vulnerability : CVE-2025-39933
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smb: client: let recv_done verify data_offset, data_length and remaining_data_length This is inspired by the related server fixes. (CVE-2025-39933)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39933
https://security-tracker.debian.org/tracker/CVE-2025-39933
https://ubuntu.com/security/CVE-2025-39933

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39933

Plugin Information
Published: 2025/10/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269441 - Linux Distros Unpatched Vulnerability : CVE-2025-39937
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer Since commit 7d5e9737efda (net:
rfkill: gpio: get the name and type from device property) rfkill_find_type() gets called with the possibly uninitialized const char *type_name; local variable. On x86 systems when rfkill-gpio binds to a BCM4752 or LNV4752 acpi_device, the rfkill->type is set based on the ACPI acpi_device_id: rfkill->type = (unsigned)id->driver_data; and there is no type property so device_property_read_string() will fail and leave type_name uninitialized, leading to a potential crash. rfkill_find_type() does accept a NULL pointer, fix the potential crash by initializing type_name to NULL. Note likely sofar this has not been caught because: 1. Not many x86 machines actually have a BCM4752/LNV4752 acpi_device 2. The stack happened to contain NULL where type_name is stored (CVE-2025-39937)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39937
https://ubuntu.com/security/CVE-2025-39937

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39937

Plugin Information
Published: 2025/10/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269449 - Linux Distros Unpatched Vulnerability : CVE-2025-39940
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dm-stripe: fix a possible integer overflow There's a possible integer overflow in stripe_io_hints if we have too large chunk size. Test if the overflow happened, and if it did, don't set limits->io_min and limits->io_opt; (CVE-2025-39940)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39940
https://security-tracker.debian.org/tracker/CVE-2025-39940
https://ubuntu.com/security/CVE-2025-39940

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H)
CVSS v3.0 Temporal Score
5.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.2
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39940

Plugin Information
Published: 2025/10/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269457 - Linux Distros Unpatched Vulnerability : CVE-2025-39946
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tls: make sure to abort the stream if headers are bogus Normally we wait for the socket to buffer up the whole record before we service it. If the socket has a tiny buffer, however, we read out the data sooner, to prevent connection stalls. Make sure that we abort the connection when we find out late that the record is actually invalid. Retrying the parsing is fine in itself but since we copy some more data each time before we parse we can overflow the allocated skb space. Constructing a scenario in which we're under pressure without enough data in the socket to parse the length upfront is quite hard. syzbot figured out a way to do this by serving us the header in small OOB sends, and then filling in the recvbuf with a large normal send. Make sure that tls_rx_msg_size() aborts strp, if we reach an invalid record there's really no way to recover. (CVE-2025-39946)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39946
https://ubuntu.com/security/CVE-2025-39946

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.4 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.5
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39946

Plugin Information
Published: 2025/10/08, Modified: 2025/12/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269450 - Linux Distros Unpatched Vulnerability : CVE-2025-39947
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mlx5e: Harden uplink netdev access against device unbind The function mlx5_uplink_netdev_get() gets the uplink netdevice pointer from mdev->mlx5e_res.uplink_netdev. However, the netdevice can be removed and its pointer cleared when unbound from the mlx5_core.eth driver. This results in a NULL pointer, causing a kernel panic. BUG: unable to handle page fault for address: 0000000000001300 at RIP:
0010:mlx5e_vport_rep_load+0x22a/0x270 [mlx5_core] Call Trace: <TASK> mlx5_esw_offloads_rep_load+0x68/0xe0 [mlx5_core] esw_offloads_enable+0x593/0x910 [mlx5_core] mlx5_eswitch_enable_locked+0x341/0x420 [mlx5_core] mlx5_devlink_eswitch_mode_set+0x17e/0x3a0 [mlx5_core] devlink_nl_eswitch_set_doit+0x60/0xd0 genl_family_rcv_msg_doit+0xe0/0x130 genl_rcv_msg+0x183/0x290 netlink_rcv_skb+0x4b/0xf0 genl_rcv+0x24/0x40 netlink_unicast+0x255/0x380 netlink_sendmsg+0x1f3/0x420 __sock_sendmsg+0x38/0x60 __sys_sendto+0x119/0x180 do_syscall_64+0x53/0x1d0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Ensure the pointer is valid before use by checking it for NULL. If it is valid, immediately call netdev_hold() to take a reference, and preventing the netdevice from being freed while it is in use. (CVE-2025-39947)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39947
https://security-tracker.debian.org/tracker/CVE-2025-39947
https://ubuntu.com/security/CVE-2025-39947

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39947

Plugin Information
Published: 2025/10/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269447 - Linux Distros Unpatched Vulnerability : CVE-2025-39949
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- qed: Don't collect too many protection override GRC elements In the protection override dump path, the firmware can return far too many GRC elements, resulting in attempting to write past the end of the previously-kmalloc'ed dump buffer. This will result in a kernel panic with reason: BUG: unable to handle kernel paging request at ADDRESS where ADDRESS is just past the end of the protection override dump buffer. The start address of the buffer is:
p_hwfn->cdev->dbg_features[DBG_FEATURE_PROTECTION_OVERRIDE].dump_buf and the size of the buffer is buf_size in the same data structure. The panic can be arrived at from either the qede Ethernet driver path: [exception RIP: qed_grc_dump_addr_range+0x108] qed_protection_override_dump at ffffffffc02662ed [qed] qed_dbg_protection_override_dump at ffffffffc0267792 [qed] qed_dbg_feature at ffffffffc026aa8f [qed] qed_dbg_all_data at ffffffffc026b211 [qed] qed_fw_fatal_reporter_dump at ffffffffc027298a [qed] devlink_health_do_dump at ffffffff82497f61 devlink_health_report at ffffffff8249cf29 qed_report_fatal_error at ffffffffc0272baf [qed] qede_sp_task at ffffffffc045ed32 [qede] process_one_work at ffffffff81d19783 or the qedf storage driver path: [exception RIP: qed_grc_dump_addr_range+0x108] qed_protection_override_dump at ffffffffc068b2ed [qed] qed_dbg_protection_override_dump at ffffffffc068c792 [qed] qed_dbg_feature at ffffffffc068fa8f [qed] qed_dbg_all_data at ffffffffc0690211 [qed] qed_fw_fatal_reporter_dump at ffffffffc069798a [qed] devlink_health_do_dump at ffffffff8aa95e51 devlink_health_report at ffffffff8aa9ae19 qed_report_fatal_error at ffffffffc0697baf [qed] qed_hw_err_notify at ffffffffc06d32d7 [qed] qed_spq_post at ffffffffc06b1011 [qed] qed_fcoe_destroy_conn at ffffffffc06b2e91 [qed] qedf_cleanup_fcport at ffffffffc05e7597 [qedf] qedf_rport_event_handler at ffffffffc05e7bf7 [qedf] fc_rport_work at ffffffffc02da715 [libfc] process_one_work at ffffffff8a319663 Resolve this by clamping the firmware's return value to the maximum number of legal elements the firmware should return. (CVE-2025-39949)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39949
https://ubuntu.com/security/CVE-2025-39949

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39949

Plugin Information
Published: 2025/10/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269445 - Linux Distros Unpatched Vulnerability : CVE-2025-39953
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cgroup: split cgroup_destroy_wq into 3 workqueues A hung task can occur during [1] LTP cgroup testing when repeatedly mounting/unmounting perf_event and net_prio controllers with systemd.unified_cgroup_hierarchy=1. The hang manifests in cgroup_lock_and_drain_offline() during root destruction. Related case: cgroup_fj_function_perf_event cgroup_fj_function.sh perf_event cgroup_fj_function_net_prio cgroup_fj_function.sh net_prio Call Trace:
cgroup_lock_and_drain_offline+0x14c/0x1e8 cgroup_destroy_root+0x3c/0x2c0 css_free_rwork_fn+0x248/0x338 process_one_work+0x16c/0x3b8 worker_thread+0x22c/0x3b0 kthread+0xec/0x100 ret_from_fork+0x10/0x20 Root Cause: CPU0 CPU1 mount perf_event umount net_prio cgroup1_get_tree cgroup_kill_sb rebind_subsystems // root destruction enqueues // cgroup_destroy_wq // kill all perf_event css // one perf_event css A is dying // css A offline enqueues cgroup_destroy_wq // root destruction will be executed first css_free_rwork_fn cgroup_destroy_root cgroup_lock_and_drain_offline // some perf descendants are dying // cgroup_destroy_wq max_active = 1 // waiting for css A to die Problem scenario: 1. CPU0 mounts perf_event (rebind_subsystems) 2. CPU1 unmounts net_prio (cgroup_kill_sb), queuing root destruction work 3. A dying perf_event CSS gets queued for offline after root destruction 4. Root destruction waits for offline completion, but offline work is blocked behind root destruction in cgroup_destroy_wq (max_active=1) Solution: Split cgroup_destroy_wq into three dedicated workqueues: cgroup_offline_wq Handles CSS offline operations cgroup_release_wq Manages resource release cgroup_free_wq Performs final memory deallocation This separation eliminates blocking in the CSS free path while waiting for offline operations to complete. [1] https://github.com/linux-test-project/ltp/blob/master/runtest/controllers (CVE-2025-39953)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39953
https://ubuntu.com/security/CVE-2025-39953

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39953

Plugin Information
Published: 2025/10/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
270204 - Linux Distros Unpatched Vulnerability : CVE-2025-39956
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- igc: don't fail igc_probe() on LED setup error When igc_led_setup() fails, igc_probe() fails and triggers kernel panic in free_netdev() since unregister_netdev() is not called. [1] This behavior can be tested using fault-injection framework, especially the failslab feature. [2] Since LED support is not mandatory, treat LED setup failures as non-fatal and continue probe with a warning message, consequently avoiding the kernel panic. [1] kernel BUG at net/core/dev.c:12047! Oops: invalid opcode: 0000 [#1] SMP NOPTI CPU: 0 UID: 0 PID: 937 Comm: repro-igc-led-e Not tainted 6.17.0-rc4-enjuk-tnguy-00865-gc4940196ab02 #64 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:free_netdev+0x278/0x2b0 [...] Call Trace: <TASK> igc_probe+0x370/0x910 local_pci_probe+0x3a/0x80 pci_device_probe+0xd1/0x200 [...] [2] #!/bin/bash -ex FAILSLAB_PATH=/sys/kernel/debug/failslab/ DEVICE=0000:00:05.0 START_ADDR=$(grep igc_led_setup /proc/kallsyms \ | awk '{printf(0x%s, $1)}') END_ADDR=$(printf 0x%x $((START_ADDR + 0x100))) echo $START_ADDR > $FAILSLAB_PATH/require-start echo $END_ADDR > $FAILSLAB_PATH/require-end echo 1 >
$FAILSLAB_PATH/times echo 100 > $FAILSLAB_PATH/probability echo N > $FAILSLAB_PATH/ignore-gfp-wait echo $DEVICE > /sys/bus/pci/drivers/igc/bind (CVE-2025-39956)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39956
https://ubuntu.com/security/CVE-2025-39956

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39956

Plugin Information
Published: 2025/10/13, Modified: 2025/11/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
270207 - Linux Distros Unpatched Vulnerability : CVE-2025-39957
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: mac80211: increase scan_ies_len for S1G Currently the S1G capability element is not taken into account for the scan_ies_len, which leads to a buffer length validation failure in ieee80211_prep_hw_scan() and subsequent WARN in __ieee80211_start_scan(). This prevents hw scanning from functioning. To fix ensure we accommodate for the S1G capability length. (CVE-2025-39957)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39957
https://ubuntu.com/security/CVE-2025-39957

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
4.0 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39957

Plugin Information
Published: 2025/10/13, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
270206 - Linux Distros Unpatched Vulnerability : CVE-2025-39958
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- iommu/s390: Make attach succeed when the device was surprise removed When a PCI device is removed with surprise hotplug, there may still be attempts to attach the device to the default domain as part of tear down via (__iommu_release_dma_ownership()), or because the removal happens during probe (__iommu_probe_device()). In both cases zpci_register_ioat() fails with a cc value indicating that the device handle is invalid. This is because the device is no longer part of the instance as far as the hypervisor is concerned. Currently this leads to an error return and s390_iommu_attach_device() fails.
This triggers the WARN_ON() in __iommu_group_set_domain_nofail() because attaching to the default domain must never fail. With the device fenced by the hypervisor no DMAs to or from memory are possible and the IOMMU translations have no effect. Proceed as if the registration was successful and let the hotplug event handling clean up the device. This is similar to how devices in the error state are handled since commit 59bbf596791b (iommu/s390: Make attach succeed even if the device is in error state) except that for removal the domain will not be registered later. This approach was also previously discussed at the link.
Handle both cases, error state and removal, in a helper which checks if the error needs to be propagated or ignored. Avoid magic number condition codes by using the pre-existing, but never used, defines for PCI load/store condition codes and rename them to reflect that they apply to all PCI instructions.
(CVE-2025-39958)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39958
https://security-tracker.debian.org/tracker/CVE-2025-39958
https://ubuntu.com/security/CVE-2025-39958

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.0 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39958

Plugin Information
Published: 2025/10/13, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271155 - Linux Distros Unpatched Vulnerability : CVE-2025-39959
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp: Fix incorrect retrival of acp_chip_info Use dev_get_drvdata(dev->parent) instead of dev_get_platdata(dev) to correctly obtain acp_chip_info members in the acp I2S driver. Previously, some members were not updated properly due to incorrect data access, which could potentially lead to null pointer dereferences. This issue was missed in the earlier commit (ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot), which only addressed set_tdm_slot(). This change ensures that all relevant functions correctly retrieve acp_chip_info, preventing further null pointer dereference issues. (CVE-2025-39959)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39959
https://ubuntu.com/security/CVE-2025-39959

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39959

Plugin Information
Published: 2025/10/22, Modified: 2025/11/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
270208 - Linux Distros Unpatched Vulnerability : CVE-2025-39961
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- iommu/amd/pgtbl: Fix possible race while increase page table level The AMD IOMMU host page table implementation supports dynamic page table levels (up to 6 levels), starting with a 3-level configuration that expands based on IOVA address. The kernel maintains a root pointer and current page table level to enable proper page table walks in alloc_pte()/fetch_pte() operations. The IOMMU IOVA allocator initially starts with 32-bit address and onces its exhuasted it switches to 64-bit address (max address is determined based on IOMMU and device DMA capability). To support larger IOVA, AMD IOMMU driver increases page table level. But in unmap path (iommu_v1_unmap_pages()), fetch_pte() reads pgtable->[root/mode] without lock. So its possible that in exteme corner case, when increase_address_space() is updating pgtable->[root/mode], fetch_pte() reads wrong page table level (pgtable->mode). It does compare the value with level encoded in page table and returns NULL. This will result is iommu_unmap ops to fail and upper layer may retry/log WARN_ON. CPU 0 CPU 1 ------ ------ map pages unmap pages alloc_pte() ->
increase_address_space() iommu_v1_unmap_pages() -> fetch_pte() pgtable->root = pte (new root value) READ pgtable->[mode/root] Reads new root, old mode Updates mode (pgtable->mode += 1) Since Page table level updates are infrequent and already synchronized with a spinlock, implement seqcount to enable lock-free read operations on the read path. (CVE-2025-39961)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39961
https://security-tracker.debian.org/tracker/CVE-2025-39961
https://ubuntu.com/security/CVE-2025-39961

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.8 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
CVSS v3.0 Temporal Score
5.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39961

Plugin Information
Published: 2025/10/13, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
270205 - Linux Distros Unpatched Vulnerability : CVE-2025-39963
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- io_uring: fix incorrect io_kiocb reference in io_link_skb In io_link_skb function, there is a bug where prev_notif is incorrectly assigned using 'nd' instead of 'prev_nd'. This causes the context validation check to compare the current notification with itself instead of comparing it with the previous notification. Fix by using the correct prev_nd parameter when obtaining prev_notif. (CVE-2025-39963)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39963
https://ubuntu.com/security/CVE-2025-39963

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39963

Plugin Information
Published: 2025/10/13, Modified: 2025/12/23
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
270221 - Linux Distros Unpatched Vulnerability : CVE-2025-39965
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI x->id.spi == 0 means no SPI assigned, but since commit 94f39804d891 (xfrm: Duplicate SPI Handling), we now create states and add them to the byspi list with this value. __xfrm_state_delete doesn't remove those states from the byspi list, since they shouldn't be there, and this shows up as a UAF the next time we go through the byspi list. (CVE-2025-39965)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39965
https://ubuntu.com/security/CVE-2025-39965

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.1
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.9 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-39965

Plugin Information
Published: 2025/10/14, Modified: 2025/11/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271531 - Linux Distros Unpatched Vulnerability : CVE-2025-39969
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- i40e: fix validation of VF state in get resources VF state I40E_VF_STATE_ACTIVE is not the only state in which VF is actually active so it should not be used to determine if a VF is allowed to obtain resources.
Use I40E_VF_STATE_RESOURCES_LOADED that is set only in i40e_vc_get_vf_resources_msg() and cleared during reset. (CVE-2025-39969)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39969
https://ubuntu.com/security/CVE-2025-39969

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39969

Plugin Information
Published: 2025/10/27, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271538 - Linux Distros Unpatched Vulnerability : CVE-2025-39970
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- i40e: fix input validation logic for action_meta Fix condition to check 'greater or equal' to prevent OOB dereference. (CVE-2025-39970)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39970
https://ubuntu.com/security/CVE-2025-39970

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39970

Plugin Information
Published: 2025/10/27, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271537 - Linux Distros Unpatched Vulnerability : CVE-2025-39980
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nexthop: Forbid FDB status change while nexthop is in a group The kernel forbids the creation of non-FDB nexthop groups with FDB nexthops: # ip nexthop add id 1 via 192.0.2.1 fdb # ip nexthop add id 2 group 1 Error: Non FDB nexthop group cannot have fdb nexthops. And vice versa: # ip nexthop add id 3 via 192.0.2.2 dev dummy1 # ip nexthop add id 4 group 3 fdb Error: FDB nexthop group can only have fdb nexthops. However, as long as no routes are pointing to a non-FDB nexthop group, the kernel allows changing the type of a nexthop from FDB to non-FDB and vice versa: # ip nexthop add id 5 via 192.0.2.2 dev dummy1 # ip nexthop add id 6 group 5 # ip nexthop replace id 5 via 192.0.2.2 fdb # echo $? 0 This configuration is invalid and can result in a NPD [1] since FDB nexthops are not associated with a nexthop device: # ip route add 198.51.100.1/32 nhid 6 # ping 198.51.100.1 Fix by preventing nexthop FDB status change while the nexthop is in a group: # ip nexthop add id 7 via 192.0.2.2 dev dummy1 # ip nexthop add id 8 group 7 # ip nexthop replace id 7 via 192.0.2.2 fdb Error: Cannot change nexthop FDB status while in a group. [1] BUG: kernel NULL pointer dereference, address: 00000000000003c0 [...] Oops: Oops: 0000 [#1] SMP CPU: 6 UID: 0 PID: 367 Comm: ping Not tainted 6.17.0-rc6-virtme-gb65678cacc03 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 RIP: 0010:fib_lookup_good_nhc+0x1e/0x80 [...] Call Trace: <TASK> fib_table_lookup+0x541/0x650 ip_route_output_key_hash_rcu+0x2ea/0x970 ip_route_output_key_hash+0x55/0x80 __ip4_datagram_connect+0x250/0x330 udp_connect+0x2b/0x60
__sys_connect+0x9c/0xd0 __x64_sys_connect+0x18/0x20 do_syscall_64+0xa4/0x2a0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 (CVE-2025-39980)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39980
https://ubuntu.com/security/CVE-2025-39980

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H)
CVSS v3.0 Temporal Score
5.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39980

Plugin Information
Published: 2025/10/27, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244032 - Linux Distros Unpatched Vulnerability : CVE-2025-39989
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- x86/mce: use is_copy_from_user() to determine copy-from-user context Patch series mm/hwpoison: Fix regressions in memory failure handling, v4. ## 1. What am I trying to do: This patchset resolves two critical regressions related to memory failure handling that have appeared in the upstream kernel since version 5.17, as compared to 5.10 LTS. - copyin case: poison found in user page while kernel copying from user space - instr case: poison found while instruction fetching in user space ## 2. What is the expected outcome and why - For copyin case: Kernel can recover from poison found where kernel is doing get_user() or copy_from_user() if those places get an error return and the kernel return -EFAULT to the process instead of crashing. More specifily, MCE handler checks the fixup handler type to decide whether an in kernel #MC can be recovered. When EX_TYPE_UACCESS is found, the PC jumps to recovery code specified in
_ASM_EXTABLE_FAULT() and return a -EFAULT to user space. - For instr case: If a poison found while instruction fetching in user space, full recovery is possible. User process takes #PF, Linux allocates a new page and fills by reading from storage. ## 3. What actually happens and why - For copyin case: kernel panic since v5.17 Commit 4c132d1d844a (x86/futex: Remove .fixup usage) introduced a new extable fixup type, EX_TYPE_EFAULT_REG, and later patches updated the extable fixup type for copy-from-user operations, changing it from EX_TYPE_UACCESS to EX_TYPE_EFAULT_REG. It breaks previous EX_TYPE_UACCESS handling when posion found in get_user() or copy_from_user(). - For instr case: user process is killed by a SIGBUS signal due to #CMCI and #MCE race When an uncorrected memory error is consumed there is a race between the CMCI from the memory controller reporting an uncorrected error with a UCNA signature, and the core reporting and SRAR signature machine check when the data is about to be consumed. ### Background: why
*UN*corrected errors tied to *C*MCI in Intel platform [1] Prior to Icelake memory controllers reported patrol scrub events that detected a previously unseen uncorrected error in memory by signaling a broadcast machine check with an SRAO (Software Recoverable Action Optional) signature in the machine check bank.
This was overkill because it's not an urgent problem that no core is on the verge of consuming that bad data. It's also found that multi SRAO UCE may cause nested MCE interrupts and finally become an IERR.
Hence, Intel downgrades the machine check bank signature of patrol scrub from SRAO to UCNA (Uncorrected, No Action required), and signal changed to #CMCI. Just to add to the confusion, Linux does take an action (in uc_decode_notifier()) to try to offline the page despite the UC*NA* signature name. ### Background:
why #CMCI and #MCE race when poison is consuming in Intel platform [1] Having decided that CMCI/UCNA is the best action for patrol scrub errors, the memory controller uses it for reads too. But the memory controller is executing asynchronously from the core, and can't tell the difference between a real read and a speculative read. So it will do CMCI/UCNA if an error is found in any read. Thus: 1) Core is clever and thinks address A is needed soon, issues a speculative read. 2) Core finds it is going to use address A soon after sending the read request 3) The CMCI from the memory controller is in a race with MCE from the core that will soon try to retire the load from address A. Quite often (because speculation has got better) the CMCI from the memory controller is delivered before the core is committed to the instruction reading address A, so the interrupt is taken, and Linux offlines the page (marking it as poison). ## Why user process is killed for instr case Commit 046545a661af (mm/hwpoison: fix error page recovered but reported not ---truncated--- (CVE-2025-39989)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39989
https://security-tracker.debian.org/tracker/CVE-2025-39989
https://ubuntu.com/security/CVE-2025-39989

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:H/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39989

Plugin Information
Published: 2025/08/06, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271544 - Linux Distros Unpatched Vulnerability : CVE-2025-39990
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Check the helper function is valid in get_helper_proto kernel test robot reported verifier bug [1] where the helper func pointer could be NULL due to disabled config option. As Alexei suggested we could check on that in get_helper_proto directly. Marking tail_call helper func with BPF_PTR_POISON, because it is unused by design. [1] https://lore.kernel.org/oe-lkp/202507160818.68358831-lkp@intel.com (CVE-2025-39990)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39990
https://security-tracker.debian.org/tracker/CVE-2025-39990
https://ubuntu.com/security/CVE-2025-39990

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39990

Plugin Information
Published: 2025/10/27, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271533 - Linux Distros Unpatched Vulnerability : CVE-2025-39991
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() If ab->fw.m3_data points to data, then fw pointer remains null. Further, if m3_mem is not allocated, then fw is dereferenced to be passed to ath11k_err function. Replace fw->size by m3_len. Found by Linux Verification Center (linuxtesting.org) with SVACE. (CVE-2025-39991)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39991
https://ubuntu.com/security/CVE-2025-39991

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39991

Plugin Information
Published: 2025/10/27, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271534 - Linux Distros Unpatched Vulnerability : CVE-2025-39992
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm: swap: check for stable address space before operating on the VMA It is possible to hit a zero entry while traversing the vmas in unuse_mm() called from swapoff path and accessing it causes the OOPS: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000446--> Loading the memory from offset 0x40 on the XA_ZERO_ENTRY as address. Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault The issue is manifested from the below race between the fork() on a process and swapoff: fork(dup_mmap()) swapoff(unuse_mm) --------------- ----------------- 1) Identical mtree is built using __mt_dup(). 2) copy_pte_range()--> copy_nonpresent_pte(): The dst mm is added into the mmlist to be visible to the swapoff operation. 3) Fatal signal is sent to the parent process(which is the current during the fork) thus skip the duplication of the vmas and mark the vma range with XA_ZERO_ENTRY as a marker for this process that helps during exit_mmap(). 4) swapoff is tried on the 'mm' added to the 'mmlist' as part of the 2. 5) unuse_mm(), that iterates through the vma's of this 'mm' will hit the non-NULL zero entry and operating on this zero entry as a vma is resulting into the oops. The proper fix would be around not exposing this partially-valid tree to others when droping the mmap lock, which is being solved with [1]. A simpler solution would be checking for MMF_UNSTABLE, as it is set if mm_struct is not fully initialized in dup_mmap(). Thanks to Liam/Lorenzo/David for all the suggestions in fixing this issue. (CVE-2025-39992)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39992
https://ubuntu.com/security/CVE-2025-39992

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39992

Plugin Information
Published: 2025/10/27, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271551 - Linux Distros Unpatched Vulnerability : CVE-2025-40000
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() There is a bug observed when rtw89_core_tx_kick_off_and_wait() tries to access already freed skb_data: BUG: KFENCE: use-after-free write in rtw89_core_tx_kick_off_and_wait drivers/net/wireless/realtek/rtw89/core.c:1110 CPU: 6 UID: 0 PID:
41377 Comm: kworker/u64:24 Not tainted 6.17.0-rc1+ #1 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS edk2-20250523-14.fc42 05/23/2025 Workqueue: events_unbound cfg80211_wiphy_work [cfg80211] Use-after-free write at 0x0000000020309d9d (in kfence-#251): rtw89_core_tx_kick_off_and_wait drivers/net/wireless/realtek/rtw89/core.c:1110 rtw89_core_scan_complete drivers/net/wireless/realtek/rtw89/core.c:5338 rtw89_hw_scan_complete_cb drivers/net/wireless/realtek/rtw89/fw.c:7979 rtw89_chanctx_proceed_cb drivers/net/wireless/realtek/rtw89/chan.c:3165 rtw89_chanctx_proceed drivers/net/wireless/realtek/rtw89/chan.h:141 rtw89_hw_scan_complete drivers/net/wireless/realtek/rtw89/fw.c:8012 rtw89_mac_c2h_scanofld_rsp drivers/net/wireless/realtek/rtw89/mac.c:5059 rtw89_fw_c2h_work drivers/net/wireless/realtek/rtw89/fw.c:6758 process_one_work kernel/workqueue.c:3241 worker_thread kernel/workqueue.c:3400 kthread kernel/kthread.c:463 ret_from_fork arch/x86/kernel/process.c:154 ret_from_fork_asm arch/x86/entry/entry_64.S:258 kfence-#251: 0x0000000056e2393d-0x000000009943cb62, size=232, cache=skbuff_head_cache allocated by task 41377 on cpu 6 at 77869.159548s (0.009551s ago):
__alloc_skb net/core/skbuff.c:659 __netdev_alloc_skb net/core/skbuff.c:734 ieee80211_nullfunc_get net/mac80211/tx.c:5844 rtw89_core_send_nullfunc drivers/net/wireless/realtek/rtw89/core.c:3431 rtw89_core_scan_complete drivers/net/wireless/realtek/rtw89/core.c:5338 rtw89_hw_scan_complete_cb drivers/net/wireless/realtek/rtw89/fw.c:7979 rtw89_chanctx_proceed_cb drivers/net/wireless/realtek/rtw89/chan.c:3165 rtw89_chanctx_proceed drivers/net/wireless/realtek/rtw89/chan.c:3194 rtw89_hw_scan_complete drivers/net/wireless/realtek/rtw89/fw.c:8012 rtw89_mac_c2h_scanofld_rsp drivers/net/wireless/realtek/rtw89/mac.c:5059 rtw89_fw_c2h_work drivers/net/wireless/realtek/rtw89/fw.c:6758 process_one_work kernel/workqueue.c:3241 worker_thread kernel/workqueue.c:3400 kthread kernel/kthread.c:463 ret_from_fork arch/x86/kernel/process.c:154 ret_from_fork_asm arch/x86/entry/entry_64.S:258 freed by task 1045 on cpu 9 at 77869.168393s (0.001557s ago): ieee80211_tx_status_skb net/mac80211/status.c:1117 rtw89_pci_release_txwd_skb drivers/net/wireless/realtek/rtw89/pci.c:564 rtw89_pci_release_tx_skbs.isra.0 drivers/net/wireless/realtek/rtw89/pci.c:651 rtw89_pci_release_tx drivers/net/wireless/realtek/rtw89/pci.c:676 rtw89_pci_napi_poll drivers/net/wireless/realtek/rtw89/pci.c:4238 __napi_poll net/core/dev.c:7495 net_rx_action net/core/dev.c:7557 net/core/dev.c:7684 handle_softirqs kernel/softirq.c:580 do_softirq.part.0 kernel/softirq.c:480 __local_bh_enable_ip kernel/softirq.c:407 rtw89_pci_interrupt_threadfn drivers/net/wireless/realtek/rtw89/pci.c:927 irq_thread_fn kernel/irq/manage.c:1133 irq_thread kernel/irq/manage.c:1257 kthread kernel/kthread.c:463 ret_from_fork arch/x86/kernel/process.c:154 ret_from_fork_asm arch/x86/entry/entry_64.S:258 It is a consequence of a race between the waiting and the signaling side of the completion: Waiting thread Completing thread rtw89_core_tx_kick_off_and_wait() rcu_assign_pointer(skb_data->wait, wait) /* start waiting */ wait_for_completion_timeout() rtw89_pci_tx_status() rtw89_core_tx_wait_complete() rcu_read_lock() /* signals completion and
---truncated--- (CVE-2025-40000)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40000
https://ubuntu.com/security/CVE-2025-40000

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40000

Plugin Information
Published: 2025/10/27, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271660 - Linux Distros Unpatched Vulnerability : CVE-2025-40010
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- afs: Fix potential null pointer dereference in afs_put_server afs_put_server() accessed server->debug_id before the NULL check, which could lead to a null pointer dereference. Move the debug_id assignment, ensuring we never dereference a NULL server pointer. (CVE-2025-40010)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40010
https://ubuntu.com/security/CVE-2025-40010

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40010

Plugin Information
Published: 2025/10/27, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271666 - Linux Distros Unpatched Vulnerability : CVE-2025-40011
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/gma500: Fix null dereference in hdmi teardown pci_set_drvdata sets the value of pdev->driver_data to NULL, after which the driver_data obtained from the same dev is dereferenced in oaktrail_hdmi_i2c_exit, and the i2c_dev is extracted from it. To prevent this, swap these calls. Found by Linux Verification Center (linuxtesting.org) with Svacer. (CVE-2025-40011)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40011
https://ubuntu.com/security/CVE-2025-40011

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40011

Plugin Information
Published: 2025/10/27, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271664 - Linux Distros Unpatched Vulnerability : CVE-2025-40016
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID Per UVC 1.1+ specification 3.7.2, units and terminals must have a non-zero unique ID. ``` Each Unit and Terminal within the video function is assigned a unique identification number, the Unit ID (UID) or Terminal ID (TID), contained in the bUnitID or bTerminalID field of the descriptor. The value 0x00 is reserved for undefined ID, ``` If we add a new entity with id 0 or a duplicated ID, it will be marked as UVC_INVALID_ENTITY_ID. In a previous attempt commit 3dd075fe8ebb (media: uvcvideo: Require entities to have a non-zero unique ID), we ignored all the invalid units, this broke a lot of non-compatible cameras. Hopefully we are more lucky this time.
This also prevents some syzkaller reproducers from triggering warnings due to a chain of entities referring to themselves. In one particular case, an Output Unit is connected to an Input Unit, both with the same ID of 1. But when looking up for the source ID of the Output Unit, that same entity is found instead of the input entity, which leads to such warnings. In another case, a backward chain was considered finished as the source ID was 0. Later on, that entity was found, but its pads were not valid.
Here is a sample stack trace for one of those cases. [ 20.650953] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 20.830206] usb 1-1: Using ep0 maxpacket: 8 [ 20.833501] usb 1-1: config 0 descriptor?? [ 21.038518] usb 1-1: string descriptor 0 read error: -71 [ 21.038893] usb 1-1: Found UVC 0.00 device <unnamed> (2833:0201) [ 21.039299] uvcvideo 1-1:0.0: Entity type for entity Output 1 was not initialized! [ 21.041583] uvcvideo 1-1:0.0: Entity type for entity Input 1 was not initialized! [ 21.042218] ------------[ cut here ]------------ [ 21.042536] WARNING: CPU: 0 PID: 9 at drivers/media/mc/mc-entity.c:1147 media_create_pad_link+0x2c4/0x2e0 [ 21.043195] Modules linked in: [ 21.043535] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.11.0-rc7-00030-g3480e43aeccf #444 [ 21.044101] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [ 21.044639] Workqueue: usb_hub_wq hub_event [ 21.045100] RIP: 0010:media_create_pad_link+0x2c4/0x2e0 [ 21.045508] Code: fe e8 20 01 00 00 b8 f4 ff ff ff 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 0f 0b eb e9 0f 0b eb 0a 0f 0b eb 06 <0f> 0b eb 02 0f 0b b8 ea ff ff ff eb d4 66 2e 0f 1f 84 00 00 00 00 [ 21.046801] RSP: 0018:ffffc9000004b318 EFLAGS: 00010246 [ 21.047227] RAX: ffff888004e5d458 RBX:
0000000000000000 RCX: ffffffff818fccf1 [ 21.047719] RDX: 000000000000007b RSI: 0000000000000000 RDI:
ffff888004313290 [ 21.048241] RBP: ffff888004313290 R08: 0001ffffffffffff R09: 0000000000000000 [ 21.048701] R10: 0000000000000013 R11: 0001888004313290 R12: 0000000000000003 [ 21.049138] R13:
ffff888004313080 R14: ffff888004313080 R15: 0000000000000000 [ 21.049648] FS: 0000000000000000(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000 [ 21.050271] CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 [ 21.050688] CR2: 0000592cc27635b0 CR3: 000000000431c000 CR4: 0000000000750ef0 [ 21.051136] PKRU: 55555554 [ 21.051331] Call Trace: [ 21.051480] <TASK> [ 21.051611] ? __warn+0xc4/0x210 [ 21.051861] ? media_create_pad_link+0x2c4/0x2e0 [ 21.052252] ? report_bug+0x11b/0x1a0 [ 21.052540] ? trace_hardirqs_on+0x31/0x40 [ 21.052901] ? handle_bug+0x3d/0x70 [ 21.053197] ? exc_invalid_op+0x1a/0x50 [ 21.053511] ? asm_exc_invalid_op+0x1a/0x20 [ 21.053924] ? media_create_pad_link+0x91/0x2e0 [ 21.054364] ? media_create_pad_link+0x2c4/0x2e0 [ 21.054834] ? media_create_pad_link+0x91/0x2e0 [ 21.055131] ?
_raw_spin_unlock+0x1e/0x40 [ 21.055441] ? __v4l2_device_register_subdev+0x202/0x210 [ 21.055837] uvc_mc_register_entities+0x358/0x400 [ 21.056144] uvc_register_chains+0x1 ---truncated--- (CVE-2025-40016)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40016
https://security-tracker.debian.org/tracker/CVE-2025-40016
https://ubuntu.com/security/CVE-2025-40016

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40016

Plugin Information
Published: 2025/10/27, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271715 - Linux Distros Unpatched Vulnerability : CVE-2025-40018
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leading to a use-after- free. Fix this by introducing a global `exiting_module` flag, set to true in ip_vs_ftp_exit() before unregistering the pernet subsystem. In __ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns cleanup (when exiting_module is false) and defer it to __ip_vs_cleanup_batch(), which unregisters all apps after all connections are flushed. If called during module exit, unregister ip_vs_ftp immediately. (CVE-2025-40018)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40018
https://ubuntu.com/security/CVE-2025-40018

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40018

Plugin Information
Published: 2025/10/27, Modified: 2025/12/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271915 - Linux Distros Unpatched Vulnerability : CVE-2025-40030
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- pinctrl: check the return value of pinmux_ops::get_function_name() While the API contract in docs doesn't specify it explicitly, the generic implementation of the get_function_name() callback from struct pinmux_ops - pinmux_generic_get_function_name() - can fail and return NULL. This is already checked in pinmux_check_ops() so add a similar check in pinmux_func_name_to_selector() instead of passing the returned pointer right down to strcmp() where the NULL can get dereferenced. This is normal operation when adding new pinfunctions. (CVE-2025-40030)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40030
https://ubuntu.com/security/CVE-2025-40030

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40030

Plugin Information
Published: 2025/10/28, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271894 - Linux Distros Unpatched Vulnerability : CVE-2025-40038
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid Skip the WRMSR and HLT fastpaths in SVM's VM-Exit handler if the next RIP isn't valid, e.g. because KVM is running with nrips=false. SVM must decode and emulate to skip the instruction if the CPU doesn't provide the next RIP, and getting the instruction bytes to decode requires reading guest memory. Reading guest memory through the emulator can fault, i.e. can sleep, which is disallowed since the fastpath handlers run with IRQs disabled. BUG:
sleeping function called from invalid context at ./include/linux/uaccess.h:106 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 32611, name: qemu preempt_count: 1, expected: 0 INFO: lockdep is turned off. irq event stamp: 30580 hardirqs last enabled at (30579): [<ffffffffc08b2527>] vcpu_run+0x1787/0x1db0 [kvm] hardirqs last disabled at (30580): [<ffffffffb4f62e32>]
__schedule+0x1e2/0xed0 softirqs last enabled at (30570): [<ffffffffb4247a64>] fpu_swap_kvm_fpstate+0x44/0x210 softirqs last disabled at (30568): [<ffffffffb4247a64>] fpu_swap_kvm_fpstate+0x44/0x210 CPU: 298 UID: 0 PID: 32611 Comm: qemu Tainted: G U 6.16.0-smp-- e6c618b51cfe-sleep #782 NONE Tainted: [U]=USER Hardware name: Google Astoria-Turin/astoria, BIOS 0.20241223.2-0 01/17/2025 Call Trace: <TASK> dump_stack_lvl+0x7d/0xb0 __might_resched+0x271/0x290
__might_fault+0x28/0x80 kvm_vcpu_read_guest_page+0x8d/0xc0 [kvm] kvm_fetch_guest_virt+0x92/0xc0 [kvm]
__do_insn_fetch_bytes+0xf3/0x1e0 [kvm] x86_decode_insn+0xd1/0x1010 [kvm] x86_emulate_instruction+0x105/0x810 [kvm] __svm_skip_emulated_instruction+0xc4/0x140 [kvm_amd] handle_fastpath_invd+0xc4/0x1a0 [kvm] vcpu_run+0x11a1/0x1db0 [kvm] kvm_arch_vcpu_ioctl_run+0x5cc/0x730 [kvm] kvm_vcpu_ioctl+0x578/0x6a0 [kvm] __se_sys_ioctl+0x6d/0xb0 do_syscall_64+0x8a/0x2c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f479d57a94b </TASK> Note, this is essentially a reapply of commit 5c30e8101e8d (KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid), but with different justification (KVM now grabs SRCU when skipping the instruction for other reasons).
(CVE-2025-40038)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40038
https://ubuntu.com/security/CVE-2025-40038

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40038

Plugin Information
Published: 2025/10/28, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271902 - Linux Distros Unpatched Vulnerability : CVE-2025-40040
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm/ksm: fix flag-dropping behavior in ksm_madvise syzkaller discovered the following crash: (kernel BUG) [ 44.607039] ------------[ cut here ]------------ [ 44.607422] kernel BUG at mm/userfaultfd.c:2067! [ 44.608148] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 44.608814] CPU: 1 UID: 0 PID:
2475 Comm: reproducer Not tainted 6.16.0-rc6 #1 PREEMPT(none) [ 44.609635] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 44.610695] RIP:
0010:userfaultfd_release_all+0x3a8/0x460 <snip other registers, drop unreliable trace> [ 44.617726] Call Trace: [ 44.617926] <TASK> [ 44.619284] userfaultfd_release+0xef/0x1b0 [ 44.620976] __fput+0x3f9/0xb60 [ 44.621240] fput_close_sync+0x110/0x210 [ 44.622222] __x64_sys_close+0x8f/0x120 [ 44.622530] do_syscall_64+0x5b/0x2f0 [ 44.622840] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 44.623244] RIP:
0033:0x7f365bb3f227 Kernel panics because it detects UFFD inconsistency during userfaultfd_release_all().
Specifically, a VMA which has a valid pointer to vma->vm_userfaultfd_ctx, but no UFFD flags in vma->vm_flags. The inconsistency is caused in ksm_madvise(): when user calls madvise() with MADV_UNMEARGEABLE on a VMA that is registered for UFFD in MINOR mode, it accidentally clears all flags stored in the upper 32 bits of vma->vm_flags. Assuming x86_64 kernel build, unsigned long is 64-bit and unsigned int and int are 32-bit wide. This setup causes the following mishap during the &= ~VM_MERGEABLE assignment. VM_MERGEABLE is a 32-bit constant of type unsigned int, 0x8000'0000. After ~ is applied, it becomes 0x7fff'ffff unsigned int, which is then promoted to unsigned long before the & operation. This promotion fills upper 32 bits with leading 0s, as we're doing unsigned conversion (and even for a signed conversion, this wouldn't help as the leading bit is 0). & operation thus ends up AND-ing vm_flags with 0x0000'0000'7fff'ffff instead of intended 0xffff'ffff'7fff'ffff and hence accidentally clears the upper 32-bits of its value. Fix it by changing `VM_MERGEABLE` constant to unsigned long, using the BIT() macro.
Note: other VM_* flags are not affected: This only happens to the VM_MERGEABLE flag, as the other VM_* flags are all constants of type int and after ~ operation, they end up with leading 1 and are thus converted to unsigned long with leading 1s. Note 2: After commit 31defc3b01d9 (userfaultfd: remove (VM_)BUG_ON()s), this is no longer a kernel BUG, but a WARNING at the same place: [ 45.595973] WARNING:
CPU: 1 PID: 2474 at mm/userfaultfd.c:2067 but the root-cause (flag-drop) remains the same. [akpm@linux- foundation.org: rust bindgen wasn't able to handle BIT(), from Miguel] (CVE-2025-40040)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40040
https://ubuntu.com/security/CVE-2025-40040

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40040

Plugin Information
Published: 2025/10/28, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271898 - Linux Distros Unpatched Vulnerability : CVE-2025-40042
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference There is a critical race condition in kprobe initialization that can lead to NULL pointer dereference and kernel crash.
[1135630.084782] Unable to handle kernel paging request at virtual address 0000710a04630000 ...
[1135630.260314] pstate: 404003c9 (nZcv DAIF +PAN -UAO) [1135630.269239] pc : kprobe_perf_func+0x30/0x260 [1135630.277643] lr : kprobe_dispatcher+0x44/0x60 [1135630.286041] sp : ffffaeff4977fa40 [1135630.293441] x29: ffffaeff4977fa40 x28: ffffaf015340e400 [1135630.302837] x27: 0000000000000000 x26: 0000000000000000 [1135630.312257] x25: ffffaf029ed108a8 x24: ffffaf015340e528 [1135630.321705] x23: ffffaeff4977fc50 x22:
ffffaeff4977fc50 [1135630.331154] x21: 0000000000000000 x20: ffffaeff4977fc50 [1135630.340586] x19:
ffffaf015340e400 x18: 0000000000000000 [1135630.349985] x17: 0000000000000000 x16: 0000000000000000 [1135630.359285] x15: 0000000000000000 x14: 0000000000000000 [1135630.368445] x13: 0000000000000000 x12:
0000000000000000 [1135630.377473] x11: 0000000000000000 x10: 0000000000000000 [1135630.386411] x9 :
0000000000000000 x8 : 0000000000000000 [1135630.395252] x7 : 0000000000000000 x6 : 0000000000000000 [1135630.403963] x5 : 0000000000000000 x4 : 0000000000000000 [1135630.412545] x3 : 0000710a04630000 x2 :
0000000000000006 [1135630.421021] x1 : ffffaeff4977fc50 x0 : 0000710a04630000 [1135630.429410] Call trace:
[1135630.434828] kprobe_perf_func+0x30/0x260 [1135630.441661] kprobe_dispatcher+0x44/0x60 [1135630.448396] aggr_pre_handler+0x70/0xc8 [1135630.454959] kprobe_breakpoint_handler+0x140/0x1e0 [1135630.462435] brk_handler+0xbc/0xd8 [1135630.468437] do_debug_exception+0x84/0x138 [1135630.475074] el1_dbg+0x18/0x8c [1135630.480582] security_file_permission+0x0/0xd0 [1135630.487426] vfs_write+0x70/0x1c0 [1135630.493059] ksys_write+0x5c/0xc8 [1135630.498638] __arm64_sys_write+0x24/0x30 [1135630.504821] el0_svc_common+0x78/0x130 [1135630.510838] el0_svc_handler+0x38/0x78 [1135630.516834] el0_svc+0x8/0x1b0 kernel/trace/trace_kprobe.c: 1308 0xffff3df8995039ec <kprobe_perf_func+0x2c>: ldr x21, [x24,#120] include/linux/compiler.h: 294 0xffff3df8995039f0 <kprobe_perf_func+0x30>: ldr x1, [x21,x0] kernel/trace/trace_kprobe.c 1308: head = this_cpu_ptr(call->perf_events); 1309: if (hlist_empty(head)) 1310: return 0; crash> struct trace_event_call -o struct trace_event_call { ... [120] struct hlist_head
*perf_events; //(call->perf_event) ... } crash> struct trace_event_call ffffaf015340e528 struct trace_event_call { ... perf_events = 0xffff0ad5fa89f088, //this value is correct, but x21 = 0 ... } Race Condition Analysis: The race occurs between kprobe activation and perf_events initialization: CPU0 CPU1 ==== ==== perf_kprobe_init perf_trace_event_init tp_event->perf_events = list;(1) tp_event->class->reg (2) KPROBE ACTIVE Debug exception triggers ... kprobe_dispatcher kprobe_perf_func (tk->tp.flags &
TP_FLAG_PROFILE) head = this_cpu_ptr(call->perf_events)(3) (perf_events is still NULL) Problem: 1. CPU0 executes (1) assigning tp_event->perf_events = list 2. CPU0 executes (2) enabling kprobe functionality via class->reg() 3. CPU1 triggers and reaches kprobe_dispatcher 4. CPU1 checks TP_FLAG_PROFILE - condition passes (step 2 completed) 5. CPU1 calls kprobe_perf_func() and crashes at (3) because call->perf_events is still NULL CPU1 sees that kprobe functionality is enabled but does not see that perf_events has been assigned. Add pairing read an ---truncated--- (CVE-2025-40042)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40042
https://ubuntu.com/security/CVE-2025-40042

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40042

Plugin Information
Published: 2025/10/28, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271899 - Linux Distros Unpatched Vulnerability : CVE-2025-40049
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Squashfs: fix uninit-value in squashfs_get_parent Syzkaller reports a KMSAN: uninit-value in squashfs_get_parent bug. This is caused by open_by_handle_at() being called with a file handle containing an invalid parent inode number. In particular the inode number is that of a symbolic link, rather than a directory. Squashfs_get_parent() gets called with that symbolic link inode, and accesses the parent member field. unsigned int parent_ino = squashfs_i(inode)->parent; Because non-directory inodes in Squashfs do not have a parent value, this is uninitialised, and this causes an uninitialised value access. The fix is to initialise parent with the invalid inode 0, which will cause an EINVAL error to be returned. Regular inodes used to share the parent field with the block_list_start field. This is removed in this commit to enable the parent field to contain the invalid inode number 0. (CVE-2025-40049)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40049
https://ubuntu.com/security/CVE-2025-40049

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40049

Plugin Information
Published: 2025/10/28, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271901 - Linux Distros Unpatched Vulnerability : CVE-2025-40053
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: dlink: handle copy_thresh allocation failure The driver did not handle failure of `netdev_alloc_skb_ip_align()`. If the allocation failed, dereferencing `skb->protocol` could lead to a NULL pointer dereference. This patch tries to allocate `skb`. If the allocation fails, it falls back to the normal path. Tested-on: D-Link DGE-550T Rev-A3 (CVE-2025-40053)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40053
https://ubuntu.com/security/CVE-2025-40053

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40053

Plugin Information
Published: 2025/10/28, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271918 - Linux Distros Unpatched Vulnerability : CVE-2025-40056
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vhost: vringh: Fix copy_to_iter return value check The return value of copy_to_iter can't be negative, check whether the copied length is equal to the requested length instead of checking for negative values.
(CVE-2025-40056)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40056
https://ubuntu.com/security/CVE-2025-40056

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40056

Plugin Information
Published: 2025/10/28, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271907 - Linux Distros Unpatched Vulnerability : CVE-2025-40057
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ptp: Add a upper bound on max_vclocks syzbot reported WARNING in max_vclocks_store. This occurs when the argument max is too large for kcalloc to handle. Extend the guard to guard against values that are too large for kcalloc (CVE-2025-40057)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40057
https://security-tracker.debian.org/tracker/CVE-2025-40057
https://ubuntu.com/security/CVE-2025-40057

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40057

Plugin Information
Published: 2025/10/28, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271866 - Linux Distros Unpatched Vulnerability : CVE-2025-40061
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA/rxe: Fix race in do_task() when draining When do_task() exhausts its iteration budget (!ret), it sets the state to TASK_STATE_IDLE to reschedule, without a secondary check on the current task->state. This can overwrite the TASK_STATE_DRAINING state set by a concurrent call to rxe_cleanup_task() or rxe_disable_task(). While state changes are protected by a spinlock, both rxe_cleanup_task() and rxe_disable_task() release the lock while waiting for the task to finish draining in the while(!is_done(task)) loop. The race occurs if do_task() hits its iteration limit and acquires the lock in this window. The cleanup logic may then proceed while the task incorrectly reschedules itself, leading to a potential use-after-free. This bug was introduced during the migration from tasklets to workqueues, where the special handling for the draining case was lost. Fix this by restoring the original pre- migration behavior. If the state is TASK_STATE_DRAINING when iterations are exhausted, set cont to 1 to force a new loop iteration. This allows the task to finish its work, so that a subsequent iteration can reach the switch statement and correctly transition the state to TASK_STATE_DRAINED, stopping the task as intended. (CVE-2025-40061)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40061
https://ubuntu.com/security/CVE-2025-40061

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0002
CVSS v2.0 Base Score
4.0 (CVSS2#AV:L/AC:H/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40061

Plugin Information
Published: 2025/10/28, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271876 - Linux Distros Unpatched Vulnerability : CVE-2025-40064
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smc: Fix use-after-free in __pnet_find_base_ndev(). syzbot reported use-after-free of net_device in
__pnet_find_base_ndev(), which was called during connect(). [0] smc_pnet_find_ism_resource() fetches sk_dst_get(sk)->dev and passes down to pnet_find_base_ndev(), where RTNL is held. Then, UAF happened at
__pnet_find_base_ndev() when the dev is first used. This means dev had already been freed before acquiring RTNL in pnet_find_base_ndev(). While dev is going away, dst->dev could be swapped with blackhole_netdev, and the dev's refcnt by dst will be released. We must hold dev's refcnt before calling smc_pnet_find_ism_resource(). Also, smc_pnet_find_roce_resource() has the same problem. Let's use
__sk_dst_get() and dst_dev_rcu() in the two functions. [0]: BUG: KASAN: use-after-free in
__pnet_find_base_ndev+0x1b1/0x1c0 net/smc/smc_pnet.c:926 Read of size 1 at addr ffff888036bac33a by task syz.0.3632/18609 CPU: 1 UID: 0 PID: 18609 Comm: syz.0.3632 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 Call Trace: <TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595
__pnet_find_base_ndev+0x1b1/0x1c0 net/smc/smc_pnet.c:926 pnet_find_base_ndev net/smc/smc_pnet.c:946 [inline] smc_pnet_find_ism_by_pnetid net/smc/smc_pnet.c:1103 [inline] smc_pnet_find_ism_resource+0xef/0x390 net/smc/smc_pnet.c:1154 smc_find_ism_device net/smc/af_smc.c:1030 [inline] smc_find_proposal_devices net/smc/af_smc.c:1115 [inline] __smc_connect+0x372/0x1890 net/smc/af_smc.c:1545 smc_connect+0x877/0xd90 net/smc/af_smc.c:1715 __sys_connect_file net/socket.c:2086 [inline] __sys_connect+0x313/0x440 net/socket.c:2105 __do_sys_connect net/socket.c:2111 [inline]
__se_sys_connect net/socket.c:2108 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:2108 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f47cbf8eba9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f47ccdb1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 00007f47cc1d5fa0 RCX: 00007f47cbf8eba9 RDX:
0000000000000010 RSI: 0000200000000280 RDI: 000000000000000b RBP: 00007f47cc011e19 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13:
00007f47cc1d6038 R14: 00007f47cc1d5fa0 R15: 00007ffc512f8aa8 </TASK> The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888036bacd00 pfn:0x36bac flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 ffffea0001243d08 ffff8880b863fdc0 0000000000000000 raw: ffff888036bacd00 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 2, migratetype Unmovable, gfp_mask 0x446dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 16741, tgid 16741 (syz-executor), ts 343313197788, free_ts 380670750466 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1851 prep_new_page mm/page_alloc.c:1859 [inline] get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3858 __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5148 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416 ___kmalloc_large_node+0x5f/0x1b0 mm/slub.c:4317 __kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:4348 __do_kmalloc_node mm/slub.c:4364 [inline] __kvmalloc_node ---truncated--- (CVE-2025-40064)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40064
https://security-tracker.debian.org/tracker/CVE-2025-40064
https://ubuntu.com/security/CVE-2025-40064

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.3
EPSS Score
0.0002
CVSS v2.0 Base Score
5.9 (CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40064

Plugin Information
Published: 2025/10/28, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271878 - Linux Distros Unpatched Vulnerability : CVE-2025-40070
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- pps: fix warning in pps_register_cdev when register device fail Similar to previous commit 2a934fdb01db (media: v4l2-dev: fix error handling in __video_register_device()), the release hook should be set before device_register(). Otherwise, when device_register() return error and put_device() try to callback the release function, the below warning may happen. ------------[ cut here ]------------ WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567 Modules linked in: CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE RIP:
0010:device_release+0x1bd/0x240 drivers/base/core.c:2567 Call Trace: <TASK> kobject_cleanup+0x136/0x410 lib/kobject.c:689 kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0xe9/0x130 lib/kobject.c:737 put_device+0x24/0x30 drivers/base/core.c:3797 pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402 pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108 pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57 tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432 tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563 tiocsetd drivers/tty/tty_io.c:2429 [inline] tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:598 [inline] __se_sys_ioctl fs/ioctl.c:584 [inline]
__x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK>
Before commit c79a39dc8d06 (pps: Fix a use-after-free), pps_register_cdev() call device_create() to create pps->dev, which will init dev->release to device_create_release(). Now the comment is outdated, just remove it. Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed in pps_register_source() to avoid a double free in the failure case. (CVE-2025-40070)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40070
https://ubuntu.com/security/CVE-2025-40070

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40070

Plugin Information
Published: 2025/10/28, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271865 - Linux Distros Unpatched Vulnerability : CVE-2025-40071
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tty: n_gsm: Don't block input queue by waiting MSC Currently gsm_queue() processes incoming frames and when opening a DLC channel it calls gsm_dlci_open() which calls gsm_modem_update(). If basic mode is used it calls gsm_modem_upd_via_msc() and it cannot block the input queue by waiting the response to come into the same input queue. Instead allow sending Modem Status Command without waiting for remote end to respond. Define a new function gsm_modem_send_initial_msc() for this purpose. As MSC is only valid for basic encoding, it does not do anything for advanced or when convergence layer type 2 is used.
(CVE-2025-40071)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40071
https://security-tracker.debian.org/tracker/CVE-2025-40071
https://ubuntu.com/security/CVE-2025-40071

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H)
CVSS v3.0 Temporal Score
5.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.2
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40071

Plugin Information
Published: 2025/10/28, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271974 - Linux Distros Unpatched Vulnerability : CVE-2025-40083
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/sched: sch_qfq: Fix null-deref in agg_dequeue To prevent a potential crash in agg_dequeue (net/sched/sch_qfq.c) when cl->qdisc->ops->peek(cl->qdisc) returns NULL, we check the return value before using it, similar to the existing approach in sch_hfsc.c. To avoid code duplication, the following changes are made: 1. Changed qdisc_warn_nonwc(include/net/pkt_sched.h) into a static inline function. 2. Moved qdisc_peek_len from net/sched/sch_hfsc.c to include/net/pkt_sched.h so that sch_qfq can reuse it. 3.
Applied qdisc_peek_len in agg_dequeue to avoid crashing. (CVE-2025-40083)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40083
https://security-tracker.debian.org/tracker/CVE-2025-40083
https://ubuntu.com/security/CVE-2025-40083

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40083

Plugin Information
Published: 2025/10/29, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
271973 - Linux Distros Unpatched Vulnerability : CVE-2025-40085
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card In try_to_register_card(), the return value of usb_ifnum_to_if() is passed directly to usb_interface_claimed() without a NULL check, which will lead to a NULL pointer dereference when creating an invalid USB audio device. Fix this by adding a check to ensure the interface pointer is valid before passing it to usb_interface_claimed(). (CVE-2025-40085)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40085
https://ubuntu.com/security/CVE-2025-40085

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40085

Plugin Information
Published: 2025/10/29, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
272065 - Linux Distros Unpatched Vulnerability : CVE-2025-40086
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/xe: Don't allow evicting of BOs in same VM in array of VM binds An array of VM binds can potentially evict other buffer objects (BOs) within the same VM under certain conditions, which may lead to NULL pointer dereferences later in the bind pipeline. To prevent this, clear the allow_res_evict flag in the xe_bo_validate call. v2: - Invert polarity of no_res_evict (Thomas) - Add comment in code explaining issue (Thomas) (cherry picked from commit 8b9ba8d6d95fe75fed6b0480bb03da4b321bea08) (CVE-2025-40086)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40086
https://security-tracker.debian.org/tracker/CVE-2025-40086
https://ubuntu.com/security/CVE-2025-40086

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40086

Plugin Information
Published: 2025/10/30, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
272049 - Linux Distros Unpatched Vulnerability : CVE-2025-40099
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cifs: parse_dfs_referrals: prevent oob on malformed input Malicious SMB server can send invalid reply to FSCTL_DFS_GET_REFERRALS - reply smaller than sizeof(struct get_dfs_referral_rsp) - reply with number of referrals smaller than NumberOfReferrals in the header Processing of such replies will cause oob. Return
-EINVAL error on such replies to prevent oob-s. (CVE-2025-40099)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40099
https://security-tracker.debian.org/tracker/CVE-2025-40099
https://ubuntu.com/security/CVE-2025-40099

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40099

Plugin Information
Published: 2025/10/30, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
272057 - Linux Distros Unpatched Vulnerability : CVE-2025-40103
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smb: client: Fix refcount leak for cifs_sb_tlink Fix three refcount inconsistency issues related to `cifs_sb_tlink`. Comments for `cifs_sb_tlink` state that `cifs_put_tlink()` needs to be called after successful calls to `cifs_sb_tlink()`. Three calls fail to update refcount accordingly, leading to possible resource leaks. (CVE-2025-40103)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40103
https://security-tracker.debian.org/tracker/CVE-2025-40103
https://ubuntu.com/security/CVE-2025-40103

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40103

Plugin Information
Published: 2025/10/30, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
272053 - Linux Distros Unpatched Vulnerability : CVE-2025-40104
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ixgbevf: fix mailbox API compatibility by negotiating supported features There was backward compatibility in the terms of mailbox API. Various drivers from various OSes supporting 10G adapters from Intel portfolio could easily negotiate mailbox API. This convention has been broken since introducing API 1.4.
Commit 0062e7cc955e (ixgbevf: add VF IPsec offload code) added support for IPSec which is specific only for the kernel ixgbe driver. None of the rest of the Intel 10G PF/VF drivers supports it. And actually lack of support was not included in the IPSec implementation - there were no such code paths. No possibility to negotiate support for the feature was introduced along with introduction of the feature itself. Commit 339f28964147 (ixgbevf: Add support for new mailbox communication between PF and VF) increasing API version to 1.5 did the same - it introduced code supported specifically by the PF ESX driver. It altered API version for the VF driver in the same time not touching the version defined for the PF ixgbe driver. It led to additional discrepancies, as the code provided within API 1.6 cannot be supported for Linux ixgbe driver as it causes crashes. The issue was noticed some time ago and mitigated by Jake within the commit d0725312adf5 (ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5). As a result we have regression for IPsec support and after increasing API to version 1.6 ixgbevf driver stopped to support ESX MBX. To fix this mess add new mailbox op asking PF driver about supported features. Basing on a response determine whether to set support for IPSec and ESX-specific enhanced mailbox. New mailbox op, for compatibility purposes, must be added within new API revision, as API version of OOT PF & VF drivers is already increased to 1.6 and doesn't incorporate features negotiate op. Features negotiation mechanism gives possibility to be extended with new features when needed in the future. (CVE-2025-40104)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40104
https://security-tracker.debian.org/tracker/CVE-2025-40104
https://ubuntu.com/security/CVE-2025-40104

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40104

Plugin Information
Published: 2025/10/30, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
272061 - Linux Distros Unpatched Vulnerability : CVE-2025-40105
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vfs: Don't leak disconnected dentries on umount When user calls open_by_handle_at() on some inode that is not cached, we will create disconnected dentry for it. If such dentry is a directory, exportfs_decode_fh_raw() will then try to connect this dentry to the dentry tree through reconnect_path().
It may happen for various reasons (such as corrupted fs or race with rename) that the call to lookup_one_unlocked() in reconnect_one() will fail to find the dentry we are trying to reconnect and instead create a new dentry under the parent. Now this dentry will not be marked as disconnected although the parent still may well be disconnected (at least in case this inconsistency happened because the fs is corrupted and .. doesn't point to the real parent directory). This creates inconsistency in disconnected flags but AFAICS it was mostly harmless. At least until commit f1ee616214cb (VFS: don't keep disconnected dentries on d_anon) which removed adding of most disconnected dentries to sb->s_anon list. Thus after this commit cleanup of disconnected dentries implicitely relies on the fact that dput() will immediately reclaim such dentries. However when some leaf dentry isn't marked as disconnected, as in the scenario described above, the reclaim doesn't happen and the dentries are leaked. Memory reclaim can eventually reclaim them but otherwise they stay in memory and if umount comes first, we hit infamous Busy inodes after unmount bug. Make sure all dentries created under a disconnected parent are marked as disconnected as well. (CVE-2025-40105)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40105
https://ubuntu.com/security/CVE-2025-40105

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40105

Plugin Information
Published: 2025/10/30, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
274554 - Linux Distros Unpatched Vulnerability : CVE-2025-40109
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- crypto: rng - Ensure set_ent is always present Ensure that set_ent is always set since only drbg provides it. (CVE-2025-40109)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40109
https://ubuntu.com/security/CVE-2025-40109

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.2 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
3.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.2
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40109

Plugin Information
Published: 2025/11/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275208 - Linux Distros Unpatched Vulnerability : CVE-2025-40115
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() During mpt3sas_transport_port_remove(), messages were logged with dev_printk() against &mpt3sas_port->port->dev.
At this point the SAS transport device may already be partially unregistered or freed, leading to a crash when accessing its struct device. Using ioc_info(), which logs via the PCI device (ioc->pdev->dev), guaranteed to remain valid until driver removal. [83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI [83428.295785] CPU: 145 UID: 0 PID:
113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary) [83428.295792] Tainted:
[O]=OOT_MODULE, [E]=UNSIGNED_MODULE [83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024 [83428.295799] RIP: 0010:__dev_printk+0x1f/0x70 [83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff [83428.295813] RSP:
0018:ff85aeafc3137bb0 EFLAGS: 00010206 [83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX:
5000cca25103be32 [83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845 [83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8 [83428.295826] R10:
ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000 [83428.295830] R13: ff4290ee6e345de0 R14:
ff4290ee81290000 R15: ff4290ee6e345e30 [83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000 [83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [83428.295840] CR2:
00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0 [83428.295844] PKRU: 55555554 [83428.295846] Call Trace: [83428.295848] <TASK> [83428.295850] _dev_printk+0x5c/0x80 [83428.295857] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.295863] mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas] [83428.295882] _scsih_remove_device+0x21b/0x280 [mpt3sas] [83428.295894] ?
_scsih_expander_node_remove+0x108/0x140 [mpt3sas] [83428.295906] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.295910] mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas] [83428.295921]
_scsih_expander_node_remove+0x129/0x140 [mpt3sas] [83428.295933] _scsih_expander_node_remove+0x6a/0x140 [mpt3sas] [83428.295944] scsih_remove+0x3f0/0x4a0 [mpt3sas] [83428.295957] pci_device_remove+0x3b/0xb0 [83428.295962] device_release_driver_internal+0x193/0x200 [83428.295968] driver_detach+0x44/0x90 [83428.295971] bus_remove_driver+0x69/0xf0 [83428.295975] pci_unregister_driver+0x2a/0xb0 [83428.295979]
_mpt3sas_exit+0x1f/0x300 [mpt3sas] [83428.295991] __do_sys_delete_module.constprop.0+0x174/0x310 [83428.295997] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.296000] ? __x64_sys_getdents64+0x9a/0x110 [83428.296005] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.296009] ? syscall_trace_enter+0xf6/0x1b0 [83428.296014] do_syscall_64+0x7b/0x2c0 [83428.296019] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.296023] entry_SYSCALL_64_after_hwframe+0x76/0x7e (CVE-2025-40115)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40115
https://ubuntu.com/security/CVE-2025-40115

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40115

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275198 - Linux Distros Unpatched Vulnerability : CVE-2025-40120
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock Prevent USB runtime PM (autosuspend) for AX88772* in bind. usbnet enables runtime PM (autosuspend) by default, so disabling it via the usb_driver flag is ineffective. On AX88772B, autosuspend shows no measurable power saving with current driver (no link partner, admin up/down). The ~0.453 W -> ~0.248 W drop on v6.1 comes from phylib powering the PHY off on admin-down, not from USB autosuspend. The real hazard is that with runtime PM enabled, ndo_open() (under RTNL) may synchronously trigger autoresume (usb_autopm_get_interface()) into asix_resume() while the USB PM lock is held. Resume paths then invoke phylink/phylib and MDIO, which also expect RTNL, leading to possible deadlocks or PM lock vs MDIO wake issues. To avoid this, keep the device runtime-PM active by taking a usage reference in ax88772_bind() and dropping it in unbind(). A non-zero PM usage count blocks runtime suspend regardless of userspace policy (.../power/control - pm_runtime_allow/forbid), making this approach robust against sysfs overrides. Holding a runtime-PM usage ref does not affect system-wide suspend; system sleep/resume callbacks continue to run as before.
(CVE-2025-40120)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40120
https://ubuntu.com/security/CVE-2025-40120

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40120

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275210 - Linux Distros Unpatched Vulnerability : CVE-2025-40121
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping When an invalid value is passed via quirk option, currently bytcr_rt5640 driver just ignores and leaves as is, which may lead to unepxected results like OOB access. This patch adds the sanity check and corrects the input mapping to the certain default value if an invalid value is passed. (CVE-2025-40121)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40121
https://ubuntu.com/security/CVE-2025-40121

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40121

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275180 - Linux Distros Unpatched Vulnerability : CVE-2025-40123
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Enforce expected_attach_type for tailcall compatibility Yinhao et al. recently reported: Our fuzzer tool discovered an uninitialized pointer issue in the bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem. This leads to a NULL pointer dereference when a BPF program attempts to deference the txq member of struct xdp_buff object. The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the entry point for bpf_prog_test_run_xdp() and its expected_attach_type can neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP to pass xdp_is_valid_access() validation. The program returns struct xdp_md's egress_ifindex, and the latter is only allowed to be accessed under mentioned expected_attach_type. progB is then inserted into the tailcall which progA calls. The underlying issue goes beyond XDP though. Another example are programs of type BPF_PROG_TYPE_CGROUP_SOCK_ADDR.
sock_addr_is_valid_access() as well as sock_addr_func_proto() have different logic depending on the programs' expected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME should not be allowed doing a tailcall into a program which calls bpf_bind() out of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT. In short, specifying expected_attach_type allows to open up additional functionality or restrictions beyond what the basic bpf_prog_type enables. The use of tailcalls must not violate these constraints. Fix it by enforcing expected_attach_type in __bpf_prog_map_compatible(). Note that we only enforce this for tailcall maps, but not for BPF devmaps or cpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and cpu_map_bpf_prog_run*() which set up a new environment / context and therefore these situations are not prone to this issue. (CVE-2025-40123)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40123
https://security-tracker.debian.org/tracker/CVE-2025-40123
https://ubuntu.com/security/CVE-2025-40123

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40123

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275189 - Linux Distros Unpatched Vulnerability : CVE-2025-40125
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx In
__blk_mq_update_nr_hw_queues() the return value of blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx fails, later changing the number of hw_queues or removing disk will trigger the following warning: kernfs: can not remove 'nr_tags', no directory WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160 Call Trace: remove_files.isra.1+0x38/0xb0 sysfs_remove_group+0x4d/0x100 sysfs_remove_groups+0x31/0x60 __kobject_del+0x23/0xf0 kobject_del+0x17/0x40 blk_mq_unregister_hctx+0x5d/0x80 blk_mq_sysfs_unregister_hctxs+0x94/0xd0 blk_mq_update_nr_hw_queues+0x124/0x760 nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] nullb_device_submit_queues_store+0x92/0x120 [null_blk] kobjct_del() was called unconditionally even if sysfs creation failed. Fix it by checkig the kobject creation statusbefore deleting it. (CVE-2025-40125)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40125
https://ubuntu.com/security/CVE-2025-40125

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40125

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275185 - Linux Distros Unpatched Vulnerability : CVE-2025-40129
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sunrpc: fix null pointer dereference on zero-length checksum In xdr_stream_decode_opaque_auth(), zero- length checksum.len causes checksum.data to be set to NULL. This triggers a NPD when accessing checksum.data in gss_krb5_verify_mic_v2(). This patch ensures that the value of checksum.len is not less than XDR_UNIT. (CVE-2025-40129)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40129
https://ubuntu.com/security/CVE-2025-40129

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40129

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275195 - Linux Distros Unpatched Vulnerability : CVE-2025-40134
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- dm: fix NULL pointer dereference in __dm_suspend() There is a race condition between dm device suspend and table load that can lead to null pointer dereference. The issue occurs when suspend is invoked before table load completes: BUG: kernel NULL pointer dereference, address: 0000000000000054 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 6 PID: 6798 Comm: dmsetup Not tainted 6.6.0-g7e52f5f0ca9b #62 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP:
0010:blk_mq_wait_quiesce_done+0x0/0x50 Call Trace: <TASK> blk_mq_quiesce_queue+0x2c/0x50 dm_stop_queue+0xd/0x20 __dm_suspend+0x130/0x330 dm_suspend+0x11a/0x180 dev_suspend+0x27e/0x560 ctl_ioctl+0x4cf/0x850 dm_ctl_ioctl+0xd/0x20 vfs_ioctl+0x1d/0x50 __se_sys_ioctl+0x9b/0xc0
__x64_sys_ioctl+0x19/0x30 x64_sys_call+0x2c4a/0x4620 do_syscall_64+0x9e/0x1b0 The issue can be triggered as below: T1 T2 dm_suspend table_load __dm_suspend dm_setup_md_queue dm_mq_init_request_queue blk_mq_init_allocated_queue => q->mq_ops = set->ops; (1) dm_stop_queue / dm_wait_for_completion =>
q->tag_set NULL pointer! (2) => q->tag_set = set; (3) Fix this by checking if a valid table (map) exists before performing request-based suspend and waiting for target I/O. When map is NULL, skip these table- dependent suspend steps. Even when map is NULL, no I/O can reach any target because there is no table loaded; I/O submitted in this state will fail early in the DM layer. Skipping the table-dependent suspend logic in this case is safe and avoids NULL pointer dereferences. (CVE-2025-40134)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40134
https://ubuntu.com/security/CVE-2025-40134

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40134

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275213 - Linux Distros Unpatched Vulnerability : CVE-2025-40139
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). smc_clc_prfx_set() is called during connect() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use
__sk_dst_get() and dev_dst_rcu() under rcu_read_lock() after kernel_getsockname(). Note that the returned value of smc_clc_prfx_set() is not used in the caller. While at it, we change the 1st arg of smc_clc_prfx_set[46]_rcu() not to touch dst there. (CVE-2025-40139)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40139
https://security-tracker.debian.org/tracker/CVE-2025-40139
https://ubuntu.com/security/CVE-2025-40139

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40139

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275231 - Linux Distros Unpatched Vulnerability : CVE-2025-40141
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: ISO: Fix possible UAF on iso_conn_free This attempt to fix similar issue to sco_conn_free where if the conn->sk is not set to NULL may lead to UAF on iso_conn_free. (CVE-2025-40141)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40141
https://ubuntu.com/security/CVE-2025-40141

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40141

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275179 - Linux Distros Unpatched Vulnerability : CVE-2025-40146
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- blk-mq: fix potential deadlock while nr_requests grown Allocate and free sched_tags while queue is freezed can deadlock[1], this is a long term problem, hence allocate memory before freezing queue and free memory after queue is unfreezed. [1] https://lore.kernel.org/all/0659ea8d-a463-47c8-9180-43c719e106eb@linux.ibm.com/ (CVE-2025-40146)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40146
https://security-tracker.debian.org/tracker/CVE-2025-40146
https://ubuntu.com/security/CVE-2025-40146

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40146

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275181 - Linux Distros Unpatched Vulnerability : CVE-2025-40147
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- blk-throttle: fix access race during throttle policy activation On repeated cold boots we occasionally hit a NULL pointer crash in blk_should_throtl() when throttling is consulted before the throttle policy is fully enabled for the queue. Checking only q->td != NULL is insufficient during early initialization, so blkg_to_pd() for the throttle policy can still return NULL and blkg_to_tg() becomes NULL, which later gets dereferenced. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000156 ... pc : submit_bio_noacct+0x14c/0x4c8 lr : submit_bio_noacct+0x48/0x4c8 sp : ffff800087f0b690 x29:
ffff800087f0b690 x28: 0000000000005f90 x27: ffff00068af393c0 x26: 0000000000080000 x25: 000000000002fbc0 x24: ffff000684ddcc70 x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000 x20:
0000000000080000 x19: ffff000684ddcd08 x18: ffffffffffffffff x17: 0000000000000000 x16: ffff80008132a550 x15: 0000ffff98020fff x14: 0000000000000000 x13: 1fffe000d11d7021 x12: ffff000688eb810c x11:
ffff00077ec4bb80 x10: ffff000688dcb720 x9 : ffff80008068ef60 x8 : 00000a6fb8a86e85 x7 : 000000000000111e x6 : 0000000000000002 x5 : 0000000000000246 x4 : 0000000000015cff x3 : 0000000000394500 x2 :
ffff000682e35e40 x1 : 0000000000364940 x0 : 000000000000001a Call trace: submit_bio_noacct+0x14c/0x4c8 verity_map+0x178/0x2c8 __map_bio+0x228/0x250 dm_submit_bio+0x1c4/0x678 __submit_bio+0x170/0x230 submit_bio_noacct_nocheck+0x16c/0x388 submit_bio_noacct+0x16c/0x4c8 submit_bio+0xb4/0x210 f2fs_submit_read_bio+0x4c/0xf0 f2fs_mpage_readpages+0x3b0/0x5f0 f2fs_readahead+0x90/0xe8 Tighten blk_throtl_activated() to also require that the throttle policy bit is set on the queue: return q->td != NULL && test_bit(blkcg_policy_throtl.plid, q->blkcg_pols); This prevents blk_should_throtl() from accessing throttle group state until policy data has been attached to blkgs. (CVE-2025-40147)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40147
https://security-tracker.debian.org/tracker/CVE-2025-40147
https://ubuntu.com/security/CVE-2025-40147

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40147

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275200 - Linux Distros Unpatched Vulnerability : CVE-2025-40149
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). get_netdev_for_sock() is called during setsockopt(), so not under RCU. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dst_dev_rcu(). Note that the only ->ndo_sk_get_lower_dev() user is bond_sk_get_lower_dev(), which uses RCU. (CVE-2025-40149)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40149
https://security-tracker.debian.org/tracker/CVE-2025-40149
https://ubuntu.com/security/CVE-2025-40149

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40149

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275192 - Linux Distros Unpatched Vulnerability : CVE-2025-40153
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm: hugetlb: avoid soft lockup when mprotect to large memory area When calling mprotect() to a large hugetlb memory area in our customer's workload (~300GB hugetlb memory), soft lockup was observed:
watchdog: BUG: soft lockup - CPU#98 stuck for 23s! [t2_new_sysv:126916] CPU: 98 PID: 126916 Comm:
t2_new_sysv Kdump: loaded Not tainted 6.17-rc7 Hardware name: GIGACOMPUTING R2A3-T40-AAV1/Jefferson CIO, BIOS 5.4.4.1 07/15/2025 pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc :
mte_clear_page_tags+0x14/0x24 lr : mte_sync_tags+0x1c0/0x240 sp : ffff80003150bb80 x29: ffff80003150bb80 x28: ffff00739e9705a8 x27: 0000ffd2d6a00000 x26: 0000ff8e4bc00000 x25: 00e80046cde00f45 x24:
0000000000022458 x23: 0000000000000000 x22: 0000000000000004 x21: 000000011b380000 x20: ffff000000000000 x19: 000000011b379f40 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15:
0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc875e0aa5e2c x8 : 0000000000000000 x7 : 0000000000000000 x6 :
0000000000000000 x5 : fffffc01ce7a5c00 x4 : 00000000046cde00 x3 : fffffc0000000000 x2 : 0000000000000004 x1 : 0000000000000040 x0 : ffff0046cde7c000 Call trace: mte_clear_page_tags+0x14/0x24 set_huge_pte_at+0x25c/0x280 hugetlb_change_protection+0x220/0x430 change_protection+0x5c/0x8c mprotect_fixup+0x10c/0x294 do_mprotect_pkey.constprop.0+0x2e0/0x3d4 __arm64_sys_mprotect+0x24/0x44 invoke_syscall+0x50/0x160 el0_svc_common+0x48/0x144 do_el0_svc+0x30/0xe0 el0_svc+0x30/0xf0 el0t_64_sync_handler+0xc4/0x148 el0t_64_sync+0x1a4/0x1a8 Soft lockup is not triggered with THP or base page because there is cond_resched() called for each PMD size. Although the soft lockup was triggered by MTE, it should be not MTE specific. The other processing which takes long time in the loop may trigger soft lockup too. So add cond_resched() for hugetlb to avoid soft lockup. (CVE-2025-40153)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40153
https://ubuntu.com/security/CVE-2025-40153

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40153

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275223 - Linux Distros Unpatched Vulnerability : CVE-2025-40154
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping When an invalid value is passed via quirk option, currently bytcr_rt5640 driver only shows an error message but leaves as is. This may lead to unepxected results like OOB access. This patch corrects the input mapping to the certain default value if an invalid value is passed. (CVE-2025-40154)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40154
https://ubuntu.com/security/CVE-2025-40154

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40154

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275235 - Linux Distros Unpatched Vulnerability : CVE-2025-40155
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic In legacy mode, SSPTPTR is ignored if TT is not 00b or 01b. SSPTPTR maybe uninitialized or zero in that case and may cause oops like: Oops: general protection fault, probably for non-canonical address 0xf00087d3f000f000: 0000 [#1] SMP NOPTI CPU: 2 UID: 0 PID: 786 Comm: cat Not tainted 6.16.0 #191 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014 RIP: 0010:pgtable_walk_level+0x98/0x150 RSP: 0018:ffffc90000f279c0 EFLAGS: 00010206 RAX: 0000000040000000 RBX: ffffc90000f27ab0 RCX: 000000000000001e RDX: 0000000000000003 RSI: f00087d3f000f000 RDI: f00087d3f0010000 RBP: ffffc90000f27a00 R08: ffffc90000f27a98 R09:
0000000000000002 R10: 0000000000000000 R11: 0000000000000000 R12: f00087d3f000f000 R13: 0000000000000000 R14: 0000000040000000 R15: ffffc90000f27a98 FS: 0000764566dcb740(0000) GS:ffff8881f812c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000764566d44000 CR3:
0000000109d81003 CR4: 0000000000772ef0 PKRU: 55555554 Call Trace: <TASK> pgtable_walk_level+0x88/0x150 domain_translation_struct_show.isra.0+0x2d9/0x300 dev_domain_translation_struct_show+0x20/0x40 seq_read_iter+0x12d/0x490 ... Avoid walking the page table if TT is not 00b or 01b. (CVE-2025-40155)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40155
https://ubuntu.com/security/CVE-2025-40155

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40155

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275190 - Linux Distros Unpatched Vulnerability : CVE-2025-40160
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xen/events: Return -EEXIST for bound VIRQs Change find_virq() to return -EEXIST when a VIRQ is bound to a different CPU than the one passed in. With that, remove the BUG_ON() from bind_virq_to_irq() to propogate the error upwards. Some VIRQs are per-cpu, but others are per-domain or global. Those must be bound to CPU0 and can then migrate elsewhere. The lookup for per-domain and global will probably fail when migrated off CPU 0, especially when the current CPU is tracked. This now returns -EEXIST instead of BUG_ON(). A second call to bind a per-domain or global VIRQ is not expected, but make it non-fatal to avoid trying to look up the irq, since we don't know which per_cpu(virq_to_irq) it will be in. (CVE-2025-40160)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40160
https://security-tracker.debian.org/tracker/CVE-2025-40160
https://ubuntu.com/security/CVE-2025-40160

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40160

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275218 - Linux Distros Unpatched Vulnerability : CVE-2025-40162
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails devm_kasprintf() may return NULL on memory allocation failure, but the debug message prints cpus->dai_name before checking it. Move the dev_dbg() call after the NULL check to prevent potential NULL pointer dereference. (CVE-2025-40162)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40162
https://ubuntu.com/security/CVE-2025-40162

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40162

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275228 - Linux Distros Unpatched Vulnerability : CVE-2025-40166
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/xe/guc: Check GuC running state before deregistering exec queue In normal operation, a registered exec queue is disabled and deregistered through the GuC, and freed only after the GuC confirms completion.
However, if the driver is forced to unbind while the exec queue is still running, the user may call exec_destroy() after the GuC has already been stopped and CT communication disabled. In this case, the driver cannot receive a response from the GuC, preventing proper cleanup of exec queue resources. Fix this by directly releasing the resources when GuC is not running. Here is the failure dmesg log: [ 468.089581] ---[ end trace 0000000000000000 ]--- [ 468.089608] pci 0000:03:00.0: [drm] *ERROR* GT0: GUC ID manager unclean (1/65535) [ 468.090558] pci 0000:03:00.0: [drm] GT0: total 65535 [ 468.090562] pci 0000:03:00.0: [drm] GT0: used 1 [ 468.090564] pci 0000:03:00.0: [drm] GT0: range 1..1 (1) [ 468.092716]
------------[ cut here ]------------ [ 468.092719] WARNING: CPU: 14 PID: 4775 at drivers/gpu/drm/xe/xe_ttm_vram_mgr.c:298 ttm_vram_mgr_fini+0xf8/0x130 [xe] v2: use xe_uc_fw_is_running() instead of xe_guc_ct_enabled(). As CT may go down and come back during VF migration. (cherry picked from commit 9b42321a02c50a12b2beb6ae9469606257fbecea) (CVE-2025-40166)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40166
https://ubuntu.com/security/CVE-2025-40166

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40166

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275225 - Linux Distros Unpatched Vulnerability : CVE-2025-40167
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination syzbot reported a BUG_ON in ext4_es_cache_extent() when opening a verity file on a corrupted ext4 filesystem mounted without a journal. The issue is that the filesystem has an inode with both the INLINE_DATA and EXTENTS flags set:
EXT4-fs error (device loop0): ext4_cache_extents:545: inode #15: comm syz.0.17: corrupted extent tree:
lblk 0 < prev 66 Investigation revealed that the inode has both flags set: DEBUG: inode 15 - flag=1, i_inline_off=164, has_inline=1, extents_flag=1 This is an invalid combination since an inode should have either: - INLINE_DATA: data stored directly in the inode - EXTENTS: data stored in extent-mapped blocks Having both flags causes ext4_has_inline_data() to return true, skipping extent tree validation in
__ext4_iget(). The unvalidated out-of-order extents then trigger a BUG_ON in ext4_es_cache_extent() due to integer underflow when calculating hole sizes. Fix this by detecting this invalid flag combination early in ext4_iget() and rejecting the corrupted inode. (CVE-2025-40167)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40167
https://ubuntu.com/security/CVE-2025-40167

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40167

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275238 - Linux Distros Unpatched Vulnerability : CVE-2025-40168
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). smc_clc_prfx_match() is called from smc_listen_work() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use
__sk_dst_get() and dst_dev_rcu(). Note that the returned value of smc_clc_prfx_match() is not used in the caller. (CVE-2025-40168)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40168
https://security-tracker.debian.org/tracker/CVE-2025-40168
https://ubuntu.com/security/CVE-2025-40168

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40168

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275237 - Linux Distros Unpatched Vulnerability : CVE-2025-40169
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Reject negative offsets for ALU ops When verifying BPF programs, the check_alu_op() function validates instructions with ALU operations. The 'offset' field in these instructions is a signed 16-bit integer. The existing check 'insn->off > 1' was intended to ensure the offset is either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is signed, this check incorrectly accepts all negative values (e.g., -1). This commit tightens the validation by changing the condition to '(insn->off != 0 &&
insn->off != 1)'. This ensures that any value other than the explicitly permitted 0 and 1 is rejected, hardening the verifier against malformed BPF programs. (CVE-2025-40169)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40169
https://ubuntu.com/security/CVE-2025-40169

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40169

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275219 - Linux Distros Unpatched Vulnerability : CVE-2025-40173
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/ip6_tunnel: Prevent perpetual tunnel growth Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too. While ipv4 tunnel headroom adjustment growth was limited in commit 5ae1e9922bbd (net: ip_tunnel: prevent perpetual headroom growth), ipv6 tunnel yet increases the headroom without any ceiling. Reflect ipv4 tunnel headroom adjustment limit on ipv6 version. Credits to Francesco Ruggeri, who was originally debugging this issue and wrote local Arista-specific patch and a reproducer.
(CVE-2025-40173)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40173
https://ubuntu.com/security/CVE-2025-40173

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40173

Plugin Information
Published: 2025/11/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275361 - Linux Distros Unpatched Vulnerability : CVE-2025-40178
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- pid: Add a judgment for ns null in pid_nr_ns __task_pid_nr_ns ns = task_active_pid_ns(current);
pid_nr_ns(rcu_dereference(*task_pid_ptr(task, type)), ns); if (pid && ns->level <= pid->level) { Sometimes null is returned for task_active_pid_ns. Then it will trigger kernel panic in pid_nr_ns. For example:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000058 Mem abort info: ESR = 0x0000000096000007 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault Data abort info: ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 39-bit VAs, pgdp=00000002175aa000 [0000000000000058] pgd=08000002175ab003, p4d=08000002175ab003, pud=08000002175ab003, pmd=08000002175be003, pte=0000000000000000 pstate: 834000c5 (Nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : __task_pid_nr_ns+0x74/0xd0 lr : __task_pid_nr_ns+0x24/0xd0 sp : ffffffc08001bd10 x29:
ffffffc08001bd10 x28: ffffffd4422b2000 x27: 0000000000000001 x26: ffffffd442821168 x25: ffffffd442821000 x24: 00000f89492eab31 x23: 00000000000000c0 x22: ffffff806f5693c0 x21: ffffff806f5693c0 x20:
0000000000000001 x19: 0000000000000000 x18: 0000000000000000 x17: 00000000529c6ef0 x16: 00000000529c6ef0 x15: 00000000023a1adc x14: 0000000000000003 x13: 00000000007ef6d8 x12: 001167c391c78800 x11:
00ffffffffffffff x10: 0000000000000000 x9 : 0000000000000001 x8 : ffffff80816fa3c0 x7 : 0000000000000000 x6 : 49534d702d535449 x5 : ffffffc080c4c2c0 x4 : ffffffd43ee128c8 x3 : ffffffd43ee124dc x2 :
0000000000000000 x1 : 0000000000000001 x0 : ffffff806f5693c0 Call trace: __task_pid_nr_ns+0x74/0xd0 ...
__handle_irq_event_percpu+0xd4/0x284 handle_irq_event+0x48/0xb0 handle_fasteoi_irq+0x160/0x2d8 generic_handle_domain_irq+0x44/0x60 gic_handle_irq+0x4c/0x114 call_on_irq_stack+0x3c/0x74 do_interrupt_handler+0x4c/0x84 el1_interrupt+0x34/0x58 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x68/0x6c account_kernel_stack+0x60/0x144 exit_task_stack_account+0x1c/0x80 do_exit+0x7e4/0xaf8 ...
get_signal+0x7bc/0x8d8 do_notify_resume+0x128/0x828 el0_svc+0x6c/0x70 el0t_64_sync_handler+0x68/0xbc el0t_64_sync+0x1a8/0x1ac Code: 35fffe54 911a02a8 f9400108 b4000128 (b9405a69) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Oops: Fatal exception in interrupt (CVE-2025-40178)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40178
https://ubuntu.com/security/CVE-2025-40178

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40178

Plugin Information
Published: 2025/11/13, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275337 - Linux Distros Unpatched Vulnerability : CVE-2025-40179
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: verify orphan file size is not too big In principle orphan file can be arbitrarily large. However orphan replay needs to traverse it all and we also pin all its buffers in memory. Thus filesystems with absurdly large orphan files can lead to big amounts of memory consumed. Limit orphan file size to a sane value and also use kvmalloc() for allocating array of block descriptor structures to avoid large order allocations for sane but large orphan files. (CVE-2025-40179)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40179
https://ubuntu.com/security/CVE-2025-40179

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40179

Plugin Information
Published: 2025/11/13, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275358 - Linux Distros Unpatched Vulnerability : CVE-2025-40183
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} Cilium has a BPF egress gateway feature which forces outgoing K8s Pod traffic to pass through dedicated egress gateways which then SNAT the traffic in order to interact with stable IPs outside the cluster. The traffic is directed to the gateway via vxlan tunnel in collect md mode. A recent BPF change utilized the bpf_redirect_neigh() helper to forward packets after the arrival and decap on vxlan, which turned out over time that the kmalloc-256 slab usage in kernel was ever-increasing. The issue was that vxlan allocates the metadata_dst object and attaches it through a fake dst entry to the skb. The latter was never released though given bpf_redirect_neigh() was merely setting the new dst entry via skb_dst_set() without dropping an existing one first. (CVE-2025-40183)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40183
https://ubuntu.com/security/CVE-2025-40183

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40183

Plugin Information
Published: 2025/11/13, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275334 - Linux Distros Unpatched Vulnerability : CVE-2025-40187
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 and sctp_ulpevent_make_authkey() returns 0, then the variable ai_ev remains zero and the zero will be dereferenced in the sctp_ulpevent_free() function. (CVE-2025-40187)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40187
https://ubuntu.com/security/CVE-2025-40187

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40187

Plugin Information
Published: 2025/11/13, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275365 - Linux Distros Unpatched Vulnerability : CVE-2025-40194
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() The cpufreq_cpu_put() call in update_qos_request() takes place too early because the latter subsequently calls freq_qos_update_request() that indirectly accesses the policy object in question through the QoS request object passed to it.
Fortunately, update_qos_request() is called under intel_pstate_driver_lock, so this issue does not matter for changing the intel_pstate operation mode, but it theoretically can cause a crash to occur on CPU device hot removal (which currently can only happen in virt, but it is formally supported nevertheless).
Address this issue by modifying update_qos_request() to drop the reference to the policy later.
(CVE-2025-40194)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40194
https://ubuntu.com/security/CVE-2025-40194

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40194

Plugin Information
Published: 2025/11/13, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275367 - Linux Distros Unpatched Vulnerability : CVE-2025-40195
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mount: handle NULL values in mnt_ns_release() When calling in listmount() mnt_ns_release() may be passed a NULL pointer. Handle that case gracefully. (CVE-2025-40195)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40195
https://ubuntu.com/security/CVE-2025-40195

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40195

Plugin Information
Published: 2025/11/13, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275335 - Linux Distros Unpatched Vulnerability : CVE-2025-40197
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: media: mc: Clear minor number before put device The device minor should not be cleared after the device is released. (CVE-2025-40197)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40197
https://ubuntu.com/security/CVE-2025-40197

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40197

Plugin Information
Published: 2025/11/13, Modified: 2025/12/12
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275345 - Linux Distros Unpatched Vulnerability : CVE-2025-40199
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches Helge reported that the introduction of PP_MAGIC_MASK let to crashes on boot on his 32-bit parisc machine. The cause of this is the mask is set too wide, so the page_pool_page_is_pp() incurs false positives which crashes the machine. Just disabling the check in page_pool_is_pp() will lead to the page_pool code itself malfunctioning; so instead of doing this, this patch changes the define for PP_DMA_INDEX_BITS to avoid mistaking arbitrary kernel pointers for page_pool-tagged pages. The fix relies on the kernel pointers that alias with the pp_magic field always being above PAGE_OFFSET. With this assumption, we can use the lowest bit of the value of PAGE_OFFSET as the upper bound of the PP_DMA_INDEX_MASK, which should avoid the false positives. Because we cannot rely on PAGE_OFFSET always being a compile-time constant, nor on it always being >0, we fall back to disabling the dma_index storage when there are not enough bits available. This leaves us in the situation we were in before the patch in the Fixes tag, but only on a subset of architecture configurations. This seems to be the best we can do until the transition to page types in complete for page_pool pages. v2: - Make sure there's at least 8 bits available and that the PAGE_OFFSET bit calculation doesn't wrap (CVE-2025-40199)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40199
https://ubuntu.com/security/CVE-2025-40199

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40199

Plugin Information
Published: 2025/11/13, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275357 - Linux Distros Unpatched Vulnerability : CVE-2025-40200
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Squashfs: reject negative file sizes in squashfs_read_inode() Syskaller reports a WARNING in ovl_copy_up_file in overlayfs. This warning is ultimately caused because the underlying Squashfs file system returns a file with a negative file size. This commit checks for a negative file size and returns EINVAL. [phillip@squashfs.org.uk: only need to check 64 bit quantity] (CVE-2025-40200)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40200
https://ubuntu.com/security/CVE-2025-40200

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40200

Plugin Information
Published: 2025/11/13, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275352 - Linux Distros Unpatched Vulnerability : CVE-2025-40201
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths The usage of task_lock(tsk->group_leader) in sys_prlimit64()->do_prlimit() path is very broken. sys_prlimit64() does get_task_struct(tsk) but this only protects task_struct itself. If tsk != current and tsk is not a leader, this process can exit/exec and task_lock(tsk->group_leader) may use the already freed task_struct. Another problem is that sys_prlimit64() can race with mt-exec which changes ->group_leader. In this case do_prlimit() may take the wrong lock, or (worse) ->group_leader may change between task_lock() and task_unlock(). Change sys_prlimit64() to take tasklist_lock when necessary. This is not nice, but I don't see a better fix for -stable. (CVE-2025-40201)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40201
https://ubuntu.com/security/CVE-2025-40201

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40201

Plugin Information
Published: 2025/11/13, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
275351 - Linux Distros Unpatched Vulnerability : CVE-2025-40206
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- netfilter: nft_objref: validate objref and objrefmap expressions Referencing a synproxy stateful object from OUTPUT hook causes kernel crash due to infinite recursive calls: BUG: TASK stack guard page was hit at 000000008bda5b8c (stack is 000000003ab1c4a5..00000000494d8b12) [...] Call Trace:
__find_rr_leaf+0x99/0x230 fib6_table_lookup+0x13b/0x2d0 ip6_pol_route+0xa4/0x400 fib6_rule_lookup+0x156/0x240 ip6_route_output_flags+0xc6/0x150 __nf_ip6_route+0x23/0x50 synproxy_send_tcp_ipv6+0x106/0x200 synproxy_send_client_synack_ipv6+0x1aa/0x1f0 nft_synproxy_do_eval+0x263/0x310 nft_do_chain+0x5a8/0x5f0 [nf_tables nft_do_chain_inet+0x98/0x110 nf_hook_slow+0x43/0xc0 __ip6_local_out+0xf0/0x170 ip6_local_out+0x17/0x70 synproxy_send_tcp_ipv6+0x1a2/0x200 synproxy_send_client_synack_ipv6+0x1aa/0x1f0 [...] Implement objref and objrefmap expression validate functions. Currently, only NFT_OBJECT_SYNPROXY object type requires validation. This will also handle a jump to a chain using a synproxy object from the OUTPUT hook. Now when trying to reference a synproxy object in the OUTPUT hook, nft will produce the following error:
synproxy_crash.nft: Error: Could not process rule: Operation not supported synproxy name mysynproxy ^^^^^^^^^^^^^^^^^^^^^^^^ (CVE-2025-40206)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40206
https://security-tracker.debian.org/tracker/CVE-2025-40206
https://ubuntu.com/security/CVE-2025-40206

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40206

Plugin Information
Published: 2025/11/13, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277482 - Linux Distros Unpatched Vulnerability : CVE-2025-40215
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xfrm: delete x->tunnel as we delete x The ipcomp fallback tunnels currently get deleted (from the various lists and hashtables) as the last user state that needed that fallback is destroyed (not deleted). If a reference to that user state still exists, the fallback state will remain on the hashtables/lists, triggering the WARN in xfrm_state_fini. Because of those remaining references, the fix in commit f75a2804da39 (xfrm: destroy xfrm_state synchronously on net exit path) is not complete. We recently fixed one such situation in TCP due to defered freeing of skbs (commit 9b6412e6979f (tcp: drop secpath at the same time as we currently drop dst)). This can also happen due to IP reassembly: skbs with a secpath remain on the reassembly queue until netns destruction. If we can't guarantee that the queues are flushed by the time xfrm_state_fini runs, there may still be references to a (user) xfrm_state, preventing the timely deletion of the corresponding fallback state. Instead of chasing each instance of skbs holding a secpath one by one, this patch fixes the issue directly within xfrm, by deleting the fallback state as soon as the last user state depending on it has been deleted. Destruction will still happen when the final reference is dropped. A separate lockdep class for the fallback state is required since we're going to lock x->tunnel while x is locked. (CVE-2025-40215)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40215
https://security-tracker.debian.org/tracker/CVE-2025-40215
https://ubuntu.com/security/CVE-2025-40215

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.2 (CVSS2#AV:L/AC:L/Au:S/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40215

Plugin Information
Published: 2025/12/04, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277593 - Linux Distros Unpatched Vulnerability : CVE-2025-40216
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- io_uring/rsrc: don't rely on user vaddr alignment There is no guaranteed alignment for user pointers, however the calculation of an offset of the first page into a folio after coalescing uses some weird bit mask logic, get rid of it. (CVE-2025-40216)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40216
https://ubuntu.com/security/CVE-2025-40216

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40216

Plugin Information
Published: 2025/12/05, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277478 - Linux Distros Unpatched Vulnerability : CVE-2025-40217
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- pidfs: validate extensible ioctls Validate extensible ioctls stricter than we do now. (CVE-2025-40217)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40217
https://security-tracker.debian.org/tracker/CVE-2025-40217
https://ubuntu.com/security/CVE-2025-40217

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40217

Plugin Information
Published: 2025/12/04, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277596 - Linux Distros Unpatched Vulnerability : CVE-2025-40218
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success DAMON's virtual address space operation set implementation (vaddr) calls pte_offset_map_lock() inside the page table walk callback function. This is for reading and writing page table accessed bits. If pte_offset_map_lock() fails, it retries by returning the page table walk callback function with ACTION_AGAIN. pte_offset_map_lock() can continuously fail if the target is a pmd migration entry, though. Hence it could cause an infinite page table walk if the migration cannot be done until the page table walk is finished. This indeed caused a soft lockup when CPU hotplugging and DAMON were running in parallel. Avoid the infinite loop by simply not retrying the page table walk. DAMON is promising only a best-effort accuracy, so missing access to such pages is no problem. (CVE-2025-40218)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40218
https://ubuntu.com/security/CVE-2025-40218

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.1 (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
3.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40218

Plugin Information
Published: 2025/12/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277481 - Linux Distros Unpatched Vulnerability : CVE-2025-40219
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV Before disabling SR-IOV via config space accesses to the parent PF, sriov_disable() first removes the PCI devices representing the VFs. Since commit 9d16947b7583 (PCI: Add global pci_lock_rescan_remove()) such removal operations are serialized against concurrent remove and rescan using the pci_rescan_remove_lock. No such locking was ever added in sriov_disable() however. In particular when commit 18f9e9d150fc (PCI/IOV: Factor out sriov_add_vfs()) factored out the PCI device removal into sriov_del_vfs() there was still no locking around the pci_iov_remove_virtfn() calls. On s390 the lack of serialization in sriov_disable() may cause double remove and list corruption with the below (amended) trace being observed: PSW: 0704c00180000000 0000000c914e4b38 (klist_put+56) GPRS: 000003800313fb48 0000000000000000 0000000100000001 0000000000000001 00000000f9b520a8 0000000000000000 0000000000002fbd 00000000f4cc9480 0000000000000001 0000000000000000 0000000000000000 0000000180692828 00000000818e8000 000003800313fe2c 000003800313fb20 000003800313fad8 #0 [3800313fb20] device_del at c9158ad5c #1 [3800313fb88] pci_remove_bus_device at c915105ba #2 [3800313fbd0] pci_iov_remove_virtfn at c9152f198 #3 [3800313fc28] zpci_iov_remove_virtfn at c90fb67c0 #4 [3800313fc60] zpci_bus_remove_device at c90fb6104 #5 [3800313fca0] __zpci_event_availability at c90fb3dca #6 [3800313fd08] chsc_process_sei_nt0 at c918fe4a2 #7 [3800313fd60] crw_collect_info at c91905822 #8 [3800313fe10] kthread at c90feb390 #9 [3800313fe68] __ret_from_fork at c90f6aa64 #10 [3800313fe98] ret_from_fork at c9194f3f2. This is because in addition to sriov_disable() removing the VFs, the platform also generates hot-unplug events for the VFs. This being the reverse operation to the hotplug events generated by sriov_enable() and handled via pdev->no_vf_scan. And while the event processing takes pci_rescan_remove_lock and checks whether the struct pci_dev still exists, the lack of synchronization makes this checking racy. Other races may also be possible of course though given that this lack of locking persisted so long observable races seem very rare. Even on s390 the list corruption was only observed with certain devices since the platform events are only triggered by config accesses after the removal, so as long as the removal finished synchronously they would not race. Either way the locking is missing so fix this by adding it to the sriov_del_vfs() helper. Just like PCI rescan-remove, locking is also missing in sriov_add_vfs() including for the error case where pci_stop_and_remove_bus_device() is called without the PCI rescan-remove lock being held. Even in the non-error case, adding new PCI devices and buses should be serialized via the PCI rescan-remove lock. Add the necessary locking. (CVE-2025-40219)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40219
https://ubuntu.com/security/CVE-2025-40219

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40219

Plugin Information
Published: 2025/12/04, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277496 - Linux Distros Unpatched Vulnerability : CVE-2025-40220
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fuse: fix livelock in synchronous file put from fuseblk workers I observed a hang when running generic/323 against a fuseblk server. This test opens a file, initiates a lot of AIO writes to that file descriptor, and closes the file descriptor before the writes complete. Unsurprisingly, the AIO exerciser threads are mostly stuck waiting for responses from the fuseblk server: # cat /proc/372265/task/372313/stack [<0>] request_wait_answer+0x1fe/0x2a0 [fuse] [<0>] __fuse_simple_request+0xd3/0x2b0 [fuse] [<0>] fuse_do_getattr+0xfc/0x1f0 [fuse] [<0>] fuse_file_read_iter+0xbe/0x1c0 [fuse] [<0>] aio_read+0x130/0x1e0 [<0>] io_submit_one+0x542/0x860 [<0>] __x64_sys_io_submit+0x98/0x1a0 [<0>] do_syscall_64+0x37/0xf0 [<0>] entry_SYSCALL_64_after_hwframe+0x4b/0x53 But the /weird/ part is that the fuseblk server threads are waiting for responses from itself: # cat /proc/372210/task/372232/stack [<0>] request_wait_answer+0x1fe/0x2a0 [fuse] [<0>] __fuse_simple_request+0xd3/0x2b0 [fuse] [<0>] fuse_file_put+0x9a/0xd0 [fuse] [<0>] fuse_release+0x36/0x50 [fuse] [<0>] __fput+0xec/0x2b0 [<0>] task_work_run+0x55/0x90 [<0>] syscall_exit_to_user_mode+0xe9/0x100 [<0>] do_syscall_64+0x43/0xf0 [<0>] entry_SYSCALL_64_after_hwframe+0x4b/0x53 The fuseblk server is fuse2fs so there's nothing all that exciting in the server itself. So why is the fuse server calling fuse_file_put? The commit message for the fstest sheds some light on that: By closing the file descriptor before calling io_destroy, you pretty much guarantee that the last put on the ioctx will be done in interrupt context (during I/O completion).
Aha. AIO fgets a new struct file from the fd when it queues the ioctx. The completion of the FUSE_WRITE command from userspace causes the fuse server to call the AIO completion function. The completion puts the struct file, queuing a delayed fput to the fuse server task. When the fuse server task returns to userspace, it has to run the delayed fput, which in the case of a fuseblk server, it does synchronously.
Sending the FUSE_RELEASE command sychronously from fuse server threads is a bad idea because a client program can initiate enough simultaneous AIOs such that all the fuse server threads end up in delayed_fput, and now there aren't any threads left to handle the queued fuse commands. Fix this by only using asynchronous fputs when closing files, and leave a comment explaining why. (CVE-2025-40220)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40220
https://ubuntu.com/security/CVE-2025-40220

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40220

Plugin Information
Published: 2025/12/04, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277479 - Linux Distros Unpatched Vulnerability : CVE-2025-40231
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vsock: fix lock inversion in vsock_assign_transport() Syzbot reported a potential lock inversion deadlock between vsock_register_mutex and sk_lock-AF_VSOCK when vsock_linger() is called. The issue was introduced by commit 687aa0c5581b (vsock: Fix transport_* TOCTOU) which added vsock_register_mutex locking in vsock_assign_transport() around the transport->release() call, that can call vsock_linger().
vsock_assign_transport() can be called with sk_lock held. vsock_linger() calls sk_wait_event() that temporarily releases and re-acquires sk_lock. During this window, if another thread hold vsock_register_mutex while trying to acquire sk_lock, a circular dependency is created. Fix this by releasing vsock_register_mutex before calling transport->release() and vsock_deassign_transport(). This is safe because we don't need to hold vsock_register_mutex while releasing the old transport, and we ensure the new transport won't disappear by obtaining a module reference first via try_module_get().
(CVE-2025-40231)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40231
https://ubuntu.com/security/CVE-2025-40231

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40231

Plugin Information
Published: 2025/12/04, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277597 - Linux Distros Unpatched Vulnerability : CVE-2025-40237
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fs/notify: call exportfs_encode_fid with s_umount Calling intotify_show_fdinfo() on fd watching an overlayfs inode, while the overlayfs is being unmounted, can lead to dereferencing NULL ptr. This issue was found by syzkaller. Race Condition Diagram: Thread 1 Thread 2 -------- -------- generic_shutdown_super() shrink_dcache_for_umount sb->s_root = NULL | | vfs_read() | inotify_fdinfo() | * inode get from mark * | show_mark_fhandle(m, inode) | exportfs_encode_fid(inode, ..) | ovl_encode_fh(inode, ..) | ovl_check_encode_origin(inode) | * deref i_sb->s_root * | | v fsnotify_sb_delete(sb) Which then leads to: [ 32.133461] Oops: general protection fault, probably for non- canonical address 0xdffffc0000000006: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 32.134438] KASAN: null- ptr-deref in range [0x0000000000000030-0x0000000000000037] [ 32.135032] CPU: 1 UID: 0 PID: 4468 Comm:
systemd-coredum Not tainted 6.17.0-rc6 #22 PREEMPT(none) <snip registers, unreliable trace> [ 32.143353] Call Trace: [ 32.143732] ovl_encode_fh+0xd5/0x170 [ 32.144031] exportfs_encode_inode_fh+0x12f/0x300 [ 32.144425] show_mark_fhandle+0xbe/0x1f0 [ 32.145805] inotify_fdinfo+0x226/0x2d0 [ 32.146442] inotify_show_fdinfo+0x1c5/0x350 [ 32.147168] seq_show+0x530/0x6f0 [ 32.147449] seq_read_iter+0x503/0x12a0 [ 32.148419] seq_read+0x31f/0x410 [ 32.150714] vfs_read+0x1f0/0x9e0 [ 32.152297] ksys_read+0x125/0x240 IOW ovl_check_encode_origin derefs inode->i_sb->s_root, after it was set to NULL in the unmount path. Fix it by protecting calling exportfs_encode_fid() from show_mark_fhandle() with s_umount lock. This form of fix was suggested by Amir in [1]. [1]:
https://lore.kernel.org/all/CAOQ4uxhbDwhb+2Brs1UdkoF0a3NSdBAOQPNfEHjahrgoKJpLEw@mail.gmail.com/ (CVE-2025-40237)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40237
https://ubuntu.com/security/CVE-2025-40237

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40237

Plugin Information
Published: 2025/12/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277592 - Linux Distros Unpatched Vulnerability : CVE-2025-40238
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mlx5: Fix IPsec cleanup over MPV device When we do mlx5e_detach_netdev() we eventually disable blocking events notifier, among those events are IPsec MPV events from IB to core. So before disabling those blocking events, make sure to also unregister the devcom device and mark all this device operations as complete, in order to prevent the other device from using invalid netdev during future devcom events which could cause the trace below. BUG: kernel NULL pointer dereference, address: 0000000000000010 PGD 146427067 P4D 146427067 PUD 146488067 PMD 0 Oops: Oops: 0000 [#1] SMP CPU: 1 UID: 0 PID: 7735 Comm:
devlink Tainted: GW 6.12.0-rc6_for_upstream_min_debug_2024_11_08_00_46 #1 Tainted: [W]=WARN Hardware name:
QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP:
0010:mlx5_devcom_comp_set_ready+0x5/0x40 [mlx5_core] Code: 00 01 48 83 05 23 32 1e 00 01 41 b8 ed ff ff ff e9 60 ff ff ff 48 83 05 00 32 1e 00 01 eb e3 66 0f 1f 44 00 00 0f 1f 44 00 00 <48> 8b 47 10 48 83 05 5f 32 1e 00 01 48 8b 50 40 48 85 d2 74 05 40 RSP: 0018:ffff88811a5c35f8 EFLAGS: 00010206 RAX: ffff888106e8ab80 RBX: ffff888107d7e200 RCX: ffff88810d6f0a00 RDX: ffff88810d6f0a00 RSI: 0000000000000001 RDI:
0000000000000000 RBP: ffff88811a17e620 R08: 0000000000000040 R09: 0000000000000000 R10: ffff88811a5c3618 R11: 0000000de85d51bd R12: ffff88811a17e600 R13: ffff88810d6f0a00 R14: 0000000000000000 R15:
ffff8881034bda80 FS: 00007f27bdf89180(0000) GS:ffff88852c880000(0000) knlGS:0000000000000000 CS: 0010 DS:
0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000010 CR3: 000000010f159005 CR4: 0000000000372eb0 DR0:
0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __die+0x20/0x60 ? page_fault_oops+0x150/0x3e0 ? exc_page_fault+0x74/0x130 ? asm_exc_page_fault+0x22/0x30 ? mlx5_devcom_comp_set_ready+0x5/0x40 [mlx5_core] mlx5e_devcom_event_mpv+0x42/0x60 [mlx5_core] mlx5_devcom_send_event+0x8c/0x170 [mlx5_core] blocking_event+0x17b/0x230 [mlx5_core] notifier_call_chain+0x35/0xa0 blocking_notifier_call_chain+0x3d/0x60 mlx5_blocking_notifier_call_chain+0x22/0x30 [mlx5_core] mlx5_core_mp_event_replay+0x12/0x20 [mlx5_core] mlx5_ib_bind_slave_port+0x228/0x2c0 [mlx5_ib] mlx5_ib_stage_init_init+0x664/0x9d0 [mlx5_ib] ? idr_alloc_cyclic+0x50/0xb0 ?
__kmalloc_cache_noprof+0x167/0x340 ? __kmalloc_noprof+0x1a7/0x430 __mlx5_ib_add+0x34/0xd0 [mlx5_ib] mlx5r_probe+0xe9/0x310 [mlx5_ib] ? kernfs_add_one+0x107/0x150 ? __mlx5_ib_add+0xd0/0xd0 [mlx5_ib] auxiliary_bus_probe+0x3e/0x90 really_probe+0xc5/0x3a0 ? driver_probe_device+0x90/0x90
__driver_probe_device+0x80/0x160 driver_probe_device+0x1e/0x90 __device_attach_driver+0x7d/0x100 bus_for_each_drv+0x80/0xd0 __device_attach+0xbc/0x1f0 bus_probe_device+0x86/0xa0 device_add+0x62d/0x830
__auxiliary_device_add+0x3b/0xa0 ? auxiliary_device_init+0x41/0x90 add_adev+0xd1/0x150 [mlx5_core] mlx5_rescan_drivers_locked+0x21c/0x300 [mlx5_core] esw_mode_change+0x6c/0xc0 [mlx5_core] mlx5_devlink_eswitch_mode_set+0x21e/0x640 [mlx5_core] devlink_nl_eswitch_set_doit+0x60/0xe0 genl_family_rcv_msg_doit+0xd0/0x120 genl_rcv_msg+0x180/0x2b0 ? devlink_get_from_attrs_lock+0x170/0x170 ? devlink_nl_eswitch_get_doit+0x290/0x290 ? devlink_nl_pre_doit_port_optional+0x50/0x50 ? genl_family_rcv_msg_dumpit+0xf0/0xf0 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x1fc/0x2d0 netlink_sendmsg+0x1e4/0x410 __sock_sendmsg+0x38/0x60 ? sockfd_lookup_light+0x12/0x60 __sys_sendto+0x105/0x160 ? __sys_recvmsg+0x4e/0x90
__x64_sys_sendto+0x20/0x30 do_syscall_64+0x4c/0x100 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP:
0033:0x7f27bc91b13a Code: bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 8b 05 fa 96 2c 00 45 89 c9 4c 63 d1 48 63 ff 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff ---truncated--- (CVE-2025-40238)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40238
https://ubuntu.com/security/CVE-2025-40238

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40238

Plugin Information
Published: 2025/12/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277589 - Linux Distros Unpatched Vulnerability : CVE-2025-40239
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: phy: micrel: always set shared->phydev for LAN8814 Currently, during the LAN8814 PTP probe shared->phydev is only set if PTP clock gets actually set, otherwise the function will return before setting it. This is an issue as shared->phydev is unconditionally being used when IRQ is being handled, especially in lan8814_gpio_process_cap and since it was not set it will cause a NULL pointer exception and crash the kernel. So, simply always set shared->phydev to avoid the NULL pointer exception.
(CVE-2025-40239)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40239
https://ubuntu.com/security/CVE-2025-40239

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40239

Plugin Information
Published: 2025/12/05, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277511 - Linux Distros Unpatched Vulnerability : CVE-2025-40248
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vsock: Ignore signal/timeout on connect() if already established During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues: 1. connect() invoking vsock_transport_cancel_pkt() -> virtio_transport_purge_skbs() may race with sendmsg() invoking virtio_transport_get_credit(). This results in a permanently elevated `vvs->bytes_unsent`. Which, in turn, confuses the SOCK_LINGER handling. 2. connect() resetting a connected socket's state may race with socket being placed in a sockmap. A disconnected socket remaining in a sockmap breaks sockmap's assumptions. And gives rise to WARNs. 3. connect() transitioning SS_CONNECTED -> SS_UNCONNECTED allows for a transport change/drop after TCP_ESTABLISHED. Which poses a problem for any simultaneous sendmsg() or connect() and may result in a use-after-free/null-ptr-deref. Do not disconnect socket on signal/timeout. Keep the logic for unconnected sockets: they don't linger, can't be placed in a sockmap, are rejected by sendmsg(). [1]:
https://lore.kernel.org/netdev/e07fd95c-9a38-4eea-9638-133e38c2ec9b@rbox.co/ [2]:
https://lore.kernel.org/netdev/20250317-vsock-trans-signal-race-v4-0-fc8837f3f1d4@rbox.co/ [3]:
https://lore.kernel.org/netdev/60f1b7db-3099-4f6a-875e-af9f6ef194f6@rbox.co/ (CVE-2025-40248)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40248
https://security-tracker.debian.org/tracker/CVE-2025-40248
https://ubuntu.com/security/CVE-2025-40248

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40248

Plugin Information
Published: 2025/12/04, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277519 - Linux Distros Unpatched Vulnerability : CVE-2025-40250
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mlx5: Clean up only new IRQ glue on request_irq() failure The mlx5_irq_alloc() function can inadvertently free the entire rmap and end up in a crash[1] when the other threads tries to access this, when request_irq() fails due to exhausted IRQ vectors. This commit modifies the cleanup to remove only the specific IRQ mapping that was just added. This prevents removal of other valid mappings and ensures precise cleanup of the failed IRQ allocation's associated glue object. Note: This error is observed when both fwctl and rds configs are enabled. [1] mlx5_core 0000:05:00.0: Successfully registered panic handler for port 1 mlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to request irq. err = -28 infiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while trying to test write-combining support mlx5_core 0000:05:00.0: Successfully unregistered panic handler for port 1 mlx5_core 0000:06:00.0:
Successfully registered panic handler for port 1 mlx5_core 0000:06:00.0: mlx5_irq_alloc:293:(pid 66740):
Failed to request irq. err = -28 infiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while trying to test write-combining support mlx5_core 0000:06:00.0: Successfully unregistered panic handler for port 1 mlx5_core 0000:03:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to request irq. err = -28 mlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to request irq. err = -28 general protection fault, probably for non-canonical address 0xe277a58fde16f291: 0000 [#1] SMP NOPTI RIP:
0010:free_irq_cpu_rmap+0x23/0x7d Call Trace: <TASK> ? show_trace_log_lvl+0x1d6/0x2f9 ? show_trace_log_lvl+0x1d6/0x2f9 ? mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core] ? __die_body.cold+0x8/0xa ? die_addr+0x39/0x53 ? exc_general_protection+0x1c4/0x3e9 ? dev_vprintk_emit+0x5f/0x90 ? asm_exc_general_protection+0x22/0x27 ? free_irq_cpu_rmap+0x23/0x7d mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core] irq_pool_request_vector+0x7d/0x90 [mlx5_core] mlx5_irq_request+0x2e/0xe0 [mlx5_core] mlx5_irq_request_vector+0xad/0xf7 [mlx5_core] comp_irq_request_pci+0x64/0xf0 [mlx5_core] create_comp_eq+0x71/0x385 [mlx5_core] ? mlx5e_open_xdpsq+0x11c/0x230 [mlx5_core] mlx5_comp_eqn_get+0x72/0x90 [mlx5_core] ? xas_load+0x8/0x91 mlx5_comp_irqn_get+0x40/0x90 [mlx5_core] mlx5e_open_channel+0x7d/0x3c7 [mlx5_core] mlx5e_open_channels+0xad/0x250 [mlx5_core] mlx5e_open_locked+0x3e/0x110 [mlx5_core] mlx5e_open+0x23/0x70 [mlx5_core] __dev_open+0xf1/0x1a5
__dev_change_flags+0x1e1/0x249 dev_change_flags+0x21/0x5c do_setlink+0x28b/0xcc4 ? __nla_parse+0x22/0x3d ? inet6_validate_link_af+0x6b/0x108 ? cpumask_next+0x1f/0x35 ? __snmp6_fill_stats64.constprop.0+0x66/0x107 ?
__nla_validate_parse+0x48/0x1e6 __rtnl_newlink+0x5ff/0xa57 ? kmem_cache_alloc_trace+0x164/0x2ce rtnl_newlink+0x44/0x6e rtnetlink_rcv_msg+0x2bb/0x362 ? __netlink_sendskb+0x4c/0x6c ? netlink_unicast+0x28f/0x2ce ? rtnl_calcit.isra.0+0x150/0x146 netlink_rcv_skb+0x5f/0x112 netlink_unicast+0x213/0x2ce netlink_sendmsg+0x24f/0x4d9 __sock_sendmsg+0x65/0x6a
____sys_sendmsg+0x28f/0x2c9 ? import_iovec+0x17/0x2b ___sys_sendmsg+0x97/0xe0 __sys_sendmsg+0x81/0xd8 do_syscall_64+0x35/0x87 entry_SYSCALL_64_after_hwframe+0x6e/0x0 RIP: 0033:0x7fc328603727 Code: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 0b ed ff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 44 ed ff ff 48 RSP: 002b:00007ffe8eb3f1a0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 000000000000000d RCX:
00007fc328603727 RDX: 0000000000000000 RSI: 00007ffe8eb3f1f0 RDI: 000000000000000d RBP: 00007ffe8eb3f1f0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000293 R12:
0000000000000000 R13: 00000000000 ---truncated--- (CVE-2025-40250)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40250
https://security-tracker.debian.org/tracker/CVE-2025-40250
https://ubuntu.com/security/CVE-2025-40250

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40250

Plugin Information
Published: 2025/12/04, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277508 - Linux Distros Unpatched Vulnerability : CVE-2025-40252
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() The loops in 'qede_tpa_cont()' and 'qede_tpa_end()', iterate over 'cqe->len_list[]' using only a zero-length terminator as the stopping condition. If the terminator was missing or malformed, the loop could run past the end of the fixed-size array. Add an explicit bound check using ARRAY_SIZE() in both loops to prevent a potential out-of-bounds access. Found by Linux Verification Center (linuxtesting.org) with SVACE. (CVE-2025-40252)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40252
https://security-tracker.debian.org/tracker/CVE-2025-40252
https://ubuntu.com/security/CVE-2025-40252

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)
CVSS v3.0 Temporal Score
5.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40252

Plugin Information
Published: 2025/12/04, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277510 - Linux Distros Unpatched Vulnerability : CVE-2025-40253
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- s390/ctcm: Fix double-kfree The function 'mpc_rcvd_sweep_req(mpcginfo)' is called conditionally from function 'ctcmpc_unpack_skb'. It frees passed mpcginfo. After that a call to function 'kfree' in function 'ctcmpc_unpack_skb' frees it again. Remove 'kfree' call in function 'mpc_rcvd_sweep_req(mpcginfo)'. Bug detected by the clang static analyzer. (CVE-2025-40253)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40253
https://security-tracker.debian.org/tracker/CVE-2025-40253
https://ubuntu.com/security/CVE-2025-40253

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40253

Plugin Information
Published: 2025/12/04, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277528 - Linux Distros Unpatched Vulnerability : CVE-2025-40254
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: openvswitch: remove never-working support for setting nsh fields The validation of the set(nsh(...)) action is completely wrong. It runs through the nsh_key_put_from_nlattr() function that is the same function that validates NSH keys for the flow match and the push_nsh() action. However, the set(nsh(...)) has a very different memory layout. Nested attributes in there are doubled in size in case of the masked set(). That makes proper validation impossible. There is also confusion in the code between the 'masked'
flag, that says that the nested attributes are doubled in size containing both the value and the mask, and the 'is_mask' that says that the value we're parsing is the mask. This is causing kernel crash on trying to write into mask part of the match with SW_FLOW_KEY_PUT() during validation, while validate_nsh() doesn't allocate any memory for it: BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF:
supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 1c2383067 P4D 1c2383067 PUD 20b703067 PMD 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 8 UID: 0 Kdump: loaded Not tainted 6.17.0-rc4+ #107 PREEMPT(voluntary) RIP: 0010:nsh_key_put_from_nlattr+0x19d/0x610 [openvswitch] Call Trace: <TASK> validate_nsh+0x60/0x90 [openvswitch] validate_set.constprop.0+0x270/0x3c0 [openvswitch]
__ovs_nla_copy_actions+0x477/0x860 [openvswitch] ovs_nla_copy_actions+0x8d/0x100 [openvswitch] ovs_packet_cmd_execute+0x1cc/0x310 [openvswitch] genl_family_rcv_msg_doit+0xdb/0x130 genl_family_rcv_msg+0x14b/0x220 genl_rcv_msg+0x47/0xa0 netlink_rcv_skb+0x53/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x280/0x3b0 netlink_sendmsg+0x1f7/0x430 ____sys_sendmsg+0x36b/0x3a0
___sys_sendmsg+0x87/0xd0 __sys_sendmsg+0x6d/0xd0 do_syscall_64+0x7b/0x2c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The third issue with this process is that while trying to convert the non-masked set into masked one, validate_set() copies and doubles the size of the OVS_KEY_ATTR_NSH as if it didn't have any nested attributes. It should be copying each nested attribute and doubling them in size independently. And the process must be properly reversed during the conversion back from masked to a non-masked variant during the flow dump. In the end, the only two outcomes of trying to use this action are either validation failure or a kernel crash. And if somehow someone manages to install a flow with such an action, it will most definitely not do what it is supposed to, since all the keys and the masks are mixed up. Fixing all the issues is a complex task as it requires re-writing most of the validation code. Given that and the fact that this functionality never worked since introduction, let's just remove it altogether. It's better to re-introduce it later with a proper implementation instead of trying to fix it in stable releases. (CVE-2025-40254)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40254
https://security-tracker.debian.org/tracker/CVE-2025-40254
https://ubuntu.com/security/CVE-2025-40254

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40254

Plugin Information
Published: 2025/12/04, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277518 - Linux Distros Unpatched Vulnerability : CVE-2025-40255
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() The ethtool tsconfig Netlink path can trigger a null pointer dereference. A call chain such as: tsconfig_prepare_data() ->
dev_get_hwtstamp_phylib() -> vlan_hwtstamp_get() -> generic_hwtstamp_get_lower() ->
generic_hwtstamp_ioctl_lower() results in generic_hwtstamp_ioctl_lower() being called with kernel_cfg->ifr as NULL. The generic_hwtstamp_ioctl_lower() function does not expect a NULL ifr and dereferences it, leading to a system crash. Fix this by adding a NULL check for kernel_cfg->ifr in generic_hwtstamp_ioctl_lower(). If ifr is NULL, return -EINVAL. (CVE-2025-40255)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40255
https://ubuntu.com/security/CVE-2025-40255

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40255

Plugin Information
Published: 2025/12/04, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277516 - Linux Distros Unpatched Vulnerability : CVE-2025-40257
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mptcp: fix a race in mptcp_pm_del_add_timer() mptcp_pm_del_add_timer() can call sk_stop_timer_sync(sk, &entry->add_timer) while another might have free entry already, as reported by syzbot. Add RCU protection to fix this issue. Also change confusing add_timer variable with stop_timer boolean. syzbot report: BUG:
KASAN: slab-use-after-free in __timer_delete_sync+0x372/0x3f0 kernel/time/timer.c:1616 Read of size 4 at addr ffff8880311e4150 by task kworker/1:1/44 CPU: 1 UID: 0 PID: 44 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Workqueue: events mptcp_worker Call Trace: <TASK> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 __timer_delete_sync+0x372/0x3f0 kernel/time/timer.c:1616 sk_stop_timer_sync+0x1b/0x90 net/core/sock.c:3631 mptcp_pm_del_add_timer+0x283/0x310 net/mptcp/pm.c:362 mptcp_incoming_options+0x1357/0x1f60 net/mptcp/options.c:1174 tcp_data_queue+0xca/0x6450 net/ipv4/tcp_input.c:5361 tcp_rcv_established+0x1335/0x2670 net/ipv4/tcp_input.c:6441 tcp_v4_do_rcv+0x98b/0xbf0 net/ipv4/tcp_ipv4.c:1931 tcp_v4_rcv+0x252a/0x2dc0 net/ipv4/tcp_ipv4.c:2374 ip_protocol_deliver_rcu+0x221/0x440 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:239 NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318 NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318 __netif_receive_skb_one_core net/core/dev.c:6079 [inline]
__netif_receive_skb+0x143/0x380 net/core/dev.c:6192 process_backlog+0x31e/0x900 net/core/dev.c:6544
__napi_poll+0xb6/0x540 net/core/dev.c:7594 napi_poll net/core/dev.c:7657 [inline] net_rx_action+0x5f7/0xda0 net/core/dev.c:7784 handle_softirqs+0x22f/0x710 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline] __local_bh_enable_ip+0x1a0/0x2e0 kernel/softirq.c:302 mptcp_pm_send_ack net/mptcp/pm.c:210 [inline] mptcp_pm_addr_send_ack+0x41f/0x500 net/mptcp/pm.c:-1 mptcp_pm_worker+0x174/0x320 net/mptcp/pm.c:1002 mptcp_worker+0xd5/0x1170 net/mptcp/protocol.c:2762 process_one_work kernel/workqueue.c:3263 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Allocated by task 44: kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:77 poison_kmalloc_redzone mm/kasan/common.c:400 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:417 kasan_kmalloc include/linux/kasan.h:262 [inline]
__kmalloc_cache_noprof+0x1ef/0x6c0 mm/slub.c:5748 kmalloc_noprof include/linux/slab.h:957 [inline] mptcp_pm_alloc_anno_list+0x104/0x460 net/mptcp/pm.c:385 mptcp_pm_create_subflow_or_signal_addr+0xf9d/0x1360 net/mptcp/pm_kernel.c:355 mptcp_pm_nl_fully_established net/mptcp/pm_kernel.c:409 [inline] __mptcp_pm_kernel_worker+0x417/0x1ef0 net/mptcp/pm_kernel.c:1529 mptcp_pm_worker+0x1ee/0x320 net/mptcp/pm.c:1008 mptcp_worker+0xd5/0x1170 net/mptcp/protocol.c:2762 process_one_work kernel/workqueue.c:3263 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 6630: kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
__kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:587 kasan_save_free_info mm/kasan/kasan.h:406 [inline] poison_slab_object m ---truncated--- (CVE-2025-40257)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40257
https://security-tracker.debian.org/tracker/CVE-2025-40257
https://ubuntu.com/security/CVE-2025-40257

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40257

Plugin Information
Published: 2025/12/04, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277529 - Linux Distros Unpatched Vulnerability : CVE-2025-40259
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: sg: Do not sleep in atomic context sg_finish_rem_req() calls blk_rq_unmap_user(). The latter function may sleep. Hence, call sg_finish_rem_req() with interrupts enabled instead of disabled.
(CVE-2025-40259)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40259
https://security-tracker.debian.org/tracker/CVE-2025-40259
https://ubuntu.com/security/CVE-2025-40259

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40259

Plugin Information
Published: 2025/12/04, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277521 - Linux Distros Unpatched Vulnerability : CVE-2025-40261
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() nvme_fc_delete_assocation() waits for pending I/O to complete before returning, and an error can cause ->ioerr_work to be queued after cancel_work_sync() had been called. Move the call to cancel_work_sync() to be after nvme_fc_delete_association() to ensure ->ioerr_work is not running when the nvme_fc_ctrl object is freed.
Otherwise the following can occur: [ 1135.911754] list_del corruption, ff2d24c8093f31f8->next is NULL [ 1135.917705] ------------[ cut here ]------------ [ 1135.922336] kernel BUG at lib/list_debug.c:52! [ 1135.926784] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 1135.931851] CPU: 48 UID: 0 PID: 726 Comm:
kworker/u449:23 Kdump: loaded Not tainted 6.12.0 #1 PREEMPT(voluntary) [ 1135.943490] Hardware name: Dell Inc. PowerEdge R660/0HGTK9, BIOS 2.5.4 01/16/2025 [ 1135.950969] Workqueue: 0x0 (nvme-wq) [ 1135.954673] RIP: 0010:__list_del_entry_valid_or_report.cold+0xf/0x6f [ 1135.961041] Code: c7 c7 98 68 72 94 e8 26 45 fe ff 0f 0b 48 c7 c7 70 68 72 94 e8 18 45 fe ff 0f 0b 48 89 fe 48 c7 c7 80 69 72 94 e8 07 45 fe ff <0f> 0b 48 89 d1 48 c7 c7 a0 6a 72 94 48 89 c2 e8 f3 44 fe ff 0f 0b [ 1135.979788] RSP: 0018:ff579b19482d3e50 EFLAGS: 00010046 [ 1135.985015] RAX: 0000000000000033 RBX: ff2d24c8093f31f0 RCX: 0000000000000000 [ 1135.992148] RDX: 0000000000000000 RSI: ff2d24d6bfa1d0c0 RDI: ff2d24d6bfa1d0c0 [ 1135.999278] RBP:
ff2d24c8093f31f8 R08: 0000000000000000 R09: ffffffff951e2b08 [ 1136.006413] R10: ffffffff95122ac8 R11:
0000000000000003 R12: ff2d24c78697c100 [ 1136.013546] R13: fffffffffffffff8 R14: 0000000000000000 R15:
ff2d24c78697c0c0 [ 1136.020677] FS: 0000000000000000(0000) GS:ff2d24d6bfa00000(0000) knlGS:0000000000000000 [ 1136.028765] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1136.034510] CR2:
00007fd207f90b80 CR3: 000000163ea22003 CR4: 0000000000f73ef0 [ 1136.041641] DR0: 0000000000000000 DR1:
0000000000000000 DR2: 0000000000000000 [ 1136.048776] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7:
0000000000000400 [ 1136.055910] PKRU: 55555554 [ 1136.058623] Call Trace: [ 1136.061074] <TASK> [ 1136.063179] ? show_trace_log_lvl+0x1b0/0x2f0 [ 1136.067540] ? show_trace_log_lvl+0x1b0/0x2f0 [ 1136.071898] ? move_linked_works+0x4a/0xa0 [ 1136.075998] ? __list_del_entry_valid_or_report.cold+0xf/0x6f [ 1136.081744] ? __die_body.cold+0x8/0x12 [ 1136.085584] ? die+0x2e/0x50 [ 1136.088469] ? do_trap+0xca/0x110 [ 1136.091789] ? do_error_trap+0x65/0x80 [ 1136.095543] ?
__list_del_entry_valid_or_report.cold+0xf/0x6f [ 1136.101289] ? exc_invalid_op+0x50/0x70 [ 1136.105127] ?
__list_del_entry_valid_or_report.cold+0xf/0x6f [ 1136.110874] ? asm_exc_invalid_op+0x1a/0x20 [ 1136.115059] ? __list_del_entry_valid_or_report.cold+0xf/0x6f [ 1136.120806] move_linked_works+0x4a/0xa0 [ 1136.124733] worker_thread+0x216/0x3a0 [ 1136.128485] ? __pfx_worker_thread+0x10/0x10 [ 1136.132758] kthread+0xfa/0x240 [ 1136.135904] ? __pfx_kthread+0x10/0x10 [ 1136.139657] ret_from_fork+0x31/0x50 [ 1136.143236] ? __pfx_kthread+0x10/0x10 [ 1136.146988] ret_from_fork_asm+0x1a/0x30 [ 1136.150915] </TASK>
(CVE-2025-40261)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40261
https://security-tracker.debian.org/tracker/CVE-2025-40261
https://ubuntu.com/security/CVE-2025-40261

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.6 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
CVSS v3.0 Temporal Score
6.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.5
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40261

Plugin Information
Published: 2025/12/04, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277520 - Linux Distros Unpatched Vulnerability : CVE-2025-40264
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- be2net: pass wrb_params in case of OS2BMC be_insert_vlan_in_pkt() is called with the wrb_params argument being NULL at be_send_pkt_to_bmc() call site. This may lead to dereferencing a NULL pointer when processing a workaround for specific packet, as commit bc0c3405abbb (be2net: fix a Tx stall bug caused by a specific ipv6 packet) states. The correct way would be to pass the wrb_params from be_xmit().
(CVE-2025-40264)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40264
https://security-tracker.debian.org/tracker/CVE-2025-40264
https://ubuntu.com/security/CVE-2025-40264

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40264

Plugin Information
Published: 2025/12/04, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277777 - Linux Distros Unpatched Vulnerability : CVE-2025-40267
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- io_uring/rw: ensure allocated iovec gets cleared for early failure A previous commit reused the recyling infrastructure for early cleanup, but this is not enough for the case where our internal caches have overflowed. If this happens, then the allocated iovec can get leaked if the request is also aborted early.
Reinstate the previous forced free of the iovec for that situation. (CVE-2025-40267)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40267
https://ubuntu.com/security/CVE-2025-40267

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40267

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277710 - Linux Distros Unpatched Vulnerability : CVE-2025-40268
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cifs: client: fix memory leak in smb3_fs_context_parse_param The user calls fsconfig twice, but when the program exits, free() only frees ctx->source for the second fsconfig, not the first. Regarding fc->source, there is no code in the fs context related to its memory reclamation. To fix this memory leak, release the source memory corresponding to ctx or fc before each parsing. syzbot reported: BUG: memory leak unreferenced object 0xffff888128afa360 (size 96): backtrace (crc 79c9c7ba): kstrdup+0x3c/0x80 mm/util.c:84 smb3_fs_context_parse_param+0x229b/0x36c0 fs/smb/client/fs_context.c:1444 BUG: memory leak unreferenced object 0xffff888112c7d900 (size 96): backtrace (crc 79c9c7ba): smb3_fs_context_fullpath+0x70/0x1b0 fs/smb/client/fs_context.c:629 smb3_fs_context_parse_param+0x2266/0x36c0 fs/smb/client/fs_context.c:1438 (CVE-2025-40268)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40268
https://security-tracker.debian.org/tracker/CVE-2025-40268
https://ubuntu.com/security/CVE-2025-40268

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40268

Plugin Information
Published: 2025/12/08, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277712 - Linux Distros Unpatched Vulnerability : CVE-2025-40269
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer The PCM stream data in USB-audio driver is transferred over USB URB packet buffers, and each packet size is determined dynamically. The packet sizes are limited by some factors such as wMaxPacketSize USB descriptor. OTOH, in the current code, the actually used packet sizes are determined only by the rate and the PPS, which may be bigger than the size limit above. This results in a buffer overflow, as reported by syzbot. Basically when the limit is smaller than the calculated packet size, it implies that something is wrong, most likely a weird USB descriptor. So the best option would be just to return an error at the parameter setup time before doing any further operations. This patch introduces such a sanity check, and returns -EINVAL when the packet size is greater than maxpacksize. The comparison with ep->packsize[1] alone should suffice since it's always equal or greater than ep->packsize[0]. (CVE-2025-40269)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40269
https://security-tracker.debian.org/tracker/CVE-2025-40269
https://ubuntu.com/security/CVE-2025-40269

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.1
EPSS Score
0.0003
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40269

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277702 - Linux Distros Unpatched Vulnerability : CVE-2025-40275
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd In snd_usb_create_streams(), for UAC version 3 devices, the Interface Association Descriptor (IAD) is retrieved via usb_ifnum_to_if().
If this call fails, a fallback routine attempts to obtain the IAD from the next interface and sets a BADD profile. However, snd_usb_mixer_controls_badd() assumes that the IAD retrieved from usb_ifnum_to_if() is always valid, without performing a NULL check. This can lead to a NULL pointer dereference when usb_ifnum_to_if() fails to find the interface descriptor. This patch adds a NULL pointer check after calling usb_ifnum_to_if() in snd_usb_mixer_controls_badd() to prevent the dereference. This issue was discovered by syzkaller, which triggered the bug by sending a crafted USB device descriptor.
(CVE-2025-40275)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40275
https://security-tracker.debian.org/tracker/CVE-2025-40275
https://ubuntu.com/security/CVE-2025-40275

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40275

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277720 - Linux Distros Unpatched Vulnerability : CVE-2025-40284
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: MGMT: cancel mesh send timer when hdev removed mesh_send_done timer is not canceled when hdev is removed, which causes crash if the timer triggers after hdev is gone. Cancel the timer when MGMT removes the hdev, like other MGMT timers. Should fix the BUG: sporadically seen by BlueZ test bot (in Mesh - Send cancel - 1 test). Log: ------ BUG: KASAN: slab-use-after-free in run_timer_softirq+0x76b/0x7d0 ... Freed by task 36: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30
__kasan_save_free_info+0x3a/0x60 __kasan_slab_free+0x43/0x70 kfree+0x103/0x500 device_release+0x9a/0x210 kobject_put+0x100/0x1e0 vhci_release+0x18b/0x240 ------ (CVE-2025-40284)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40284
https://security-tracker.debian.org/tracker/CVE-2025-40284
https://ubuntu.com/security/CVE-2025-40284

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40284

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277635 - Linux Distros Unpatched Vulnerability : CVE-2025-40287
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- exfat: fix improper check of dentry.stream.valid_size We found an infinite loop bug in the exFAT file system that can lead to a Denial-of-Service (DoS) condition. When a dentry in an exFAT filesystem is malformed, the following system calls SYS_openat, SYS_ftruncate, and SYS_pwrite64 can cause the kernel to hang. Root cause analysis shows that the size validation code in exfat_find() does not check whether dentry.stream.valid_size is negative. As a result, the system calls mentioned above can succeed and eventually trigger the DoS issue. This patch adds a check for negative dentry.stream.valid_size to prevent this vulnerability. (CVE-2025-40287)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40287
https://security-tracker.debian.org/tracker/CVE-2025-40287
https://ubuntu.com/security/CVE-2025-40287

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40287

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277641 - Linux Distros Unpatched Vulnerability : CVE-2025-40293
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- iommufd: Don't overflow during division for dirty tracking If pgshift is 63 then BITS_PER_TYPE(*bitmap->bitmap) * pgsize will overflow to 0 and this triggers divide by 0. In this case the index should just be 0, so reorganize things to divide by shift and avoid hitting any overflows.
(CVE-2025-40293)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40293
https://security-tracker.debian.org/tracker/CVE-2025-40293
https://ubuntu.com/security/CVE-2025-40293

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40293

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277725 - Linux Distros Unpatched Vulnerability : CVE-2025-40294
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() In the parse_adv_monitor_pattern() function, the value of the 'length' variable is currently limited to HCI_MAX_EXT_AD_LENGTH(251). The size of the 'value' array in the mgmt_adv_pattern structure is 31. If the value of 'pattern[i].length' is set in the user space and exceeds 31, the 'patterns[i].value' array can be accessed out of bound when copied.
Increasing the size of the 'value' array in the 'mgmt_adv_pattern' structure will break the userspace.
Considering this, and to avoid OOB access revert the limits for 'offset' and 'length' back to the value of HCI_MAX_AD_LENGTH. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE.
(CVE-2025-40294)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40294
https://security-tracker.debian.org/tracker/CVE-2025-40294
https://ubuntu.com/security/CVE-2025-40294

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40294

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277640 - Linux Distros Unpatched Vulnerability : CVE-2025-40304
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if the Y position is off- screen and clip image height to screen boundary. Break from the rendering loop if the X position is off- screen. When clipping image width to fit the screen, update the character count to match the clipped width to prevent buffer size mismatches. Without the character count update, bit_putcs_aligned and bit_putcs_unaligned receive mismatched parameters where the buffer is allocated for the clipped width but cnt reflects the original larger count, causing out-of-bounds writes. (CVE-2025-40304)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40304
https://security-tracker.debian.org/tracker/CVE-2025-40304
https://ubuntu.com/security/CVE-2025-40304

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
3.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
3.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40304

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277729 - Linux Distros Unpatched Vulnerability : CVE-2025-40307
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- exfat: validate cluster allocation bits of the allocation bitmap syzbot created an exfat image with cluster bits not set for the allocation bitmap. exfat-fs reads and uses the allocation bitmap without checking this. The problem is that if the start cluster of the allocation bitmap is 6, cluster 6 can be allocated when creating a directory with mkdir. exfat zeros out this cluster in exfat_mkdir, which can delete existing entries. This can reallocate the allocated entries. In addition, the allocation bitmap is also zeroed out, so cluster 6 can be reallocated. This patch adds exfat_test_bitmap_range to validate that clusters used for the allocation bitmap are correctly marked as in-use. (CVE-2025-40307)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40307
https://security-tracker.debian.org/tracker/CVE-2025-40307
https://ubuntu.com/security/CVE-2025-40307

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40307

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277717 - Linux Distros Unpatched Vulnerability : CVE-2025-40308
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: bcsp: receive data only if registered Currently, bcsp_recv() can be called even when the BCSP protocol has not been registered. This leads to a NULL pointer dereference, as shown in the following stack trace: KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] RIP:
0010:bcsp_recv+0x13d/0x1740 drivers/bluetooth/hci_bcsp.c:590 Call Trace: <TASK>
hci_uart_tty_receive+0x194/0x220 drivers/bluetooth/hci_ldisc.c:627 tiocsti+0x23c/0x2c0 drivers/tty/tty_io.c:2290 tty_ioctl+0x626/0xde0 drivers/tty/tty_io.c:2706 vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f To prevent this, ensure that the HCI_UART_REGISTERED flag is set before processing received data. If the protocol is not registered, return -EUNATCH. (CVE-2025-40308)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40308
https://security-tracker.debian.org/tracker/CVE-2025-40308
https://ubuntu.com/security/CVE-2025-40308

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40308

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277665 - Linux Distros Unpatched Vulnerability : CVE-2025-40309
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: SCO: Fix UAF on sco_conn_free BUG: KASAN: slab-use-after-free in sco_conn_free net/bluetooth/sco.c:87 [inline] BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:65 [inline] BUG: KASAN: slab-use-after-free in sco_conn_put+0xdd/0x410 net/bluetooth/sco.c:107 Write of size 8 at addr ffff88811cb96b50 by task kworker/u17:4/352 CPU: 1 UID: 0 PID: 352 Comm: kworker/u17:4 Not tainted 6.17.0-rc5-g717368f83676 #4 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: hci13 hci_cmd_sync_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x10b/0x170 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x191/0x550 mm/kasan/report.c:482 kasan_report+0xc4/0x100 mm/kasan/report.c:595 sco_conn_free net/bluetooth/sco.c:87 [inline] kref_put include/linux/kref.h:65 [inline] sco_conn_put+0xdd/0x410 net/bluetooth/sco.c:107 sco_connect_cfm+0xb4/0xae0 net/bluetooth/sco.c:1441 hci_connect_cfm include/net/bluetooth/hci_core.h:2082 [inline] hci_conn_failed+0x20a/0x2e0 net/bluetooth/hci_conn.c:1313 hci_conn_unlink+0x55f/0x810 net/bluetooth/hci_conn.c:1121 hci_conn_del+0xb6/0x1110 net/bluetooth/hci_conn.c:1147 hci_abort_conn_sync+0x8c5/0xbb0 net/bluetooth/hci_sync.c:5689 hci_cmd_sync_work+0x281/0x380 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0x77e/0x1040 kernel/workqueue.c:3319 worker_thread+0xbee/0x1200 kernel/workqueue.c:3400 kthread+0x3c7/0x870 kernel/kthread.c:463 ret_from_fork+0x13a/0x1e0 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Allocated by task 31370: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x30/0x70 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0x82/0x90 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4382 [inline] __kmalloc_noprof+0x22f/0x390 mm/slub.c:4394 kmalloc_noprof include/linux/slab.h:909 [inline] sk_prot_alloc+0xae/0x220 net/core/sock.c:2239 sk_alloc+0x34/0x5a0 net/core/sock.c:2295 bt_sock_alloc+0x3c/0x330 net/bluetooth/af_bluetooth.c:151 sco_sock_alloc net/bluetooth/sco.c:562 [inline] sco_sock_create+0xc0/0x350 net/bluetooth/sco.c:593 bt_sock_create+0x161/0x3b0 net/bluetooth/af_bluetooth.c:135 __sock_create+0x3ad/0x780 net/socket.c:1589 sock_create net/socket.c:1647 [inline] __sys_socket_create net/socket.c:1684 [inline] __sys_socket+0xd5/0x330 net/socket.c:1731
__do_sys_socket net/socket.c:1745 [inline] __se_sys_socket net/socket.c:1743 [inline]
__x64_sys_socket+0x7a/0x90 net/socket.c:1743 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc7/0x240 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 31374: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x30/0x70 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:243 [inline]
__kasan_slab_free+0x3d/0x50 mm/kasan/common.c:275 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2428 [inline] slab_free mm/slub.c:4701 [inline] kfree+0x199/0x3b0 mm/slub.c:4900 sk_prot_free net/core/sock.c:2278 [inline] __sk_destruct+0x4aa/0x630 net/core/sock.c:2373 sco_sock_release+0x2ad/0x300 net/bluetooth/sco.c:1333 __sock_release net/socket.c:649 [inline] sock_close+0xb8/0x230 net/socket.c:1439 __fput+0x3d1/0x9e0 fs/file_table.c:468 task_work_run+0x206/0x2a0 kernel/task_work.c:227 get_signal+0x1201/0x1410 kernel/signal.c:2807 arch_do_signal_or_restart+0x34/0x740 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x68/0xc0 kernel/entry/common.c:40 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] s ---truncated--- (CVE-2025-40309)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40309
https://security-tracker.debian.org/tracker/CVE-2025-40309
https://ubuntu.com/security/CVE-2025-40309

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:A/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40309

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277714 - Linux Distros Unpatched Vulnerability : CVE-2025-40318
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the same entry, leading to double list_del() and UAF. Fix this by holding cmd_sync_work_lock across both lookup and cancel, so that the entry cannot be removed concurrently. (CVE-2025-40318)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40318
https://security-tracker.debian.org/tracker/CVE-2025-40318
https://ubuntu.com/security/CVE-2025-40318

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.3 (CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40318

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277722 - Linux Distros Unpatched Vulnerability : CVE-2025-40321
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode Currently, whenever there is a need to transmit an Action frame, the brcmfmac driver always uses the P2P vif to send the actframe IOVAR to firmware. The P2P interfaces were available when wpa_supplicant is managing the wlan interface.
However, the P2P interfaces are not created/initialized when only hostapd is managing the wlan interface.
And if hostapd receives an ANQP Query REQ Action frame even from an un-associated STA, the brcmfmac driver tries to use an uninitialized P2P vif pointer for sending the IOVAR to firmware. This NULL pointer dereferencing triggers a driver crash. [ 1417.074538] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [...] [ 1417.075188] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT) [...] [ 1417.075653] Call trace: [ 1417.075662] brcmf_p2p_send_action_frame+0x23c/0xc58 [brcmfmac] [ 1417.075738] brcmf_cfg80211_mgmt_tx+0x304/0x5c0 [brcmfmac] [ 1417.075810] cfg80211_mlme_mgmt_tx+0x1b0/0x428 [cfg80211] [ 1417.076067] nl80211_tx_mgmt+0x238/0x388 [cfg80211] [ 1417.076281] genl_family_rcv_msg_doit+0xe0/0x158 [ 1417.076302] genl_rcv_msg+0x220/0x2a0 [ 1417.076317] netlink_rcv_skb+0x68/0x140 [ 1417.076330] genl_rcv+0x40/0x60 [ 1417.076343] netlink_unicast+0x330/0x3b8 [ 1417.076357] netlink_sendmsg+0x19c/0x3f8 [ 1417.076370] __sock_sendmsg+0x64/0xc0 [ 1417.076391]
____sys_sendmsg+0x268/0x2a0 [ 1417.076408] ___sys_sendmsg+0xb8/0x118 [ 1417.076427]
__sys_sendmsg+0x90/0xf8 [ 1417.076445] __arm64_sys_sendmsg+0x2c/0x40 [ 1417.076465] invoke_syscall+0x50/0x120 [ 1417.076486] el0_svc_common.constprop.0+0x48/0xf0 [ 1417.076506] do_el0_svc+0x24/0x38 [ 1417.076525] el0_svc+0x30/0x100 [ 1417.076548] el0t_64_sync_handler+0x100/0x130 [ 1417.076569] el0t_64_sync+0x190/0x198 [ 1417.076589] Code: f9401e80 aa1603e2 f9403be1 5280e483 (f9400000) Fix this, by always using the vif corresponding to the wdev on which the Action frame Transmission request was initiated by the userspace. This way, even if P2P vif is not available, the IOVAR is sent to firmware on AP vif and the ANQP Query RESP Action frame is transmitted without crashing the driver. Move init_completion() for send_af_done from brcmf_p2p_create_p2pdev() to brcmf_p2p_attach(). Because the former function would not get executed when only hostapd is managing wlan interface, and it is not safe to do reinit_completion() later in brcmf_p2p_tx_action_frame(), without any prior init_completion(). And in the brcmf_p2p_tx_action_frame() function, the condition check for P2P Presence response frame is not needed, since the wpa_supplicant is properly sending the P2P Presense Response frame on the P2P-GO vif instead of the P2P-Device vif. [Cc stable] (CVE-2025-40321)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40321
https://security-tracker.debian.org/tracker/CVE-2025-40321
https://ubuntu.com/security/CVE-2025-40321

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.7 (CVSS2#AV:A/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40321

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277674 - Linux Distros Unpatched Vulnerability : CVE-2025-40323
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fbcon: Set fb_display[i]->mode to NULL when the mode is released Recently, we discovered the following issue through syzkaller: BUG: KASAN: slab-use-after-free in fb_mode_is_equal+0x285/0x2f0 Read of size 4 at addr ff11000001b3c69c by task syz.xxx ... Call Trace: <TASK> dump_stack_lvl+0xab/0xe0 print_address_description.constprop.0+0x2c/0x390 print_report+0xb9/0x280 kasan_report+0xb8/0xf0 fb_mode_is_equal+0x285/0x2f0 fbcon_mode_deleted+0x129/0x180 fb_set_var+0xe7f/0x11d0 do_fb_ioctl+0x6a0/0x750 fb_ioctl+0xe0/0x140 __x64_sys_ioctl+0x193/0x210 do_syscall_64+0x5f/0x9c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Based on experimentation and analysis, during framebuffer unregistration, only the memory of fb_info->modelist is freed, without setting the corresponding fb_display[i]->mode to NULL for the freed modes. This leads to UAF issues during subsequent accesses.
Here's an example of reproduction steps: 1. With /dev/fb0 already registered in the system, load a kernel module to register a new device /dev/fb1; 2. Set fb1's mode to the global fb_display[] array (via FBIOPUT_CON2FBMAP); 3. Switch console from fb to VGA (to allow normal rmmod of the ko); 4. Unload the kernel module, at this point fb1's modelist is freed, leaving a wild pointer in fb_display[]; 5. Trigger the bug via system calls through fb0 attempting to delete a mode from fb0. Add a check in do_unregister_framebuffer(): if the mode to be freed exists in fb_display[], set the corresponding mode pointer to NULL. (CVE-2025-40323)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40323
https://security-tracker.debian.org/tracker/CVE-2025-40323
https://ubuntu.com/security/CVE-2025-40323

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40323

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277726 - Linux Distros Unpatched Vulnerability : CVE-2025-40324
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NFSD: Fix crash in nfsd4_read_release() When tracing is enabled, the trace_nfsd_read_done trace point crashes during the pynfs read.testNoFh test. (CVE-2025-40324)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40324
https://security-tracker.debian.org/tracker/CVE-2025-40324
https://ubuntu.com/security/CVE-2025-40324

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40324

Plugin Information
Published: 2025/12/08, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
247655 - Linux Distros Unpatched Vulnerability : CVE-2025-40325
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- md/raid10: wait barrier before returning discard request with REQ_NOWAIT raid10_handle_discard should wait barrier before returning a discard bio which has REQ_NOWAIT. And there is no need to print warning calltrace if a discard bio has REQ_NOWAIT flag. Quality engineer usually checks dmesg and reports error if dmesg has warning/error calltrace. (CVE-2025-40325)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40325
https://security-tracker.debian.org/tracker/CVE-2025-40325
https://ubuntu.com/security/CVE-2025-40325

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40325

Plugin Information
Published: 2025/08/10, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277849 - Linux Distros Unpatched Vulnerability : CVE-2025-40329
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb The Mesa issue referenced below pointed out a possible deadlock: [ 1231.611031] Possible interrupt unsafe locking scenario: [ 1231.611033] CPU0 CPU1 [ 1231.611034] ---- ---- [ 1231.611035] lock(&xa->xa_lock#17); [ 1231.611038] local_irq_disable(); [ 1231.611039] lock(&fence->lock); [ 1231.611041] lock(&xa->xa_lock#17); [ 1231.611044] <Interrupt> [ 1231.611045] lock(&fence->lock); [ 1231.611047] *** DEADLOCK *** In this example, CPU0 would be any function accessing job->dependencies through the xa_* functions that don't disable interrupts (eg:
drm_sched_job_add_dependency(), drm_sched_entity_kill_jobs_cb()). CPU1 is executing drm_sched_entity_kill_jobs_cb() as a fence signalling callback so in an interrupt context. It will deadlock when trying to grab the xa_lock which is already held by CPU0. Replacing all xa_* usage by their xa_*_irq counterparts would fix this issue, but Christian pointed out another issue: dma_fence_signal takes fence.lock and so does dma_fence_add_callback. dma_fence_signal() // locks f1.lock ->
drm_sched_entity_kill_jobs_cb() -> foreach dependencies -> dma_fence_add_callback() // locks f2.lock This will deadlock if f1 and f2 share the same spinlock. To fix both issues, the code iterating on dependencies and re-arming them is moved out to drm_sched_entity_kill_jobs_work(). [phasta: commit message nits] (CVE-2025-40329)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40329
https://security-tracker.debian.org/tracker/CVE-2025-40329
https://ubuntu.com/security/CVE-2025-40329

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40329

Plugin Information
Published: 2025/12/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277968 - Linux Distros Unpatched Vulnerability : CVE-2025-40330
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bnxt_en: Shutdown FW DMA in bnxt_shutdown() The netif_close() call in bnxt_shutdown() only stops packet DMA. There may be FW DMA for trace logging (recently added) that will continue. If we kexec to a new kernel, the DMA will corrupt memory in the new kernel. Add bnxt_hwrm_func_drv_unrgtr() to unregister the driver from the FW. This will stop the FW DMA. In case the call fails, call pcie_flr() to reset the function and stop the DMA. (CVE-2025-40330)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40330
https://ubuntu.com/security/CVE-2025-40330

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40330

Plugin Information
Published: 2025/12/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277848 - Linux Distros Unpatched Vulnerability : CVE-2025-40340
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. I saw an oops in xe_gem_fault when running the xe-fast-feedback testlist against the realtime kernel without debug options enabled. The panic happens after core_hotunplug unbind-rebind finishes. Presumably what happens is that a process mmaps, unlocks because of the FAULT_FLAG_RETRY_NOWAIT logic, has no process memory left, causing ttm_bo_vm_dummy_page() to return VM_FAULT_NOPAGE, since there was nothing left to populate, and then oopses in mem_type_is_vram(tbo->resource->mem_type) because tbo->resource is NULL. It's convoluted, but fits the data and explains the oops after the test exits. (CVE-2025-40340)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40340
https://security-tracker.debian.org/tracker/CVE-2025-40340
https://ubuntu.com/security/CVE-2025-40340

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40340

Plugin Information
Published: 2025/12/09, Modified: 2025/12/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277880 - Linux Distros Unpatched Vulnerability : CVE-2025-40341
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- futex: Don't leak robust_list pointer on exec race sys_get_robust_list() and compat_get_robust_list() use ptrace_may_access() to check if the calling task is allowed to access another task's robust_list pointer.
This check is racy against a concurrent exec() in the target process. During exec(), a task may transition from a non-privileged binary to a privileged one (e.g., setuid binary) and its credentials/memory mappings may change. If get_robust_list() performs ptrace_may_access() before this transition, it may erroneously allow access to sensitive information after the target becomes privileged. A racy access allows an attacker to exploit a window during which ptrace_may_access() passes before a target process transitions to a privileged state via exec(). For example, consider a non-privileged task T that is about to execute a setuid-root binary. An attacker task A calls get_robust_list(T) while T is still unprivileged. Since ptrace_may_access() checks permissions based on current credentials, it succeeds. However, if T begins exec immediately afterwards, it becomes privileged and may change its memory mappings. Because get_robust_list() proceeds to access T->robust_list without synchronizing with exec() it may read user- space pointers from a now-privileged process. This violates the intended post-exec access restrictions and could expose sensitive memory addresses or be used as a primitive in a larger exploit chain. Consequently, the race can lead to unauthorized disclosure of information across privilege boundaries and poses a potential security risk. Take a read lock on signal->exec_update_lock prior to invoking ptrace_may_access() and accessing the robust_list/compat_robust_list. This ensures that the target task's exec state remains stable during the check, allowing for consistent and synchronized validation of credentials. (CVE-2025-40341)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40341
https://security-tracker.debian.org/tracker/CVE-2025-40341
https://ubuntu.com/security/CVE-2025-40341

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0001
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:H/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40341

Plugin Information
Published: 2025/12/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
277852 - Linux Distros Unpatched Vulnerability : CVE-2025-40344
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ASoC: Intel: avs: Disable periods-elapsed work when closing PCM avs_dai_fe_shutdown() handles the shutdown procedure for HOST HDAudio stream while period-elapsed work services its IRQs. As the former frees the DAI's private context, these two operations shall be synchronized to avoid slab-use-after-free or worse errors. (CVE-2025-40344)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40344
https://security-tracker.debian.org/tracker/CVE-2025-40344
https://ubuntu.com/security/CVE-2025-40344

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40344

Plugin Information
Published: 2025/12/09, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278927 - Linux Distros Unpatched Vulnerability : CVE-2025-40346
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() Fix incorrect use of PTR_ERR_OR_ZERO() in topology_parse_cpu_capacity() which causes the code to proceed with NULL clock pointers. The current logic uses !PTR_ERR_OR_ZERO(cpu_clk) which evaluates to true for both valid pointers and NULL, leading to potential NULL pointer dereference in clk_get_rate(). Per include/linux/err.h documentation, PTR_ERR_OR_ZERO(ptr) returns: The error code within @ptr if it is an error pointer; 0 otherwise. This means PTR_ERR_OR_ZERO() returns 0 for both valid pointers AND NULL pointers. Therefore !PTR_ERR_OR_ZERO(cpu_clk) evaluates to true (proceed) when cpu_clk is either valid or NULL, causing clk_get_rate(NULL) to be called when of_clk_get() returns NULL. Replace with !IS_ERR_OR_NULL(cpu_clk) which only proceeds for valid pointers, preventing potential NULL pointer dereference in clk_get_rate().
(CVE-2025-40346)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40346
https://ubuntu.com/security/CVE-2025-40346

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40346

Plugin Information
Published: 2025/12/17, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278925 - Linux Distros Unpatched Vulnerability : CVE-2025-40348
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- slab: Avoid race on slab->obj_exts in alloc_slab_obj_exts If two competing threads enter alloc_slab_obj_exts() and one of them fails to allocate the object extension vector, it might override the valid slab->obj_exts allocated by the other thread with OBJEXTS_ALLOC_FAIL. This will cause the thread that lost this race and expects a valid pointer to dereference a NULL pointer later on. Update slab->obj_exts atomically using cmpxchg() to avoid slab->obj_exts overrides by racing threads. Thanks for Vlastimil and Suren's help with debugging. (CVE-2025-40348)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40348
https://ubuntu.com/security/CVE-2025-40348

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.1
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40348

Plugin Information
Published: 2025/12/17, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
244936 - Linux Distros Unpatched Vulnerability : CVE-2025-4035
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character.
This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation. (CVE-2025-4035)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-4035
https://security-tracker.debian.org/tracker/CVE-2025-4035
https://ubuntu.com/security/CVE-2025-4035

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
4.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-4035

Plugin Information
Published: 2025/08/07, Modified: 2025/10/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libsoup
278864 - Linux Distros Unpatched Vulnerability : CVE-2025-40350
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ XDP programs can change the layout of an xdp_buff through bpf_xdp_adjust_tail() and bpf_xdp_adjust_head(). Therefore, the driver cannot assume the size of the linear data area nor fragments. Fix the bug in mlx5 by generating skb according to xdp_buff after XDP programs run. Currently, when handling multi-buf XDP, the mlx5 driver assumes the layout of an xdp_buff to be unchanged. That is, the linear data area continues to be empty and fragments remain the same. This may cause the driver to generate erroneous skb or triggering a kernel warning. When an XDP program added linear data through bpf_xdp_adjust_head(), the linear data will be ignored as mlx5e_build_linear_skb() builds an skb without linear data and then pull data from fragments to fill the linear data area. When an XDP program has shrunk the non-linear data through bpf_xdp_adjust_tail(), the delta passed to __pskb_pull_tail() may exceed the actual nonlinear data size and trigger the BUG_ON in it. To fix the issue, first record the original number of fragments. If the number of fragments changes after the XDP program runs, rewind the end fragment pointer by the difference and recalculate the truesize. Then, build the skb with the linear data area matching the xdp_buff.
Finally, only pull data in if there is non-linear data and fill the linear part up to 256 bytes.
(CVE-2025-40350)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40350
https://ubuntu.com/security/CVE-2025-40350

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40350

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278810 - Linux Distros Unpatched Vulnerability : CVE-2025-40355
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- sysfs: check visibility before changing group attribute ownership Since commit 0c17270f9b92 (net: sysfs:
Implement is_visible for phys_(port_id, port_name, switch_id)), __dev_change_net_namespace() can hit WARN_ON() when trying to change owner of a file that isn't visible. See the trace below: WARNING: CPU: 6 PID: 2938 at net/core/dev.c:12410 __dev_change_net_namespace+0xb89/0xc30 CPU: 6 UID: 0 PID: 2938 Comm:
incusd Not tainted 6.17.1-1-mainline #1 PREEMPT(full) 4b783b4a638669fb644857f484487d17cb45ed1f Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP07, BIOS 03.07 02/19/2025 RIP:
0010:__dev_change_net_namespace+0xb89/0xc30 [...] Call Trace: <TASK> ? if6_seq_show+0x30/0x50 do_setlink.isra.0+0xc7/0x1270 ? __nla_validate_parse+0x5c/0xcc0 ? security_capable+0x94/0x1a0 rtnl_newlink+0x858/0xc20 ? update_curr+0x8e/0x1c0 ? update_entity_lag+0x71/0x80 ? sched_balance_newidle+0x358/0x450 ? psi_task_switch+0x113/0x2a0 ? __pfx_rtnl_newlink+0x10/0x10 rtnetlink_rcv_msg+0x346/0x3e0 ? sched_clock+0x10/0x30 ? __pfx_rtnetlink_rcv_msg+0x10/0x10 netlink_rcv_skb+0x59/0x110 netlink_unicast+0x285/0x3c0 ? __alloc_skb+0xdb/0x1a0 netlink_sendmsg+0x20d/0x430 ____sys_sendmsg+0x39f/0x3d0 ? import_iovec+0x2f/0x40 ___sys_sendmsg+0x99/0xe0
__sys_sendmsg+0x8a/0xf0 do_syscall_64+0x81/0x970 ? __sys_bind+0xe3/0x110 ? syscall_exit_work+0x143/0x1b0 ? do_syscall_64+0x244/0x970 ? sock_alloc_file+0x63/0xc0 ? syscall_exit_work+0x143/0x1b0 ? do_syscall_64+0x244/0x970 ? alloc_fd+0x12e/0x190 ? put_unused_fd+0x2a/0x70 ? do_sys_openat2+0xa2/0xe0 ? syscall_exit_work+0x143/0x1b0 ? do_syscall_64+0x244/0x970 ? exc_page_fault+0x7e/0x1a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] </TASK> Fix this by checking is_visible() before trying to touch the attribute. (CVE-2025-40355)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40355
https://security-tracker.debian.org/tracker/CVE-2025-40355
https://ubuntu.com/security/CVE-2025-40355

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40355

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278929 - Linux Distros Unpatched Vulnerability : CVE-2025-40357
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/smc: fix general protection fault in __smc_diag_dump The syzbot report a crash: Oops: general protection fault, probably for non-canonical address 0xfbd5a5d5a0000003: 0000 [#1] SMP KASAN NOPTI KASAN:
maybe wild-memory-access in range [0xdead4ead00000018-0xdead4ead0000001f] CPU: 1 UID: 0 PID: 6949 Comm:
syz.0.335 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:smc_diag_msg_common_fill net/smc/smc_diag.c:44 [inline] RIP:
0010:__smc_diag_dump.constprop.0+0x3ca/0x2550 net/smc/smc_diag.c:89 Call Trace: <TASK>
smc_diag_dump_proto+0x26d/0x420 net/smc/smc_diag.c:217 smc_diag_dump+0x27/0x90 net/smc/smc_diag.c:234 netlink_dump+0x539/0xd30 net/netlink/af_netlink.c:2327 __netlink_dump_start+0x6d6/0x990 net/netlink/af_netlink.c:2442 netlink_dump_start include/linux/netlink.h:341 [inline] smc_diag_handler_dump+0x1f9/0x240 net/smc/smc_diag.c:251 __sock_diag_cmd net/core/sock_diag.c:249 [inline] sock_diag_rcv_msg+0x438/0x790 net/core/sock_diag.c:285 netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2552 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x5a7/0x870 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg net/socket.c:729 [inline] ____sys_sendmsg+0xa95/0xc70 net/socket.c:2614 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2668
__sys_sendmsg+0x16d/0x220 net/socket.c:2700 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4e0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK>
The process like this: (CPU1) | (CPU2) ---------------------------------|------------------------------- inet_create() | // init clcsock to NULL | sk = sk_alloc() | | // unexpectedly change clcsock | inet_init_csk_locks() | | // add sk to hash table | smc_inet_init_sock() | smc_sk_init() | smc_hash_sk() | | // traverse the hash table | smc_diag_dump_proto | __smc_diag_dump() | // visit wrong clcsock | smc_diag_msg_common_fill() // alloc clcsock | smc_create_clcsk | sock_create_kern | With CONFIG_DEBUG_LOCK_ALLOC=y, the smc->clcsock is unexpectedly changed in inet_init_csk_locks(). The INET_PROTOSW_ICSK flag is no need by smc, just remove it. After removing the INET_PROTOSW_ICSK flag, this patch alse revert commit 6fd27ea183c2 (net/smc: fix lacks of icsk_syn_mss with IPPROTO_SMC) to avoid casting smc_sock to inet_connection_sock. (CVE-2025-40357)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40357
https://ubuntu.com/security/CVE-2025-40357

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40357

Plugin Information
Published: 2025/12/17, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278873 - Linux Distros Unpatched Vulnerability : CVE-2025-40360
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/sysfb: Do not dereference NULL pointer in plane reset The plane state in
__drm_gem_reset_shadow_plane() can be NULL. Do not deref that pointer, but forward NULL to the other plane-reset helpers. Clears plane->state to NULL. v2: - fix typo in commit description (Javier) (CVE-2025-40360)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40360
https://security-tracker.debian.org/tracker/CVE-2025-40360
https://ubuntu.com/security/CVE-2025-40360

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40360

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278909 - Linux Distros Unpatched Vulnerability : CVE-2025-40361
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock The parent function ext4_xattr_inode_lookup_create already uses GFP_NOFS for memory alloction, so the function ext4_xattr_inode_cache_find should use same gfp_flag. (CVE-2025-40361)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40361
https://security-tracker.debian.org/tracker/CVE-2025-40361
https://ubuntu.com/security/CVE-2025-40361

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40361

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278805 - Linux Distros Unpatched Vulnerability : CVE-2025-40363
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: ipv6: fix field-spanning memcpy warning in AH output Fix field-spanning memcpy warnings in ah6_output() and ah6_output_done() where extension headers are copied to/from IPv6 address fields, triggering fortify-string warnings about writes beyond the 16-byte address fields. memcpy: detected field- spanning write (size 40) of single field &top_iph->saddr at net/ipv6/ah6.c:439 (size 16) WARNING: CPU: 0 PID: 8838 at net/ipv6/ah6.c:439 ah6_output+0xe7e/0x14e0 net/ipv6/ah6.c:439 The warnings are false positives as the extension headers are intentionally placed after the IPv6 header in memory. Fix by properly copying addresses and extension headers separately, and introduce helper functions to avoid code duplication. (CVE-2025-40363)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40363
https://security-tracker.debian.org/tracker/CVE-2025-40363
https://ubuntu.com/security/CVE-2025-40363

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.2 (CVSS2#AV:L/AC:L/Au:S/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40363

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
252410 - Linux Distros Unpatched Vulnerability : CVE-2025-43228
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The issue was addressed with improved UI. This issue is fixed in iOS 18.6 and iPadOS 18.6, Safari 18. 6.
Visiting a malicious website may lead to address bar spoofing. (CVE-2025-43228)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-43228
https://security-tracker.debian.org/tracker/CVE-2025-43228
https://ubuntu.com/security/CVE-2025-43228

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
3.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
2.2
EPSS Score
0.0002
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-43228

Plugin Information
Published: 2025/08/20, Modified: 2025/09/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- webkit2gtk3
- webkit2gtk3-jsc
247075 - Linux Distros Unpatched Vulnerability : CVE-2025-4373
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which to insert the character is large, the position will overflow, leading to a buffer underwrite. (CVE-2025-4373)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-4373
https://ubuntu.com/security/CVE-2025-4373

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
4.8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)
CVSS v3.0 Temporal Score
4.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.3
EPSS Score
0.0004
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-4373

Plugin Information
Published: 2025/08/09, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- librsvg2
- librsvg2-tools
251939 - Linux Distros Unpatched Vulnerability : CVE-2025-4382
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in systems utilizing LUKS-encrypted disks with GRUB configured for TPM-based auto- decryption. When GRUB is set to automatically decrypt disks using keys stored in the TPM, it reads the decryption key into system memory. If an attacker with physical access can corrupt the underlying filesystem superblock, GRUB will fail to locate a valid filesystem and enter rescue mode. At this point, the disk is already decrypted, and the decryption key remains loaded in system memory. This scenario may allow an attacker with physical access to access the unencrypted data without any further authentication, thereby compromising data confidentiality. Furthermore, the ability to force this state through filesystem corruption also presents a data integrity concern. (CVE-2025-4382)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-4382
https://security-tracker.debian.org/tracker/CVE-2025-4382
https://ubuntu.com/security/CVE-2025-4382

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.9 (CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
5.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0003
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-4382

Plugin Information
Published: 2025/08/19, Modified: 2025/12/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- grub2-common
- grub2-efi-x64
- grub2-tools
- grub2-tools-minimal
257497 - Linux Distros Unpatched Vulnerability : CVE-2025-43903
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries. (CVE-2025-43903)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-43903
https://security-tracker.debian.org/tracker/CVE-2025-43903

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
3.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.0001
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-43903

Plugin Information
Published: 2025/08/27, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- poppler
- poppler-cpp
- poppler-glib
- poppler-utils
249435 - Linux Distros Unpatched Vulnerability : CVE-2025-4432
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to induce this panic by sending a specially crafted packet. It will likely occur unintentionally in 1 out of every 2**32 packets sent or received.
(CVE-2025-4432)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-4432
https://security-tracker.debian.org/tracker/CVE-2025-4432
https://ubuntu.com/security/CVE-2025-4432

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.001
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-4432

Plugin Information
Published: 2025/08/15, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
- gjs
- polkit
- polkit-libs
244192 - Linux Distros Unpatched Vulnerability : CVE-2025-4476
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious HTTP server. If a user's application using the vulnerable libsoup library connects to this malicious server, it could result in a denial-of-service. Successful exploitation requires tricking a user's client application into connecting to the attacker's malicious server. (CVE-2025-4476)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-4476
https://security-tracker.debian.org/tracker/CVE-2025-4476

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
4.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-4476

Plugin Information
Published: 2025/08/06, Modified: 2025/12/09
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libsoup
252065 - Linux Distros Unpatched Vulnerability : CVE-2025-4516
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- There is an issue in CPython when using `bytes.decode(unicode_escape, error=ignore|replace)`. If you are not using the unicode_escape encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError. (CVE-2025-4516)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-4516
https://security-tracker.debian.org/tracker/CVE-2025-4516

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.1 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
6.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-4516

Plugin Information
Published: 2025/08/19, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- python-unversioned-command
- python3
- python3-libs
247155 - Linux Distros Unpatched Vulnerability : CVE-2025-45582
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of Member name contains '..' that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain x ->
../../../../../home/victim/.ssh and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which tar xf is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each tar xf in its Security Rules of Thumb; however, third-party advice leads users to run tar xf more than once into the same directory. (CVE-2025-45582)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-45582
https://ubuntu.com/security/CVE-2025-45582

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.1 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L)
CVSS v3.0 Temporal Score
3.9 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
3.8
EPSS Score
0.0003
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-45582

Plugin Information
Published: 2025/08/10, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- tar
244019 - Linux Distros Unpatched Vulnerability : CVE-2025-4565
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901 (CVE-2025-4565)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-4565
https://security-tracker.debian.org/tracker/CVE-2025-4565
https://ubuntu.com/security/CVE-2025-4565

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
8.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
4.6 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.0004
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-4565

Plugin Information
Published: 2025/08/06, Modified: 2025/09/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- protobuf-lite
252439 - Linux Distros Unpatched Vulnerability : CVE-2025-4574
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.
(CVE-2025-4574)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-4574
https://ubuntu.com/security/CVE-2025-4574

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
2.5
EPSS Score
0.0004
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-4574

Plugin Information
Published: 2025/08/20, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
260210 - Linux Distros Unpatched Vulnerability : CVE-2025-46646
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding.
NOTE: this issue exists because of an incomplete fix for CVE-2024-46954. (CVE-2025-46646)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-46646

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.5 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
3.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.0
EPSS Score
0.0001
References

CVE | CVE-2025-46646

Plugin Information
Published: 2025/09/01, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- ghostscript
- ghostscript-tools-fonts
- ghostscript-tools-printing
- libgs
247150 - Linux Distros Unpatched Vulnerability : CVE-2025-4673
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information. (CVE-2025-4673)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-4673
https://security-tracker.debian.org/tracker/CVE-2025-4673
https://ubuntu.com/security/CVE-2025-4673

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
6.2 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-4673

Plugin Information
Published: 2025/08/10, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- conmon
- containernetworking-plugins
- podman
- rhc
253584 - Linux Distros Unpatched Vulnerability : CVE-2025-47183
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree function may read past the end of a heap buffer while parsing an MP4 file, leading to information disclosure. (CVE-2025-47183)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-47183
https://security-tracker.debian.org/tracker/CVE-2025-47183
https://ubuntu.com/security/CVE-2025-47183

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.6 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.3 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-47183

Plugin Information
Published: 2025/08/22, Modified: 2025/12/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gstreamer1-plugins-good
- gstreamer1-plugins-good-gtk
253562 - Linux Distros Unpatched Vulnerability : CVE-2025-47806
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In GStreamer through 1.26.1, the subparse plugin's parse_subrip_time function may write data past the bounds of a stack buffer, leading to a crash. (CVE-2025-47806)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-47806

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.6 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
5.3 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.2
EPSS Score
0.0002
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.8 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-47806

Plugin Information
Published: 2025/08/22, Modified: 2025/11/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gstreamer1-plugins-base
253557 - Linux Distros Unpatched Vulnerability : CVE-2025-47807
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In GStreamer through 1.26.1, the subparse plugin's subrip_unescape_formatting function may dereference a NULL pointer while parsing a subtitle file, leading to a crash. (CVE-2025-47807)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-47807

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-47807

Plugin Information
Published: 2025/08/22, Modified: 2025/11/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gstreamer1-plugins-base
253574 - Linux Distros Unpatched Vulnerability : CVE-2025-47808
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In GStreamer through 1.26.1, the subparse plugin's tmplayer_parse_line function may dereference a NULL pointer while parsing a subtitle file, leading to a crash. (CVE-2025-47808)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-47808

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.6 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
5.3 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.2
EPSS Score
0.0004
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-47808

Plugin Information
Published: 2025/08/22, Modified: 2025/11/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gstreamer1-plugins-base
253526 - Linux Distros Unpatched Vulnerability : CVE-2025-47906
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath (, ., and ..), can result in the binaries listed in the PATH being unexpectedly returned. (CVE-2025-47906)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-47906
https://security-tracker.debian.org/tracker/CVE-2025-47906
https://ubuntu.com/security/CVE-2025-47906

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.3
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-47906

Plugin Information
Published: 2025/08/22, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- conmon
- containernetworking-plugins
- podman
- rhc
266048 - Linux Distros Unpatched Vulnerability : CVE-2025-47910
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.
(CVE-2025-47910)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-47910
https://ubuntu.com/security/CVE-2025-47910

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.5
EPSS Score
0.0001
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-47910

Plugin Information
Published: 2025/09/29, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- conmon
- containernetworking-plugins
- podman
- rhc
270218 - Linux Distros Unpatched Vulnerability : CVE-2025-47912
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: http://[::1]/. IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement. (CVE-2025-47912)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-47912
https://security-tracker.debian.org/tracker/CVE-2025-47912
https://ubuntu.com/security/CVE-2025-47912

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-47912

Plugin Information
Published: 2025/10/13, Modified: 2025/11/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- rhc
260292 - Linux Distros Unpatched Vulnerability : CVE-2025-48386
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1. (CVE-2025-48386)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-48386

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-48386

Plugin Information
Published: 2025/09/02, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- git
- git-core
- git-core-doc
- perl-Git
251613 - Linux Distros Unpatched Vulnerability : CVE-2025-49177
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests. (CVE-2025-49177)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-49177
https://security-tracker.debian.org/tracker/CVE-2025-49177
https://ubuntu.com/security/CVE-2025-49177

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L)
CVSS v3.0 Temporal Score
5.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.0
EPSS Score
0.0001
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-49177

Plugin Information
Published: 2025/08/18, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- tigervnc
- tigervnc-icons
- tigervnc-license
- tigervnc-selinux
- tigervnc-server
- tigervnc-server-minimal
246034 - Linux Distros Unpatched Vulnerability : CVE-2025-4969
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was found in the libsoup package. This flaw stems from its failure to correctly verify the termination of multipart HTTP messages. This can allow a remote attacker to send a specially crafted multipart HTTP body, causing the libsoup-consuming server to read beyond its allocated memory boundaries (out-of-bounds read). (CVE-2025-4969)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-4969
https://security-tracker.debian.org/tracker/CVE-2025-4969

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.5
EPSS Score
0.001
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-4969

Plugin Information
Published: 2025/08/08, Modified: 2025/12/09
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libsoup
243733 - Linux Distros Unpatched Vulnerability : CVE-2025-50181
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0. (CVE-2025-50181)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-50181
https://security-tracker.debian.org/tracker/CVE-2025-50181

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
3.8
EPSS Score
0.0001
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-50181

Plugin Information
Published: 2025/08/05, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- python3-pip-wheel
248306 - Linux Distros Unpatched Vulnerability : CVE-2025-50182
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0. (CVE-2025-50182)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-50182

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
5.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.8
EPSS Score
0.0001
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-50182

Plugin Information
Published: 2025/08/11, Modified: 2025/12/25
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- python3-pip-wheel
253586 - Linux Distros Unpatched Vulnerability : CVE-2025-50952
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- openjpeg v 2.5.0 was discovered to contain a NULL pointer dereference via the component /openjp2/dwt.c.
(CVE-2025-50952)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-50952
https://ubuntu.com/security/CVE-2025-50952

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.3
EPSS Score
0.0003
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-50952

Plugin Information
Published: 2025/08/22, Modified: 2025/12/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- openjpeg2
257905 - Linux Distros Unpatched Vulnerability : CVE-2025-5278
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.
(CVE-2025-5278)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-5278
https://security-tracker.debian.org/tracker/CVE-2025-5278
https://ubuntu.com/security/CVE-2025-5278

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L)
CVSS v3.0 Temporal Score
4.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.3
EPSS Score
0.0001
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-5278

Plugin Information
Published: 2025/08/27, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- coreutils
- coreutils-common
258011 - Linux Distros Unpatched Vulnerability : CVE-2025-5351
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed.
(CVE-2025-5351)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-5351
https://security-tracker.debian.org/tracker/CVE-2025-5351

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-5351

Plugin Information
Published: 2025/08/27, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libssh
- libssh-config
260733 - Linux Distros Unpatched Vulnerability : CVE-2025-54080
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of- bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed in version 0.28.6. (CVE-2025-54080)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-54080
https://security-tracker.debian.org/tracker/CVE-2025-54080
https://ubuntu.com/security/CVE-2025-54080

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
1.8 (CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-54080

Plugin Information
Published: 2025/09/03, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- exiv2
- exiv2-libs
275747 - Linux Distros Unpatched Vulnerability : CVE-2025-54770
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability has been identified in the GRUB2 bootloader's network module that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the net_set_vlan command is not properly unregistered when the network module is unloaded from memory. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability (CVE-2025-54770)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-54770
https://security-tracker.debian.org/tracker/CVE-2025-54770
https://ubuntu.com/security/CVE-2025-54770

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.2
EPSS Score
0.0001
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-54770

Plugin Information
Published: 2025/11/18, Modified: 2025/11/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- grub2-common
- grub2-efi-x64
- grub2-tools
- grub2-tools-minimal
275737 - Linux Distros Unpatched Vulnerability : CVE-2025-54771
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader). The flaw occurs because the file-closing process incorrectly retains a memory pointer, leaving an invalid reference to a file system structure. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.
(CVE-2025-54771)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-54771
https://security-tracker.debian.org/tracker/CVE-2025-54771
https://ubuntu.com/security/CVE-2025-54771

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.2
EPSS Score
0.0001
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-54771

Plugin Information
Published: 2025/11/18, Modified: 2025/11/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- grub2-common
- grub2-efi-x64
- grub2-tools
- grub2-tools-minimal
253585 - Linux Distros Unpatched Vulnerability : CVE-2025-54798
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4. (CVE-2025-54798)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-54798
https://ubuntu.com/security/CVE-2025-54798

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.0001
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.2 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-54798

Plugin Information
Published: 2025/08/22, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gjs
- polkit
- polkit-libs
261409 - Linux Distros Unpatched Vulnerability : CVE-2025-55173
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5. (CVE-2025-55173)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-55173

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
3.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.0003
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.5 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-55173

Plugin Information
Published: 2025/09/05, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- dotnet-host
- firefox
- netstandard-targeting-pack-2.1
260734 - Linux Distros Unpatched Vulnerability : CVE-2025-55304
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial- of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6. (CVE-2025-55304)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-55304
https://security-tracker.debian.org/tracker/CVE-2025-55304
https://ubuntu.com/security/CVE-2025-55304

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
1.8 (CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-55304

Plugin Information
Published: 2025/09/03, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- exiv2
- exiv2-libs
255761 - Linux Distros Unpatched Vulnerability : CVE-2025-5683
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- When loading a specifically crafted ICNS format image file in QImage then it will trigger a crash. This issue affects Qt from versions 6.3.0 through 6.5.9, from 6.6.0 through 6.8.4, 6.9.0. This is fixed in 6.5.10, 6.8.5 and 6.9.1. (CVE-2025-5683)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-5683
https://security-tracker.debian.org/tracker/CVE-2025-5683
https://ubuntu.com/security/CVE-2025-5683

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
5.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L)
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-5683

Plugin Information
Published: 2025/08/27, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- qt5-srpm-macros
261410 - Linux Distros Unpatched Vulnerability : CVE-2025-57752
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization API routes are affected by cache key confusion. When images returned from API routes vary based on request headers (such as Cookie or Authorization), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug.
This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5. All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled. (CVE-2025-57752)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-57752

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.4 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-57752

Plugin Information
Published: 2025/09/05, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- dotnet-host
- firefox
- netstandard-targeting-pack-2.1
260739 - Linux Distros Unpatched Vulnerability : CVE-2025-58058
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14. (CVE-2025-58058)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-58058
https://security-tracker.debian.org/tracker/CVE-2025-58058
https://ubuntu.com/security/CVE-2025-58058

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0004
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-58058

Plugin Information
Published: 2025/09/03, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- conmon
- podman
260941 - Linux Distros Unpatched Vulnerability : CVE-2025-58160
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences. (CVE-2025-58160)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-58160
https://security-tracker.debian.org/tracker/CVE-2025-58160
https://ubuntu.com/security/CVE-2025-58160

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v4.0 Base Score
2.3 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0004
CVSS v2.0 Base Score
3.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
3.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-58160

Plugin Information
Published: 2025/09/03, Modified: 2025/11/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
- libsmbclient
- libwbclient
- samba-client
- samba-client-libs
- samba-common
- samba-common-libs
270210 - Linux Distros Unpatched Vulnerability : CVE-2025-58185
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion. (CVE-2025-58185)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-58185
https://security-tracker.debian.org/tracker/CVE-2025-58185
https://ubuntu.com/security/CVE-2025-58185

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0001
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-58185

Plugin Information
Published: 2025/10/13, Modified: 2025/11/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- conmon
- containernetworking-plugins
- podman
- rhc
270213 - Linux Distros Unpatched Vulnerability : CVE-2025-58189
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped. (CVE-2025-58189)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-58189
https://security-tracker.debian.org/tracker/CVE-2025-58189
https://ubuntu.com/security/CVE-2025-58189

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-58189

Plugin Information
Published: 2025/10/13, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- conmon
- containernetworking-plugins
- podman
- rhc
276954 - Linux Distros Unpatched Vulnerability : CVE-2025-58436
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in version 2.4.15. (CVE-2025-58436)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-58436
https://security-tracker.debian.org/tracker/CVE-2025-58436

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.5 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-58436

Plugin Information
Published: 2025/12/01, Modified: 2025/12/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- cups
- cups-client
- cups-filesystem
- cups-ipptool
- cups-libs
248416 - Linux Distros Unpatched Vulnerability : CVE-2025-5889
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue.
The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component. (CVE-2025-5889)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-5889
https://security-tracker.debian.org/tracker/CVE-2025-5889
https://ubuntu.com/security/CVE-2025-5889

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
2.3 (CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.0004
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-5889

Plugin Information
Published: 2025/08/11, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gjs
- polkit
- polkit-libs
248896 - Linux Distros Unpatched Vulnerability : CVE-2025-5915
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over- read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window.
This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions. (CVE-2025-5915)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-5915
https://ubuntu.com/security/CVE-2025-5915

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.6 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.2
EPSS Score
0.0001
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-5915

Plugin Information
Published: 2025/08/12, Modified: 2025/11/09
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libarchive
245760 - Linux Distros Unpatched Vulnerability : CVE-2025-5916
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. This bug affects libarchive versions prior to 3.8.0. (CVE-2025-5916)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-5916
https://ubuntu.com/security/CVE-2025-5916

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.6 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.0
EPSS Score
0.0001
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-5916

Plugin Information
Published: 2025/08/08, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libarchive
246334 - Linux Distros Unpatched Vulnerability : CVE-2025-5917
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one'
miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation. This bug affects libarchive versions prior to 3.8.0. (CVE-2025-5917)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-5917
https://ubuntu.com/security/CVE-2025-5917

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.0 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-5917

Plugin Information
Published: 2025/08/08, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libarchive
244236 - Linux Distros Unpatched Vulnerability : CVE-2025-5918
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of- bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition. (CVE-2025-5918)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-5918
https://security-tracker.debian.org/tracker/CVE-2025-5918
https://ubuntu.com/security/CVE-2025-5918

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.6 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
6.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0001
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-5918

Plugin Information
Published: 2025/08/06, Modified: 2025/11/12
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libarchive
272130 - Linux Distros Unpatched Vulnerability : CVE-2025-6075
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables. (CVE-2025-6075)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-6075
https://security-tracker.debian.org/tracker/CVE-2025-6075
https://ubuntu.com/security/CVE-2025-6075

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
1.8 (CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
4.0 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.0001
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-6075

Plugin Information
Published: 2025/10/31, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
274085 - Linux Distros Unpatched Vulnerability : CVE-2025-60753
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash). (CVE-2025-60753)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-60753
https://security-tracker.debian.org/tracker/CVE-2025-60753
https://ubuntu.com/security/CVE-2025-60753

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-60753

Plugin Information
Published: 2025/11/05, Modified: 2025/11/07
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libarchive
275745 - Linux Distros Unpatched Vulnerability : CVE-2025-61661
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. This flaw occurs because the bootloader mishandles string conversion when reading information from a USB device, allowing an attacker to exploit inconsistent length values. A local attacker can connect a maliciously configured USB device during the boot sequence to trigger this issue. A successful exploitation may lead GRUB to crash, leading to a Denial of Service. Data corruption may be also possible, although given the complexity of the exploit the impact is most likely limited. (CVE-2025-61661)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-61661
https://security-tracker.debian.org/tracker/CVE-2025-61661
https://ubuntu.com/security/CVE-2025-61661

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.8 (CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)
CVSS v3.0 Temporal Score
4.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.0
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-61661

Plugin Information
Published: 2025/11/18, Modified: 2025/11/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- grub2-common
- grub2-efi-x64
- grub2-tools
- grub2-tools-minimal
275735 - Linux Distros Unpatched Vulnerability : CVE-2025-61662
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invoking the orphaned command, causing the application to access a memory location that is no longer valid. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded. (CVE-2025-61662)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-61662
https://security-tracker.debian.org/tracker/CVE-2025-61662
https://ubuntu.com/security/CVE-2025-61662

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
4.9 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
4.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.2
EPSS Score
0.0001
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-61662

Plugin Information
Published: 2025/11/18, Modified: 2025/11/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- grub2-common
- grub2-efi-x64
- grub2-tools
- grub2-tools-minimal
275739 - Linux Distros Unpatched Vulnerability : CVE-2025-61663
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is not properly unregistered when the module is unloaded. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability. Impact on the data integrity and confidentiality is also not discarded. (CVE-2025-61663)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-61663
https://security-tracker.debian.org/tracker/CVE-2025-61663
https://ubuntu.com/security/CVE-2025-61663

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:P)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-61663

Plugin Information
Published: 2025/11/18, Modified: 2025/11/19
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- grub2-common
- grub2-efi-x64
- grub2-tools
- grub2-tools-minimal
270220 - Linux Distros Unpatched Vulnerability : CVE-2025-61724
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption.
(CVE-2025-61724)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-61724
https://security-tracker.debian.org/tracker/CVE-2025-61724
https://ubuntu.com/security/CVE-2025-61724

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-61724

Plugin Information
Published: 2025/10/13, Modified: 2025/11/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- containernetworking-plugins
- podman
- rhc
277086 - Linux Distros Unpatched Vulnerability : CVE-2025-61727
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com. (CVE-2025-61727)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-61727
https://security-tracker.debian.org/tracker/CVE-2025-61727
https://ubuntu.com/security/CVE-2025-61727

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-61727

Plugin Information
Published: 2025/12/03, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- containernetworking-plugins
- podman
- rhc
276958 - Linux Distros Unpatched Vulnerability : CVE-2025-61915
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of- bound write. This issue has been patched in version 2.4.15. (CVE-2025-61915)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-61915
https://security-tracker.debian.org/tracker/CVE-2025-61915

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.0 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0001
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-61915

Plugin Information
Published: 2025/12/01, Modified: 2025/12/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- cups
- cups-client
- cups-filesystem
- cups-ipptool
- cups-libs
277772 - Linux Distros Unpatched Vulnerability : CVE-2025-62408
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6. (CVE-2025-62408)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-62408

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-62408

Plugin Information
Published: 2025/12/08, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- c-ares
255311 - Linux Distros Unpatched Vulnerability : CVE-2025-6273
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was found in WebAssembly wabt up to 1.0.37 and classified as problematic. This issue affects the function LogOpcode of the file src/binary-reader-objdump.cc. The manipulation leads to reachable assertion. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains that this issue might not affect real world wasm programs. (CVE-2025-6273)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-6273
https://security-tracker.debian.org/tracker/CVE-2025-6273
https://ubuntu.com/security/CVE-2025-6273

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
5.0 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-6273

Plugin Information
Published: 2025/08/26, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
251199 - Linux Distros Unpatched Vulnerability : CVE-2025-6274
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been classified as problematic.
Affected is the function OnDataCount of the file src/interp/binary-reader-interp.cc. The manipulation leads to resource consumption. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. A similar issue reported during the same timeframe was disputed by the code maintainer because it might not affect real world wasm programs. Therefore, this entry might get disputed as well in the future. (CVE-2025-6274)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-6274
https://security-tracker.debian.org/tracker/CVE-2025-6274
https://ubuntu.com/security/CVE-2025-6274

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.7 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-6274

Plugin Information
Published: 2025/08/18, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
275284 - Linux Distros Unpatched Vulnerability : CVE-2025-64503
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-filters prior to 1.28.18, by crafting a PDF file with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x's `pdftoraster` tool to write beyond the bounds of an array. First, a PDF with a large `MediaBox` width value causes `header.cupsWidth` to become large. Next, the calculation of `bytesPerLine = (header.cupsBitsPerPixel * header.cupsWidth + 7) / 8` overflows, resulting in a small value. Then, `lineBuf` is allocated with the small `bytesPerLine` size.
Finally, `convertLineChunked` calls `writePixel8`, which attempts to write to `lineBuf` outside of its buffer size (out of bounds write). In libcupsfilters, the maintainers found the same `bytesPerLine` multiplication without overflow check, but the provided test case does not cause an overflow there, because the values are different. Commit 50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is incorporated into cups-filters version 1.28.18. (CVE-2025-64503)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-64503
https://security-tracker.debian.org/tracker/CVE-2025-64503

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.0 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.0001
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-64503

Plugin Information
Published: 2025/11/13, Modified: 2025/12/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- cups-filters
- cups-filters-libs
276644 - Linux Distros Unpatched Vulnerability : CVE-2025-64505
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of- bounds memory access. This issue has been patched in version 1.6.51. (CVE-2025-64505)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-64505
https://ubuntu.com/security/CVE-2025-64505

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
CVSS v3.0 Temporal Score
5.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.0
EPSS Score
0.0001
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-64505

Plugin Information
Published: 2025/11/24, Modified: 2025/12/12
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
- java-1.8.0-openjdk
- java-1.8.0-openjdk-demo
- java-1.8.0-openjdk-devel
- java-1.8.0-openjdk-headless
- java-1.8.0-openjdk-javadoc
- java-1.8.0-openjdk-javadoc-zip
- java-1.8.0-openjdk-src
- java-17-openjdk
- java-17-openjdk-demo
- java-17-openjdk-devel
- java-17-openjdk-headless
- java-17-openjdk-javadoc
- java-17-openjdk-javadoc-zip
- java-17-openjdk-jmods
- java-17-openjdk-src
- java-17-openjdk-static-libs
- java-21-openjdk
- java-21-openjdk-demo
- java-21-openjdk-devel
- java-21-openjdk-headless
- java-21-openjdk-javadoc
- java-21-openjdk-javadoc-zip
- java-21-openjdk-jmods
- java-21-openjdk-src
- java-21-openjdk-static-libs
- libpng
- libpng-devel
276642 - Linux Distros Unpatched Vulnerability : CVE-2025-64506
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51. (CVE-2025-64506)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-64506
https://ubuntu.com/security/CVE-2025-64506

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
CVSS v3.0 Temporal Score
5.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.0
EPSS Score
0.0001
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-64506

Plugin Information
Published: 2025/11/24, Modified: 2025/12/12
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
- java-1.8.0-openjdk
- java-1.8.0-openjdk-demo
- java-1.8.0-openjdk-devel
- java-1.8.0-openjdk-headless
- java-1.8.0-openjdk-javadoc
- java-1.8.0-openjdk-javadoc-zip
- java-1.8.0-openjdk-src
- java-17-openjdk
- java-17-openjdk-demo
- java-17-openjdk-devel
- java-17-openjdk-headless
- java-17-openjdk-javadoc
- java-17-openjdk-javadoc-zip
- java-17-openjdk-jmods
- java-17-openjdk-src
- java-17-openjdk-static-libs
- java-21-openjdk
- java-21-openjdk-demo
- java-21-openjdk-devel
- java-21-openjdk-headless
- java-21-openjdk-javadoc
- java-21-openjdk-javadoc-zip
- java-21-openjdk-jmods
- java-21-openjdk-src
- java-21-openjdk-static-libs
- libpng
- libpng-devel
275394 - Linux Distros Unpatched Vulnerability : CVE-2025-64718
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- js-yaml is a JavaScript YAML parser and dumper. In js-yaml 4.1.0 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default). (CVE-2025-64718)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-64718
https://security-tracker.debian.org/tracker/CVE-2025-64718
https://ubuntu.com/security/CVE-2025-64718

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.0003
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-64718

Plugin Information
Published: 2025/11/13, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gjs
- polkit
- polkit-libs
276979 - Linux Distros Unpatched Vulnerability : CVE-2025-66035
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin.
If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs. (CVE-2025-66035)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-66035
https://security-tracker.debian.org/tracker/CVE-2025-66035
https://ubuntu.com/security/CVE-2025-66035

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v4.0 Base Score
7.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N)
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
6.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-66035

Plugin Information
Published: 2025/12/01, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
- gjs
277591 - Linux Distros Unpatched Vulnerability : CVE-2025-66412
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts. This vulnerability is fixed in 21.0.2, 20.3.15, and 19.2.17. (CVE-2025-66412)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-66412
https://security-tracker.debian.org/tracker/CVE-2025-66412

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v4.0 Base Score
8.5 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
5.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.8
EPSS Score
0.0005
CVSS v2.0 Base Score
3.5 (CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
3.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-66412

Plugin Information
Published: 2025/12/05, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
- gjs
280126 - Linux Distros Unpatched Vulnerability : CVE-2025-66861
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in function d_unqualified_name in file cp-demangle.c in BinUtils 2.26 allowing attackers to cause a denial of service via crafted PE file. (CVE-2025-66861)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-66861
https://security-tracker.debian.org/tracker/CVE-2025-66861

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-66861

Plugin Information
Published: 2025/12/29, Modified: 2025/12/30
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
280133 - Linux Distros Unpatched Vulnerability : CVE-2025-66864
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. (CVE-2025-66864)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-66864
https://security-tracker.debian.org/tracker/CVE-2025-66864

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-66864

Plugin Information
Published: 2025/12/29, Modified: 2025/12/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
280128 - Linux Distros Unpatched Vulnerability : CVE-2025-66866
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An issue was discovered in function d_abi_tags in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file. (CVE-2025-66866)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-66866
https://security-tracker.debian.org/tracker/CVE-2025-66866

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-66866

Plugin Information
Published: 2025/12/29, Modified: 2025/12/31
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
278373 - Linux Distros Unpatched Vulnerability : CVE-2025-67499
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container. Versions 1.6.0 through 1.8.0 inadvertently forward all traffic with the same destination port as the host port when the portmap plugin is configured with the nftables backend, thus ignoring the destination IP. This includes traffic not intended for the node itself, i.e. traffic to containers hosted on the node. Containers that request HostPort forwarding can intercept all traffic destined for that port.
This requires that the portmap plugin be explicitly configured to use the nftables backend. This issue is fixed in version 1.9.0. To workaround, configure the portmap plugin to use the iptables backend. It does not have this vulnerability. (CVE-2025-67499)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-67499
https://ubuntu.com/security/CVE-2025-67499

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.6 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
CVSS v3.0 Temporal Score
6.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.5
EPSS Score
0.0001
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-67499

Plugin Information
Published: 2025/12/11, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- containernetworking-plugins
278852 - Linux Distros Unpatched Vulnerability : CVE-2025-68170
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/radeon: Do not kfree() devres managed rdev Since the allocation of the drivers main structure was changed to devm_drm_dev_alloc() rdev is managed by devres and we shouldn't be calling kfree() on it. This fixes things exploding if the driver probe fails and devres cleans up the rdev after we already free'd it.
(cherry picked from commit 16c0681617b8a045773d4d87b6140002fa75b03b) (CVE-2025-68170)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68170
https://security-tracker.debian.org/tracker/CVE-2025-68170
https://ubuntu.com/security/CVE-2025-68170

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68170

Plugin Information
Published: 2025/12/16, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278808 - Linux Distros Unpatched Vulnerability : CVE-2025-68171
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- x86/fpu: Ensure XFD state on signal delivery Sean reported [1] the following splat when running KVM tests:
WARNING: CPU: 232 PID: 15391 at xfd_validate_state+0x65/0x70 Call Trace: <TASK>
fpu__clear_user_states+0x9c/0x100 arch_do_signal_or_restart+0x142/0x210 exit_to_user_mode_loop+0x55/0x100 do_syscall_64+0x205/0x2c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Chao further identified [2] a reproducible scenario involving signal delivery: a non-AMX task is preempted by an AMX-enabled task which modifies the XFD MSR. When the non-AMX task resumes and reloads XSTATE with init values, a warning is triggered due to a mismatch between fpstate::xfd and the CPU's current XFD state. fpu__clear_user_states() does not currently re-synchronize the XFD state after such preemption. Invoke xfd_update_state() which detects and corrects the mismatch if there is a dynamic feature. This also benefits the sigreturn path, as fpu__restore_sig() may call fpu__clear_user_states() when the sigframe is inaccessible. [ dhansen: minor changelog munging ] (CVE-2025-68171)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68171
https://security-tracker.debian.org/tracker/CVE-2025-68171
https://ubuntu.com/security/CVE-2025-68171

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.0 (CVSS2#AV:L/AC:H/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68171

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278812 - Linux Distros Unpatched Vulnerability : CVE-2025-68173
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ftrace: Fix softlockup in ftrace_module_enable A soft lockup was observed when loading amdgpu module. If a module has a lot of tracable functions, multiple calls to kallsyms_lookup can spend too much time in RCU critical section and with disabled preemption, causing kernel panic. This is the same issue that was fixed in commit d0b24b4e91fc (ftrace: Prevent RCU stall on PREEMPT_VOLUNTARY kernels) and commit 42ea22e754ba (ftrace: Add cond_resched() to ftrace_graph_set_hash()). Fix it the same way by adding cond_resched() in ftrace_module_enable. (CVE-2025-68173)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68173
https://security-tracker.debian.org/tracker/CVE-2025-68173
https://ubuntu.com/security/CVE-2025-68173

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68173

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278830 - Linux Distros Unpatched Vulnerability : CVE-2025-68185
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing Theoretically it's an oopsable race, but I don't believe one can manage to hit it on real hardware; might become doable on a KVM, but it still won't be easy to attack. Anyway, it's easy to deal with - since xdr_encode_hyper() is just a call of put_unaligned_be64(), we can put that under ->d_lock and be done with that.
(CVE-2025-68185)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68185
https://security-tracker.debian.org/tracker/CVE-2025-68185
https://ubuntu.com/security/CVE-2025-68185

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68185

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278818 - Linux Distros Unpatched Vulnerability : CVE-2025-68191
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- udp_tunnel: use netdev_warn() instead of netdev_WARN() netdev_WARN() uses WARN/WARN_ON to print a backtrace along with file and line information. In this case, udp_tunnel_nic_register() returning an error is just a failed operation, not a kernel bug. udp_tunnel_nic_register() can fail due to a memory allocation failure (kzalloc() or udp_tunnel_nic_alloc()). This is a normal runtime error and not a kernel bug. Replace netdev_WARN() with netdev_warn() accordingly. (CVE-2025-68191)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68191
https://security-tracker.debian.org/tracker/CVE-2025-68191
https://ubuntu.com/security/CVE-2025-68191

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68191

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278886 - Linux Distros Unpatched Vulnerability : CVE-2025-68192
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup Raw IP packets have no MAC header, leaving skb->mac_header uninitialized. This can trigger kernel panics on ARM64 when xfrm or other subsystems access the offset due to strict alignment checks. Initialize the MAC header to prevent such crashes. This can trigger kernel panics on ARM when running IPsec over the qmimux0 interface. Example trace: Internal error: Oops: 000000009600004f [#1] SMP CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.34-gbe78e49cb433 #1 Hardware name: LS1028A RDB Board (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO
-DIT -SSBS BTYPE=--) pc : xfrm_input+0xde8/0x1318 lr : xfrm_input+0x61c/0x1318 sp : ffff800080003b20 Call trace: xfrm_input+0xde8/0x1318 xfrm6_rcv+0x38/0x44 xfrm6_esp_rcv+0x48/0xa8 ip6_protocol_deliver_rcu+0x94/0x4b0 ip6_input_finish+0x44/0x70 ip6_input+0x44/0xc0 ipv6_rcv+0x6c/0x114
__netif_receive_skb_one_core+0x5c/0x8c __netif_receive_skb+0x18/0x60 process_backlog+0x78/0x17c
__napi_poll+0x38/0x180 net_rx_action+0x168/0x2f0 (CVE-2025-68192)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68192
https://security-tracker.debian.org/tracker/CVE-2025-68192
https://ubuntu.com/security/CVE-2025-68192

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68192

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278928 - Linux Distros Unpatched Vulnerability : CVE-2025-68197
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() With older FW, we may get the ASYNC_EVENT_CMPL_EVENT_ID_DBG_BUF_PRODUCER for FW trace data type that has not been initialized. This will result in a crash in bnxt_bs_trace_type_wrap(). Add a guard to check for a valid magic_byte pointer before proceeding. (CVE-2025-68197)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68197
https://ubuntu.com/security/CVE-2025-68197

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68197

Plugin Information
Published: 2025/12/17, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278891 - Linux Distros Unpatched Vulnerability : CVE-2025-68198
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- crash: fix crashkernel resource shrink When crashkernel is configured with a high reservation, shrinking its value below the low crashkernel reservation causes two issues: 1. Invalid crashkernel resource objects 2. Kernel crash if crashkernel shrinking is done twice For example, with crashkernel=200M,high, the kernel reserves 200MB of high memory and some default low memory (say 256MB). The reservation appears as: cat /proc/iomem | grep -i crash af000000-beffffff : Crash kernel 433000000-43f7fffff : Crash kernel If crashkernel is then shrunk to 50MB (echo 52428800 > /sys/kernel/kexec_crash_size), /proc/iomem still shows 256MB reserved: af000000-beffffff : Crash kernel Instead, it should show 50MB: af000000-b21fffff : Crash kernel Further shrinking crashkernel to 40MB causes a kernel crash with the following trace (x86): BUG:
kernel NULL pointer dereference, address: 0000000000000038 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI <snip...> Call Trace: <TASK> ? __die_body.cold+0x19/0x27 ? page_fault_oops+0x15a/0x2f0 ? search_module_extables+0x19/0x60 ? search_bpf_extables+0x5f/0x80 ? exc_page_fault+0x7e/0x180 ? asm_exc_page_fault+0x26/0x30 ? __release_resource+0xd/0xb0 release_resource+0x26/0x40
__crash_shrink_memory+0xe5/0x110 crash_shrink_memory+0x12a/0x190 kexec_crash_size_store+0x41/0x80 kernfs_fop_write_iter+0x141/0x1f0 vfs_write+0x294/0x460 ksys_write+0x6d/0xf0 <snip...> This happens because __crash_shrink_memory()/kernel/crash_core.c incorrectly updates the crashk_res resource object even when crashk_low_res should be updated. Fix this by ensuring the correct crashkernel resource object is updated when shrinking crashkernel memory. (CVE-2025-68198)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68198
https://security-tracker.debian.org/tracker/CVE-2025-68198
https://ubuntu.com/security/CVE-2025-68198

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68198

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278861 - Linux Distros Unpatched Vulnerability : CVE-2025-68204
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure If of_genpd_add_provider_onecell() fails during probe, the previously created generic power domains are not removed, leading to a memory leak and potential kernel crash later in genpd_debug_add(). Add proper error handling to unwind the initialized domains before returning from probe to ensure all resources are correctly released on failure. Example crash trace observed without this fix: | Unable to handle kernel paging request at virtual address fffffffffffffc70 | CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.0-rc1 #405 PREEMPT | Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform | pstate: 00000005 (nzcv daif
-PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : genpd_debug_add+0x2c/0x160 | lr : genpd_debug_init+0x74/0x98 | Call trace: | genpd_debug_add+0x2c/0x160 (P) | genpd_debug_init+0x74/0x98 | do_one_initcall+0xd0/0x2d8 | do_initcall_level+0xa0/0x140 | do_initcalls+0x60/0xa8 | do_basic_setup+0x28/0x40 | kernel_init_freeable+0xe8/0x170 | kernel_init+0x2c/0x140 | ret_from_fork+0x10/0x20 (CVE-2025-68204)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68204
https://security-tracker.debian.org/tracker/CVE-2025-68204
https://ubuntu.com/security/CVE-2025-68204

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68204

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278843 - Linux Distros Unpatched Vulnerability : CVE-2025-68209
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mlx5: Fix default values in create CQ Currently, CQs without a completion function are assigned the mlx5_add_cq_to_tasklet function by default. This is problematic since only user CQs created through the mlx5_ib driver are intended to use this function. Additionally, all CQs that will use doorbells instead of polling for completions must call mlx5_cq_arm. However, the default CQ creation flow leaves a valid value in the CQ's arm_db field, allowing FW to send interrupts to polling-only CQs in certain corner cases.
These two factors would allow a polling-only kernel CQ to be triggered by an EQ interrupt and call a completion function intended only for user CQs, causing a null pointer exception. Some areas in the driver have prevented this issue with one-off fixes but did not address the root cause. This patch fixes the described issue by adding defaults to the create CQ flow. It adds a default dummy completion function to protect against null pointer exceptions, and it sets an invalid command sequence number by default in kernel CQs to prevent the FW from sending an interrupt to the CQ until it is armed. User CQs are responsible for their own initialization values. Callers of mlx5_core_create_cq are responsible for changing the completion function and arming the CQ per their needs. (CVE-2025-68209)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68209
https://security-tracker.debian.org/tracker/CVE-2025-68209
https://ubuntu.com/security/CVE-2025-68209

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68209

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278915 - Linux Distros Unpatched Vulnerability : CVE-2025-68211
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item Currently, scan_get_next_rmap_item() walks every page address in a VMA to locate mergeable pages. This becomes highly inefficient when scanning large virtual memory areas that contain mostly unmapped regions, causing ksmd to use large amount of cpu without deduplicating much pages. This patch replaces the per-address lookup with a range walk using walk_page_range(). The range walker allows KSM to skip over entire unmapped holes in a VMA, avoiding unnecessary lookups. This problem was previously discussed in [1]. Consider the following test program which creates a 32 TiB mapping in the virtual address space but only populates a single page:
#include <unistd.h> #include <stdio.h> #include <sys/mman.h> /* 32 TiB */ const size_t size = 32ul * 1024
* 1024 * 1024 * 1024; int main() { char *area = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_NORESERVE | MAP_PRIVATE | MAP_ANON, -1, 0); if (area == MAP_FAILED) { perror(mmap() failed ); return -1; } /* Populate a single page such that we get an anon_vma. */ *area = 0; /* Enable KSM. */ madvise(area, size, MADV_MERGEABLE); pause(); return 0; } $ ./ksm-sparse & $ echo 1 > /sys/kernel/mm/ksm/run Without this patch ksmd uses 100% of the cpu for a long time (more then 1 hour in my test machine) scanning all the 32 TiB virtual address space that contain only one mapped page. This makes ksmd essentially deadlocked not able to deduplicate anything of value. With this patch ksmd walks only the one mapped page and skips the rest of the 32 TiB virtual address space, making the scan fast using little cpu. (CVE-2025-68211)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68211
https://security-tracker.debian.org/tracker/CVE-2025-68211
https://ubuntu.com/security/CVE-2025-68211

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68211

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278813 - Linux Distros Unpatched Vulnerability : CVE-2025-68214
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- timers: Fix NULL function pointer race in timer_shutdown_sync() There is a race condition between timer_shutdown_sync() and timer expiration that can lead to hitting a WARN_ON in expire_timers(). The issue occurs when timer_shutdown_sync() clears the timer function to NULL while the timer is still running on another CPU. The race scenario looks like this: CPU0 CPU1 <SOFTIRQ> lock_timer_base() expire_timers() base->running_timer = timer; unlock_timer_base() [call_timer_fn enter] mod_timer() ...
timer_shutdown_sync() lock_timer_base() // For now, will not detach the timer but only clear its function to NULL if (base->running_timer != timer) ret = detach_if_pending(timer, base, true); if (shutdown) timer->function = NULL; unlock_timer_base() [call_timer_fn exit] lock_timer_base() base->running_timer = NULL; unlock_timer_base() ... // Now timer is pending while its function set to NULL. // next timer trigger <SOFTIRQ> expire_timers() WARN_ON_ONCE(!fn) // hit ... lock_timer_base() // Now timer will detach if (base->running_timer != timer) ret = detach_if_pending(timer, base, true); if (shutdown) timer->function = NULL; unlock_timer_base() The problem is that timer_shutdown_sync() clears the timer function regardless of whether the timer is currently running. This can leave a pending timer with a NULL function pointer, which triggers the WARN_ON_ONCE(!fn) check in expire_timers(). Fix this by only clearing the timer function when actually detaching the timer. If the timer is running, leave the function pointer intact, which is safe because the timer will be properly detached when it finishes running.
(CVE-2025-68214)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68214
https://security-tracker.debian.org/tracker/CVE-2025-68214
https://ubuntu.com/security/CVE-2025-68214

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.1
EPSS Score
0.0002
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68214

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278791 - Linux Distros Unpatched Vulnerability : CVE-2025-68215
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ice: fix PTP cleanup on driver removal in error path Improve the cleanup on releasing PTP resources in error path. The error case might happen either at the driver probe and PTP feature initialization or on PTP restart (errors in reset handling, NVM update etc). In both cases, calls to PF PTP cleanup (ice_ptp_cleanup_pf function) and 'ps_lock' mutex deinitialization were missed. Additionally, ptp clock was not unregistered in the latter case. Keep PTP state as 'uninitialized' on init to distinguish between error scenarios and to avoid resource release duplication at driver removal. The consequence of missing ice_ptp_cleanup_pf call is the following call trace dumped when ice_adapter object is freed (port list is not empty, as it is required at this stage): [ T93022] ------------[ cut here ]------------ [ T93022] WARNING: CPU: 10 PID: 93022 at ice/ice_adapter.c:67 ice_adapter_put+0xef/0x100 [ice] ... [ T93022] RIP:
0010:ice_adapter_put+0xef/0x100 [ice] ... [ T93022] Call Trace: [ T93022] <TASK> [ T93022] ? ice_adapter_put+0xef/0x100 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] [ T93022] ?
__warn.cold+0xb0/0x10e [ T93022] ? ice_adapter_put+0xef/0x100 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] [ T93022] ? report_bug+0xd8/0x150 [ T93022] ? handle_bug+0xe9/0x110 [ T93022] ? exc_invalid_op+0x17/0x70 [ T93022] ? asm_exc_invalid_op+0x1a/0x20 [ T93022] ? ice_adapter_put+0xef/0x100 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] [ T93022] pci_device_remove+0x42/0xb0 [ T93022] device_release_driver_internal+0x19f/0x200 [ T93022] driver_detach+0x48/0x90 [ T93022] bus_remove_driver+0x70/0xf0 [ T93022] pci_unregister_driver+0x42/0xb0 [ T93022] ice_module_exit+0x10/0xdb0 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] ... [ T93022] ---[ end trace 0000000000000000 ]--- [ T93022] ice: module unloaded (CVE-2025-68215)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68215
https://security-tracker.debian.org/tracker/CVE-2025-68215
https://ubuntu.com/security/CVE-2025-68215

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68215

Plugin Information
Published: 2025/12/16, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278880 - Linux Distros Unpatched Vulnerability : CVE-2025-68218
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- nvme-multipath: fix lockdep WARN due to partition scan work Blktests test cases nvme/014, 057 and 058 fail occasionally due to a lockdep WARN. As reported in the Closes tag URL, the WARN indicates that a deadlock can happen due to the dependency among disk->open_mutex, kblockd workqueue completion and partition_scan_work completion. To avoid the lockdep WARN and the potential deadlock, cut the dependency by running the partition_scan_work not by kblockd workqueue but by nvme_wq. (CVE-2025-68218)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68218
https://security-tracker.debian.org/tracker/CVE-2025-68218
https://ubuntu.com/security/CVE-2025-68218

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68218

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278823 - Linux Distros Unpatched Vulnerability : CVE-2025-68219
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cifs: fix memory leak in smb3_fs_context_parse_param error path Add proper cleanup of ctx->source and fc->source to the cifs_parse_mount_err error handler. This ensures that memory allocated for the source strings is correctly freed on all error paths, matching the cleanup already performed in the success path by smb3_cleanup_fs_context_contents(). Pointers are also set to NULL after freeing to prevent potential double-free issues. This change fixes a memory leak originally detected by syzbot. The leak occurred when processing Opt_source mount options if an error happened after ctx->source and fc->source were successfully allocated but before the function completed. The specific leak sequence was: 1. ctx->source = smb3_fs_context_fullpath(ctx, '/') allocates memory 2. fc->source = kstrdup(ctx->source, GFP_KERNEL) allocates more memory 3. A subsequent error jumps to cifs_parse_mount_err 4. The old error handler freed passwords but not the source strings, causing the memory to leak. This issue was not addressed by commit e8c73eb7db0a (cifs: client: fix memory leak in smb3_fs_context_parse_param), which only fixed leaks from repeated fsconfig() calls but not this error path. Patch updated with minor change suggested by kernel test robot (CVE-2025-68219)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68219
https://security-tracker.debian.org/tracker/CVE-2025-68219
https://ubuntu.com/security/CVE-2025-68219

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68219

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278792 - Linux Distros Unpatched Vulnerability : CVE-2025-68223
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/radeon: delete radeon_fence_process in is_signaled, no deadlock Delete the attempt to progress the queue when checking if fence is signaled. This avoids deadlock. dma-fence_ops::signaled can be called with the fence lock in unknown state. For radeon, the fence lock is also the wait queue lock. This can cause a self deadlock when signaled() tries to make forward progress on the wait queue. But advancing the queue is unneeded because incorrectly returning false from signaled() is perfectly acceptable. (cherry picked from commit 527ba26e50ec2ca2be9c7c82f3ad42998a75d0db) (CVE-2025-68223)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68223
https://security-tracker.debian.org/tracker/CVE-2025-68223
https://ubuntu.com/security/CVE-2025-68223

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H)
CVSS v3.0 Temporal Score
5.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68223

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278926 - Linux Distros Unpatched Vulnerability : CVE-2025-68228
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/plane: Fix create_in_format_blob() return value create_in_format_blob() is either supposed to return a valid pointer or an error, but never NULL. The caller will dereference the blob when it is not an error, and thus will oops if NULL returned. Return proper error values in the failure cases. (CVE-2025-68228)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68228
https://ubuntu.com/security/CVE-2025-68228

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68228

Plugin Information
Published: 2025/12/17, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278881 - Linux Distros Unpatched Vulnerability : CVE-2025-68229
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() If the allocation of tl_hba->sh fails in tcm_loop_driver_probe() and we attempt to dereference it in tcm_loop_tpg_address_show() we will get a segfault, see below for an example. So, check tl_hba->sh before dereferencing it. Unable to allocate struct scsi_host BUG: kernel NULL pointer dereference, address: 0000000000000194 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 8356 Comm: tokio-runtime-w Not tainted 6.6.104.2-4.azl3 #1 Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/28/2024 RIP:
0010:tcm_loop_tpg_address_show+0x2e/0x50 [tcm_loop] ... Call Trace: <TASK> configfs_read_iter+0x12d/0x1d0 [configfs] vfs_read+0x1b5/0x300 ksys_read+0x6f/0xf0 ... (CVE-2025-68229)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68229
https://security-tracker.debian.org/tracker/CVE-2025-68229
https://ubuntu.com/security/CVE-2025-68229

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68229

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278908 - Linux Distros Unpatched Vulnerability : CVE-2025-68241
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe The sit driver's packet transmission path calls: sit_tunnel_xmit() -> update_or_create_fnhe(), which lead to fnhe_remove_oldest() being called to delete entries exceeding FNHE_RECLAIM_DEPTH+random. The race window is between fnhe_remove_oldest() selecting fnheX for deletion and the subsequent kfree_rcu(). During this time, the concurrent path's
__mkroute_output() -> find_exception() can fetch the soon-to-be-deleted fnheX, and rt_bind_exception() then binds it with a new dst using a dst_hold(). When the original fnheX is freed via RCU, the dst reference remains permanently leaked. CPU 0 CPU 1 __mkroute_output() find_exception() [fnheX] update_or_create_fnhe() fnhe_remove_oldest() [fnheX] rt_bind_exception() [bind dst] RCU callback [fnheX freed, dst leak] This issue manifests as a device reference count leak and a warning in dmesg when unregistering the net device: unregister_netdevice: waiting for sitX to become free. Usage count = N Ido Schimmel provided the simple test validation method [1]. The fix clears 'oldest->fnhe_daddr' before calling fnhe_flush_routes(). Since rt_bind_exception() checks this field, setting it to zero prevents the stale fnhe from being reused and bound to a new dst just before it is freed. [1] ip netns add ns1 ip -n ns1 link set dev lo up ip -n ns1 address add 192.0.2.1/32 dev lo ip -n ns1 link add name dummy1 up type dummy ip -n ns1 route add 192.0.2.2/32 dev dummy1 ip -n ns1 link add name gretap1 up arp off type gretap \ local 192.0.2.1 remote 192.0.2.2 ip -n ns1 route add 198.51.0.0/16 dev gretap1 taskset -c 0 ip netns exec ns1 mausezahn gretap1 \ -A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q & taskset -c 2 ip netns exec ns1 mausezahn gretap1 \ -A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q & sleep 10 ip netns pids ns1 | xargs kill ip netns del ns1 (CVE-2025-68241)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68241
https://security-tracker.debian.org/tracker/CVE-2025-68241
https://ubuntu.com/security/CVE-2025-68241

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68241

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278839 - Linux Distros Unpatched Vulnerability : CVE-2025-68242
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NFS: Fix LTP test failures when timestamps are delegated The utimes01 and utime06 tests fail when delegated timestamps are enabled, specifically in subtests that modify the atime and mtime fields using the 'nobody' user ID. The problem can be reproduced as follow: # echo /media *(rw,no_root_squash,sync) >> /etc/exports # export -ra # mount -o rw,nfsvers=4.2 127.0.0.1:/media /tmpdir # cd /opt/ltp # ./runltp
-d /tmpdir -s utimes01 # ./runltp -d /tmpdir -s utime06 This issue occurs because nfs_setattr does not verify the inode's UID against the caller's fsuid when delegated timestamps are permitted for the inode.
This patch adds the UID check and if it does not match then the request is sent to the server for permission checking. (CVE-2025-68242)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68242
https://security-tracker.debian.org/tracker/CVE-2025-68242
https://ubuntu.com/security/CVE-2025-68242

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68242

Plugin Information
Published: 2025/12/16, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278836 - Linux Distros Unpatched Vulnerability : CVE-2025-68245
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup commit efa95b01da18 (netpoll: fix use after free) incorrectly ignored the refcount and prematurely set dev->npinfo to NULL during netpoll cleanup, leading to improper behavior and memory leaks. Scenario causing lack of proper cleanup: 1) A netpoll is associated with a NIC (e.g., eth0) and netdev->npinfo is allocated, and refcnt = 1 - Keep in mind that npinfo is shared among all netpoll instances. In this case, there is just one. 2) Another netpoll is also associated with the same NIC and npinfo->refcnt += 1. - Now dev->npinfo->refcnt = 2; - There is just one npinfo associated to the netdev. 3) When the first netpolls goes to clean up: - The first cleanup succeeds and clears np->dev->npinfo, ignoring refcnt. - It basically calls `RCU_INIT_POINTER(np->dev->npinfo, NULL);` - Set dev->npinfo = NULL, without proper cleanup - No
->ndo_netpoll_cleanup() is either called 4) Now the second target tries to clean up - The second cleanup fails because np->dev->npinfo is already NULL. * In this case, ops->ndo_netpoll_cleanup() was never called, and the skb pool is not cleaned as well (for the second netpoll instance) - This leaks npinfo and skbpool skbs, which is clearly reported by kmemleak. Revert commit efa95b01da18 (netpoll: fix use after free) and adds clarifying comments emphasizing that npinfo cleanup should only happen once the refcount reaches zero, ensuring stable and correct netpoll behavior. (CVE-2025-68245)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68245
https://security-tracker.debian.org/tracker/CVE-2025-68245
https://ubuntu.com/security/CVE-2025-68245

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68245

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278888 - Linux Distros Unpatched Vulnerability : CVE-2025-68264
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ext4: refresh inline data size before write operations The cached ei->i_inline_size can become stale between the initial size check and when ext4_update_inline_data()/ext4_create_inline_data() use it.
Although ext4_get_max_inline_size() reads the correct value at the time of the check, concurrent xattr operations can modify i_inline_size before ext4_write_lock_xattr() is acquired. This causes ext4_update_inline_data() and ext4_create_inline_data() to work with stale capacity values, leading to a BUG_ON() crash in ext4_write_inline_data(): kernel BUG at fs/ext4/inline.c:1331! BUG_ON(pos + len >
EXT4_I(inode)->i_inline_size); The race window: 1. ext4_get_max_inline_size() reads i_inline_size = 60 (correct) 2. Size check passes for 50-byte write 3. [Another thread adds xattr, i_inline_size changes to 40] 4. ext4_write_lock_xattr() acquires lock 5. ext4_update_inline_data() uses stale i_inline_size = 60 6.
Attempts to write 50 bytes but only 40 bytes actually available 7. BUG_ON() triggers Fix this by recalculating i_inline_size via ext4_find_inline_data_nolock() immediately after acquiring xattr_sem. This ensures ext4_update_inline_data() and ext4_create_inline_data() work with current values that are protected from concurrent modifications. This is similar to commit a54c4613dac1 (ext4: fix race writing to an inline_data file while its xattrs are changing) which fixed i_inline_off staleness. This patch addresses the related i_inline_size staleness issue. (CVE-2025-68264)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68264
https://security-tracker.debian.org/tracker/CVE-2025-68264
https://ubuntu.com/security/CVE-2025-68264

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68264

Plugin Information
Published: 2025/12/16, Modified: 2025/12/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278804 - Linux Distros Unpatched Vulnerability : CVE-2025-68281
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ASoC: SDCA: bug fix while parsing mipi-sdca-control-cn-list struct sdca_control declares values field as integer array. But the memory allocated to it is of char array. This causes crash for sdca_parse_function API. This patch addresses the issue by allocating correct data size. (CVE-2025-68281)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68281
https://ubuntu.com/security/CVE-2025-68281

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68281

Plugin Information
Published: 2025/12/16, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278806 - Linux Distros Unpatched Vulnerability : CVE-2025-68282
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: gadget: udc: fix use-after-free in usb_gadget_state_work A race condition during gadget teardown can lead to a use-after-free in usb_gadget_state_work(), as reported by KASAN: BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0 Workqueue: events usb_gadget_state_work The fundamental race occurs because a concurrent event (e.g., an interrupt) can call usb_gadget_set_state() and schedule gadget->work at any time during the cleanup process in usb_del_gadget(). Commit 399a45e5237c (usb: gadget: core: flush gadget workqueue after device removal) attempted to fix this by moving flush_work() to after device_del().
However, this does not fully solve the race, as a new work item can still be scheduled *after* flush_work() completes but before the gadget's memory is freed, leading to the same use-after-free. This patch fixes the race condition robustly by introducing a 'teardown' flag and a 'state_lock' spinlock to the usb_gadget struct. The flag is set during cleanup in usb_del_gadget() *before* calling flush_work() to prevent any new work from being scheduled once cleanup has commenced. The scheduling site, usb_gadget_set_state(), now checks this flag under the lock before queueing the work, thus safely closing the race window. (CVE-2025-68282)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68282
https://security-tracker.debian.org/tracker/CVE-2025-68282
https://ubuntu.com/security/CVE-2025-68282

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68282

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278828 - Linux Distros Unpatched Vulnerability : CVE-2025-68284
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- libceph: prevent potential out-of-bounds writes in handle_auth_session_key() The len field originates from untrusted network packets. Boundary checks have been added to prevent potential out-of-bounds writes when decrypting the connection secret or processing service tickets. [ idryomov: changelog ] (CVE-2025-68284)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68284
https://security-tracker.debian.org/tracker/CVE-2025-68284
https://ubuntu.com/security/CVE-2025-68284

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68284

Plugin Information
Published: 2025/12/16, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278904 - Linux Distros Unpatched Vulnerability : CVE-2025-68285
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- libceph: fix potential use-after-free in have_mon_and_osd_map() The wait loop in __ceph_open_session() can race with the client receiving a new monmap or osdmap shortly after the initial map is received. Both ceph_monc_handle_map() and handle_one_map() install a new map immediately after freeing the old one kfree(monc->monmap); monc->monmap = monmap; ceph_osdmap_destroy(osdc->osdmap); osdc->osdmap = newmap;
under client->monc.mutex and client->osdc.lock respectively, but because neither is taken in have_mon_and_osd_map() it's possible for client->monc.monmap->epoch and client->osdc.osdmap->epoch arms in client->monc.monmap && client->monc.monmap->epoch && client->osdc.osdmap && client->osdc.osdmap->epoch;
condition to dereference an already freed map. This happens to be reproducible with generic/395 and generic/397 with KASAN enabled: BUG: KASAN: slab-use-after-free in have_mon_and_osd_map+0x56/0x70 Read of size 4 at addr ffff88811012d810 by task mount.ceph/13305 CPU: 2 UID: 0 PID: 13305 Comm: mount.ceph Not tainted 6.14.0-rc2-build2+ #1266 ... Call Trace: <TASK> have_mon_and_osd_map+0x56/0x70 ceph_open_session+0x182/0x290 ceph_get_tree+0x333/0x680 vfs_get_tree+0x49/0x180 do_new_mount+0x1a3/0x2d0 path_mount+0x6dd/0x730 do_mount+0x99/0xe0 __do_sys_mount+0x141/0x180 do_syscall_64+0x9f/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> Allocated by task 13305: ceph_osdmap_alloc+0x16/0x130 ceph_osdc_init+0x27a/0x4c0 ceph_create_client+0x153/0x190 create_fs_client+0x50/0x2a0 ceph_get_tree+0xff/0x680 vfs_get_tree+0x49/0x180 do_new_mount+0x1a3/0x2d0 path_mount+0x6dd/0x730 do_mount+0x99/0xe0 __do_sys_mount+0x141/0x180 do_syscall_64+0x9f/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 9475: kfree+0x212/0x290 handle_one_map+0x23c/0x3b0 ceph_osdc_handle_map+0x3c9/0x590 mon_dispatch+0x655/0x6f0 ceph_con_process_message+0xc3/0xe0 ceph_con_v1_try_read+0x614/0x760 ceph_con_workfn+0x2de/0x650 process_one_work+0x486/0x7c0 process_scheduled_works+0x73/0x90 worker_thread+0x1c8/0x2a0 kthread+0x2ec/0x300 ret_from_fork+0x24/0x40 ret_from_fork_asm+0x1a/0x30 Rewrite the wait loop to check the above condition directly with client->monc.mutex and client->osdc.lock taken as appropriate. While at it, improve the timeout handling (previously mount_timeout could be exceeded in case wait_event_interruptible_timeout() slept more than once) and access client->auth_err under client->monc.mutex to match how it's set in finish_auth().
monmap_show() and osdmap_show() now take the respective lock before accessing the map as well.
(CVE-2025-68285)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68285
https://security-tracker.debian.org/tracker/CVE-2025-68285
https://ubuntu.com/security/CVE-2025-68285

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
6.2 (CVSS2#AV:L/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68285

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278884 - Linux Distros Unpatched Vulnerability : CVE-2025-68288
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- usb: storage: Fix memory leak in USB bulk transport A kernel memory leak was identified by the 'ioctl_sg01' test from Linux Test Project (LTP). The following bytes were mainly observed: 0x53425355.
When USB storage devices incorrectly skip the data phase with status data, the code extracts/validates the CSW from the sg buffer, but fails to clear it afterwards. This leaves status protocol data in srb's transfer buffer, such as the US_BULK_CS_SIGN 'USBS' signature observed here. Thus, this can lead to USB protocols leaks to user space through SCSI generic (/dev/sg*) interfaces, such as the one seen here when the LTP test requested 512 KiB. Fix the leak by zeroing the CSW data in srb's transfer buffer immediately after the validation of devices that skip data phase. Note: Differently from CVE-2018-1000204, which fixed a big leak by zero- ing pages at allocation time, this leak occurs after allocation, when USB protocol data is written to already-allocated sg pages. (CVE-2025-68288)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68288
https://security-tracker.debian.org/tracker/CVE-2025-68288
https://ubuntu.com/security/CVE-2025-68288

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68288

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278858 - Linux Distros Unpatched Vulnerability : CVE-2025-68291
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). syzbot reported divide-by-zero in __tcp_select_window() by MPTCP socket. [0] We had a similar issue for the bare TCP and fixed in commit 499350a5a6e7 (tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0). Let's apply the same fix to mptcp_do_fastclose(). [0]: Oops: divide error: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 6068 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:__tcp_select_window+0x824/0x1320 net/ipv4/tcp_output.c:3336 Code: ff ff ff 44 89 f1 d3 e0 89 c1 f7 d1 41 01 cc 41 21 c4 e9 a9 00 00 00 e8 ca 49 01 f8 e9 9c 00 00 00 e8 c0 49 01 f8 44 89 e0 99 <f7> 7c 24 1c 41 29 d4 48 bb 00 00 00 00 00 fc ff df e9 80 00 00 00 RSP: 0018:ffffc90003017640 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88807b469e40 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP:
ffffc90003017730 R08: ffff888033268143 R09: 1ffff1100664d028 R10: dffffc0000000000 R11: ffffed100664d029 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS:
000055557faa0500(0000) GS:ffff888126135000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033 CR2: 00007f64a1912ff8 CR3: 0000000072122000 CR4: 00000000003526f0 Call Trace: <TASK>
tcp_select_window net/ipv4/tcp_output.c:281 [inline] __tcp_transmit_skb+0xbc7/0x3aa0 net/ipv4/tcp_output.c:1568 tcp_transmit_skb net/ipv4/tcp_output.c:1649 [inline] tcp_send_active_reset+0x2d1/0x5b0 net/ipv4/tcp_output.c:3836 mptcp_do_fastclose+0x27e/0x380 net/mptcp/protocol.c:2793 mptcp_disconnect+0x238/0x710 net/mptcp/protocol.c:3253 mptcp_sendmsg_fastopen+0x2f8/0x580 net/mptcp/protocol.c:1776 mptcp_sendmsg+0x1774/0x1980 net/mptcp/protocol.c:1855 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0xe5/0x270 net/socket.c:742 __sys_sendto+0x3bd/0x520 net/socket.c:2244 __do_sys_sendto net/socket.c:2251 [inline]
__se_sys_sendto net/socket.c:2247 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2247 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f66e998f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffff9acedb8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f66e9be5fa0 RCX: 00007f66e998f749 RDX:
0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007ffff9acee10 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13:
00007f66e9be5fa0 R14: 00007f66e9be5fa0 R15: 0000000000000006 </TASK> (CVE-2025-68291)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68291
https://security-tracker.debian.org/tracker/CVE-2025-68291
https://ubuntu.com/security/CVE-2025-68291

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
9.4 (CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
8.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68291

Plugin Information
Published: 2025/12/16, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278849 - Linux Distros Unpatched Vulnerability : CVE-2025-68292
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- mm/memfd: fix information leak in hugetlb folios When allocating hugetlb folios for memfd, three initialization steps are missing: 1. Folios are not zeroed, leading to kernel memory disclosure to userspace 2. Folios are not marked uptodate before adding to page cache 3. hugetlb_fault_mutex is not taken before hugetlb_add_to_page_cache() The memfd allocation path bypasses the normal page fault handler (hugetlb_no_page) which would handle all of these initialization steps. This is problematic especially for udmabuf use cases where folios are pinned and directly accessed by userspace via DMA. Fix by matching the initialization pattern used in hugetlb_no_page(): - Zero the folio using folio_zero_user() which is optimized for huge pages - Mark it uptodate with folio_mark_uptodate() - Take hugetlb_fault_mutex before adding to page cache to prevent races The folio_zero_user() change also fixes a potential security issue where uninitialized kernel memory could be disclosed to userspace through read() or mmap() operations on the memfd. (CVE-2025-68292)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68292
https://security-tracker.debian.org/tracker/CVE-2025-68292
https://ubuntu.com/security/CVE-2025-68292

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68292

Plugin Information
Published: 2025/12/16, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278883 - Linux Distros Unpatched Vulnerability : CVE-2025-68295
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- smb: client: fix memory leak in cifs_construct_tcon() When having a multiuser mount with domain= specified and using cifscreds, cifs_set_cifscreds() will end up setting @ctx->domainname, so it needs to be freed before leaving cifs_construct_tcon(). This fixes the following memory leak reported by kmemleak:
mount.cifs //srv/share /mnt -o domain=ZELDA,multiuser,... su - testuser cifscreds add -d ZELDA -u testuser ... ls /mnt/1 ... umount /mnt echo scan > /sys/kernel/debug/kmemleak cat /sys/kernel/debug/kmemleak unreferenced object 0xffff8881203c3f08 (size 8): comm ls, pid 5060, jiffies 4307222943 hex dump (first 8 bytes): 5a 45 4c 44 41 00 cc cc ZELDA... backtrace (crc d109a8cf):
__kmalloc_node_track_caller_noprof+0x572/0x710 kstrdup+0x3a/0x70 cifs_sb_tlink+0x1209/0x1770 [cifs] cifs_get_fattr+0xe1/0xf50 [cifs] cifs_get_inode_info+0xb5/0x240 [cifs] cifs_revalidate_dentry_attr+0x2d1/0x470 [cifs] cifs_getattr+0x28e/0x450 [cifs] vfs_getattr_nosec+0x126/0x180 vfs_statx+0xf6/0x220 do_statx+0xab/0x110 __x64_sys_statx+0xd5/0x130 do_syscall_64+0xbb/0x380 entry_SYSCALL_64_after_hwframe+0x77/0x7f (CVE-2025-68295)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68295
https://security-tracker.debian.org/tracker/CVE-2025-68295
https://ubuntu.com/security/CVE-2025-68295

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68295

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278871 - Linux Distros Unpatched Vulnerability : CVE-2025-68296
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup Protect vga_switcheroo_client_fb_set() with console lock. Avoids OOB access in fbcon_remap_all(). Without holding the console lock the call races with switching outputs. VGA switcheroo calls fbcon_remap_all() when switching clients. The fbcon function uses struct fb_info.node, which is set by register_framebuffer(). As the fb-helper code currently sets up VGA switcheroo before registering the framebuffer, the value of node is -1 and therefore not a legal value. For example, fbcon uses the value within set_con2fb_map() [1] as an index into an array. Moving vga_switcheroo_client_fb_set() after register_framebuffer() can result in VGA switching that does not switch fbcon correctly. Therefore move vga_switcheroo_client_fb_set() under fbcon_fb_registered(), which already holds the console lock. Fbdev calls fbcon_fb_registered() from within register_framebuffer().
Serializes the helper with VGA switcheroo's call to fbcon_remap_all(). Although vga_switcheroo_client_fb_set() takes an instance of struct fb_info as parameter, it really only needs the contained fbcon state. Moving the call to fbcon initialization is therefore cleaner than before. Only amdgpu, i915, nouveau and radeon support vga_switcheroo. For all other drivers, this change does nothing.
(CVE-2025-68296)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68296
https://security-tracker.debian.org/tracker/CVE-2025-68296
https://ubuntu.com/security/CVE-2025-68296

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.4 (CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68296

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278851 - Linux Distros Unpatched Vulnerability : CVE-2025-68297
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ceph: fix crash in process_v2_sparse_read() for encrypted directories The crash in process_v2_sparse_read() for fscrypt-encrypted directories has been reported. Issue takes place for Ceph msgr2 protocol in secure mode. It can be reproduced by the steps: sudo mount -t ceph :/ /mnt/cephfs/ -o name=admin,fs=cephfs,ms_mode=secure (1) mkdir /mnt/cephfs/fscrypt-test-3 (2) cp area_decrypted.tar /mnt/cephfs/fscrypt-test-3 (3) fscrypt encrypt --source=raw_key --key=./my.key /mnt/cephfs/fscrypt-test-3 (4) fscrypt lock /mnt/cephfs/fscrypt-test-3 (5) fscrypt unlock --key=my.key /mnt/cephfs/fscrypt-test-3 (6) cat /mnt/cephfs/fscrypt-test-3/area_decrypted.tar (7) Issue has been triggered [ 408.072247] ------------[ cut here ]------------ [ 408.072251] WARNING: CPU: 1 PID: 392 at net/ceph/messenger_v2.c:865 ceph_con_v2_try_read+0x4b39/0x72f0 [ 408.072267] Modules linked in: intel_rapl_msr intel_rapl_common intel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_discovery pmt_class intel_pmc_ssram_telemetry intel_vsec kvm_intel joydev kvm irqbypass polyval_clmulni ghash_clmulni_intel aesni_intel rapl input_leds psmouse serio_raw i2c_piix4 vga16fb bochs vgastate i2c_smbus floppy mac_hid qemu_fw_cfg pata_acpi sch_fq_codel rbd msr parport_pc ppdev lp parport efi_pstore [ 408.072304] CPU: 1 UID: 0 PID: 392 Comm: kworker/1:3 Not tainted 6.17.0-rc7+ [ 408.072307] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-5.fc42 04/01/2014 [ 408.072310] Workqueue: ceph-msgr ceph_con_workfn [ 408.072314] RIP: 0010:ceph_con_v2_try_read+0x4b39/0x72f0 [ 408.072317] Code: c7 c1 20 f0 d4 ae 50 31 d2 48 c7 c6 60 27 d5 ae 48 c7 c7 f8 8e 6f b0 68 60 38 d5 ae e8 00 47 61 fe 48 83 c4 18 e9 ac fc ff ff <0f> 0b e9 06 fe ff ff 4c 8b 9d 98 fd ff ff 0f 84 64 e7 ff ff 89 85 [ 408.072319] RSP: 0018:ffff88811c3e7a30 EFLAGS:
00010246 [ 408.072322] RAX: ffffed1024874c6f RBX: ffffea00042c2b40 RCX: 0000000000000f38 [ 408.072324] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 408.072325] RBP: ffff88811c3e7ca8 R08:
0000000000000000 R09: 00000000000000c8 [ 408.072326] R10: 00000000000000c8 R11: 0000000000000000 R12:
00000000000000c8 [ 408.072327] R13: dffffc0000000000 R14: ffff8881243a6030 R15: 0000000000003000 [ 408.072329] FS: 0000000000000000(0000) GS:ffff88823eadf000(0000) knlGS:0000000000000000 [ 408.072331] CS:
0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 408.072332] CR2: 000000c0003c6000 CR3: 000000010c106005 CR4: 0000000000772ef0 [ 408.072336] PKRU: 55555554 [ 408.072337] Call Trace: [ 408.072338] <TASK> [ 408.072340] ? sched_clock_noinstr+0x9/0x10 [ 408.072344] ? __pfx_ceph_con_v2_try_read+0x10/0x10 [ 408.072347] ? _raw_spin_unlock+0xe/0x40 [ 408.072349] ? finish_task_switch.isra.0+0x15d/0x830 [ 408.072353] ? __kasan_check_write+0x14/0x30 [ 408.072357] ? mutex_lock+0x84/0xe0 [ 408.072359] ?
__pfx_mutex_lock+0x10/0x10 [ 408.072361] ceph_con_workfn+0x27e/0x10e0 [ 408.072364] ? metric_delayed_work+0x311/0x2c50 [ 408.072367] process_one_work+0x611/0xe20 [ 408.072371] ?
__kasan_check_write+0x14/0x30 [ 408.072373] worker_thread+0x7e3/0x1580 [ 408.072375] ?
__pfx__raw_spin_lock_irqsave+0x10/0x10 [ 408.072378] ? __pfx_worker_thread+0x10/0x10 [ 408.072381] kthread+0x381/0x7a0 [ 408.072383] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 408.072385] ?
__pfx_kthread+0x10/0x10 [ 408.072387] ? __kasan_check_write+0x14/0x30 [ 408.072389] ? recalc_sigpending+0x160/0x220 [ 408.072392] ? _raw_spin_unlock_irq+0xe/0x50 [ 408.072394] ? calculate_sigpending+0x78/0xb0 [ 408.072395] ? __pfx_kthread+0x10/0x10 [ 408.072397] ret_from_fork+0x2b6/0x380 [ 408.072400] ? __pfx_kthread+0x10/0x10 [ 408.072402] ret_from_fork_asm+0x1a/0x30 [ 408.072406] </TASK> [ 408.072407] ---[ end trace 0000000000000000 ]--- [ 408.072418] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000
---truncated--- (CVE-2025-68297)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68297
https://security-tracker.debian.org/tracker/CVE-2025-68297
https://ubuntu.com/security/CVE-2025-68297

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68297

Plugin Information
Published: 2025/12/16, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278875 - Linux Distros Unpatched Vulnerability : CVE-2025-68298
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref In btusb_mtk_setup(), we set `btmtk_data->isopkt_intf` to: usb_ifnum_to_if(data->udev, MTK_ISO_IFNUM) That function can return NULL in some cases. Even when it returns NULL, though, we still go on to call btusb_mtk_claim_iso_intf(). As of commit e9087e828827 (Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()), calling btusb_mtk_claim_iso_intf() when `btmtk_data->isopkt_intf` is NULL will cause a crash because we'll end up passing a bad pointer to device_lock(). Prior to that commit we'd pass the NULL pointer directly to usb_driver_claim_interface() which would detect it and return an error, which was handled. Resolve the crash in btusb_mtk_claim_iso_intf() by adding a NULL check at the start of the function. This makes the code handle a NULL `btmtk_data->isopkt_intf` the same way it did before the problematic commit (just with a slight change to the error message printed). (CVE-2025-68298)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68298
https://security-tracker.debian.org/tracker/CVE-2025-68298
https://ubuntu.com/security/CVE-2025-68298

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68298

Plugin Information
Published: 2025/12/16, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278819 - Linux Distros Unpatched Vulnerability : CVE-2025-68299
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- afs: Fix delayed allocation of a cell's anonymous key The allocation of a cell's anonymous key is done in a background thread along with other cell setup such as doing a DNS upcall. In the reported bug, this is triggered by afs_parse_source() parsing the device name given to mount() and calling afs_lookup_cell() with the name of the cell. The normal key lookup then tries to use the key description on the anonymous authentication key as the reference for request_key() - but it may not yet be set and so an oops can happen. This has been made more likely to happen by the fix for dynamic lookup failure. Fix this by firstly allocating a reference name and attaching it to the afs_cell record when the record is created. It can share the memory allocation with the cell name (unfortunately it can't just overlap the cell name by prepending it with afs@ as the cell name already has a '.' prepended for other purposes). This reference name is then passed to request_key(). Secondly, the anon key is now allocated on demand at the point a key is requested in afs_request_key() if it is not already allocated. A mutex is used to prevent multiple allocation for a cell. Thirdly, make afs_request_key_rcu() return NULL if the anonymous key isn't yet allocated (if we need it) and then the caller can return -ECHILD to drop out of RCU-mode and afs_request_key() can be called. Note that the anonymous key is kind of necessary to make the key lookup cache work as that doesn't currently cache a negative lookup, but it's probably worth some investigation to see if NULL can be used instead. (CVE-2025-68299)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68299
https://ubuntu.com/security/CVE-2025-68299

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68299

Plugin Information
Published: 2025/12/16, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278887 - Linux Distros Unpatched Vulnerability : CVE-2025-68304
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: hci_core: lookup hci_conn on RX path on protocol side The hdev lock/lookup/unlock/use pattern in the packet RX path doesn't ensure hci_conn* is not concurrently modified/deleted. This locking appears to be leftover from before conn_hash started using RCU commit bf4c63252490b (Bluetooth: convert conn hash to RCU) and not clear if it had purpose since then. Currently, there are code paths that delete hci_conn* from elsewhere than the ordered hdev->workqueue where the RX work runs in. E.g. commit 5af1f84ed13a (Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync) introduced some of these, and there probably were a few others before it. It's better to do the locking so that even if these run concurrently no UAF is possible. Move the lookup of hci_conn and associated socket-specific conn to protocol recv handlers, and do them within a single critical section to cover hci_conn* usage and lookup. syzkaller has reported a crash that appears to be this issue: [Task hdev->workqueue] [Task 2] hci_disconnect_all_sync l2cap_recv_acldata(hcon) hci_conn_get(hcon) hci_abort_conn_sync(hcon) hci_dev_lock hci_dev_lock hci_conn_del(hcon) v-------------------------------- hci_dev_unlock hci_conn_put(hcon) conn = hcon->l2cap_data (UAF) (CVE-2025-68304)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68304
https://security-tracker.debian.org/tracker/CVE-2025-68304
https://ubuntu.com/security/CVE-2025-68304

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.7 (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.1 (CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68304

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278780 - Linux Distros Unpatched Vulnerability : CVE-2025-68306
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso interface When performing reset tests and encountering abnormal card drop issues that lead to a kernel crash, it is necessary to perform a null check before releasing resources to avoid attempting to release a null pointer. <4>[ 29.158070] Hardware name: Google Quigon sku196612/196613 board (DT) <4>[ 29.158076] Workqueue: hci0 hci_cmd_sync_work [bluetooth] <4>[ 29.158154] pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) <4>[ 29.158162] pc : klist_remove+0x90/0x158 <4>[ 29.158174] lr : klist_remove+0x88/0x158 <4>[ 29.158180] sp :
ffffffc0846b3c00 <4>[ 29.158185] pmr_save: 000000e0 <4>[ 29.158188] x29: ffffffc0846b3c30 x28:
ffffff80cd31f880 x27: ffffff80c1bdc058 <4>[ 29.158199] x26: dead000000000100 x25: ffffffdbdc624ea3 x24:
ffffff80c1bdc4c0 <4>[ 29.158209] x23: ffffffdbdc62a3e6 x22: ffffff80c6c07000 x21: ffffffdbdc829290 <4>[ 29.158219] x20: 0000000000000000 x19: ffffff80cd3e0648 x18: 000000031ec97781 <4>[ 29.158229] x17:
ffffff80c1bdc4a8 x16: ffffffdc10576548 x15: ffffff80c1180428 <4>[ 29.158238] x14: 0000000000000000 x13:
000000000000e380 x12: 0000000000000018 <4>[ 29.158248] x11: ffffff80c2a7fd10 x10: 0000000000000000 x9 :
0000000100000000 <4>[ 29.158257] x8 : 0000000000000000 x7 : 7f7f7f7f7f7f7f7f x6 : 2d7223ff6364626d <4>[ 29.158266] x5 : 0000008000000000 x4 : 0000000000000020 x3 : 2e7325006465636e <4>[ 29.158275] x2 :
ffffffdc11afeff8 x1 : 0000000000000000 x0 : ffffffdc11be4d0c <4>[ 29.158285] Call trace: <4>[ 29.158290] klist_remove+0x90/0x158 <4>[ 29.158298] device_release_driver_internal+0x20c/0x268 <4>[ 29.158308] device_release_driver+0x1c/0x30 <4>[ 29.158316] usb_driver_release_interface+0x70/0x88 <4>[ 29.158325] btusb_mtk_release_iso_intf+0x68/0xd8 [btusb (HASH:e8b6 5)] <4>[ 29.158347] btusb_mtk_reset+0x5c/0x480 [btusb (HASH:e8b6 5)] <4>[ 29.158361] hci_cmd_sync_work+0x10c/0x188 [bluetooth (HASH:a4fa 6)] <4>[ 29.158430] process_scheduled_works+0x258/0x4e8 <4>[ 29.158441] worker_thread+0x300/0x428 <4>[ 29.158448] kthread+0x108/0x1d0 <4>[ 29.158455] ret_from_fork+0x10/0x20 <0>[ 29.158467] Code: 91343000 940139d1 f9400268 927ff914 (f9401297) <4>[ 29.158474] ---[ end trace 0000000000000000 ]--- <0>[ 29.167129] Kernel panic - not syncing: Oops: Fatal exception <2>[ 29.167144] SMP: stopping secondary CPUs <4>[ 29.167158]
------------[ cut here ]------------ (CVE-2025-68306)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68306
https://security-tracker.debian.org/tracker/CVE-2025-68306
https://ubuntu.com/security/CVE-2025-68306

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68306

Plugin Information
Published: 2025/12/16, Modified: 2025/12/18
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278829 - Linux Distros Unpatched Vulnerability : CVE-2025-68307
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs The driver lacks the cleanup of failed transfers of URBs. This reduces the number of available URBs per error by 1. This leads to reduced performance and ultimately to a complete stop of the transmission. If the sending of a bulk URB fails do proper cleanup: - increase netdev stats - mark the echo_sbk as free - free the driver's context and do accounting - wake the send queue (CVE-2025-68307)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68307
https://security-tracker.debian.org/tracker/CVE-2025-68307
https://ubuntu.com/security/CVE-2025-68307

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68307

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278835 - Linux Distros Unpatched Vulnerability : CVE-2025-68308
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- can: kvaser_usb: leaf: Fix potential infinite loop in command parsers The `kvaser_usb_leaf_wait_cmd()` and `kvaser_usb_leaf_read_bulk_callback` functions contain logic to zero-length commands. These commands are used to align data to the USB endpoint's wMaxPacketSize boundary. The driver attempts to skip these placeholders by aligning the buffer position `pos` to the next packet boundary using `round_up()` function. However, if zero-length command is found exactly on a packet boundary (i.e., `pos` is a multiple of wMaxPacketSize, including 0), `round_up` function will return the unchanged value of `pos`. This prevents `pos` to be increased, causing an infinite loop in the parsing logic. This patch fixes this in the function by using `pos + 1` instead. This ensures that even if `pos` is on a boundary, the calculation is based on `pos + 1`, forcing `round_up()` to always return the next aligned boundary. (CVE-2025-68308)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68308
https://security-tracker.debian.org/tracker/CVE-2025-68308
https://ubuntu.com/security/CVE-2025-68308

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68308

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278889 - Linux Distros Unpatched Vulnerability : CVE-2025-68309
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- PCI/AER: Fix NULL pointer access by aer_info The kzalloc(GFP_KERNEL) may return NULL, so all accesses to aer_info->xxx will result in kernel panic. Fix it. (CVE-2025-68309)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68309
https://ubuntu.com/security/CVE-2025-68309

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68309

Plugin Information
Published: 2025/12/16, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278901 - Linux Distros Unpatched Vulnerability : CVE-2025-68310
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump Do not block PCI config accesses through pci_cfg_access_lock() when executing the s390 variant of PCI error recovery: Acquire just device_lock() instead of pci_dev_lock() as powerpc's EEH and generig PCI AER processing do. During error recovery testing a pair of tasks was reported to be hung: mlx5_core 0000:00:00.1:
mlx5_health_try_recover:338:(pid 5553): health recovery flow aborted, PCI reads still not working INFO:
task kmcheck:72 blocked for more than 122 seconds. Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1 echo 0 > /proc/sys/kernel/hung_task_timeout_secs disables this message. task:kmcheck state:D stack:0 pid:72 tgid:72 ppid:2 flags:0x00000000 Call Trace: [<000000065256f030>] __schedule+0x2a0/0x590 [<000000065256f356>] schedule+0x36/0xe0 [<000000065256f572>] schedule_preempt_disabled+0x22/0x30 [<0000000652570a94>] __mutex_lock.constprop.0+0x484/0x8a8 [<000003ff800673a4>] mlx5_unload_one+0x34/0x58 [mlx5_core] [<000003ff8006745c>] mlx5_pci_err_detected+0x94/0x140 [mlx5_core] [<0000000652556c5a>] zpci_event_attempt_error_recovery+0xf2/0x398 [<0000000651b9184a>] __zpci_event_error+0x23a/0x2c0 INFO:
task kworker/u1664:6:1514 blocked for more than 122 seconds. Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1 echo 0 > /proc/sys/kernel/hung_task_timeout_secs disables this message. task:kworker/u1664:6 state:D stack:0 pid:1514 tgid:1514 ppid:2 flags:0x00000000 Workqueue:
mlx5_health0000:00:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core] Call Trace: [<000000065256f030>]
__schedule+0x2a0/0x590 [<000000065256f356>] schedule+0x36/0xe0 [<0000000652172e28>] pci_wait_cfg+0x80/0xe8 [<0000000652172f94>] pci_cfg_access_lock+0x74/0x88 [<000003ff800916b6>] mlx5_vsc_gw_lock+0x36/0x178 [mlx5_core] [<000003ff80098824>] mlx5_crdump_collect+0x34/0x1c8 [mlx5_core] [<000003ff80074b62>] mlx5_fw_fatal_reporter_dump+0x6a/0xe8 [mlx5_core] [<0000000652512242>] devlink_health_do_dump.part.0+0x82/0x168 [<0000000652513212>] devlink_health_report+0x19a/0x230 [<000003ff80075a12>] mlx5_fw_fatal_reporter_err_work+0xba/0x1b0 [mlx5_core] No kernel log of the exact same error with an upstream kernel is available - but the very same deadlock situation can be constructed there, too: - task: kmcheck mlx5_unload_one() tries to acquire devlink lock while the PCI error recovery code has set pdev->block_cfg_access by way of pci_cfg_access_lock() - task: kworker mlx5_crdump_collect() tries to set block_cfg_access through pci_cfg_access_lock() while devlink_health_report() had acquired the devlink lock. A similar deadlock situation can be reproduced by requesting a crdump with > devlink health dump show pci/<BDF> reporter fw_fatal while PCI error recovery is executed on the same <BDF> physical function by mlx5_core's pci_error_handlers. On s390 this can be injected with > zpcictl --reset-fw <BDF>
Tests with this patch failed to reproduce that second deadlock situation, the devlink command is rejected with kernel answers: Permission denied - and we get a kernel log message of: mlx5_core 1ed0:00:00.1:
mlx5_crdump_collect:50:(pid 254382): crdump: failed to lock vsc gw err -5 because the config read of VSC_SEMAPHORE is rejected by the underlying hardware. Two prior attempts to address this issue have been discussed and ultimately rejected [see link], with the primary argument that s390's implementation of PCI error recovery is imposing restrictions that neither powerpc's EEH nor PCI AER handling need. Tests show that PCI error recovery on s390 is running to completion even without blocking access to PCI config space.
(CVE-2025-68310)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68310
https://security-tracker.debian.org/tracker/CVE-2025-68310
https://ubuntu.com/security/CVE-2025-68310

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68310

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278789 - Linux Distros Unpatched Vulnerability : CVE-2025-68313
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- x86/CPU/AMD: Add RDSEED fix for Zen5 There's an issue with RDSEED's 16-bit and 32-bit register output variants on Zen5 which return a random value of 0 at a rate inconsistent with randomness while incorrectly signaling success (CF=1). Search the web for AMD-SB-7055 for more detail. Add a fix glue which checks microcode revisions. [ bp: Add microcode revisions checking, rewrite. ] (CVE-2025-68313)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68313
https://security-tracker.debian.org/tracker/CVE-2025-68313
https://ubuntu.com/security/CVE-2025-68313

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68313

Plugin Information
Published: 2025/12/16, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278832 - Linux Distros Unpatched Vulnerability : CVE-2025-68317
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- io_uring/zctx: check chained notif contexts Send zc only links ubuf_info for requests coming from the same context. There are some ambiguous syz reports, so let's check the assumption on notification completion.
(CVE-2025-68317)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68317
https://security-tracker.debian.org/tracker/CVE-2025-68317
https://ubuntu.com/security/CVE-2025-68317

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68317

Plugin Information
Published: 2025/12/16, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278877 - Linux Distros Unpatched Vulnerability : CVE-2025-68321
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- page_pool: always add GFP_NOWARN for ATOMIC allocations Driver authors often forget to add GFP_NOWARN for page allocation from the datapath. This is annoying to users as OOMs are a fact of life, and we pretty much expect network Rx to hit page allocation failures during OOM. Make page pool add GFP_NOWARN for ATOMIC allocations by default. (CVE-2025-68321)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68321
https://security-tracker.debian.org/tracker/CVE-2025-68321
https://ubuntu.com/security/CVE-2025-68321

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H)
CVSS v3.0 Temporal Score
5.6 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.0
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68321

Plugin Information
Published: 2025/12/16, Modified: 2025/12/17
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279564 - Linux Distros Unpatched Vulnerability : CVE-2025-68326
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- drm/xe/guc: Fix stack_depot usage Add missing stack_depot_init() call when CONFIG_DRM_XE_DEBUG_GUC is enabled to fix the following call stack: [] BUG: kernel NULL pointer dereference, address:
0000000000000000 [] Workqueue: drm_sched_run_job_work [gpu_sched] [] RIP:
0010:stack_depot_save_flags+0x172/0x870 [] Call Trace: [] <TASK> [] fast_req_track+0x58/0xb0 [xe] (cherry picked from commit 64fdf496a6929a0a194387d2bb5efaf5da2b542f) (CVE-2025-68326)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68326
https://ubuntu.com/security/CVE-2025-68326

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68326

Plugin Information
Published: 2025/12/22, Modified: 2025/12/23
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279575 - Linux Distros Unpatched Vulnerability : CVE-2025-68334
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- platform/x86/amd/pmc: Add support for Van Gogh SoC The ROG Xbox Ally (non-X) SoC features a similar architecture to the Steam Deck. While the Steam Deck supports S3 (s2idle causes a crash), this support was dropped by the Xbox Ally which only S0ix suspend. Since the handler is missing here, this causes the device to not suspend and the AMD GPU driver to crash while trying to resume afterwards due to a power hang. (CVE-2025-68334)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68334
https://security-tracker.debian.org/tracker/CVE-2025-68334
https://ubuntu.com/security/CVE-2025-68334

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68334

Plugin Information
Published: 2025/12/22, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279560 - Linux Distros Unpatched Vulnerability : CVE-2025-68336
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- locking/spinlock/debug: Fix data-race in do_raw_write_lock KCSAN reports: BUG: KCSAN: data-race in do_raw_write_lock / do_raw_write_lock write (marked) to 0xffff800009cf504c of 4 bytes by task 1102 on cpu 1: do_raw_write_lock+0x120/0x204 _raw_write_lock_irq do_exit call_usermodehelper_exec_async ret_from_fork read to 0xffff800009cf504c of 4 bytes by task 1103 on cpu 0: do_raw_write_lock+0x88/0x204
_raw_write_lock_irq do_exit call_usermodehelper_exec_async ret_from_fork value changed: 0xffffffff ->
0x00000001 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 1103 Comm: kworker/u4:1 6.1.111 Commit 1a365e822372 (locking/spinlock/debug: Fix various data races) has adressed most of these races, but seems to be not consistent/not complete. >From do_raw_write_lock() only debug_write_lock_after() part has been converted to WRITE_ONCE(), but not debug_write_lock_before() part. Do it now. (CVE-2025-68336)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68336
https://security-tracker.debian.org/tracker/CVE-2025-68336
https://ubuntu.com/security/CVE-2025-68336

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.1
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:H/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68336

Plugin Information
Published: 2025/12/22, Modified: 2025/12/23
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279566 - Linux Distros Unpatched Vulnerability : CVE-2025-68337
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted There's issue when file system corrupted: ------------[ cut here ]------------ kernel BUG at fs/jbd2/transaction.c:1289! Oops:
invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 5 UID: 0 PID: 2031 Comm: mkdir Not tainted 6.18.0-rc1-next RIP: 0010:jbd2_journal_get_create_access+0x3b6/0x4d0 RSP: 0018:ffff888117aafa30 EFLAGS: 00010202 RAX:
0000000000000000 RBX: ffff88811a86b000 RCX: ffffffff89a63534 RDX: 1ffff110200ec602 RSI: 0000000000000004 RDI: ffff888100763010 RBP: ffff888100763000 R08: 0000000000000001 R09: ffff888100763028 R10:
0000000000000003 R11: 0000000000000000 R12: 0000000000000000 R13: ffff88812c432000 R14: ffff88812c608000 R15: ffff888120bfc000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f91d6970c99 CR3:
00000001159c4000 CR4: 00000000000006f0 Call Trace: <TASK> __ext4_journal_get_create_access+0x42/0x170 ext4_getblk+0x319/0x6f0 ext4_bread+0x11/0x100 ext4_append+0x1e6/0x4a0 ext4_init_new_dir+0x145/0x1d0 ext4_mkdir+0x326/0x920 vfs_mkdir+0x45c/0x740 do_mkdirat+0x234/0x2f0 __x64_sys_mkdir+0xd6/0x120 do_syscall_64+0x5f/0xfa0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The above issue occurs with us in errors=continue mode when accompanied by storage failures. There have been many inconsistencies in the file system data. In the case of file system data inconsistency, for example, if the block bitmap of a referenced block is not set, it can lead to the situation where a block being committed is allocated and used again. As a result, the following condition will not be satisfied then trigger BUG_ON. Of course, it is entirely possible to construct a problematic image that can trigger this BUG_ON through specific operations. In fact, I have constructed such an image and easily reproduced this issue. Therefore, J_ASSERT() holds true only under ideal conditions, but it may not necessarily be satisfied in exceptional scenarios. Using J_ASSERT() directly in abnormal situations would cause the system to crash, which is clearly not what we want. So here we directly trigger a JBD abort instead of immediately invoking BUG_ON.
(CVE-2025-68337)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68337
https://security-tracker.debian.org/tracker/CVE-2025-68337
https://ubuntu.com/security/CVE-2025-68337

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68337

Plugin Information
Published: 2025/12/22, Modified: 2025/12/23
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279638 - Linux Distros Unpatched Vulnerability : CVE-2025-68342
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data The URB received in gs_usb_receive_bulk_callback() contains a struct gs_host_frame. The length of the data after the header depends on the gs_host_frame hf::flags and the active device features (e.g. time stamping). Introduce a new function gs_usb_get_minimum_length() and check that we have at least received the required amount of data before accessing it. Only copy the data to that skb that has actually been received. [mkl: rename gs_usb_get_minimum_length() -> +gs_usb_get_minimum_rx_length()] (CVE-2025-68342)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68342
https://security-tracker.debian.org/tracker/CVE-2025-68342
https://ubuntu.com/security/CVE-2025-68342

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68342

Plugin Information
Published: 2025/12/23, Modified: 2025/12/24
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279641 - Linux Distros Unpatched Vulnerability : CVE-2025-68343
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header The driver expects to receive a struct gs_host_frame in gs_usb_receive_bulk_callback(). Use struct_group to describe the header of the struct gs_host_frame and check that we have at least received the header before accessing any members of it. To resubmit the URB, do not dereference the pointer chain dev->parent->hf_size_rx but use parent->hf_size_rx instead. Since urb->context contains parent, it is always defined, while dev is not defined if the URB it too short. (CVE-2025-68343)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68343
https://security-tracker.debian.org/tracker/CVE-2025-68343
https://ubuntu.com/security/CVE-2025-68343

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68343

Plugin Information
Published: 2025/12/23, Modified: 2025/12/24
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279813 - Linux Distros Unpatched Vulnerability : CVE-2025-68345
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() The acpi_get_first_physical_node() function can return NULL, in which case the get_device() function also returns NULL, but this value is then dereferenced without checking,so add a check to prevent a crash.
Found by Linux Verification Center (linuxtesting.org) with SVACE. (CVE-2025-68345)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68345
https://security-tracker.debian.org/tracker/CVE-2025-68345
https://ubuntu.com/security/CVE-2025-68345

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68345

Plugin Information
Published: 2025/12/24, Modified: 2025/12/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279791 - Linux Distros Unpatched Vulnerability : CVE-2025-68348
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- block: fix memory leak in __blkdev_issue_zero_pages Move the fatal signal check before bio_alloc() to prevent a memory leak when BLKDEV_ZERO_KILLABLE is set and a fatal signal is pending. Previously, the bio was allocated before checking for a fatal signal. If a signal was pending, the code would break out of the loop without freeing or chaining the just-allocated bio, causing a memory leak. This matches the pattern already used in __blkdev_issue_write_zeroes() where the signal check precedes the allocation.
(CVE-2025-68348)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68348
https://security-tracker.debian.org/tracker/CVE-2025-68348
https://ubuntu.com/security/CVE-2025-68348

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68348

Plugin Information
Published: 2025/12/24, Modified: 2025/12/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279775 - Linux Distros Unpatched Vulnerability : CVE-2025-68349
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode pnfs_set_layoutcommit relies on the lseg refcount to keep the layout around. Need to clear NFS_INO_LAYOUTCOMMIT otherwise we might attempt to reference a null layout. (CVE-2025-68349)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68349
https://security-tracker.debian.org/tracker/CVE-2025-68349
https://ubuntu.com/security/CVE-2025-68349

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68349

Plugin Information
Published: 2025/12/24, Modified: 2025/12/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279713 - Linux Distros Unpatched Vulnerability : CVE-2025-68353
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net: vxlan: prevent NULL deref in vxlan_xmit_one Neither sock4 nor sock6 pointers are guaranteed to be non-NULL in vxlan_xmit_one, e.g. if the iface is brought down. This can lead to the following NULL dereference: BUG: kernel NULL pointer dereference, address: 0000000000000010 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:vxlan_xmit_one+0xbb3/0x1580 Call Trace: vxlan_xmit+0x429/0x610 dev_hard_start_xmit+0x55/0xa0 __dev_queue_xmit+0x6d0/0x7f0 ip_finish_output2+0x24b/0x590 ip_output+0x63/0x110 Mentioned commits changed the code path in vxlan_xmit_one and as a side effect the sock4/6 pointer validity checks in vxlan(6)_get_route were lost. Fix this by adding back checks. Since both commits being fixed were released in the same version (v6.7) and are strongly related, bundle the fixes in a single commit. (CVE-2025-68353)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68353
https://security-tracker.debian.org/tracker/CVE-2025-68353
https://ubuntu.com/security/CVE-2025-68353

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68353

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279769 - Linux Distros Unpatched Vulnerability : CVE-2025-68368
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- md: init bioset in mddev_init IO operations may be needed before md_run(), such as updating metadata after writing sysfs. Without bioset, this triggers a NULL pointer dereference as below: BUG: kernel NULL pointer dereference, address: 0000000000000020 Call Trace: md_update_sb+0x658/0xe00 new_level_store+0xc5/0x120 md_attr_store+0xc9/0x1e0 sysfs_kf_write+0x6f/0xa0 kernfs_fop_write_iter+0x141/0x2a0 vfs_write+0x1fc/0x5a0 ksys_write+0x79/0x180 __x64_sys_write+0x1d/0x30 x64_sys_call+0x2818/0x2880 do_syscall_64+0xa9/0x580 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Reproducer ``` mdadm -CR /dev/md0 -l1 -n2 /dev/sd[cd] echo inactive > /sys/block/md0/md/array_state echo 10 > /sys/block/md0/md/new_level ``` mddev_init() can only be called once per mddev, no need to test if bioset has been initialized anymore. (CVE-2025-68368)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68368
https://security-tracker.debian.org/tracker/CVE-2025-68368
https://ubuntu.com/security/CVE-2025-68368

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68368

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279717 - Linux Distros Unpatched Vulnerability : CVE-2025-68371
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: smartpqi: Fix device resources accessed after device removal Correct possible race conditions during device removal. Previously, a scheduled work item to reset a LUN could still execute after the device was removed, leading to use-after-free and other resource access issues. This race condition occurs because the abort handler may schedule a LUN reset concurrently with device removal via sdev_destroy(), leading to use-after-free and improper access to freed resources. - Check in the device reset handler if the device is still present in the controller's SCSI device list before running; if not, the reset is skipped. - Cancel any pending TMF work that has not started in sdev_destroy(). - Ensure device freeing in sdev_destroy() is done while holding the LUN reset mutex to avoid races with ongoing resets.
(CVE-2025-68371)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68371
https://security-tracker.debian.org/tracker/CVE-2025-68371
https://ubuntu.com/security/CVE-2025-68371

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68371

Plugin Information
Published: 2025/12/24, Modified: 2025/12/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279702 - Linux Distros Unpatched Vulnerability : CVE-2025-68373
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- md: avoid repeated calls to del_gendisk There is a uaf problem which is found by case 23rdev-lifetime:
Oops: general protection fault, probably for non-canonical address 0xdead000000000122 RIP:
0010:bdi_unregister+0x4b/0x170 Call Trace: <TASK> __del_gendisk+0x356/0x3e0 mddev_unlock+0x351/0x360 rdev_attr_store+0x217/0x280 kernfs_fop_write_iter+0x14a/0x210 vfs_write+0x29e/0x550 ksys_write+0x74/0xf0 do_syscall_64+0xbb/0x380 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff5250a177e The sequence is: 1. rdev remove path gets reconfig_mutex 2. rdev remove path release reconfig_mutex in mddev_unlock 3.
md stop calls do_md_stop and sets MD_DELETED 4. rdev remove path calls del_gendisk because MD_DELETED is set 5. md stop path release reconfig_mutex and calls del_gendisk again So there is a race condition we should resolve. This patch adds a flag MD_DO_DELETE to avoid the race condition. (CVE-2025-68373)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68373
https://ubuntu.com/security/CVE-2025-68373

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.1
EPSS Score
0.0002
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68373

Plugin Information
Published: 2025/12/24, Modified: 2025/12/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279802 - Linux Distros Unpatched Vulnerability : CVE-2025-68379
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- RDMA/rxe: Fix null deref on srq->rq.queue after resize failure A NULL pointer dereference can occur in rxe_srq_chk_attr() when ibv_modify_srq() is invoked twice in succession under certain error conditions.
The first call may fail in rxe_queue_resize(), which leads rxe_srq_from_attr() to set srq->rq.queue = NULL. The second call then triggers a crash (null deref) when accessing srq->rq.queue->buf->index_mask.
Call Trace: <TASK> rxe_modify_srq+0x170/0x480 [rdma_rxe] ? __pfx_rxe_modify_srq+0x10/0x10 [rdma_rxe] ? uverbs_try_lock_object+0x4f/0xa0 [ib_uverbs] ? rdma_lookup_get_uobject+0x1f0/0x380 [ib_uverbs] ib_uverbs_modify_srq+0x204/0x290 [ib_uverbs] ? __pfx_ib_uverbs_modify_srq+0x10/0x10 [ib_uverbs] ? tryinc_node_nr_active+0xe6/0x150 ? uverbs_fill_udata+0xed/0x4f0 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x2c0/0x470 [ib_uverbs] ?
__pfx_ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x10/0x10 [ib_uverbs] ? uverbs_fill_udata+0xed/0x4f0 [ib_uverbs] ib_uverbs_run_method+0x55a/0x6e0 [ib_uverbs] ?
__pfx_ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x10/0x10 [ib_uverbs] ib_uverbs_cmd_verbs+0x54d/0x800 [ib_uverbs] ? __pfx_ib_uverbs_cmd_verbs+0x10/0x10 [ib_uverbs] ? __pfx___raw_spin_lock_irqsave+0x10/0x10 ?
__pfx_do_vfs_ioctl+0x10/0x10 ? ioctl_has_perm.constprop.0.isra.0+0x2c7/0x4c0 ?
__pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 ib_uverbs_ioctl+0x13e/0x220 [ib_uverbs] ?
__pfx_ib_uverbs_ioctl+0x10/0x10 [ib_uverbs] __x64_sys_ioctl+0x138/0x1c0 do_syscall_64+0x82/0x250 ? fdget_pos+0x58/0x4c0 ? ksys_write+0xf3/0x1c0 ? __pfx_ksys_write+0x10/0x10 ? do_syscall_64+0xc8/0x250 ?
__pfx_vm_mmap_pgoff+0x10/0x10 ? fget+0x173/0x230 ? fput+0x2a/0x80 ? ksys_mmap_pgoff+0x224/0x4c0 ? do_syscall_64+0xc8/0x250 ? do_user_addr_fault+0x37b/0xfe0 ? clear_bhb_loop+0x50/0xa0 ? clear_bhb_loop+0x50/0xa0 ? clear_bhb_loop+0x50/0xa0 entry_SYSCALL_64_after_hwframe+0x76/0x7e (CVE-2025-68379)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68379
https://security-tracker.debian.org/tracker/CVE-2025-68379
https://ubuntu.com/security/CVE-2025-68379

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68379

Plugin Information
Published: 2025/12/24, Modified: 2025/12/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279798 - Linux Distros Unpatched Vulnerability : CVE-2025-68380
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath11k: fix peer HE MCS assignment In ath11k_wmi_send_peer_assoc_cmd(), peer's transmit MCS is sent to firmware as receive MCS while peer's receive MCS sent as transmit MCS, which goes against firmwire's definition. While connecting to a misbehaved AP that advertises 0xffff (meaning not supported) for 160 MHz transmit MCS map, firmware crashes due to 0xffff is assigned to he_mcs->rx_mcs_set field. Ext Tag: HE Capabilities [...] Supported HE-MCS and NSS Set [...] Rx and Tx MCS Maps 160 MHz [...] Tx HE-MCS Map 160 MHz: 0xffff Swap the assignment to fix this issue. As the HE rate control mask is meant to limit our own transmit MCS, it needs to go via he_mcs->rx_mcs_set field. With the aforementioned swapping done, change is needed as well to apply it to the peer's receive MCS. Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 (CVE-2025-68380)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68380
https://security-tracker.debian.org/tracker/CVE-2025-68380
https://ubuntu.com/security/CVE-2025-68380

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68380

Plugin Information
Published: 2025/12/24, Modified: 2025/12/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279716 - Linux Distros Unpatched Vulnerability : CVE-2025-68725
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: Do not let BPF test infra emit invalid GSO types to stack Yinhao et al. reported that their fuzzer tool was able to trigger a skb_warn_bad_offload() from netif_skb_features() -> gso_features_check(). When a BPF program - triggered via BPF test infra - pushes the packet to the loopback device via bpf_clone_redirect() then mentioned offload warning can be seen. GSO-related features are then rightfully disabled. We get into this situation due to convert___skb_to_skb() setting gso_segs and gso_size but not gso_type. Technically, it makes sense that this warning triggers since the GSO properties are malformed due to the gso_type. Potentially, the gso_type could be marked non-trustworthy through setting it at least to SKB_GSO_DODGY without any other specific assumptions, but that also feels wrong given we should not go further into the GSO engine in the first place. The checks were added in 121d57af308d (gso: validate gso_type in GSO handlers) because there were malicious (syzbot) senders that combine a protocol with a non-matching gso_type. If we would want to drop such packets, gso_features_check() currently only returns feature flags via netif_skb_features(), so one location for potentially dropping such skbs could be validate_xmit_unreadable_skb(), but then otoh it would be an additional check in the fast-path for a very corner case. Given bpf_clone_redirect() is the only place where BPF test infra could emit such packets, lets reject them right there. (CVE-2025-68725)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68725
https://security-tracker.debian.org/tracker/CVE-2025-68725
https://ubuntu.com/security/CVE-2025-68725

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68725

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279834 - Linux Distros Unpatched Vulnerability : CVE-2025-68729
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: ath12k: Fix MSDU buffer types handling in RX error path Currently, packets received on the REO exception ring from unassociated peers are of MSDU buffer type, while the driver expects link descriptor type packets. These packets are not parsed further due to a return check on packet type in ath12k_hal_desc_reo_parse_err(), but the associated skb is not freed. This may lead to kernel crashes and buffer leaks. Hence to fix, update the RX error handler to explicitly drop MSDU buffer type packets received on the REO exception ring. This prevents further processing of invalid packets and ensures stability in the RX error handling path. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 (CVE-2025-68729)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68729
https://security-tracker.debian.org/tracker/CVE-2025-68729
https://ubuntu.com/security/CVE-2025-68729

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68729

Plugin Information
Published: 2025/12/24, Modified: 2025/12/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279705 - Linux Distros Unpatched Vulnerability : CVE-2025-68732
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- gpu: host1x: Fix race in syncpt alloc/free Fix race condition between host1x_syncpt_alloc() and host1x_syncpt_put() by using kref_put_mutex() instead of kref_put() + manual mutex locking. This ensures no thread can acquire the syncpt_mutex after the refcount drops to zero but before syncpt_release acquires it. This prevents races where syncpoints could be allocated while still being cleaned up from a previous release. Remove explicit mutex locking in syncpt_release as kref_put_mutex() handles this atomically.
(CVE-2025-68732)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68732
https://security-tracker.debian.org/tracker/CVE-2025-68732
https://ubuntu.com/security/CVE-2025-68732

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.1
EPSS Score
0.0002
CVSS v2.0 Base Score
6.9 (CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.9 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68732

Plugin Information
Published: 2025/12/24, Modified: 2025/12/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279801 - Linux Distros Unpatched Vulnerability : CVE-2025-68736
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- landlock: Fix handling of disconnected directories Disconnected files or directories can appear when they are visible and opened from a bind mount, but have been renamed or moved from the source of the bind mount in a way that makes them inaccessible from the mount point (i.e. out of scope). Previously, access rights tied to files or directories opened through a disconnected directory were collected by walking the related hierarchy down to the root of the filesystem, without taking into account the mount point because it couldn't be found. This could lead to inconsistent access results, potential access right widening, and hard-to-debug renames, especially since such paths cannot be printed. For a sandboxed task to create a disconnected directory, it needs to have write access (i.e. FS_MAKE_REG, FS_REMOVE_FILE, and FS_REFER) to the underlying source of the bind mount, and read access to the related mount point. Because a sandboxed task cannot acquire more access rights than those defined by its Landlock domain, this could lead to inconsistent access rights due to missing permissions that should be inherited from the mount point hierarchy, while inheriting permissions from the filesystem hierarchy hidden by this mount point instead.
Landlock now handles files and directories opened from disconnected directories by taking into account the filesystem hierarchy when the mount point is not found in the hierarchy walk, and also always taking into account the mount point from which these disconnected directories were opened. This ensures that a rename is not allowed if it would widen access rights [1]. The rationale is that, even if disconnected hierarchies might not be visible or accessible to a sandboxed task, relying on the collected access rights from them improves the guarantee that access rights will not be widened during a rename because of the access right comparison between the source and the destination (see LANDLOCK_ACCESS_FS_REFER). It may look like this would grant more access on disconnected files and directories, but the security policies are always enforced for all the evaluated hierarchies. This new behavior should be less surprising to users and safer from an access control perspective. Remove a wrong WARN_ON_ONCE() canary in collect_domain_accesses() and fix the related comment. Because opened files have their access rights stored in the related file security properties, there is no impact for disconnected or unlinked files.
(CVE-2025-68736)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68736
https://security-tracker.debian.org/tracker/CVE-2025-68736
https://ubuntu.com/security/CVE-2025-68736

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
6.8 (CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68736

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279821 - Linux Distros Unpatched Vulnerability : CVE-2025-68740
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- ima: Handle error code returned by ima_filter_rule_match() In ima_match_rules(), if ima_filter_rule_match() returns -ENOENT due to the rule being NULL, the function incorrectly skips the 'if (!rc)' check and sets 'result = true'. The LSM rule is considered a match, causing extra files to be measured by IMA. This issue can be reproduced in the following scenario: After unloading the SELinux policy module via 'semodule -d', if an IMA measurement is triggered before ima_lsm_rules is updated, in ima_match_rules(), the first call to ima_filter_rule_match() returns -ESTALE. This causes the code to enter the 'if (rc == -ESTALE && !rule_reinitialized)' block, perform ima_lsm_copy_rule() and retry. In ima_lsm_copy_rule(), since the SELinux module has been removed, the rule becomes NULL, and the second call to ima_filter_rule_match() returns -ENOENT. This bypasses the 'if (!rc)' check and results in a false match. Call trace: selinux_audit_rule_match+0x310/0x3b8 security_audit_rule_match+0x60/0xa0 ima_match_rules+0x2e4/0x4a0 ima_match_policy+0x9c/0x1e8 ima_get_action+0x48/0x60 process_measurement+0xf8/0xa98 ima_bprm_check+0x98/0xd8 security_bprm_check+0x5c/0x78 search_binary_handler+0x6c/0x318 exec_binprm+0x58/0x1b8 bprm_execve+0xb8/0x130 do_execveat_common.isra.0+0x1a8/0x258 __arm64_sys_execve+0x48/0x68 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0xc8/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x44/0x200 el0t_64_sync_handler+0x100/0x130 el0t_64_sync+0x3c8/0x3d0 Fix this by changing 'if (!rc)' to 'if (rc <= 0)' to ensure that error codes like -ENOENT do not bypass the check and accidentally result in a successful match. (CVE-2025-68740)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68740
https://security-tracker.debian.org/tracker/CVE-2025-68740
https://ubuntu.com/security/CVE-2025-68740

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68740

Plugin Information
Published: 2025/12/24, Modified: 2025/12/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279754 - Linux Distros Unpatched Vulnerability : CVE-2025-68741
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- scsi: qla2xxx: Fix improper freeing of purex item In qla2xxx_process_purls_iocb(), an item is allocated via qla27xx_copy_multiple_pkt(), which internally calls qla24xx_alloc_purex_item(). The qla24xx_alloc_purex_item() function may return a pre-allocated item from a per-adapter pool for small allocations, instead of dynamically allocating memory with kzalloc(). An error handling path in qla2xxx_process_purls_iocb() incorrectly uses kfree() to release the item. If the item was from the pre- allocated pool, calling kfree() on it is a bug that can lead to memory corruption. Fix this by using the correct deallocation function, qla24xx_free_purex_item(), which properly handles both dynamically allocated and pre-allocated items. (CVE-2025-68741)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68741
https://security-tracker.debian.org/tracker/CVE-2025-68741
https://ubuntu.com/security/CVE-2025-68741

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68741

Plugin Information
Published: 2025/12/24, Modified: 2025/12/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279725 - Linux Distros Unpatched Vulnerability : CVE-2025-68746
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- spi: tegra210-quad: Fix timeout handling When the CPU that the QSPI interrupt handler runs on (typically CPU 0) is excessively busy, it can lead to rare cases of the IRQ thread not running before the transfer timeout is reached. While handling the timeouts, any pending transfers are cleaned up and the message that they correspond to is marked as failed, which leaves the curr_xfer field pointing at stale memory. To avoid this, clear curr_xfer to NULL upon timeout and check for this condition when the IRQ thread is finally run. While at it, also make sure to clear interrupts on failure so that new interrupts can be run.
A better, more involved, fix would move the interrupt clearing into a hard IRQ handler. Ideally we would also want to signal that the IRQ thread no longer needs to be run after the timeout is hit to avoid the extra check for a valid transfer. (CVE-2025-68746)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68746
https://security-tracker.debian.org/tracker/CVE-2025-68746
https://ubuntu.com/security/CVE-2025-68746

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68746

Plugin Information
Published: 2025/12/24, Modified: 2025/12/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
280112 - Linux Distros Unpatched Vulnerability : CVE-2025-68972
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an invalid armor message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.
(CVE-2025-68972)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68972
https://security-tracker.debian.org/tracker/CVE-2025-68972

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.9 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
5.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.0
EPSS Score
0.0001
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68972

Plugin Information
Published: 2025/12/28, Modified: 2025/12/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gnupg2
246581 - Linux Distros Unpatched Vulnerability : CVE-2025-7519
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly. (CVE-2025-7519)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-7519
https://security-tracker.debian.org/tracker/CVE-2025-7519
https://ubuntu.com/security/CVE-2025-7519

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
6.7 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
6.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
5.9
EPSS Score
0.0001
CVSS v2.0 Base Score
8.3 (CVSS2#AV:N/AC:M/Au:N/C:C/I:P/A:P)
CVSS v2.0 Temporal Score
7.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-7519

Plugin Information
Published: 2025/08/09, Modified: 2025/12/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- polkit
- polkit-libs
245701 - Linux Distros Unpatched Vulnerability : CVE-2025-8114
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash. (CVE-2025-8114)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-8114
https://security-tracker.debian.org/tracker/CVE-2025-8114

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-8114

Plugin Information
Published: 2025/08/08, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libssh
- libssh-config
266346 - Linux Distros Unpatched Vulnerability : CVE-2025-9232
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash.
Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary. (CVE-2025-9232)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-9232
https://ubuntu.com/security/CVE-2025-9232

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-9232

Plugin Information
Published: 2025/10/01, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- openssl
- openssl-devel
- openssl-libs
260410 - Linux Distros Unpatched Vulnerability : CVE-2025-9403
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was determined in jqlang jq up to 1.6. Impacted is the function run_jq_tests of the file jq_test.c of the component JSON Parser. Executing manipulation can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Other versions might be affected as well. (CVE-2025-9403)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-9403
https://security-tracker.debian.org/tracker/CVE-2025-9403
https://ubuntu.com/security/CVE-2025-9403

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.7 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-9403

Plugin Information
Published: 2025/09/02, Modified: 2025/10/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- jq
271522 - Linux Distros Unpatched Vulnerability : CVE-2025-9640
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability. (CVE-2025-9640)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-9640
https://security-tracker.debian.org/tracker/CVE-2025-9640

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
4.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.0003
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-9640

Plugin Information
Published: 2025/10/27, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libsmbclient
- libwbclient
- samba-client
- samba-client-libs
- samba-common
- samba-common-libs
261466 - Linux Distros Unpatched Vulnerability : CVE-2025-9901
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in libsoup's caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. While the issue is unlikely to affect everyday desktop use, it could result in confidentiality breaches in proxy or multi-user environments. (CVE-2025-9901)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-9901
https://security-tracker.debian.org/tracker/CVE-2025-9901
https://ubuntu.com/security/CVE-2025-9901

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0004
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-9901

Plugin Information
Published: 2025/09/05, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libsoup
214461 - RHEL 7 / 8 / 9 : java-11-openjdk ELS (RHSA-2025:0429)
-
Synopsis
The remote Red Hat host is missing a security update for java-11-openjdk ELS.
Description
The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0429 advisory.
The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.
This is the initial release of OpenJDK 11 with Extended Lifecycle Support for Red Hat Enterprise Linux versions 7, 8, and 9.
Security Fix(es):
* OpenJDK: Enhance array handling (CVE-2025-21502)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://issues.redhat.com/browse/RHEL-73804
http://www.nessus.org/u?934dc78e
https://access.redhat.com/errata/RHSA-2025:0429

Solution
Update the RHEL java-11-openjdk ELS package based on the guidance in RHSA-2025:0429.
Risk Factor
Medium
CVSS v3.0 Base Score
4.8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
4.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.3
EPSS Score
0.0002
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
3.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-21502
XREF | RHSA:2025:0429
XREF | CWE:195

Plugin Information
Published: 2025/01/22, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : java-11-openjdk-11.0.24.0.8-2.el9
Should be : java-11-openjdk-11.0.26.0.4-1.el9
Remote package installed : java-11-openjdk-demo-11.0.24.0.8-2.el9
Should be : java-11-openjdk-demo-11.0.26.0.4-1.el9
Remote package installed : java-11-openjdk-devel-11.0.24.0.8-2.el9
Should be : java-11-openjdk-devel-11.0.26.0.4-1.el9
Remote package installed : java-11-openjdk-headless-11.0.24.0.8-2.el9
Should be : java-11-openjdk-headless-11.0.26.0.4-1.el9
Remote package installed : java-11-openjdk-javadoc-11.0.24.0.8-2.el9
Should be : java-11-openjdk-javadoc-11.0.26.0.4-1.el9
Remote package installed : java-11-openjdk-javadoc-zip-11.0.24.0.8-2.el9
Should be : java-11-openjdk-javadoc-zip-11.0.26.0.4-1.el9
Remote package installed : java-11-openjdk-jmods-11.0.24.0.8-2.el9
Should be : java-11-openjdk-jmods-11.0.26.0.4-1.el9
Remote package installed : java-11-openjdk-src-11.0.24.0.8-2.el9
Should be : java-11-openjdk-src-11.0.26.0.4-1.el9
Remote package installed : java-11-openjdk-static-libs-11.0.24.0.8-2.el9
Should be : java-11-openjdk-static-libs-11.0.26.0.4-1.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
214463 - RHEL 8 / 9 : java-17-openjdk security update for RHEL 8.6, 8.8, 8.10, 9.4 and 9.5 (Moderate) (RHSA-2025:0422)
-
Synopsis
The remote Red Hat host is missing a security update for java-17-openjdk.
Description
The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0422 advisory.
The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.
Security Fix(es):
* JDK: Enhance array handling (CVE-2025-21502)
Bug Fix(es):
* The Red Hat OpenJDK packages rely on the copy-jdk-configs package to transfer configuration files to a new updated JDK. With this update, the JDK has been updated to use the latest version of copy-jdk-configs, which has been used for some years on later RHEL versions (RHEL-73867, RHEL-73871, RHEL-73872).
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
http://www.nessus.org/u?07846423
https://access.redhat.com/errata/RHSA-2025:0422

Solution
Update the RHEL java-17-openjdk package based on the guidance in RHSA-2025:0422.
Risk Factor
Medium
CVSS v3.0 Base Score
4.8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
4.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.3
EPSS Score
0.0002
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
3.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-21502
XREF | RHSA:2025:0422
XREF | CWE:195

Plugin Information
Published: 2025/01/22, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : java-17-openjdk-17.0.12.0.7-2.el9
Should be : java-17-openjdk-17.0.14.0.7-2.el9
Remote package installed : java-17-openjdk-demo-17.0.12.0.7-2.el9
Should be : java-17-openjdk-demo-17.0.14.0.7-2.el9
Remote package installed : java-17-openjdk-devel-17.0.12.0.7-2.el9
Should be : java-17-openjdk-devel-17.0.14.0.7-2.el9
Remote package installed : java-17-openjdk-headless-17.0.12.0.7-2.el9
Should be : java-17-openjdk-headless-17.0.14.0.7-2.el9
Remote package installed : java-17-openjdk-javadoc-17.0.12.0.7-2.el9
Should be : java-17-openjdk-javadoc-17.0.14.0.7-2.el9
Remote package installed : java-17-openjdk-javadoc-zip-17.0.12.0.7-2.el9
Should be : java-17-openjdk-javadoc-zip-17.0.14.0.7-2.el9
Remote package installed : java-17-openjdk-jmods-17.0.12.0.7-2.el9
Should be : java-17-openjdk-jmods-17.0.14.0.7-2.el9
Remote package installed : java-17-openjdk-src-17.0.12.0.7-2.el9
Should be : java-17-openjdk-src-17.0.14.0.7-2.el9
Remote package installed : java-17-openjdk-static-libs-17.0.12.0.7-2.el9
Should be : java-17-openjdk-static-libs-17.0.14.0.7-2.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
214504 - RHEL 8 / 9 : java-21-openjdk security update for RHEL 8.10, 9.4 and 9.5 (Moderate) (RHSA-2025:0426)
-
Synopsis
The remote Red Hat host is missing a security update for java-21-openjdk.
Description
The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0426 advisory.
The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit.
Security Fix(es):
* JDK: Enhance array handling (CVE-2025-21502)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
http://www.nessus.org/u?b06c9100
https://access.redhat.com/errata/RHSA-2025:0426

Solution
Update the RHEL java-21-openjdk package based on the guidance in RHSA-2025:0426.
Risk Factor
Medium
CVSS v3.0 Base Score
4.8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
4.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.3
EPSS Score
0.0002
CVSS v2.0 Base Score
4.0 (CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
3.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-21502
XREF | RHSA:2025:0426
XREF | CWE:195

Plugin Information
Published: 2025/01/22, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : java-21-openjdk-21.0.4.0.7-1.el9
Should be : java-21-openjdk-21.0.6.0.7-1.el9
Remote package installed : java-21-openjdk-demo-21.0.4.0.7-1.el9
Should be : java-21-openjdk-demo-21.0.6.0.7-1.el9
Remote package installed : java-21-openjdk-devel-21.0.4.0.7-1.el9
Should be : java-21-openjdk-devel-21.0.6.0.7-1.el9
Remote package installed : java-21-openjdk-headless-21.0.4.0.7-1.el9
Should be : java-21-openjdk-headless-21.0.6.0.7-1.el9
Remote package installed : java-21-openjdk-javadoc-21.0.4.0.7-1.el9
Should be : java-21-openjdk-javadoc-21.0.6.0.7-1.el9
Remote package installed : java-21-openjdk-javadoc-zip-21.0.4.0.7-1.el9
Should be : java-21-openjdk-javadoc-zip-21.0.6.0.7-1.el9
Remote package installed : java-21-openjdk-jmods-21.0.4.0.7-1.el9
Should be : java-21-openjdk-jmods-21.0.6.0.7-1.el9
Remote package installed : java-21-openjdk-src-21.0.4.0.7-1.el9
Should be : java-21-openjdk-src-21.0.6.0.7-1.el9
Remote package installed : java-21-openjdk-static-libs-21.0.4.0.7-1.el9
Should be : java-21-openjdk-static-libs-21.0.6.0.7-1.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
242422 - RHEL 9 : avahi (RHSA-2025:11402)
-
Synopsis
The remote Red Hat host is missing a security update for avahi.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:11402 advisory.
Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print with, and find shared files on other computers.
Security Fix(es):
* avahi: Avahi Wide-Area DNS Uses Constant Source Port (CVE-2024-52615)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2326418
http://www.nessus.org/u?27758116
https://access.redhat.com/errata/RHSA-2025:11402

Solution
Update the RHEL avahi package based on the guidance in RHSA-2025:11402.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
4.6 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.0006
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-52615
XREF | RHSA:2025:11402
XREF | CWE:330

Plugin Information
Published: 2025/07/21, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : avahi-0.8-21.el9
Should be : avahi-0.8-22.el9_6.1
Remote package installed : avahi-glib-0.8-21.el9
Should be : avahi-glib-0.8-22.el9_6.1
Remote package installed : avahi-libs-0.8-21.el9
Should be : avahi-libs-0.8-22.el9_6.1
Remote package installed : avahi-tools-0.8-21.el9
Should be : avahi-tools-0.8-22.el9_6.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237331 - RHEL 9 : avahi (RHSA-2025:7437)
-
Synopsis
The remote Red Hat host is missing a security update for avahi.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7437 advisory.
Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print with, and find shared files on other computers.
Security Fix(es):
* avahi: Avahi Wide-Area DNS Predictable Transaction IDs (CVE-2024-52616)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2326429
http://www.nessus.org/u?494e5981
https://access.redhat.com/errata/RHSA-2025:7437

Solution
Update the RHEL avahi package based on the guidance in RHSA-2025:7437.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
4.6 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.0006
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-52616
XREF | RHSA:2025:7437
XREF | CWE:334

Plugin Information
Published: 2025/05/27, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : avahi-0.8-21.el9
Should be : avahi-0.8-22.el9_6
Remote package installed : avahi-glib-0.8-21.el9
Should be : avahi-glib-0.8-22.el9_6
Remote package installed : avahi-libs-0.8-21.el9
Should be : avahi-libs-0.8-22.el9_6
Remote package installed : avahi-tools-0.8-21.el9
Should be : avahi-tools-0.8-22.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
276718 - RHEL 9 : buildah (RHSA-2025:22011)
-
Synopsis
The remote Red Hat host is missing one or more security updates for buildah.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22011 advisory.
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.
Security Fix(es):
* runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects (CVE-2025-52881)
* golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2404715
https://bugzilla.redhat.com/show_bug.cgi?id=2407258
http://www.nessus.org/u?173fe9d1
https://access.redhat.com/errata/RHSA-2025:22011

Solution
Update the RHEL buildah package based on the guidance in RHSA-2025:22011.
Risk Factor
High
CVSS v4.0 Base Score
7.3 (CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
9.2
EPSS Score
0.0001
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-52881
CVE | CVE-2025-58183
XREF | RHSA:2025:22011
XREF | CWE:59
XREF | CWE:770

Plugin Information
Published: 2025/11/25, Modified: 2025/11/25
Plugin Output

## tcp/0

Remote package installed : buildah-1.37.2-1.el9
Should be : buildah-1.41.6-1.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
233433 - RHEL 9 : expat (RHSA-2024:9541)
-
Synopsis
The remote Red Hat host is missing a security update for expat.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:9541 advisory.
Expat is a C library for parsing XML documents.
Security Fix(es):
* libexpat: expat: DoS via XML_ResumeParser (CVE-2024-50602)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2321987
http://www.nessus.org/u?99d1584a
https://access.redhat.com/errata/RHSA-2024:9541

Solution
Update the RHEL expat package based on the guidance in RHSA-2024:9541.
Risk Factor
Medium
CVSS v3.0 Base Score
5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0011
CVSS v2.0 Base Score
5.4 (CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-50602
XREF | RHSA:2024:9541
XREF | CWE:754

Plugin Information
Published: 2025/03/28, Modified: 2025/03/28
Plugin Output

## tcp/0

Remote package installed : expat-2.5.0-2.el9_4.1
Should be : expat-2.5.0-3.el9_5.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237459 - RHEL 9 : firefox (RHSA-2025:8293)
-
Synopsis
The remote Red Hat host is missing one or more security updates for firefox.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8293 advisory.
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* firefox: thunderbird: Clickjacking vulnerability could have led to leaking saved payment card details (CVE-2025-5267)
* firefox: thunderbird: Potential local code execution in ?Copy as cURL? command (CVE-2025-5264)
* firefox: thunderbird: Memory safety bugs (CVE-2025-5268)
* firefox: thunderbird: Script element events leaked cross-origin resource status (CVE-2025-5266)
* firefox: thunderbird: Error handling for script execution was incorrectly isolated from web content (CVE-2025-5263)
* firefox: thunderbird: Memory safety bug (CVE-2025-5269)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2368750
https://bugzilla.redhat.com/show_bug.cgi?id=2368751
https://bugzilla.redhat.com/show_bug.cgi?id=2368752
https://bugzilla.redhat.com/show_bug.cgi?id=2368755
https://bugzilla.redhat.com/show_bug.cgi?id=2368756
https://bugzilla.redhat.com/show_bug.cgi?id=2368757
http://www.nessus.org/u?b9ef6826
https://access.redhat.com/errata/RHSA-2025:8293

Solution
Update the RHEL firefox package based on the guidance in RHSA-2025:8293.
Risk Factor
High
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0009
CVSS v2.0 Base Score
9.4 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N)
CVSS v2.0 Temporal Score
7.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-5263
CVE | CVE-2025-5264
CVE | CVE-2025-5266
CVE | CVE-2025-5267
CVE | CVE-2025-5268
CVE | CVE-2025-5269
CVE | CVE-2025-5283
XREF | RHSA:2025:8293
XREF | CWE:116
XREF | CWE:119
XREF | CWE:415
XREF | CWE:829
XREF | CWE:1021

Plugin Information
Published: 2025/05/29, Modified: 2025/08/15
Plugin Output

## tcp/0

Remote package installed : firefox-128.3.0-1.el9_4
Should be : firefox-128.11.0-1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
216204 - RHEL 9 : gcc (RHSA-2025:1346)
-
Synopsis
The remote Red Hat host is missing a security update for gcc.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:1346 advisory.
The gcc packages provide compilers for C, C++, Java, Fortran, Objective C, and Ada 95 GNU, as well as related support libraries.
Security Fix(es):
* jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=1850004
http://www.nessus.org/u?f9d3780f
https://access.redhat.com/errata/RHSA-2025:1346

Solution
Update the RHEL gcc package based on the guidance in RHSA-2025:1346.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:F/RL:O/RC:C)
VPR Score
5.7
EPSS Score
0.323
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:F/RL:OF/RC:C)
References

CVE | CVE-2020-11023
XREF | CISA-KNOWN-EXPLOITED:2025/02/13
XREF | RHSA:2025:1346
XREF | CEA-ID:CEA-2021-0025
XREF | CWE:79

Plugin Information
Published: 2025/02/12, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : cpp-11.5.0-2.el9
Should be : cpp-11.5.0-5.el9_5
Remote package installed : gcc-11.5.0-2.el9
Should be : gcc-11.5.0-5.el9_5
Remote package installed : gcc-c++-11.5.0-2.el9
Should be : gcc-c++-11.5.0-5.el9_5
Remote package installed : gcc-gfortran-11.5.0-2.el9
Should be : gcc-gfortran-11.5.0-5.el9_5
Remote package installed : gcc-offload-nvptx-11.5.0-2.el9
Should be : gcc-offload-nvptx-11.5.0-5.el9_5
Remote package installed : gcc-plugin-annobin-11.5.0-2.el9
Should be : gcc-plugin-annobin-11.5.0-5.el9_5
Remote package installed : libasan-11.5.0-2.el9
Should be : libasan-11.5.0-5.el9_5
Remote package installed : libatomic-11.5.0-2.el9
Should be : libatomic-11.5.0-5.el9_5
Remote package installed : libgcc-11.5.0-2.el9
Should be : libgcc-11.5.0-5.el9_5
Remote package installed : libgfortran-11.5.0-2.el9
Should be : libgfortran-11.5.0-5.el9_5
Remote package installed : libgomp-11.5.0-2.el9
Should be : libgomp-11.5.0-5.el9_5
Remote package installed : libgomp-offload-nvptx-11.5.0-2.el9
Should be : libgomp-offload-nvptx-11.5.0-5.el9_5
Remote package installed : libitm-11.5.0-2.el9
Should be : libitm-11.5.0-5.el9_5
Remote package installed : liblsan-11.5.0-2.el9
Should be : liblsan-11.5.0-5.el9_5
Remote package installed : libquadmath-11.5.0-2.el9
Should be : libquadmath-11.5.0-5.el9_5
Remote package installed : libquadmath-devel-11.5.0-2.el9
Should be : libquadmath-devel-11.5.0-5.el9_5
Remote package installed : libstdc++-11.5.0-2.el9
Should be : libstdc++-11.5.0-5.el9_5
Remote package installed : libstdc++-devel-11.5.0-2.el9
Should be : libstdc++-devel-11.5.0-5.el9_5
Remote package installed : libubsan-11.5.0-2.el9
Should be : libubsan-11.5.0-5.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
216101 - RHEL 9 : gcc-toolset-13-gcc (RHSA-2025:1309)
-
Synopsis
The remote Red Hat host is missing a security update for gcc-toolset-13-gcc.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:1309 advisory.
The gcc-toolset-13-gcc13 package contains the GNU Compiler Collection version 13.
Security Fix(es):
* jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=1850004
http://www.nessus.org/u?c6407ded
https://access.redhat.com/errata/RHSA-2025:1309

Solution
Update the RHEL gcc-toolset-13-gcc package based on the guidance in RHSA-2025:1309.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:F/RL:O/RC:C)
VPR Score
5.7
EPSS Score
0.323
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:F/RL:OF/RC:C)
References

CVE | CVE-2020-11023
XREF | CISA-KNOWN-EXPLOITED:2025/02/13
XREF | RHSA:2025:1309
XREF | CEA-ID:CEA-2021-0025
XREF | CWE:79

Plugin Information
Published: 2025/02/11, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : gcc-toolset-13-gcc-13.3.1-2.1.el9
Should be : gcc-toolset-13-gcc-13.3.1-2.2.el9_5
Remote package installed : gcc-toolset-13-gcc-c++-13.3.1-2.1.el9
Should be : gcc-toolset-13-gcc-c++-13.3.1-2.2.el9_5
Remote package installed : gcc-toolset-13-gcc-gfortran-13.3.1-2.1.el9
Should be : gcc-toolset-13-gcc-gfortran-13.3.1-2.2.el9_5
Remote package installed : gcc-toolset-13-gcc-plugin-annobin-13.3.1-2.1.el9
Should be : gcc-toolset-13-gcc-plugin-annobin-13.3.1-2.2.el9_5
Remote package installed : gcc-toolset-13-gcc-plugin-devel-13.3.1-2.1.el9
Should be : gcc-toolset-13-gcc-plugin-devel-13.3.1-2.2.el9_5
Remote package installed : gcc-toolset-13-libasan-devel-13.3.1-2.1.el9
Should be : gcc-toolset-13-libasan-devel-13.3.1-2.2.el9_5
Remote package installed : gcc-toolset-13-libatomic-devel-13.3.1-2.1.el9
Should be : gcc-toolset-13-libatomic-devel-13.3.1-2.2.el9_5
Remote package installed : gcc-toolset-13-libgccjit-13.3.1-2.1.el9
Should be : gcc-toolset-13-libgccjit-13.3.1-2.2.el9_5
Remote package installed : gcc-toolset-13-libgccjit-devel-13.3.1-2.1.el9
Should be : gcc-toolset-13-libgccjit-devel-13.3.1-2.2.el9_5
Remote package installed : gcc-toolset-13-libitm-devel-13.3.1-2.1.el9
Should be : gcc-toolset-13-libitm-devel-13.3.1-2.2.el9_5
Remote package installed : gcc-toolset-13-liblsan-devel-13.3.1-2.1.el9
Should be : gcc-toolset-13-liblsan-devel-13.3.1-2.2.el9_5
Remote package installed : gcc-toolset-13-libquadmath-devel-13.3.1-2.1.el9
Should be : gcc-toolset-13-libquadmath-devel-13.3.1-2.2.el9_5
Remote package installed : gcc-toolset-13-libstdc++-devel-13.3.1-2.1.el9
Should be : gcc-toolset-13-libstdc++-devel-13.3.1-2.2.el9_5
Remote package installed : gcc-toolset-13-libstdc++-docs-13.3.1-2.1.el9
Should be : gcc-toolset-13-libstdc++-docs-13.3.1-2.2.el9_5
Remote package installed : gcc-toolset-13-libtsan-devel-13.3.1-2.1.el9
Should be : gcc-toolset-13-libtsan-devel-13.3.1-2.2.el9_5
Remote package installed : gcc-toolset-13-libubsan-devel-13.3.1-2.1.el9
Should be : gcc-toolset-13-libubsan-devel-13.3.1-2.2.el9_5
Remote package installed : gcc-toolset-13-offload-nvptx-13.3.1-2.1.el9
Should be : gcc-toolset-13-offload-nvptx-13.3.1-2.2.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
216103 - RHEL 9 : gcc-toolset-14-gcc (RHSA-2025:1300)
-
Synopsis
The remote Red Hat host is missing a security update for gcc-toolset-14-gcc.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:1300 advisory.
The gcc-toolset-14-gcc13 package contains the GNU Compiler Collection version 14.
Security Fix(es):
* jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=1850004
http://www.nessus.org/u?1bbc3361
https://access.redhat.com/errata/RHSA-2025:1300

Solution
Update the RHEL gcc-toolset-14-gcc package based on the guidance in RHSA-2025:1300.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:F/RL:O/RC:C)
VPR Score
5.7
EPSS Score
0.323
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:F/RL:OF/RC:C)
References

CVE | CVE-2020-11023
XREF | CISA-KNOWN-EXPLOITED:2025/02/13
XREF | RHSA:2025:1300
XREF | CEA-ID:CEA-2021-0025
XREF | CWE:79

Plugin Information
Published: 2025/02/11, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : gcc-toolset-14-gcc-14.2.1-1.2.el9
Should be : gcc-toolset-14-gcc-14.2.1-1.3.el9_5
Remote package installed : gcc-toolset-14-gcc-c++-14.2.1-1.2.el9
Should be : gcc-toolset-14-gcc-c++-14.2.1-1.3.el9_5
Remote package installed : gcc-toolset-14-gcc-gfortran-14.2.1-1.2.el9
Should be : gcc-toolset-14-gcc-gfortran-14.2.1-1.3.el9_5
Remote package installed : gcc-toolset-14-gcc-plugin-annobin-14.2.1-1.2.el9
Should be : gcc-toolset-14-gcc-plugin-annobin-14.2.1-1.3.el9_5
Remote package installed : gcc-toolset-14-gcc-plugin-devel-14.2.1-1.2.el9
Should be : gcc-toolset-14-gcc-plugin-devel-14.2.1-1.3.el9_5
Remote package installed : gcc-toolset-14-libasan-devel-14.2.1-1.2.el9
Should be : gcc-toolset-14-libasan-devel-14.2.1-1.3.el9_5
Remote package installed : gcc-toolset-14-libatomic-devel-14.2.1-1.2.el9
Should be : gcc-toolset-14-libatomic-devel-14.2.1-1.3.el9_5
Remote package installed : gcc-toolset-14-libgccjit-14.2.1-1.2.el9
Should be : gcc-toolset-14-libgccjit-14.2.1-1.3.el9_5
Remote package installed : gcc-toolset-14-libgccjit-devel-14.2.1-1.2.el9
Should be : gcc-toolset-14-libgccjit-devel-14.2.1-1.3.el9_5
Remote package installed : gcc-toolset-14-libitm-devel-14.2.1-1.2.el9
Should be : gcc-toolset-14-libitm-devel-14.2.1-1.3.el9_5
Remote package installed : gcc-toolset-14-liblsan-devel-14.2.1-1.2.el9
Should be : gcc-toolset-14-liblsan-devel-14.2.1-1.3.el9_5
Remote package installed : gcc-toolset-14-libquadmath-devel-14.2.1-1.2.el9
Should be : gcc-toolset-14-libquadmath-devel-14.2.1-1.3.el9_5
Remote package installed : gcc-toolset-14-libstdc++-devel-14.2.1-1.2.el9
Should be : gcc-toolset-14-libstdc++-devel-14.2.1-1.3.el9_5
Remote package installed : gcc-toolset-14-libstdc++-docs-14.2.1-1.2.el9
Should be : gcc-toolset-14-libstdc++-docs-14.2.1-1.3.el9_5
Remote package installed : gcc-toolset-14-libtsan-devel-14.2.1-1.2.el9
Should be : gcc-toolset-14-libtsan-devel-14.2.1-1.3.el9_5
Remote package installed : gcc-toolset-14-libubsan-devel-14.2.1-1.2.el9
Should be : gcc-toolset-14-libubsan-devel-14.2.1-1.3.el9_5
Remote package installed : gcc-toolset-14-offload-nvptx-14.2.1-1.2.el9
Should be : gcc-toolset-14-offload-nvptx-14.2.1-1.3.el9_5
Remote package installed : libasan8-14.2.1-1.2.el9
Should be : libasan8-14.2.1-1.3.el9_5
Remote package installed : libtsan2-14.2.1-1.2.el9
Should be : libtsan2-14.2.1-1.3.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
243450 - RHEL 9 : glibc (RHSA-2025:12748)
-
Synopsis
The remote Red Hat host is missing a security update for glibc.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:12748 advisory.
The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
Without these libraries, the Linux system cannot function correctly.
Security Fix(es):
* glibc: Double free in glibc (CVE-2025-8058)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2383146
http://www.nessus.org/u?50970107
https://access.redhat.com/errata/RHSA-2025:12748

Solution
Update the RHEL glibc package based on the guidance in RHSA-2025:12748.
Risk Factor
Low
CVSS v4.0 Base Score
5.9 (CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H)
CVSS v3.0 Base Score
4.2 (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
3.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.4
EPSS Score
0.0001
CVSS v2.0 Base Score
3.5 (CVSS2#AV:L/AC:H/Au:S/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
2.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-8058
XREF | RHSA:2025:12748
XREF | CWE:415

Plugin Information
Published: 2025/08/04, Modified: 2025/08/04
Plugin Output

## tcp/0

Remote package installed : glibc-2.34-125.el9_5.1
Should be : glibc-2.34-168.el9_6.23
Remote package installed : glibc-all-langpacks-2.34-125.el9_5.1
Should be : glibc-all-langpacks-2.34-168.el9_6.23
Remote package installed : glibc-common-2.34-125.el9_5.1
Should be : glibc-common-2.34-168.el9_6.23
Remote package installed : glibc-devel-2.34-125.el9_5.1
Should be : glibc-devel-2.34-168.el9_6.23
Remote package installed : glibc-gconv-extra-2.34-125.el9_5.1
Should be : glibc-gconv-extra-2.34-168.el9_6.23
Remote package installed : glibc-headers-2.34-125.el9_5.1
Should be : glibc-headers-2.34-168.el9_6.23
Remote package installed : glibc-langpack-en-2.34-125.el9_5.1
Should be : glibc-langpack-en-2.34-168.el9_6.23
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
240921 - RHEL 9 : glibc (RHSA-2025:9877)
-
Synopsis
The remote Red Hat host is missing a security update for glibc.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9877 advisory.
The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
Without these libraries, the Linux system cannot function correctly.
Security Fix(es):
* glibc: Vector register overwrite bug in glibc (CVE-2025-5702)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2370472
http://www.nessus.org/u?de2a6f33
https://access.redhat.com/errata/RHSA-2025:9877

Solution
Update the RHEL glibc package based on the guidance in RHSA-2025:9877.
Risk Factor
Medium
CVSS v3.0 Base Score
5.6 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.4
EPSS Score
0.0004
CVSS v2.0 Base Score
5.1 (CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.8 (CVSS2#E:U/RL:OF/RC:C)
STIG Severity
I
References

CVE | CVE-2025-5702
XREF | RHSA:2025:9877
XREF | IAVA:2025-A-0524
XREF | CWE:404

Plugin Information
Published: 2025/06/30, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : glibc-2.34-125.el9_5.1
Should be : glibc-2.34-168.el9_6.20
Remote package installed : glibc-all-langpacks-2.34-125.el9_5.1
Should be : glibc-all-langpacks-2.34-168.el9_6.20
Remote package installed : glibc-common-2.34-125.el9_5.1
Should be : glibc-common-2.34-168.el9_6.20
Remote package installed : glibc-devel-2.34-125.el9_5.1
Should be : glibc-devel-2.34-168.el9_6.20
Remote package installed : glibc-gconv-extra-2.34-125.el9_5.1
Should be : glibc-gconv-extra-2.34-168.el9_6.20
Remote package installed : glibc-headers-2.34-125.el9_5.1
Should be : glibc-headers-2.34-168.el9_6.20
Remote package installed : glibc-langpack-en-2.34-125.el9_5.1
Should be : glibc-langpack-en-2.34-168.el9_6.20
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237370 - RHEL 9 : gnutls (RHSA-2025:7076)
-
Synopsis
The remote Red Hat host is missing a security update for gnutls.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7076 advisory.
The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.
Security Fix(es):
* gnutls: GnuTLS Impacted by Inefficient DER Decoding in libtasn1 Leading to Remote DoS (CVE-2024-12243)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?a7e51e86
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2344615
http://www.nessus.org/u?2e12e864
https://access.redhat.com/errata/RHSA-2025:7076

Solution
Update the RHEL gnutls package based on the guidance in RHSA-2025:7076.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
4.6 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.001
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-12243
XREF | RHSA:2025:7076
XREF | CWE:407

Plugin Information
Published: 2025/05/27, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : gnutls-3.8.3-4.el9_4
Should be : gnutls-3.8.3-6.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
276688 - RHEL 9 : go-rpm-macros (RHSA-2025:22005)
-
Synopsis
The remote Red Hat host is missing a security update for go-rpm-macros.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:22005 advisory.
This package provides build-stage rpm automation to simplify the creation of Go language (golang) packages. It does not need to be included in the default build root: go-srpm-macros will pull it in for Go packages only.
Security Fix(es):
* os/exec: Unexpected paths returned from LookPath in os/exec (CVE-2025-47906)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2396546
http://www.nessus.org/u?6f74533c
https://access.redhat.com/errata/RHSA-2025:22005

Solution
Update the RHEL go-rpm-macros package based on the guidance in RHSA-2025:22005.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.3
EPSS Score
0.0002
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-47906
XREF | RHSA:2025:22005
XREF | CWE:440

Plugin Information
Published: 2025/11/25, Modified: 2025/11/25
Plugin Output

## tcp/0

Remote package installed : go-srpm-macros-3.6.0-3.el9
Should be : go-srpm-macros-3.6.0-12.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
274776 - RHEL 9 : grub2 (RHSA-2025:20532)
-
Synopsis
The remote Red Hat host is missing a security update for grub2.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:20532 advisory.
The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices.
Security Fix(es):
* grub2: grub-core/gettext: Integer overflow leads to Heap OOB Write. (CVE-2024-45777)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?b6159d8b
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2346343
https://issues.redhat.com/browse/RHEL-108060
https://issues.redhat.com/browse/RHEL-44336
https://issues.redhat.com/browse/RHEL-87421
https://issues.redhat.com/browse/RHEL-91278
http://www.nessus.org/u?6bb79356
https://access.redhat.com/errata/RHSA-2025:20532

Solution
Update the RHEL grub2 package based on the guidance in RHSA-2025:20532.
Risk Factor
Medium
CVSS v3.0 Base Score
6.7 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0004
CVSS v2.0 Base Score
6.5 (CVSS2#AV:L/AC:L/Au:M/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-45777
XREF | RHSA:2025:20532
XREF | CWE:787

Plugin Information
Published: 2025/11/11, Modified: 2025/11/11
Plugin Output

## tcp/0

Remote package installed : grub2-common-2.06-92.el9
Should be : grub2-common-2.06-114.el9_7
Remote package installed : grub2-efi-x64-2.06-92.el9
Should be : grub2-efi-x64-2.06-114.el9_7
Remote package installed : grub2-tools-2.06-92.el9
Should be : grub2-tools-2.06-114.el9_7
Remote package installed : grub2-tools-minimal-2.06-92.el9
Should be : grub2-tools-minimal-2.06-114.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237317 - RHEL 9 : grub2 (RHSA-2025:6990)
-
Synopsis
The remote Red Hat host is missing one or more security updates for grub2.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:6990 advisory.
The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices.
Security Fix(es):
* grub2: reader/jpeg: Heap OOB Write during JPEG parsing (CVE-2024-45774)
* grub2: commands/extcmd: Missing check for failed allocation (CVE-2024-45775)
* grub2: grub-core/gettext: Integer overflow leads to Heap OOB Write and Read. (CVE-2024-45776)
* grub2: fs/ufs: OOB write in the heap (CVE-2024-45781)
* grub2: fs/hfs+: refcount can be decremented twice (CVE-2024-45783)
* grub2: command/gpg: Use-after-free due to hooks not being removed on module unload (CVE-2025-0622)
* grub2: UFS: Integer overflow may lead to heap based out-of-bounds write when handling symlinks (CVE-2025-0677)
* grub2: read: Integer overflow may lead to out-of-bounds write (CVE-2025-0690)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?a7e51e86
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2337461
https://bugzilla.redhat.com/show_bug.cgi?id=2337481
https://bugzilla.redhat.com/show_bug.cgi?id=2339182
https://bugzilla.redhat.com/show_bug.cgi?id=2345857
https://bugzilla.redhat.com/show_bug.cgi?id=2345863
https://bugzilla.redhat.com/show_bug.cgi?id=2345865
https://bugzilla.redhat.com/show_bug.cgi?id=2346116
https://bugzilla.redhat.com/show_bug.cgi?id=2346123
https://issues.redhat.com/browse/RHEL-25558
https://issues.redhat.com/browse/RHEL-61263
http://www.nessus.org/u?8464c07e
https://access.redhat.com/errata/RHSA-2025:6990

Solution
Update the RHEL grub2 package based on the guidance in RHSA-2025:6990.
Risk Factor
Medium
CVSS v3.0 Base Score
6.7 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0007
CVSS v2.0 Base Score
6.5 (CVSS2#AV:L/AC:L/Au:M/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-45774
CVE | CVE-2024-45775
CVE | CVE-2024-45776
CVE | CVE-2024-45781
CVE | CVE-2024-45783
CVE | CVE-2025-0622
CVE | CVE-2025-0677
CVE | CVE-2025-0690
XREF | RHSA:2025:6990
XREF | CWE:252
XREF | CWE:416
XREF | CWE:787
XREF | CWE:911

Plugin Information
Published: 2025/05/27, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : grub2-common-2.06-92.el9
Should be : grub2-common-2.06-104.el9_6
Remote package installed : grub2-efi-x64-2.06-92.el9
Should be : grub2-efi-x64-2.06-104.el9_6
Remote package installed : grub2-tools-2.06-92.el9
Should be : grub2-tools-2.06-104.el9_6
Remote package installed : grub2-tools-minimal-2.06-92.el9
Should be : grub2-tools-minimal-2.06-104.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
269744 - RHEL 9 : iputils (RHSA-2025:17558)
-
Synopsis
The remote Red Hat host is missing a security update for iputils.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:17558 advisory.
The iputils packages contain basic utilities for monitoring a network, including ping.
Security Fix(es):
* iputils: iputils integer overflow (CVE-2025-48964)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2382657
http://www.nessus.org/u?4b873911
https://access.redhat.com/errata/RHSA-2025:17558

Solution
Update the RHEL iputils package based on the guidance in RHSA-2025:17558.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
2.5
EPSS Score
0.0003
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-48964
XREF | RHSA:2025:17558
XREF | CWE:190

Plugin Information
Published: 2025/10/08, Modified: 2025/10/08
Plugin Output

## tcp/0

Remote package installed : iputils-20210202-9.el9
Should be : iputils-20210202-11.el9_6.3
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
240427 - RHEL 9 : iputils (RHSA-2025:9432)
-
Synopsis
The remote Red Hat host is missing a security update for iputils.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9432 advisory.
The iputils packages contain basic utilities for monitoring a network, including ping.
Security Fix(es):
* iputils: Signed Integer Overflow in Timestamp Multiplication in iputils ping (CVE-2025-47268)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2364090
http://www.nessus.org/u?2e83a285
https://access.redhat.com/errata/RHSA-2025:9432

Solution
Update the RHEL iputils package based on the guidance in RHSA-2025:9432.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
3.3
EPSS Score
0.0004
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-47268
XREF | RHSA:2025:9432
XREF | CWE:190

Plugin Information
Published: 2025/06/25, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : iputils-20210202-9.el9
Should be : iputils-20210202-11.el9_6.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
212415 - RHEL 9 : kernel (RHSA-2024:10939)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:10939 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: net/smc: fix illegal rmb_desc access in SMC-D connection dump (CVE-2024-26615)
* kernel: block: initialize integrity buffer to zero before writing it to media (CVE-2024-43854)
* kernel: iommu: Restore lost return in iommu_report_device_fault() (CVE-2024-44994)
* kernel: netfilter: flowtable: initialise extack before use (CVE-2024-45018)
* kernel: selinux,smack: don't bypass permissions check in inode_setsecctx hook (CVE-2024-46695)
* kernel: net: avoid potential underflow in qdisc_pkt_len_init() with UFO (CVE-2024-49949)
* kernel: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (CVE-2024-50251)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2267355
https://bugzilla.redhat.com/show_bug.cgi?id=2309857
https://bugzilla.redhat.com/show_bug.cgi?id=2311715
https://bugzilla.redhat.com/show_bug.cgi?id=2312083
https://bugzilla.redhat.com/show_bug.cgi?id=2320505
https://bugzilla.redhat.com/show_bug.cgi?id=2324886
http://www.nessus.org/u?85566f86
https://access.redhat.com/errata/RHSA-2024:10939

Solution
Update the RHEL kernel package based on the guidance in RHSA-2024:10939.
Risk Factor
Medium
CVSS v3.0 Base Score
4.4 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
3.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.008
CVSS v2.0 Base Score
4.3 (CVSS2#AV:L/AC:L/Au:M/C:N/I:C/A:N)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-26615
CVE | CVE-2024-43854
CVE | CVE-2024-44994
CVE | CVE-2024-45018
CVE | CVE-2024-46695
CVE | CVE-2024-49949
CVE | CVE-2024-50251
XREF | RHSA:2024:10939
XREF | CWE:287
XREF | CWE:401
XREF | CWE:457
XREF | CWE:476
XREF | CWE:703

Plugin Information
Published: 2024/12/11, Modified: 2025/03/06
Plugin Output

## tcp/0

Remote package installed : bpftool-7.4.0-503.11.1.el9_5
Should be : bpftool-7.4.0-503.16.1.el9_5
Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-503.16.1.el9_5
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-503.16.1.el9_5
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-503.16.1.el9_5
Remote package installed : kernel-headers-5.14.0-503.11.1.el9_5
Should be : kernel-headers-5.14.0-503.16.1.el9_5
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-503.16.1.el9_5
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-503.16.1.el9_5
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-503.16.1.el9_5
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-503.16.1.el9_5
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-503.16.1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
216438 - RHEL 9 : kernel (RHSA-2025:1659)
-
Synopsis
The remote Red Hat host is missing a security update for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:1659 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: mm: migrate: fix getting incorrect page mapping during page migration (CVE-2023-52490)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2269187
http://www.nessus.org/u?151516d9
https://access.redhat.com/errata/RHSA-2025:1659

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:1659.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2023-52490
XREF | RHSA:2025:1659
XREF | CWE:476

Plugin Information
Published: 2025/02/19, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : bpftool-7.4.0-503.11.1.el9_5
Should be : bpftool-7.4.0-503.26.1.el9_5
Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-503.26.1.el9_5
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-503.26.1.el9_5
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-503.26.1.el9_5
Remote package installed : kernel-headers-5.14.0-503.11.1.el9_5
Should be : kernel-headers-5.14.0-503.26.1.el9_5
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-503.26.1.el9_5
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-503.26.1.el9_5
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-503.26.1.el9_5
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-503.26.1.el9_5
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-503.26.1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
274565 - RHEL 9 : kernel (RHSA-2025:19930)
-
Synopsis
The remote Red Hat host is missing one or more security updates for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19930 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: information leak via transient execution vulnerability in some AMD processors (CVE-2024-36350)
* kernel: transient execution vulnerability in some AMD processors (CVE-2024-36357)
* kernel: x86/vmscape: Add conditional IBPB mitigation (CVE-2025-40300)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2350725
https://bugzilla.redhat.com/show_bug.cgi?id=2350726
https://bugzilla.redhat.com/show_bug.cgi?id=2394627
http://www.nessus.org/u?541d8dd4
https://access.redhat.com/errata/RHSA-2025:19930

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:19930.
Risk Factor
Medium
CVSS v3.0 Base Score
5.6 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.2
EPSS Score
0.0003
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-36350
CVE | CVE-2024-36357
CVE | CVE-2025-40300
XREF | RHSA:2025:19930
XREF | CWE:99
XREF | CWE:402

Plugin Information
Published: 2025/11/10, Modified: 2025/11/10
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.62.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.62.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.62.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.62.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.62.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.62.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.62.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.62.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
276625 - RHEL 9 : kernel (RHSA-2025:21926)
-
Synopsis
The remote Red Hat host is missing a security update for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:21926 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: mm: slub: avoid wake up kswapd in set_track_prepare (CVE-2025-39843)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2396941
http://www.nessus.org/u?f83da873
https://access.redhat.com/errata/RHSA-2025:21926

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:21926.
Risk Factor
Low
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
3.8 (CVSS2#AV:L/AC:H/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
2.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-39843
XREF | RHSA:2025:21926
XREF | CWE:833

Plugin Information
Published: 2025/11/24, Modified: 2025/11/24
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-611.9.1.el9_7
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-611.9.1.el9_7
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-611.9.1.el9_7
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-611.9.1.el9_7
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-611.9.1.el9_7
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-611.9.1.el9_7
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-611.9.1.el9_7
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-611.9.1.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
233935 - RHEL 9 : kernel (RHSA-2025:3506)
-
Synopsis
The remote Red Hat host is missing a security update for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:3506 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: md: fix deadlock between mddev_suspend and flush bio (CVE-2024-43855)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
http://www.nessus.org/u?cac5672b
https://access.redhat.com/errata/RHSA-2025:3506

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:3506.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-43855
XREF | RHSA:2025:3506
XREF | CWE:833

Plugin Information
Published: 2025/04/05, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : bpftool-7.4.0-503.11.1.el9_5
Should be : bpftool-7.4.0-503.35.1.el9_5
Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-503.35.1.el9_5
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-503.35.1.el9_5
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-503.35.1.el9_5
Remote package installed : kernel-headers-5.14.0-503.11.1.el9_5
Should be : kernel-headers-5.14.0-503.35.1.el9_5
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-503.35.1.el9_5
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-503.35.1.el9_5
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-503.35.1.el9_5
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-503.35.1.el9_5
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-503.35.1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237253 - RHEL 9 : kernel (RHSA-2025:8142)
-
Synopsis
The remote Red Hat host is missing a security update for kernel.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8142 advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: cifs: Fix integer overflow while processing acregmax mount option (CVE-2025-21964)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2356665
http://www.nessus.org/u?9363bc5c
https://access.redhat.com/errata/RHSA-2025:8142

Solution
Update the RHEL kernel package based on the guidance in RHSA-2025:8142.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-21964
XREF | RHSA:2025:8142
XREF | CWE:190

Plugin Information
Published: 2025/05/26, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : kernel-5.14.0-503.11.1.el9_5
Should be : kernel-5.14.0-570.18.1.el9_6
Remote package installed : kernel-core-5.14.0-503.11.1.el9_5
Should be : kernel-core-5.14.0-570.18.1.el9_6
Remote package installed : kernel-devel-5.14.0-503.11.1.el9_5
Should be : kernel-devel-5.14.0-570.18.1.el9_6
Remote package installed : kernel-headers-5.14.0-503.11.1.el9_5
Should be : kernel-headers-5.14.0-570.18.1.el9_6
Remote package installed : kernel-modules-5.14.0-503.11.1.el9_5
Should be : kernel-modules-5.14.0-570.18.1.el9_6
Remote package installed : kernel-modules-core-5.14.0-503.11.1.el9_5
Should be : kernel-modules-core-5.14.0-570.18.1.el9_6
Remote package installed : kernel-tools-5.14.0-503.11.1.el9_5
Should be : kernel-tools-5.14.0-570.18.1.el9_6
Remote package installed : kernel-tools-libs-5.14.0-503.11.1.el9_5
Should be : kernel-tools-libs-5.14.0-570.18.1.el9_6
Remote package installed : python3-perf-5.14.0-503.11.1.el9_5
Should be : python3-perf-5.14.0-570.18.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
235815 - RHEL 9 : krb5 (RHSA-2025:7067)
-
Synopsis
The remote Red Hat host is missing a security update for krb5.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7067 advisory.
Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).
Security Fix(es):
* krb5: overflow when calculating ulog block size (CVE-2025-24528)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?a7e51e86
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2342796
https://issues.redhat.com/browse/RHEL-4902
https://issues.redhat.com/browse/RHEL-76759
http://www.nessus.org/u?68ec7276
https://access.redhat.com/errata/RHSA-2025:7067

Solution
Update the RHEL krb5 package based on the guidance in RHSA-2025:7067.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-24528
XREF | RHSA:2025:7067
XREF | CWE:787

Plugin Information
Published: 2025/05/13, Modified: 2025/07/01
Plugin Output

## tcp/0

Remote package installed : krb5-libs-1.21.1-3.el9
Should be : krb5-libs-1.21.1-6.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
240472 - RHEL 9 : krb5 (RHSA-2025:9430)
-
Synopsis
The remote Red Hat host is missing a security update for krb5.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9430 advisory.
Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).
Security Fix(es):
* krb5: Kerberos RC4-HMAC-MD5 Checksum Vulnerability Enabling Message Spoofing via MD5 Collisions (CVE-2025-3576)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2359465
http://www.nessus.org/u?5a3e4c7a
https://access.redhat.com/errata/RHSA-2025:9430

Solution
Update the RHEL krb5 package based on the guidance in RHSA-2025:9430.
Risk Factor
Medium
CVSS v3.0 Base Score
5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
5.4 (CVSS2#AV:N/AC:H/Au:N/C:N/I:C/A:N)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-3576
XREF | RHSA:2025:9430
XREF | CWE:328

Plugin Information
Published: 2025/06/25, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : krb5-libs-1.21.1-3.el9
Should be : krb5-libs-1.21.1-8.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
213161 - RHEL 9 : libsndfile:1.0.31 (RHSA-2024:11237)
-
Synopsis
The remote Red Hat host is missing a security update for libsndfile:1.0.31.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:11237 advisory.
libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV.
Security Fix(es):
* libsndfile: Segmentation fault error in ogg_vorbis.c:417 vorbis_analysis_wrote() (CVE-2024-50612)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2322057
http://www.nessus.org/u?d159eb8c
https://access.redhat.com/errata/RHSA-2024:11237

Solution
Update the RHEL libsndfile:1.0.31 package based on the guidance in RHSA-2024:11237.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-50612
XREF | RHSA:2024:11237
XREF | CWE:125

Plugin Information
Published: 2024/12/18, Modified: 2025/04/08
Plugin Output

## tcp/0

Remote package installed : libsndfile-1.0.31-8.el9
Should be : libsndfile-1.0.31-8.el9_5.2
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237240 - RHEL 9 : libsoup (RHSA-2025:8126)
-
Synopsis
The remote Red Hat host is missing one or more security updates for libsoup.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8126 advisory.
The libsoup packages provide an HTTP client and server library for GNOME.
Security Fix(es):
* libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content (CVE-2025-2784)
* libsoup: Denial of Service attack to websocket server (CVE-2025-32049)
* libsoup: OOB Read on libsoup through function soup_multipart_new_from_message in soup-multipart.c leads to crash or exit of process (CVE-2025-32914)
* libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup (CVE-2025-4948)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2354669
https://bugzilla.redhat.com/show_bug.cgi?id=2357066
https://bugzilla.redhat.com/show_bug.cgi?id=2359358
https://bugzilla.redhat.com/show_bug.cgi?id=2367183
http://www.nessus.org/u?449603d0
https://access.redhat.com/errata/RHSA-2025:8126

Solution
Update the RHEL libsoup package based on the guidance in RHSA-2025:8126.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.0017
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:POC/RL:OF/RC:C)
STIG Severity
I
References

CVE | CVE-2025-2784
CVE | CVE-2025-4948
CVE | CVE-2025-32049
CVE | CVE-2025-32914
XREF | RHSA:2025:8126
XREF | IAVA:2025-A-0780
XREF | CWE:125
XREF | CWE:191
XREF | CWE:770

Plugin Information
Published: 2025/05/26, Modified: 2025/10/24
Plugin Output

## tcp/0

Remote package installed : libsoup-2.72.0-8.el9
Should be : libsoup-2.72.0-10.el9_6.2
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
235813 - RHEL 9 : libtasn1 (RHSA-2025:7077)
-
Synopsis
The remote Red Hat host is missing a security update for libtasn1.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7077 advisory.
A library that provides Abstract Syntax Notation One (ASN.1, as specified by the X.680 ITU-T recommendation) parsing and structures management, and Distinguished Encoding Rules (DER, as per X.690) encoding and decoding functions.
Security Fix(es):
* libtasn1: Inefficient DER Decoding in libtasn1 Leading to Potential Remote DoS (CVE-2024-12133)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?a7e51e86
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2344611
http://www.nessus.org/u?f7a72f2f
https://access.redhat.com/errata/RHSA-2025:7077

Solution
Update the RHEL libtasn1 package based on the guidance in RHSA-2025:7077.
Risk Factor
High
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
4.6 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
2.2
EPSS Score
0.0009
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-12133
XREF | RHSA:2025:7077
XREF | CWE:407

Plugin Information
Published: 2025/05/13, Modified: 2025/07/01
Plugin Output

## tcp/0

Remote package installed : libtasn1-4.16.0-8.el9_1
Should be : libtasn1-4.16.0-9.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
240065 - RHEL 9 : libvpx (RHSA-2025:9118)
-
Synopsis
The remote Red Hat host is missing a security update for libvpx.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9118 advisory.
The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.
Security Fix(es):
* libvpx: Double-free in libvpx encoder (CVE-2025-5283)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2368749
http://www.nessus.org/u?7da8610b
https://access.redhat.com/errata/RHSA-2025:9118

Solution
Update the RHEL libvpx package based on the guidance in RHSA-2025:9118.
Risk Factor
High
CVSS v3.0 Base Score
5.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
4.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.3
EPSS Score
0.0009
CVSS v2.0 Base Score
9.4 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N)
CVSS v2.0 Temporal Score
7.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-5283
XREF | RHSA:2025:9118
XREF | CWE:415

Plugin Information
Published: 2025/06/16, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : libvpx-1.9.0-7.el9_2
Should be : libvpx-1.9.0-9.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
277206 - RHEL 9 : libxml2 (RHSA-2025:22376)
-
Synopsis
The remote Red Hat host is missing a security update for libxml2.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:22376 advisory.
The libxml2 library is a development toolbox providing the implementation of various XML standards.
Security Fix(es):
* libxslt: libxml2: Inifinite recursion at exsltDynMapFunction function in libexslt/dynamic.c (CVE-2025-9714)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2392605
http://www.nessus.org/u?843ac071
https://access.redhat.com/errata/RHSA-2025:22376

Solution
Update the RHEL libxml2 package based on the guidance in RHSA-2025:22376.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-9714
XREF | RHSA:2025:22376
XREF | CWE:606

Plugin Information
Published: 2025/12/03, Modified: 2025/12/03
Plugin Output

## tcp/0

Remote package installed : libxml2-2.9.13-6.el9_4
Should be : libxml2-2.9.13-14.el9_7
Remote package installed : libxml2-devel-2.9.13-6.el9_4
Should be : libxml2-devel-2.9.13-14.el9_7
Remote package installed : python3-libxml2-2.9.13-6.el9_4
Should be : python3-libxml2-2.9.13-14.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
235814 - RHEL 9 : microcode_ctl (RHSA-2025:7043)
-
Synopsis
The remote Red Hat host is missing one or more security updates for microcode_ctl.
Description
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:7043 advisory.
The microcode_ctl packages provide microcode updates for Intel and AMD processors.
Security Fix(es):
* microcode_ctl: Improper input validation in UEFI firmware (CVE-2024-28047)
* microcode_ctl: Insufficient granularity of access control in UEFI firmware (CVE-2024-39279)
* microcode_ctl: mproper initialization in UEFI firmware OutOfBandXML module (CVE-2024-31157)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?a7e51e86
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2345363
https://bugzilla.redhat.com/show_bug.cgi?id=2345381
https://bugzilla.redhat.com/show_bug.cgi?id=2345421
https://issues.redhat.com/browse/RHEL-67336
http://www.nessus.org/u?fe139c46
https://access.redhat.com/errata/RHSA-2025:7043

Solution
Update the RHEL microcode_ctl package based on the guidance in RHSA-2025:7043.
Risk Factor
Low
CVSS v4.0 Base Score
6.8 (CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H)
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
4.6 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
3.7 (CVSS2#AV:L/AC:H/Au:M/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
2.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-28047
CVE | CVE-2024-31157
CVE | CVE-2024-39279
XREF | RHSA:2025:7043
XREF | CWE:20
XREF | CWE:665
XREF | CWE:1220

Plugin Information
Published: 2025/05/13, Modified: 2025/07/01
Plugin Output

## tcp/0

Remote package installed : microcode_ctl-20240910-1.el9_5
Should be : microcode_ctl-20250211-1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
213162 - RHEL 9 : mpg123:1.32.9 (RHSA-2024:11242)
-
Synopsis
The remote Red Hat host is missing a security update for mpg123:1.32.9.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:11242 advisory.
The mpg123 packages contain real time MPEG 1.0/2.0/2.5 audio player/decoder for layers 1, 2, and 3 (most commonly MPEG 1.0 layer 3 also known as MP3), as well as re-usable decoding and output libraries.
Security Fix(es):
* mpg123: Buffer overflow when writing decoded PCM samples (CVE-2024-10573)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2322980
http://www.nessus.org/u?90191a77
https://access.redhat.com/errata/RHSA-2024:11242

Solution
Update the RHEL mpg123:1.32.9 package based on the guidance in RHSA-2024:11242.
Risk Factor
Medium
CVSS v3.0 Base Score
6.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
5.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0006
CVSS v2.0 Base Score
6.0 (CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
4.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-10573
XREF | RHSA:2024:11242
XREF | CWE:787

Plugin Information
Published: 2024/12/18, Modified: 2025/04/08
Plugin Output

## tcp/0

Remote package installed : mpg123-libs-1.26.2-5.el9
Should be : mpg123-libs-1.32.9-1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
265353 - RHEL 9 : mysql (RHSA-2025:16086)
-
Synopsis
The remote Red Hat host is missing one or more security updates for mysql.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:16086 advisory.
MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.
Security Fix(es):
* mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722)
* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30688)
* mysql: Stored Procedure unspecified vulnerability (CPU Apr 2025) (CVE-2025-30699)
* mysql: UDF unspecified vulnerability (CPU Apr 2025) (CVE-2025-30721)
* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30682)
* mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30683)
* mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30715)
* mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21574)
* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21585)
* mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30681)
* mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-21577)
* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30687)
* mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21580)
* mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30696)
* mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30705)
* mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21575)
* mysql: Options unspecified vulnerability (CPU Apr 2025) (CVE-2025-21579)
* mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30685)
* mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30704)
* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21581)
* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30689)
* mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30695)
* mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30703)
* mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693)
* mysql: DDL unspecified vulnerability (CPU Apr 2025) (CVE-2025-21584)
* mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30684)
* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50092)
* mysql: mysqldump unspecified vulnerability (CPU Jul 2025) (CVE-2025-50081)
* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50079)
* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50077)
* mysql: DML unspecified vulnerability (CPU Jul 2025) (CVE-2025-50078)
* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50091)
* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50101)
* mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50093)
* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50099)
* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50085)
* mysql: Components Services unspecified vulnerability (CPU Jul 2025) (CVE-2025-50086)
* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50082)
* mysql: Encryption unspecified vulnerability (CPU Jul 2025) (CVE-2025-50097)
* mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50104)
* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50087)
* mysql: Replication unspecified vulnerability (CPU Jul 2025) (CVE-2025-53023)
* mysql: Stored Procedure unspecified vulnerability (CPU Jul 2025) (CVE-2025-50080)
* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50088)
* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50083)
* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50084)
* mysql: Thread Pooling unspecified vulnerability (CPU Jul 2025) (CVE-2025-50100)
* mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50094)
* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50098)
* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50096)
* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://bugzilla.redhat.com/show_bug.cgi?id=2380298
https://bugzilla.redhat.com/show_bug.cgi?id=2380306
https://bugzilla.redhat.com/show_bug.cgi?id=2380308
https://bugzilla.redhat.com/show_bug.cgi?id=2380309
https://bugzilla.redhat.com/show_bug.cgi?id=2380310
https://bugzilla.redhat.com/show_bug.cgi?id=2380311
https://bugzilla.redhat.com/show_bug.cgi?id=2380312
https://bugzilla.redhat.com/show_bug.cgi?id=2380313
https://bugzilla.redhat.com/show_bug.cgi?id=2380320
https://bugzilla.redhat.com/show_bug.cgi?id=2380321
https://bugzilla.redhat.com/show_bug.cgi?id=2380322
https://bugzilla.redhat.com/show_bug.cgi?id=2380326
https://bugzilla.redhat.com/show_bug.cgi?id=2380327
https://bugzilla.redhat.com/show_bug.cgi?id=2380334
https://bugzilla.redhat.com/show_bug.cgi?id=2380335
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2359885
https://bugzilla.redhat.com/show_bug.cgi?id=2359888
https://bugzilla.redhat.com/show_bug.cgi?id=2359892
https://bugzilla.redhat.com/show_bug.cgi?id=2359894
https://bugzilla.redhat.com/show_bug.cgi?id=2359895
https://bugzilla.redhat.com/show_bug.cgi?id=2359899
https://bugzilla.redhat.com/show_bug.cgi?id=2359900
https://bugzilla.redhat.com/show_bug.cgi?id=2359902
https://bugzilla.redhat.com/show_bug.cgi?id=2359903
https://bugzilla.redhat.com/show_bug.cgi?id=2359918
https://bugzilla.redhat.com/show_bug.cgi?id=2359920
https://bugzilla.redhat.com/show_bug.cgi?id=2359924
https://bugzilla.redhat.com/show_bug.cgi?id=2359928
https://bugzilla.redhat.com/show_bug.cgi?id=2359930
https://bugzilla.redhat.com/show_bug.cgi?id=2359932
https://bugzilla.redhat.com/show_bug.cgi?id=2359934
https://bugzilla.redhat.com/show_bug.cgi?id=2359938
https://bugzilla.redhat.com/show_bug.cgi?id=2359940
https://bugzilla.redhat.com/show_bug.cgi?id=2359943
https://bugzilla.redhat.com/show_bug.cgi?id=2359944
https://bugzilla.redhat.com/show_bug.cgi?id=2359945
https://bugzilla.redhat.com/show_bug.cgi?id=2359947
https://bugzilla.redhat.com/show_bug.cgi?id=2359950
https://bugzilla.redhat.com/show_bug.cgi?id=2359963
https://bugzilla.redhat.com/show_bug.cgi?id=2359964
https://bugzilla.redhat.com/show_bug.cgi?id=2359972
https://bugzilla.redhat.com/show_bug.cgi?id=2380264
https://bugzilla.redhat.com/show_bug.cgi?id=2380273
https://bugzilla.redhat.com/show_bug.cgi?id=2380274
https://bugzilla.redhat.com/show_bug.cgi?id=2380278
https://bugzilla.redhat.com/show_bug.cgi?id=2380280
https://bugzilla.redhat.com/show_bug.cgi?id=2380283
https://bugzilla.redhat.com/show_bug.cgi?id=2380284
https://bugzilla.redhat.com/show_bug.cgi?id=2380290
https://bugzilla.redhat.com/show_bug.cgi?id=2380295
https://bugzilla.redhat.com/show_bug.cgi?id=2380291
http://www.nessus.org/u?09fc3092
https://access.redhat.com/errata/RHSA-2025:16086

Solution
Update the RHEL mysql package based on the guidance in RHSA-2025:16086.
Risk Factor
Medium
CVSS v3.0 Base Score
6.8 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.2
EPSS Score
0.0004
CVSS v2.0 Base Score
6.6 (CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:N)
CVSS v2.0 Temporal Score
4.9 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-21574
CVE | CVE-2025-21575
CVE | CVE-2025-21577
CVE | CVE-2025-21579
CVE | CVE-2025-21580
CVE | CVE-2025-21581
CVE | CVE-2025-21584
CVE | CVE-2025-21585
CVE | CVE-2025-30681
CVE | CVE-2025-30682
CVE | CVE-2025-30683
CVE | CVE-2025-30684
CVE | CVE-2025-30685
CVE | CVE-2025-30687
CVE | CVE-2025-30688
CVE | CVE-2025-30689
CVE | CVE-2025-30693
CVE | CVE-2025-30695
CVE | CVE-2025-30696
CVE | CVE-2025-30699
CVE | CVE-2025-30703
CVE | CVE-2025-30704
CVE | CVE-2025-30705
CVE | CVE-2025-30715
CVE | CVE-2025-30721
CVE | CVE-2025-30722
CVE | CVE-2025-50077
CVE | CVE-2025-50078
CVE | CVE-2025-50079
CVE | CVE-2025-50080
CVE | CVE-2025-50081
CVE | CVE-2025-50082
CVE | CVE-2025-50083
CVE | CVE-2025-50084
CVE | CVE-2025-50085
CVE | CVE-2025-50086
CVE | CVE-2025-50087
CVE | CVE-2025-50088
CVE | CVE-2025-50091
CVE | CVE-2025-50092
CVE | CVE-2025-50093
CVE | CVE-2025-50094
CVE | CVE-2025-50096
CVE | CVE-2025-50097
CVE | CVE-2025-50098
CVE | CVE-2025-50099
CVE | CVE-2025-50100
CVE | CVE-2025-50101
CVE | CVE-2025-50102
CVE | CVE-2025-50104
CVE | CVE-2025-53023
XREF | RHSA:2025:16086

Plugin Information
Published: 2025/09/17, Modified: 2025/09/17
Plugin Output

## tcp/0

Remote package installed : mysql-common-8.0.36-1.el9_3
Should be : mysql-common-8.0.43-1.el9_6
Remote package installed : mysql-errmsg-8.0.36-1.el9_3
Should be : mysql-errmsg-8.0.43-1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
278342 - RHEL 9 : mysql (RHSA-2025:23109)
-
Synopsis
The remote Red Hat host is missing one or more security updates for mysql.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23109 advisory.
MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.
Security Fix(es):
* mysql: DML unspecified vulnerability (CPU Oct 2025) (CVE-2025-53053)
* mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53044)
* mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53062)
* mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53054)
* mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53045)
* mysql: Optimizer unspecified vulnerability (CPU Oct 2025) (CVE-2025-53040)
* mysql: Components Services unspecified vulnerability (CPU Oct 2025) (CVE-2025-53069)
* mysql: Optimizer unspecified vulnerability (CPU Oct 2025) (CVE-2025-53042)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2405486
https://bugzilla.redhat.com/show_bug.cgi?id=2405491
https://bugzilla.redhat.com/show_bug.cgi?id=2405511
https://bugzilla.redhat.com/show_bug.cgi?id=2405514
https://bugzilla.redhat.com/show_bug.cgi?id=2405523
https://bugzilla.redhat.com/show_bug.cgi?id=2405534
https://bugzilla.redhat.com/show_bug.cgi?id=2405541
https://bugzilla.redhat.com/show_bug.cgi?id=2405544
https://issues.redhat.com/browse/RHEL-128145
http://www.nessus.org/u?873039cd
https://access.redhat.com/errata/RHSA-2025:23109

Solution
Update the RHEL mysql package based on the guidance in RHSA-2025:23109.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.2
EPSS Score
0.0004
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:L/Au:M/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-53040
CVE | CVE-2025-53042
CVE | CVE-2025-53044
CVE | CVE-2025-53045
CVE | CVE-2025-53053
CVE | CVE-2025-53054
CVE | CVE-2025-53062
CVE | CVE-2025-53069
XREF | RHSA:2025:23109

Plugin Information
Published: 2025/12/11, Modified: 2025/12/11
Plugin Output

## tcp/0

Remote package installed : mysql-common-8.0.36-1.el9_3
Should be : mysql-common-8.0.44-1.el9_7
Remote package installed : mysql-errmsg-8.0.36-1.el9_3
Should be : mysql-errmsg-8.0.44-1.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
235812 - RHEL 9 : openjpeg2 (RHSA-2025:7309)
-
Synopsis
The remote Red Hat host is missing one or more security updates for openjpeg2.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7309 advisory.
OpenJPEG is an open source library for reading and writing image files in JPEG2000 format.
Security Fix(es):
* openjpeg: heap buffer overflow in bin/common/color.c (CVE-2024-56826)
* openjpeg: heap buffer overflow in lib/openjp2/j2k.c (CVE-2024-56827)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?a7e51e86
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2335172
https://bugzilla.redhat.com/show_bug.cgi?id=2335174
http://www.nessus.org/u?50292c06
https://access.redhat.com/errata/RHSA-2025:7309

Solution
Update the RHEL openjpeg2 package based on the guidance in RHSA-2025:7309.
Risk Factor
Medium
CVSS v3.0 Base Score
5.6 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.2
EPSS Score
0.0003
CVSS v2.0 Base Score
5.2 (CVSS2#AV:L/AC:L/Au:S/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
3.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-56826
CVE | CVE-2024-56827
XREF | RHSA:2025:7309
XREF | CWE:122

Plugin Information
Published: 2025/05/13, Modified: 2025/07/01
Plugin Output

## tcp/0

Remote package installed : openjpeg2-2.4.0-7.el9
Should be : openjpeg2-2.4.0-8.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
235806 - RHEL 9 : openssh (RHSA-2025:6993)
-
Synopsis
The remote Red Hat host is missing a security update for openssh.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:6993 advisory.
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.
Security Fix(es):
* openssh: Machine-in-the-middle attack if VerifyHostKeyDNS is enabled (CVE-2025-26465)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?a7e51e86
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2344780
https://issues.redhat.com/browse/RHEL-47112
https://issues.redhat.com/browse/RHEL-52293
http://www.nessus.org/u?3672371c
https://access.redhat.com/errata/RHSA-2025:6993

Solution
Update the RHEL openssh package based on the guidance in RHSA-2025:6993.
Risk Factor
High
CVSS v3.0 Base Score
6.8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
6.1 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.0
EPSS Score
0.6439
CVSS v2.0 Base Score
7.1 (CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-26465
XREF | RHSA:2025:6993
XREF | CWE:390

Plugin Information
Published: 2025/05/13, Modified: 2025/07/01
Plugin Output

## tcp/0

Remote package installed : openssh-8.7p1-43.el9
Should be : openssh-8.7p1-45.el9
Remote package installed : openssh-clients-8.7p1-43.el9
Should be : openssh-clients-8.7p1-45.el9
Remote package installed : openssh-server-8.7p1-43.el9
Should be : openssh-server-8.7p1-45.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
216104 - RHEL 9 : openssl (RHSA-2025:1330)
-
Synopsis
The remote Red Hat host is missing a security update for openssl.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:1330 advisory.
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.
Security Fix(es):
* openssl: RFC7250 handshakes with unauthenticated servers don't abort as expected (CVE-2024-12797)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2342757
http://www.nessus.org/u?d461abf1
https://access.redhat.com/errata/RHSA-2025:1330

Solution
Update the RHEL openssl package based on the guidance in RHSA-2025:1330.
Risk Factor
High
CVSS v3.0 Base Score
6.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
5.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.2
EPSS Score
0.0012
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.5 (CVSS2#E:U/RL:OF/RC:C)
STIG Severity
I
References

CVE | CVE-2024-12797
XREF | RHSA:2025:1330
XREF | IAVA:2025-A-0127-S
XREF | CWE:295

Plugin Information
Published: 2025/02/11, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : openssl-3.2.2-6.el9_5
Should be : openssl-3.2.2-6.el9_5.1
Remote package installed : openssl-devel-3.2.2-6.el9_5
Should be : openssl-devel-3.2.2-6.el9_5.1
Remote package installed : openssl-libs-3.2.2-6.el9_5
Should be : openssl-libs-3.2.2-6.el9_5.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
213155 - RHEL 9 : pam (RHSA-2024:11250)
-
Synopsis
The remote Red Hat host is missing a security update for pam.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:11250 advisory.
Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.
Security Fix(es):
* pam: libpam: Libpam vulnerable to read hashed password (CVE-2024-10041)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2319212
http://www.nessus.org/u?3a4c205b
https://access.redhat.com/errata/RHSA-2024:11250

Solution
Update the RHEL pam package based on the guidance in RHSA-2024:11250.
Risk Factor
Low
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
4.1 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0003
CVSS v2.0 Base Score
3.8 (CVSS2#AV:L/AC:H/Au:S/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
2.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-10041
XREF | RHSA:2024:11250
XREF | CWE:922

Plugin Information
Published: 2024/12/18, Modified: 2024/12/18
Plugin Output

## tcp/0

Remote package installed : pam-1.5.1-20.el9
Should be : pam-1.5.1-21.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
242909 - RHEL 9 : perl (RHSA-2025:11804)
-
Synopsis
The remote Red Hat host is missing a security update for perl.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:11804 advisory.
Perl is a high-level programming language that is commonly used for system administration utilities and web programming.
Security Fix(es):
* perl: Perl threads have a working directory race condition where file operations may target unintended paths (CVE-2025-40909)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2369407
http://www.nessus.org/u?edf152b3
https://access.redhat.com/errata/RHSA-2025:11804

Solution
Update the RHEL perl package based on the guidance in RHSA-2025:11804.
Risk Factor
Medium
CVSS v3.0 Base Score
5.9 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.2
EPSS Score
0.0001
CVSS v2.0 Base Score
5.2 (CVSS2#AV:L/AC:H/Au:N/C:C/I:P/A:P)
CVSS v2.0 Temporal Score
3.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-40909
XREF | RHSA:2025:11804
XREF | CWE:426

Plugin Information
Published: 2025/07/28, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : perl-AutoLoader-5.74-481.el9
Should be : perl-AutoLoader-5.74-481.1.el9_6
Remote package installed : perl-B-1.80-481.el9
Should be : perl-B-1.80-481.1.el9_6
Remote package installed : perl-base-2.27-481.el9
Should be : perl-base-2.27-481.1.el9_6
Remote package installed : perl-Class-Struct-0.66-481.el9
Should be : perl-Class-Struct-0.66-481.1.el9_6
Remote package installed : perl-DynaLoader-1.47-481.el9
Should be : perl-DynaLoader-1.47-481.1.el9_6
Remote package installed : perl-Errno-1.30-481.el9
Should be : perl-Errno-1.30-481.1.el9_6
Remote package installed : perl-Fcntl-1.13-481.el9
Should be : perl-Fcntl-1.13-481.1.el9_6
Remote package installed : perl-File-Basename-2.85-481.el9
Should be : perl-File-Basename-2.85-481.1.el9_6
Remote package installed : perl-File-Compare-1.100.600-481.el9
Should be : perl-File-Compare-1.100.600-481.1.el9_6
Remote package installed : perl-File-Copy-2.34-481.el9
Should be : perl-File-Copy-2.34-481.1.el9_6
Remote package installed : perl-File-Find-1.37-481.el9
Should be : perl-File-Find-1.37-481.1.el9_6
Remote package installed : perl-File-stat-1.09-481.el9
Should be : perl-File-stat-1.09-481.1.el9_6
Remote package installed : perl-FileHandle-2.03-481.el9
Should be : perl-FileHandle-2.03-481.1.el9_6
Remote package installed : perl-Getopt-Std-1.12-481.el9
Should be : perl-Getopt-Std-1.12-481.1.el9_6
Remote package installed : perl-if-0.60.800-481.el9
Should be : perl-if-0.60.800-481.1.el9_6
Remote package installed : perl-interpreter-5.32.1-481.el9
Should be : perl-interpreter-5.32.1-481.1.el9_6
Remote package installed : perl-IO-1.43-481.el9
Should be : perl-IO-1.43-481.1.el9_6
Remote package installed : perl-IPC-Open3-1.21-481.el9
Should be : perl-IPC-Open3-1.21-481.1.el9_6
Remote package installed : perl-lib-0.65-481.el9
Should be : perl-lib-0.65-481.1.el9_6
Remote package installed : perl-libs-5.32.1-481.el9
Should be : perl-libs-5.32.1-481.1.el9_6
Remote package installed : perl-locale-1.09-481.el9
Should be : perl-locale-1.09-481.1.el9_6
Remote package installed : perl-macros-5.32.1-481.el9
Should be : perl-macros-5.32.1-481.1.el9_6
Remote package installed : perl-Math-Complex-1.59-481.el9
Should be : perl-Math-Complex-1.59-481.1.el9_6
Remote package installed : perl-mro-1.23-481.el9
Should be : perl-mro-1.23-481.1.el9_6
Remote package installed : perl-NDBM_File-1.15-481.el9
Should be : perl-NDBM_File-1.15-481.1.el9_6
Remote package installed : perl-overload-1.31-481.el9
Should be : perl-overload-1.31-481.1.el9_6
Remote package installed : perl-overloading-0.02-481.el9
Should be : perl-overloading-0.02-481.1.el9_6
Remote package installed : perl-POSIX-1.94-481.el9
Should be : perl-POSIX-1.94-481.1.el9_6
Remote package installed : perl-SelectSaver-1.02-481.el9
Should be : perl-SelectSaver-1.02-481.1.el9_6
Remote package installed : perl-subs-1.03-481.el9
Should be : perl-subs-1.03-481.1.el9_6
Remote package installed : perl-Symbol-1.08-481.el9
Should be : perl-Symbol-1.08-481.1.el9_6
Remote package installed : perl-vars-1.05-481.el9
Should be : perl-vars-1.05-481.1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
172117 - RHEL 9 : pesign (RHSA-2023:1067)
-
Synopsis
The remote Red Hat host is missing a security update for pesign.
Description
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:1067 advisory.
The pesign packages provide the pesign utility for signing UEFI binaries as well as other associated tools.
Security Fix(es):
* pesign: Local privilege escalation on pesign systemd service (CVE-2022-3560)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?8022991c
https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2135420
https://access.redhat.com/errata/RHSA-2023:1067

Solution
Update the RHEL pesign package based on the guidance in RHSA-2023:1067.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2022-3560
XREF | RHSA:2023:1067
XREF | CWE:22

Plugin Information
Published: 2023/03/06, Modified: 2024/11/07
Plugin Output

## tcp/0

Remote package installed : pesign-115-6.el9
Should be : pesign-115-6.el9_1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
200415 - RHEL 9 : podman (RHSA-2024:3826)
-
Synopsis
The remote Red Hat host is missing one or more security updates for podman.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3826 advisory.
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.
Security Fixes:
* podman: jose-go: improper handling of highly compressed data (CVE-2024-28180)
* podman: golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
* podman: jose: resource exhaustion (CVE-2024-28176)
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?3763ffd0
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2268017
https://bugzilla.redhat.com/show_bug.cgi?id=2268820
https://bugzilla.redhat.com/show_bug.cgi?id=2268854
https://access.redhat.com/errata/RHSA-2024:3826

Solution
Update the RHEL podman package based on the guidance in RHSA-2024:3826.
Risk Factor
Medium
CVSS v3.0 Base Score
5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS v3.0 Temporal Score
5.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0087
CVSS v2.0 Base Score
5.5 (CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
STIG Severity
I
References

CVE | CVE-2023-45290
CVE | CVE-2024-28176
CVE | CVE-2024-28180
XREF | RHSA:2024:3826
XREF | IAVA:2024-A-0356
XREF | CWE:20
XREF | CWE:400
XREF | CWE:409

Plugin Information
Published: 2024/06/12, Modified: 2025/12/09
Plugin Output

## tcp/0

Remote package installed : podman-5.2.2-1.el9
Should be : podman-4.9.4-4.el9_4
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
206496 - RHEL 9 : podman (RHSA-2024:6194)
-
Synopsis
The remote Red Hat host is missing one or more security updates for podman.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:6194 advisory.
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.
Security Fix(es):
* golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)
* go-retryablehttp: url might write sensitive information to log file (CVE-2024-6104)
* gorilla/schema: Potential memory exhaustion attack due to sparse slice deserialization (CVE-2024-37298)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2268019
https://bugzilla.redhat.com/show_bug.cgi?id=2294000
https://bugzilla.redhat.com/show_bug.cgi?id=2295010
https://issues.redhat.com/browse/RHEL-40804
http://www.nessus.org/u?e085c7c1
https://access.redhat.com/errata/RHSA-2024:6194

Solution
Update the RHEL podman package based on the guidance in RHSA-2024:6194.
Risk Factor
Medium
CVSS v3.0 Base Score
5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0029
CVSS v2.0 Base Score
4.6 (CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-6104
CVE | CVE-2024-24783
CVE | CVE-2024-37298
XREF | RHSA:2024:6194
XREF | CWE:400
XREF | CWE:532
XREF | CWE:770

Plugin Information
Published: 2024/09/03, Modified: 2025/03/10
Plugin Output

## tcp/0

Remote package installed : podman-5.2.2-1.el9
Should be : podman-4.9.4-10.el9_4
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
210749 - RHEL 9 : podman (RHSA-2024:9051)
-
Synopsis
The remote Red Hat host is missing one or more security updates for podman.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:9051 advisory.
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.
Security Fix(es):
* Buildah: Podman: Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (CVE-2024-9407)
* buildah: Buildah allows arbitrary directory mount (CVE-2024-9675)
* Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (CVE-2024-9676)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2315887
https://bugzilla.redhat.com/show_bug.cgi?id=2317458
https://bugzilla.redhat.com/show_bug.cgi?id=2317467
http://www.nessus.org/u?a60f947e
https://access.redhat.com/errata/RHSA-2024:9051

Solution
Update the RHEL podman package based on the guidance in RHSA-2024:9051.
Risk Factor
Medium
CVSS v3.0 Base Score
4.4 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
3.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.0
EPSS Score
0.0261
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-9407
CVE | CVE-2024-9675
CVE | CVE-2024-9676
XREF | RHSA:2024:9051
XREF | CWE:20
XREF | CWE:22

Plugin Information
Published: 2024/11/11, Modified: 2025/08/25
Plugin Output

## tcp/0

Remote package installed : podman-5.2.2-1.el9
Should be : podman-4.9.4-16.el9_4
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
279118 - RHEL 9 : podman (RHSA-2025:23325)
-
Synopsis
The remote Red Hat host is missing a security update for podman.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:23325 advisory.
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.
Security Fix(es):
* golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2407258
https://issues.redhat.com/browse/RHEL-132531
http://www.nessus.org/u?2d77b755
https://access.redhat.com/errata/RHSA-2025:23325

Solution
Update the RHEL podman package based on the guidance in RHSA-2025:23325.
Risk Factor
High
CVSS v3.0 Base Score
4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
2.2
EPSS Score
0.0001
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-58183
XREF | RHSA:2025:23325
XREF | CWE:770

Plugin Information
Published: 2025/12/18, Modified: 2025/12/18
Plugin Output

## tcp/0

Remote package installed : podman-5.2.2-1.el9
Should be : podman-5.6.0-9.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
243456 - RHEL 9 : python-requests (RHSA-2025:12519)
-
Synopsis
The remote Red Hat host is missing a security update for python-requests.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:12519 advisory.
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* requests: Requests vulnerable to .netrc credentials leak via malicious URLs (CVE-2024-47081)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2371272
http://www.nessus.org/u?f03cdc2e
https://access.redhat.com/errata/RHSA-2025:12519

Solution
Update the RHEL python-requests package based on the guidance in RHSA-2025:12519.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
4.6 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0006
CVSS v2.0 Base Score
5.4 (CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-47081
XREF | RHSA:2025:12519
XREF | CWE:522

Plugin Information
Published: 2025/08/04, Modified: 2025/08/04
Plugin Output

## tcp/0

Remote package installed : python3-requests-2.25.1-8.el9
Should be : python3-requests-2.25.1-10.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
235796 - RHEL 9 : python-requests (RHSA-2025:7049)
-
Synopsis
The remote Red Hat host is missing a security update for python-requests.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7049 advisory.
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* requests: subsequent requests to the same host ignore cert verification (CVE-2024-35195)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?a7e51e86
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2282114
http://www.nessus.org/u?b4c59ebd
https://access.redhat.com/errata/RHSA-2025:7049

Solution
Update the RHEL python-requests package based on the guidance in RHSA-2025:7049.
Risk Factor
Medium
CVSS v3.0 Base Score
5.6 (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N)
CVSS v3.0 Temporal Score
4.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.2
EPSS Score
0.0015
CVSS v2.0 Base Score
6.2 (CVSS2#AV:N/AC:H/Au:M/C:C/I:C/A:N)
CVSS v2.0 Temporal Score
4.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-35195
XREF | RHSA:2025:7049
XREF | CWE:670

Plugin Information
Published: 2025/05/13, Modified: 2025/07/01
Plugin Output

## tcp/0

Remote package installed : python3-requests-2.25.1-8.el9
Should be : python3-requests-2.25.1-9.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
279115 - RHEL 9 : python3.9 (RHSA-2025:23342)
-
Synopsis
The remote Red Hat host is missing one or more security updates for python3.9.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23342 advisory.
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used (CVE-2024-5642)
* cpython: Python HTMLParser quadratic complexity (CVE-2025-6069)
* cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291)
* python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2294682
https://bugzilla.redhat.com/show_bug.cgi?id=2373234
https://bugzilla.redhat.com/show_bug.cgi?id=2402342
https://bugzilla.redhat.com/show_bug.cgi?id=2408891
https://issues.redhat.com/browse/RHEL-128538
http://www.nessus.org/u?4ed9e7f9
https://access.redhat.com/errata/RHSA-2025:23342

Solution
Update the RHEL python3.9 package based on the guidance in RHSA-2025:23342.
Risk Factor
Medium
CVSS v4.0 Base Score
1.8 (CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.3
EPSS Score
0.0053
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-5642
CVE | CVE-2025-6069
CVE | CVE-2025-6075
CVE | CVE-2025-8291
XREF | RHSA:2025:23342
XREF | CWE:20
XREF | CWE:130
XREF | CWE:770
XREF | CWE:1333

Plugin Information
Published: 2025/12/18, Modified: 2025/12/18
Plugin Output

## tcp/0

Remote package installed : python-unversioned-command-3.9.19-8.el9
Should be : python-unversioned-command-3.9.25-2.el9_7
Remote package installed : python3-3.9.19-8.el9
Should be : python3-3.9.25-2.el9_7
Remote package installed : python3-libs-3.9.19-8.el9
Should be : python3-libs-3.9.25-2.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
235803 - RHEL 9 : python3.9 (RHSA-2025:6977)
-
Synopsis
The remote Red Hat host is missing a security update for python3.9.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:6977 advisory.
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* python: cpython: URL parser allowed square brackets in domain names (CVE-2025-0938)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?a7e51e86
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2343237
http://www.nessus.org/u?42eba6ff
https://access.redhat.com/errata/RHSA-2025:6977

Solution
Update the RHEL python3.9 package based on the guidance in RHSA-2025:6977.
Risk Factor
Medium
CVSS v4.0 Base Score
6.3 (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N)
CVSS v3.0 Base Score
6.8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.2
EPSS Score
0.0061
CVSS v2.0 Base Score
5.4 (CVSS2#AV:N/AC:H/Au:N/C:N/I:C/A:N)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-0938
XREF | RHSA:2025:6977
XREF | CWE:20

Plugin Information
Published: 2025/05/13, Modified: 2025/07/01
Plugin Output

## tcp/0

Remote package installed : python-unversioned-command-3.9.19-8.el9
Should be : python-unversioned-command-3.9.21-2.el9
Remote package installed : python3-3.9.19-8.el9
Should be : python3-3.9.21-2.el9
Remote package installed : python3-libs-3.9.19-8.el9
Should be : python3-libs-3.9.21-2.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
235344 - RHEL 9 : qemu-kvm (RHSA-2025:4492)
-
Synopsis
The remote Red Hat host is missing one or more security updates for qemu-kvm.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:4492 advisory.
Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.
Security Fix(es):
* QEMU: virtio-net: stack buffer overflow in virtio_net_flush_tx() (CVE-2023-6693)
* qemu-kvm: net: assertion failure in update_sctp_checksum() (CVE-2024-3567)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2254580
https://bugzilla.redhat.com/show_bug.cgi?id=2274339
http://www.nessus.org/u?5c160840
https://access.redhat.com/errata/RHSA-2025:4492

Solution
Update the RHEL qemu-kvm package based on the guidance in RHSA-2025:4492.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
CVSS v3.0 Temporal Score
4.8 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0007
CVSS v2.0 Base Score
4.3 (CVSS2#AV:L/AC:L/Au:S/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2023-6693
CVE | CVE-2024-3567
XREF | RHSA:2025:4492
XREF | CWE:121
XREF | CWE:617

Plugin Information
Published: 2025/05/06, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : qemu-guest-agent-9.0.0-10.el9_5
Should be : qemu-guest-agent-9.0.0-10.el9_5.3
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
235809 - RHEL 9 : rhc (RHSA-2025:7326)
-
Synopsis
The remote Red Hat host is missing one or more security updates for rhc.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7326 advisory.
rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management.
Security Fix(es):
* golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336)
* crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?a7e51e86
https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2341751
https://bugzilla.redhat.com/show_bug.cgi?id=2344219
https://issues.redhat.com/browse/RHEL-53958
https://issues.redhat.com/browse/RHEL-59506
http://www.nessus.org/u?508c2253
https://access.redhat.com/errata/RHSA-2025:7326

Solution
Update the RHEL rhc package based on the guidance in RHSA-2025:7326.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
5.3 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.0
EPSS Score
0.0008
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-45336
CVE | CVE-2025-22866
XREF | RHSA:2025:7326
XREF | CWE:200

Plugin Information
Published: 2025/05/13, Modified: 2025/07/01
Plugin Output

## tcp/0

Remote package installed : rhc-0.2.4-5.el9
Should be : rhc-0.2.6-3.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
277373 - RHEL 9 : systemd (RHSA-2025:22660)
-
Synopsis
The remote Red Hat host is missing a security update for systemd.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:22660 advisory.
The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups.
In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.
Security Fix(es):
* systemd-coredump: race condition that allows a local attacker to crash a SUID program and gain read access to the resulting core dump (CVE-2025-4598)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2369242
http://www.nessus.org/u?40aceef3
https://access.redhat.com/errata/RHSA-2025:22660

Solution
Update the RHEL systemd package based on the guidance in RHSA-2025:22660.
Risk Factor
Low
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
4.2 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
5.1
EPSS Score
0.0001
CVSS v2.0 Base Score
3.2 (CVSS2#AV:L/AC:L/Au:S/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
2.5 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-4598
XREF | RHSA:2025:22660
XREF | CWE:364

Plugin Information
Published: 2025/12/04, Modified: 2025/12/04
Plugin Output

## tcp/0

Remote package installed : systemd-252-46.el9_5.2
Should be : systemd-252-55.el9_7.7
Remote package installed : systemd-libs-252-46.el9_5.2
Should be : systemd-libs-252-55.el9_7.7
Remote package installed : systemd-pam-252-46.el9_5.2
Should be : systemd-pam-252-55.el9_7.7
Remote package installed : systemd-rpm-macros-252-46.el9_5.2
Should be : systemd-rpm-macros-252-55.el9_7.7
Remote package installed : systemd-udev-252-46.el9_5.2
Should be : systemd-udev-252-55.el9_7.7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
215456 - RHEL 9 : tbb (RHSA-2025:1210)
-
Synopsis
The remote Red Hat host is missing a security update for tbb.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:1210 advisory.
Threading Building Blocks (TBB) is a C++ runtime library that abstracts the low-level threading details necessary for optimal multi-core performance.
Security Fix(es):
* jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=1850004
http://www.nessus.org/u?7fd09576
https://access.redhat.com/errata/RHSA-2025:1210

Solution
Update the RHEL tbb package based on the guidance in RHSA-2025:1210.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:F/RL:O/RC:C)
VPR Score
5.7
EPSS Score
0.323
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:F/RL:OF/RC:C)
References

CVE | CVE-2020-11023
XREF | CISA-KNOWN-EXPLOITED:2025/02/13
XREF | RHSA:2025:1210
XREF | CEA-ID:CEA-2021-0025
XREF | CWE:79

Plugin Information
Published: 2025/02/10, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : tbb-2020.3-8.el9
Should be : tbb-2020.3-8.el9_5.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237389 - RHEL 9 : unbound (RHSA-2025:8197)
-
Synopsis
The remote Red Hat host is missing a security update for unbound.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8197 advisory.
The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.
Security Fix(es):
* unbound: Unbounded name compression could lead to Denial of Service (CVE-2024-8508)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2316321
http://www.nessus.org/u?7db204fb
https://access.redhat.com/errata/RHSA-2025:8197

Solution
Update the RHEL unbound package based on the guidance in RHSA-2025:8197.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
4.6 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.0074
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-8508
XREF | RHSA:2025:8197
XREF | CWE:606

Plugin Information
Published: 2025/05/27, Modified: 2025/10/09
Plugin Output

## tcp/0

Remote package installed : unbound-libs-1.16.2-3.el9_3.5
Should be : unbound-libs-1.16.2-18.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
213152 - RHEL 9 : unbound:1.16.2 (RHSA-2024:11232)
-
Synopsis
The remote Red Hat host is missing a security update for unbound:1.16.2.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:11232 advisory.
The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.
Security Fix(es):
* unbound: Unbounded name compression could lead to Denial of Service (CVE-2024-8508)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2316321
http://www.nessus.org/u?c0c7aab6
https://access.redhat.com/errata/RHSA-2024:11232

Solution
Update the RHEL unbound:1.16.2 package based on the guidance in RHSA-2024:11232.
Risk Factor
Medium
CVSS v3.0 Base Score
5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
4.6 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.0074
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-8508
XREF | RHSA:2024:11232
XREF | CWE:606

Plugin Information
Published: 2024/12/18, Modified: 2025/04/08
Plugin Output

## tcp/0

Remote package installed : unbound-libs-1.16.2-3.el9_3.5
Should be : unbound-libs-1.16.2-8.el9_5.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
270117 - RHEL 9 : vim (RHSA-2025:17742)
-
Synopsis
The remote Red Hat host is missing one or more security updates for vim.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:17742 advisory.
Vim (Vi IMproved) is an updated and improved version of the vi editor.
Security Fix(es):
* vim: Vim path traversal (CVE-2025-53906)
* vim: Vim path traversial (CVE-2025-53905)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2380360
https://bugzilla.redhat.com/show_bug.cgi?id=2380362
http://www.nessus.org/u?3be5ea2a
https://access.redhat.com/errata/RHSA-2025:17742

Solution
Update the RHEL vim package based on the guidance in RHSA-2025:17742.
Risk Factor
Low
CVSS v3.0 Base Score
4.1 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L)
CVSS v3.0 Temporal Score
3.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
3.8
EPSS Score
0.0001
CVSS v2.0 Base Score
2.6 (CVSS2#AV:L/AC:H/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
2.0 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-53905
CVE | CVE-2025-53906
XREF | RHSA:2025:17742
XREF | CWE:22

Plugin Information
Published: 2025/10/13, Modified: 2025/10/13
Plugin Output

## tcp/0

Remote package installed : vim-common-8.2.2637-21.el9
Should be : vim-common-8.2.2637-22.el9_6.1
Remote package installed : vim-enhanced-8.2.2637-21.el9
Should be : vim-enhanced-8.2.2637-22.el9_6.1
Remote package installed : vim-filesystem-8.2.2637-21.el9
Should be : vim-filesystem-8.2.2637-22.el9_6.1
Remote package installed : vim-minimal-8.2.2637-21.el9
Should be : vim-minimal-8.2.2637-22.el9_6.1
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
274774 - RHEL 9 : vim (RHSA-2025:20945)
-
Synopsis
The remote Red Hat host is missing one or more security updates for vim.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:20945 advisory.
Vim (Vi IMproved) is an updated and improved version of the vi editor.
Security Fix(es):
* vim: Vim path traversal (CVE-2025-53906)
* vim: Vim path traversial (CVE-2025-53905)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2380360
https://bugzilla.redhat.com/show_bug.cgi?id=2380362
http://www.nessus.org/u?ed01e79b
https://access.redhat.com/errata/RHSA-2025:20945

Solution
Update the RHEL vim package based on the guidance in RHSA-2025:20945.
Risk Factor
Low
CVSS v3.0 Base Score
4.1 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L)
CVSS v3.0 Temporal Score
3.7 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
3.8
EPSS Score
0.0001
CVSS v2.0 Base Score
2.6 (CVSS2#AV:L/AC:H/Au:N/C:N/I:P/A:P)
CVSS v2.0 Temporal Score
2.0 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-53905
CVE | CVE-2025-53906
XREF | RHSA:2025:20945
XREF | CWE:22

Plugin Information
Published: 2025/11/11, Modified: 2025/11/11
Plugin Output

## tcp/0

Remote package installed : vim-common-8.2.2637-21.el9
Should be : vim-common-8.2.2637-23.el9_7
Remote package installed : vim-enhanced-8.2.2637-21.el9
Should be : vim-enhanced-8.2.2637-23.el9_7
Remote package installed : vim-filesystem-8.2.2637-21.el9
Should be : vim-filesystem-8.2.2637-23.el9_7
Remote package installed : vim-minimal-8.2.2637-21.el9
Should be : vim-minimal-8.2.2637-23.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
211913 - RHEL 9 : webkit2gtk3 (RHSA-2024:10472)
-
Synopsis
The remote Red Hat host is missing a security update for webkit2gtk3.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:10472 advisory.
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: data isolation bypass vulnerability (CVE-2024-44309)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2327927
http://www.nessus.org/u?8d23370a
https://access.redhat.com/errata/RHSA-2024:10472

Solution
Update the RHEL webkit2gtk3 package based on the guidance in RHSA-2024:10472.
Risk Factor
Medium
CVSS v3.0 Base Score
6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:F/RL:O/RC:C)
VPR Score
4.6
EPSS Score
0.0067
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
5.3 (CVSS2#E:F/RL:OF/RC:C)
References

CVE | CVE-2024-44309
XREF | CISA-KNOWN-EXPLOITED:2024/12/12
XREF | RHSA:2024:10472
XREF | CWE:79

Plugin Information
Published: 2024/11/27, Modified: 2025/03/14
Plugin Output

## tcp/0

Remote package installed : webkit2gtk3-2.44.3-2.el9
Should be : webkit2gtk3-2.46.3-2.el9_5
Remote package installed : webkit2gtk3-jsc-2.44.3-2.el9
Should be : webkit2gtk3-jsc-2.46.3-2.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
234104 - RHEL 9 : webkit2gtk3 (RHSA-2025:3713)
-
Synopsis
The remote Red Hat host is missing one or more security updates for webkit2gtk3.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:3713 advisory.
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-44192)
* webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2024-54467)
* webkitgtk: Processing web content may lead to a denial-of-service (CVE-2024-54551)
* webkitgtk: Loading a malicious iframe may lead to a cross-site scripting attack (CVE-2025-24208)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-24209)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-24216)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-30427)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2353871
https://bugzilla.redhat.com/show_bug.cgi?id=2353872
https://bugzilla.redhat.com/show_bug.cgi?id=2357909
https://bugzilla.redhat.com/show_bug.cgi?id=2357910
https://bugzilla.redhat.com/show_bug.cgi?id=2357911
https://bugzilla.redhat.com/show_bug.cgi?id=2357917
https://bugzilla.redhat.com/show_bug.cgi?id=2357919
http://www.nessus.org/u?f06b5165
https://access.redhat.com/errata/RHSA-2025:3713

Solution
Update the RHEL webkit2gtk3 package based on the guidance in RHSA-2025:3713.
Risk Factor
High
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.0007
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-44192
CVE | CVE-2024-54467
CVE | CVE-2024-54551
CVE | CVE-2025-24189
CVE | CVE-2025-24208
CVE | CVE-2025-24209
CVE | CVE-2025-24216
CVE | CVE-2025-30427
XREF | RHSA:2025:3713
XREF | CWE:20
XREF | CWE:79
XREF | CWE:119
XREF | CWE:120
XREF | CWE:129
XREF | CWE:200
XREF | CWE:416

Plugin Information
Published: 2025/04/09, Modified: 2025/08/15
Plugin Output

## tcp/0

Remote package installed : webkit2gtk3-2.44.3-2.el9
Should be : webkit2gtk3-2.48.1-1.el9_5
Remote package installed : webkit2gtk3-jsc-2.44.3-2.el9
Should be : webkit2gtk3-jsc-2.48.1-1.el9_5
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
235834 - RHEL 9 : webkit2gtk3 (RHSA-2025:7387)
-
Synopsis
The remote Red Hat host is missing one or more security updates for webkit2gtk3.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7387 advisory.
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-44192)
* webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2024-54467)
* webkitgtk: Processing web content may lead to a denial-of-service (CVE-2024-54551)
* webkitgtk: Loading a malicious iframe may lead to a cross-site scripting attack (CVE-2025-24208)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-24209)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-24216)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-30427)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2353871
https://bugzilla.redhat.com/show_bug.cgi?id=2353872
https://bugzilla.redhat.com/show_bug.cgi?id=2357909
https://bugzilla.redhat.com/show_bug.cgi?id=2357910
https://bugzilla.redhat.com/show_bug.cgi?id=2357911
https://bugzilla.redhat.com/show_bug.cgi?id=2357917
https://bugzilla.redhat.com/show_bug.cgi?id=2357919
http://www.nessus.org/u?bd5291d2
https://access.redhat.com/errata/RHSA-2025:7387

Solution
Update the RHEL webkit2gtk3 package based on the guidance in RHSA-2025:7387.
Risk Factor
High
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
5.5
EPSS Score
0.0007
CVSS v2.0 Base Score
7.8 (CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-44192
CVE | CVE-2024-54467
CVE | CVE-2024-54551
CVE | CVE-2025-24208
CVE | CVE-2025-24209
CVE | CVE-2025-24216
CVE | CVE-2025-30427
XREF | RHSA:2025:7387
XREF | CWE:20
XREF | CWE:79
XREF | CWE:119
XREF | CWE:120
XREF | CWE:200
XREF | CWE:416

Plugin Information
Published: 2025/05/13, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : webkit2gtk3-2.44.3-2.el9
Should be : webkit2gtk3-2.48.1-1.el9_6
Remote package installed : webkit2gtk3-jsc-2.44.3-2.el9
Should be : webkit2gtk3-jsc-2.48.1-1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
237376 - RHEL 9 : webkit2gtk3 (RHSA-2025:7995)
-
Synopsis
The remote Red Hat host is missing one or more security updates for webkit2gtk3.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7995 advisory.
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2025-31205)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-31257)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2366501
https://bugzilla.redhat.com/show_bug.cgi?id=2366504
http://www.nessus.org/u?7182b715
https://access.redhat.com/errata/RHSA-2025:7995

Solution
Update the RHEL webkit2gtk3 package based on the guidance in RHSA-2025:7995.
Risk Factor
Critical
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
CVSS v3.0 Temporal Score
5.7 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
7.4 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-31205
CVE | CVE-2025-31257
XREF | RHSA:2025:7995
XREF | CWE:200
XREF | CWE:416

Plugin Information
Published: 2025/05/27, Modified: 2025/06/05
Plugin Output

## tcp/0

Remote package installed : webkit2gtk3-2.44.3-2.el9
Should be : webkit2gtk3-2.48.2-1.el9_6
Remote package installed : webkit2gtk3-jsc-2.44.3-2.el9
Should be : webkit2gtk3-jsc-2.48.2-1.el9_6
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.

##

18405 - Remote Desktop Protocol Server Man-in-the-Middle Weakness
-
Synopsis
It may be possible to get access to the remote host.
Description
The remote version of the Remote Desktop Protocol Server (Terminal Service) is vulnerable to a man-in-the-middle (MiTM) attack. The RDP client makes no effort to validate the identity of the server when setting up encryption. An attacker with the ability to intercept traffic from the RDP server can establish encryption with the client and server without being detected. A MiTM attack of this nature would allow the attacker to obtain any sensitive information transmitted, including authentication credentials.
This flaw exists because the RDP server stores a publicly known hard-coded RSA private key. Any attacker in a privileged network location can use the key for this attack.
See Also

http://www.nessus.org/u?8033da0d

Solution
- Force the use of SSL as a transport layer for this service if supported, or/and
- On Microsoft Windows operating systems, select the 'Allow connections only from computers running Remote Desktop with Network Level Authentication' setting if it is available.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
VPR Score
2.5
EPSS Score
0.0427
CVSS v2.0 Base Score
5.1 (CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.8 (CVSS2#E:U/RL:OF/RC:C)
References

BID | 13818
CVE | CVE-2005-1794

Plugin Information
Published: 2005/06/01, Modified: 2022/08/24
Plugin Output

## tcp/3389/msrdp

51192 - SSL Certificate Cannot Be Trusted
-
Synopsis
The SSL certificate for this service cannot be trusted.
Description
The server's X.509 certificate cannot be trusted. This situation can occur in three different ways, in which the chain of trust can be broken, as stated below :
- First, the top of the certificate chain sent by the server might not be descended from a known public certificate authority. This can occur either when the top of the chain is an unrecognized, self-signed certificate, or when intermediate certificates are missing that would connect the top of the certificate chain to a known public certificate authority.
- Second, the certificate chain may contain a certificate that is not valid at the time of the scan. This can occur either when the scan occurs before one of the certificate's 'notBefore' dates, or after one of the certificate's 'notAfter' dates.
- Third, the certificate chain may contain a signature that either didn't match the certificate's information or could not be verified. Bad signatures can be fixed by getting the certificate with the bad signature to be re-signed by its issuer. Signatures that could not be verified are the result of the certificate's issuer using a signing algorithm that Nessus either does not support or does not recognize.
If the remote host is a public host in production, any break in the chain makes it more difficult for users to verify the authenticity and identity of the web server. This could make it easier to carry out man-in-the-middle attacks against the remote host.
See Also

https://www.itu.int/rec/T-REC-X.509/en
https://en.wikipedia.org/wiki/X.509

Solution
Purchase or generate a proper SSL certificate for this service.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
Plugin Information
Published: 2010/12/15, Modified: 2025/06/16
Plugin Output

## tcp/3389/msrdp

The following certificate was at the top of the certificate
chain sent by the remote host, but it is signed by an unknown
certificate authority :
|-Subject : CN=XRDP
|-Issuer : CN=XRDP
57582 - SSL Self-Signed Certificate
-
Synopsis
The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
Description
The X.509 certificate chain for this service is not signed by a recognized certificate authority. If the remote host is a public host in production, this nullifies the use of SSL as anyone could establish a man-in-the-middle attack against the remote host.
Note that this plugin does not check for certificate chains that end in a certificate that is not self-signed, but is signed by an unrecognized certificate authority.
Solution
Purchase or generate a proper SSL certificate for this service.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
Plugin Information
Published: 2012/01/17, Modified: 2022/06/14
Plugin Output

## tcp/3389/msrdp

The following certificate was found at the top of the certificate
chain sent by the remote host, but is self-signed and was not
found in the list of known certificate authorities :
|-Subject : CN=XRDP

##

10114 - ICMP Timestamp Request Remote Date Disclosure
-
Synopsis
It is possible to determine the exact time set on the remote host.
Description
The remote host answers to an ICMP timestamp request. This allows an attacker to know the date that is set on the targeted machine, which may assist an unauthenticated, remote attacker in defeating time-based authentication protocols.
Timestamps returned from machines running Windows Vista / 7 / 2008 / 2008 R2 are deliberately incorrect, but usually within 1000 seconds of the actual system time.
Solution
Filter out the ICMP timestamp requests (13), and the outgoing ICMP timestamp replies (14).
Risk Factor
Low
VPR Score
2.2
EPSS Score
0.0037
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
References

CVE | CVE-1999-0524
XREF | CWE:200

Plugin Information
Published: 1999/08/01, Modified: 2024/10/07
Plugin Output

## icmp/0

The difference between the local and remote clocks is -18 seconds.

##

223242 - Linux Distros Unpatched Vulnerability : CVE-2020-14394
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. This flaw allows a privileged guest user to hang the QEMU process on the host, resulting in a denial of service. (CVE-2020-14394)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-14394
https://ubuntu.com/security/CVE-2020-14394

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
3.2 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
2.9 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
2.4
EPSS Score
0.0001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2020-14394

Plugin Information
Published: 2025/03/04, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- qemu-guest-agent
229894 - Linux Distros Unpatched Vulnerability : CVE-2020-25084
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked. (CVE-2020-25084)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-25084
https://ubuntu.com/security/CVE-2020-25084

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
3.2 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
2.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.6
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2020-25084

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- qemu-guest-agent
229882 - Linux Distros Unpatched Vulnerability : CVE-2020-25723
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service. (CVE-2020-25723)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-25723
https://ubuntu.com/security/CVE-2020-25723

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
3.2 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
2.8 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.6
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2020-25723

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- qemu-guest-agent
229930 - Linux Distros Unpatched Vulnerability : CVE-2020-25741
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- fdctrl_write_data in hw/block/fdc.c in QEMU 5.0.0 has a NULL pointer dereference via a NULL block pointer for the current drive. (CVE-2020-25741)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-25741
https://security-tracker.debian.org/tracker/CVE-2020-25741
https://ubuntu.com/security/CVE-2020-25741

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
3.2 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.6
EPSS Score
0.0017
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2020-25741

Plugin Information
Published: 2025/03/05, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- qemu-guest-agent
229932 - Linux Distros Unpatched Vulnerability : CVE-2020-25743
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide_cancel_dma_sync call. (CVE-2020-25743)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-25743
https://security-tracker.debian.org/tracker/CVE-2020-25743
https://ubuntu.com/security/CVE-2020-25743

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
3.2 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.0 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.6
EPSS Score
0.0003
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2020-25743

Plugin Information
Published: 2025/03/05, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- qemu-guest-agent
223537 - Linux Distros Unpatched Vulnerability : CVE-2020-35501
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in the Linux kernels implementation of audit rules, where a syscall can unexpectedly not be correctly not be logged by the audit subsystem (CVE-2020-35501)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2020-35501
https://security-tracker.debian.org/tracker/CVE-2020-35501
https://ubuntu.com/security/CVE-2020-35501

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
3.4 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
3.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.5
EPSS Score
0.0001
CVSS v2.0 Base Score
3.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
3.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2020-35501

Plugin Information
Published: 2025/03/04, Modified: 2025/12/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
223628 - Linux Distros Unpatched Vulnerability : CVE-2021-20263
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a malicious user to elevate their privileges within the guest. (CVE-2021-20263)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-20263

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
2.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.0005
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-20263

Plugin Information
Published: 2025/03/04, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- qemu-guest-agent
260341 - Linux Distros Unpatched Vulnerability : CVE-2021-25317
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows local attackers with control of the lp users to create files as root with 0644 permissions without the ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version 2.3.3op2-2.1 and prior versions. (CVE-2021-25317)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-25317

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
2.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.0003
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-25317

Plugin Information
Published: 2025/09/02, Modified: 2025/10/08
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- cups
- cups-client
- cups-filesystem
- cups-ipptool
- cups-libs
224108 - Linux Distros Unpatched Vulnerability : CVE-2021-3592
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input() function and could occur while processing a udp packet that is smaller than the size of the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 bytes of uninitialized heap memory from the host. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. (CVE-2021-3592)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-3592

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
3.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
3.3 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
2.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-3592

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- qemu-guest-agent
224031 - Linux Distros Unpatched Vulnerability : CVE-2021-3593
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp6_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. (CVE-2021-3593)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-3593
https://ubuntu.com/security/CVE-2021-3593

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
3.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
3.3 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
2.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-3593

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- qemu-guest-agent
223950 - Linux Distros Unpatched Vulnerability : CVE-2021-3594
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. (CVE-2021-3594)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-3594

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
3.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
3.3 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
2.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-3594

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- qemu-guest-agent
223939 - Linux Distros Unpatched Vulnerability : CVE-2021-3595
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. (CVE-2021-3595)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-3595

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
3.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
3.3 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
2.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-3595

Plugin Information
Published: 2025/03/05, Modified: 2025/09/10
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libslirp
- qemu-guest-agent
256910 - Linux Distros Unpatched Vulnerability : CVE-2021-4217
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution. (CVE-2021-4217)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-4217
https://security-tracker.debian.org/tracker/CVE-2021-4217

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.0 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
2.2
EPSS Score
0.0027
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2021-4217

Plugin Information
Published: 2025/08/27, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- unzip
224359 - Linux Distros Unpatched Vulnerability : CVE-2021-46934
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: i2c: validate user data in compat ioctl Wrong user data may cause warning in i2c_transfer(), ex: zero msgs. Userspace should not be able to trigger warnings, so this patch adds validation checks for user data in compact ioctl to prevent reported warnings (CVE-2021-46934)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-46934
https://ubuntu.com/security/CVE-2021-46934

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
3.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2021-46934

Plugin Information
Published: 2025/03/05, Modified: 2025/11/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224399 - Linux Distros Unpatched Vulnerability : CVE-2021-47089
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: kfence: fix memory leak when cat kfence objects Hulk robot reported a kmemleak problem: unreferenced object 0xffff93d1d8cc02e8 (size 248):
comm cat, pid 23327, jiffies 4624670141 (age 495992.217s) hex dump (first 32 bytes): 00 40 85 19 d4 93 ff ff 00 10 00 00 00 00 00 00 .@.............. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: seq_open+0x2a/0x80 full_proxy_open+0x167/0x1e0 do_dentry_open+0x1e1/0x3a0 path_openat+0x961/0xa20 do_filp_open+0xae/0x120 do_sys_openat2+0x216/0x2f0 do_sys_open+0x57/0x80 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 unreferenced object 0xffff93d419854000 (size 4096): comm cat, pid 23327, jiffies 4624670141 (age 495992.217s) hex dump (first 32 bytes): 6b 66 65 6e 63 65 2d 23 32 35 30 3a 20 30 78 30 kfence-#250: 0x0 30 30 30 30 30 30 30 37 35 34 62 64 61 31 32 2d 0000000754bda12- backtrace: seq_read_iter+0x313/0x440 seq_read+0x14b/0x1a0 full_proxy_read+0x56/0x80 vfs_read+0xa5/0x1b0 ksys_read+0xa0/0xf0 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 I find that we can easily reproduce this problem with the following commands: cat /sys/kernel/debug/kfence/objects echo scan > /sys/kernel/debug/kmemleak cat /sys/kernel/debug/kmemleak The leaked memory is allocated in the stack below: do_syscall_64 do_sys_open do_dentry_open full_proxy_open seq_open ---> alloc seq_file vfs_read full_proxy_read seq_read seq_read_iter traverse ---> alloc seq_buf And it should have been released in the following process: do_syscall_64 syscall_exit_to_user_mode exit_to_user_mode_prepare task_work_run ____fput __fput full_proxy_release ---> free here However, the release function corresponding to file_operations is not implemented in kfence. As a result, a memory leak occurs. Therefore, the solution to this problem is to implement the corresponding release function.
(CVE-2021-47089)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2021-47089
https://ubuntu.com/security/CVE-2021-47089

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
2.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
2.2
EPSS Score
0.0004
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
3.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2021-47089

Plugin Information
Published: 2025/03/05, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
229995 - Linux Distros Unpatched Vulnerability : CVE-2022-0987
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. This issue allows a local user to measure the time the methods take to execute and know whether a file owned by root or other users exists. (CVE-2022-0987)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-0987
https://security-tracker.debian.org/tracker/CVE-2022-0987
https://ubuntu.com/security/CVE-2022-0987

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
3.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0003
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-0987

Plugin Information
Published: 2025/03/05, Modified: 2025/10/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- PackageKit
- PackageKit-command-not-found
- PackageKit-glib
- PackageKit-gstreamer-plugin
- PackageKit-gtk3-module
224766 - Linux Distros Unpatched Vulnerability : CVE-2022-3219
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB. (CVE-2022-3219)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-3219
https://security-tracker.debian.org/tracker/CVE-2022-3219
https://ubuntu.com/security/CVE-2022-3219

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0001
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-3219

Plugin Information
Published: 2025/03/05, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gnupg2
224848 - Linux Distros Unpatched Vulnerability : CVE-2022-3629
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was found in Linux Kernel. It has been declared as problematic. This vulnerability affects the function vsock_connect of the file net/vmw_vsock/af_vsock.c. The manipulation leads to memory leak.
The complexity of an attack is rather high. The exploitation appears to be difficult. It is recommended to apply a patch to fix this issue. VDB-211930 is the identifier assigned to this vulnerability.
(CVE-2022-3629)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-3629
https://ubuntu.com/security/CVE-2022-3629

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0003
CVSS v2.0 Base Score
4.7 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-3629

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224903 - Linux Distros Unpatched Vulnerability : CVE-2022-3633
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function j1939_session_destroy of the file net/can/j1939/transport.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211932.
(CVE-2022-3633)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-3633
https://ubuntu.com/security/CVE-2022-3633

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0002
CVSS v2.0 Base Score
4.9 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-3633

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
224916 - Linux Distros Unpatched Vulnerability : CVE-2022-4123
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality. (CVE-2022-4123)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-4123
https://security-tracker.debian.org/tracker/CVE-2022-4123
https://ubuntu.com/security/CVE-2022-4123

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
3.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-4123

Plugin Information
Published: 2025/03/05, Modified: 2025/10/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- podman
248803 - Linux Distros Unpatched Vulnerability : CVE-2022-49841
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: serial: imx: Add missing .thaw_noirq hook The following warning is seen with non-console UART instance when system hibernates. [ 37.371969]
------------[ cut here ]------------ [ 37.376599] uart3_root_clk already disabled [ 37.380810] WARNING:
CPU: 0 PID: 296 at drivers/clk/clk.c:952 clk_core_disable+0xa4/0xb0 ... [ 37.506986] Call trace: [ 37.509432] clk_core_disable+0xa4/0xb0 [ 37.513270] clk_disable+0x34/0x50 [ 37.516672] imx_uart_thaw+0x38/0x5c [ 37.520250] platform_pm_thaw+0x30/0x6c [ 37.524089] dpm_run_callback.constprop.0+0x3c/0xd4 [ 37.528972] device_resume+0x7c/0x160 [ 37.532633] dpm_resume+0xe8/0x230 [ 37.536036] hibernation_snapshot+0x288/0x430 [ 37.540397] hibernate+0x10c/0x2e0 [ 37.543798] state_store+0xc4/0xd0 [ 37.547203] kobj_attr_store+0x1c/0x30 [ 37.550953] sysfs_kf_write+0x48/0x60 [ 37.554619] kernfs_fop_write_iter+0x118/0x1ac [ 37.559063] new_sync_write+0xe8/0x184 [ 37.562812] vfs_write+0x230/0x290 [ 37.566214] ksys_write+0x68/0xf4 [ 37.569529] __arm64_sys_write+0x20/0x2c [ 37.573452] invoke_syscall.constprop.0+0x50/0xf0 [ 37.578156] do_el0_svc+0x11c/0x150 [ 37.581648] el0_svc+0x30/0x140 [ 37.584792] el0t_64_sync_handler+0xe8/0xf0 [ 37.588976] el0t_64_sync+0x1a0/0x1a4 [ 37.592639] ---[ end trace 56e22eec54676d75 ]--- On hibernating, pm core calls into related hooks in sequence like: .freeze .freeze_noirq .thaw_noirq .thaw With .thaw_noirq hook being absent, the clock will be disabled in a unbalanced call which results the warning above.
imx_uart_freeze() clk_prepare_enable() imx_uart_suspend_noirq() clk_disable() imx_uart_thaw clk_disable_unprepare() Adding the missing .thaw_noirq hook as imx_uart_resume_noirq() will have the call sequence corrected as below and thus fix the warning. imx_uart_freeze() clk_prepare_enable() imx_uart_suspend_noirq() clk_disable() imx_uart_resume_noirq() clk_enable() imx_uart_thaw clk_disable_unprepare() (CVE-2022-49841)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-49841
https://ubuntu.com/security/CVE-2022-49841

Solution
There is no known solution at this time.
Risk Factor
Low
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.4 (CVSS2#AV:L/AC:H/Au:S/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
2.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-49841

Plugin Information
Published: 2025/08/12, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
265146 - Linux Distros Unpatched Vulnerability : CVE-2022-50280
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- pnode: terminate at peers of source The propagate_mnt() function handles mount propagation when creating mounts and propagates the source mount tree @source_mnt to all applicable nodes of the destination propagation mount tree headed by @dest_mnt. Unfortunately it contains a bug where it fails to terminate at peers of @source_mnt when looking up copies of the source mount that become masters for copies of the source mount tree mounted on top of slaves in the destination propagation tree causing a NULL dereference.
Once the mechanics of the bug are understood it's easy to trigger. Because of unprivileged user namespaces it is available to unprivileged users. While fixing this bug we've gotten confused multiple times due to unclear terminology or missing concepts. So let's start this with some clarifications: * The terms master or peer denote a shared mount. A shared mount belongs to a peer group. * A peer group is a set of shared mounts that propagate to each other. They are identified by a peer group id. The peer group id is available in @shared_mnt->mnt_group_id. Shared mounts within the same peer group have the same peer group id. The peers in a peer group can be reached via @shared_mnt->mnt_share. * The terms slave mount or dependent mount denote a mount that receives propagation from a peer in a peer group. IOW, shared mounts may have slave mounts and slave mounts have shared mounts as their master. Slave mounts of a given peer in a peer group are listed on that peers slave list available at @shared_mnt->mnt_slave_list. * The term master mount denotes a mount in a peer group. IOW, it denotes a shared mount or a peer mount in a peer group. The term master mount - or master for short - is mostly used when talking in the context of slave mounts that receive propagation from a master mount. A master mount of a slave identifies the closest peer group a slave mount receives propagation from. The master mount of a slave can be identified via @slave_mount->mnt_master. Different slaves may point to different masters in the same peer group. * Multiple peers in a peer group can have non-empty ->mnt_slave_lists. Non-empty ->mnt_slave_lists of peers don't intersect. Consequently, to ensure all slave mounts of a peer group are visited the
->mnt_slave_lists of all peers in a peer group have to be walked. * Slave mounts point to a peer in the closest peer group they receive propagation from via @slave_mnt->mnt_master (see above). Together with these peers they form a propagation group (see below). The closest peer group can thus be identified through the peer group id @slave_mnt->mnt_master->mnt_group_id of the peer/master that a slave mount receives propagation from. * A shared-slave mount is a slave mount to a peer group pg1 while also a peer in another peer group pg2. IOW, a peer group may receive propagation from another peer group. If a peer group pg1 is a slave to another peer group pg2 then all peers in peer group pg1 point to the same peer in peer group pg2 via ->mnt_master. IOW, all peers in peer group pg1 appear on the same ->mnt_slave_list.
IOW, they cannot be slaves to different peer groups. * A pure slave mount is a slave mount that is a slave to a peer group but is not a peer in another peer group. * A propagation group denotes the set of mounts consisting of a single peer group pg1 and all slave mounts and shared-slave mounts that point to a peer in that peer group via ->mnt_master. IOW, all slave mounts such that @slave_mnt->mnt_master->mnt_group_id is equal to @shared_mnt->mnt_group_id. The concept of a propagation group makes it easier to talk about a single propagation level in a propagation tree. For example, in propagate_mnt() the immediate peers of @dest_mnt and all slaves of @dest_mnt's peer group form a propagation group pr ---truncated--- (CVE-2022-50280)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2022-50280
https://ubuntu.com/security/CVE-2022-50280

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.7 (CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L)
CVSS v3.0 Temporal Score
3.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.2 (CVSS2#AV:A/AC:M/Au:S/C:N/I:N/A:C)
CVSS v2.0 Temporal Score
4.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2022-50280

Plugin Information
Published: 2025/09/17, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
226246 - Linux Distros Unpatched Vulnerability : CVE-2023-1513
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak. (CVE-2023-1513)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-1513
https://ubuntu.com/security/CVE-2023-1513

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
3.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.0001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-1513

Plugin Information
Published: 2025/03/05, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269429 - Linux Distros Unpatched Vulnerability : CVE-2023-53597
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cifs: fix mid leak during reconnection after timeout threshold When the number of responses with status of STATUS_IO_TIMEOUT exceeds a specified threshold (NUM_STATUS_IO_TIMEOUT), we reconnect the connection. But we do not return the mid, or the credits returned for the mid, or reduce the number of in-flight requests.
This bug could result in the server->in_flight count to go bad, and also cause a leak in the mids. This change moves the check to a few lines below where the response is decrypted, even of the response is read from the transform header. This way, the code for returning the mids can be reused. Also, the cifs_reconnect was reconnecting just the transport connection before. In case of multi-channel, this may not be what we want to do after several timeouts. Changed that to reconnect the session and the tree too.
Also renamed NUM_STATUS_IO_TIMEOUT to a more appropriate name MAX_STATUS_IO_TIMEOUT. (CVE-2023-53597)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-53597
https://security-tracker.debian.org/tracker/CVE-2023-53597
https://ubuntu.com/security/CVE-2023-53597

Solution
There is no known solution at this time.
Risk Factor
Low
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-53597

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279930 - Linux Distros Unpatched Vulnerability : CVE-2023-54074
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- net/mlx5e: Use correct encap attribute during invalidation With introduction of post action infrastructure most of the users of encap attribute had been modified in order to obtain the correct attribute by calling mlx5e_tc_get_encap_attr() helper instead of assuming encap action is always on default attribute. However, the cited commit didn't modify mlx5e_invalidate_encap() which prevents it from destroying correct modify header action which leads to a warning [0]. Fix the issue by using correct attribute. [0]: Feb 21 09:47:35 c-237-177-40-045 kernel: WARNING: CPU: 17 PID: 654 at drivers/net/ethernet/mellanox/mlx5/core/en_tc.c:684 mlx5e_tc_attach_mod_hdr+0x1cc/0x230 [mlx5_core] Feb 21 09:47:35 c-237-177-40-045 kernel: RIP:
0010:mlx5e_tc_attach_mod_hdr+0x1cc/0x230 [mlx5_core] Feb 21 09:47:35 c-237-177-40-045 kernel: Call Trace:
Feb 21 09:47:35 c-237-177-40-045 kernel: <TASK> Feb 21 09:47:35 c-237-177-40-045 kernel:
mlx5e_tc_fib_event_work+0x8e3/0x1f60 [mlx5_core] Feb 21 09:47:35 c-237-177-40-045 kernel: ? mlx5e_take_all_encap_flows+0xe0/0xe0 [mlx5_core] Feb 21 09:47:35 c-237-177-40-045 kernel: ? lock_downgrade+0x6d0/0x6d0 Feb 21 09:47:35 c-237-177-40-045 kernel: ? lockdep_hardirqs_on_prepare+0x273/0x3f0 Feb 21 09:47:35 c-237-177-40-045 kernel: ? lockdep_hardirqs_on_prepare+0x273/0x3f0 Feb 21 09:47:35 c-237-177-40-045 kernel:
process_one_work+0x7c2/0x1310 Feb 21 09:47:35 c-237-177-40-045 kernel: ? lockdep_hardirqs_on_prepare+0x3f0/0x3f0 Feb 21 09:47:35 c-237-177-40-045 kernel: ? pwq_dec_nr_in_flight+0x230/0x230 Feb 21 09:47:35 c-237-177-40-045 kernel: ? rwlock_bug.part.0+0x90/0x90 Feb 21 09:47:35 c-237-177-40-045 kernel: worker_thread+0x59d/0xec0 Feb 21 09:47:35 c-237-177-40-045 kernel: ? __kthread_parkme+0xd9/0x1d0 (CVE-2023-54074)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54074
https://ubuntu.com/security/CVE-2023-54074

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
3.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.9
EPSS Score
0.0002
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54074

Plugin Information
Published: 2025/12/25, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279720 - Linux Distros Unpatched Vulnerability : CVE-2023-54137
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- vfio/type1: fix cap_migration information leak Fix an information leak where an uninitialized hole in struct vfio_iommu_type1_info_cap_migration on the stack is exposed to userspace. The definition of struct vfio_iommu_type1_info_cap_migration contains a hole as shown in this pahole(1) output: struct vfio_iommu_type1_info_cap_migration { struct vfio_info_cap_header header; /* 0 8 */ __u32 flags; /* 8 4 */ /* XXX 4 bytes hole, try to pack */ __u64 pgsize_bitmap; /* 16 8 */ __u64 max_dirty_bitmap_size; /* 24 8
*/ /* size: 32, cachelines: 1, members: 4 */ /* sum members: 28, holes: 1, sum holes: 4 */ /* last cacheline: 32 bytes */ }; The cap_mig variable is filled in without initializing the hole: static int vfio_iommu_migration_build_caps(struct vfio_iommu *iommu, struct vfio_info_cap *caps) { struct vfio_iommu_type1_info_cap_migration cap_mig; cap_mig.header.id = VFIO_IOMMU_TYPE1_INFO_CAP_MIGRATION;
cap_mig.header.version = 1; cap_mig.flags = 0; /* support minimum pgsize */ cap_mig.pgsize_bitmap = (size_t)1 << __ffs(iommu->pgsize_bitmap); cap_mig.max_dirty_bitmap_size = DIRTY_BITMAP_SIZE_MAX; return vfio_info_add_capability(caps, &cap_mig.header, sizeof(cap_mig)); } The structure is then copied to a temporary location on the heap. At this point it's already too late and ioctl(VFIO_IOMMU_GET_INFO) copies it to userspace later: int vfio_info_add_capability(struct vfio_info_cap *caps, struct vfio_info_cap_header *cap, size_t size) { struct vfio_info_cap_header *header; header = vfio_info_cap_add(caps, size, cap->id, cap->version); if (IS_ERR(header)) return PTR_ERR(header);
memcpy(header + 1, cap + 1, size - sizeof(*header)); return 0; } This issue was found by code inspection.
(CVE-2023-54137)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54137
https://ubuntu.com/security/CVE-2023-54137

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
3.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.9
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54137

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
279809 - Linux Distros Unpatched Vulnerability : CVE-2023-54145
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log It's trivial for user to trigger verifier log line truncated warning, as verifier has a fixed-sized buffer of 1024 bytes (as of now), and there are at least two pieces of user-provided information that can be output through this buffer, and both can be arbitrarily sized by user: - BTF names; - BTF.ext source code lines strings. Verifier log buffer should be properly sized for typical verifier state output. But it's sort-of expected that this buffer won't be long enough in some circumstances. So let's drop the check. In any case code will work correctly, at worst truncating a part of a single line output. (CVE-2023-54145)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2023-54145
https://security-tracker.debian.org/tracker/CVE-2023-54145
https://ubuntu.com/security/CVE-2023-54145

Solution
There is no known solution at this time.
Risk Factor
Low
VPR Score
6.7
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2023-54145

Plugin Information
Published: 2025/12/24, Modified: 2025/12/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
260239 - Linux Distros Unpatched Vulnerability : CVE-2024-0217
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted. As a result, some memory access could occur on memory regions that were previously freed. Once freed, a memory region can be reused for other allocations and any previously stored data in this memory region is considered lost. (CVE-2024-0217)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-0217
https://ubuntu.com/security/CVE-2024-0217

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0005
CVSS v2.0 Base Score
4.4 (CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-0217

Plugin Information
Published: 2025/09/02, Modified: 2025/10/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- PackageKit
- PackageKit-command-not-found
- PackageKit-glib
- PackageKit-gstreamer-plugin
- PackageKit-gtk3-module
227747 - Linux Distros Unpatched Vulnerability : CVE-2024-11053
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password. (CVE-2024-11053)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-11053
https://ubuntu.com/security/CVE-2024-11053

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.4 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
3.1 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
2.4
EPSS Score
0.0009
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-11053

Plugin Information
Published: 2025/03/05, Modified: 2025/09/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- curl
- libcurl
249752 - Linux Distros Unpatched Vulnerability : CVE-2024-21000
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges).
Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data. (CVE-2024-21000)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-21000
https://ubuntu.com/security/CVE-2024-21000

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.8 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
3.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.5
EPSS Score
0.0016
CVSS v2.0 Base Score
5.5 (CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-21000

Plugin Information
Published: 2025/08/15, Modified: 2025/10/28
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- mysql-common
- mysql-errmsg
228026 - Linux Distros Unpatched Vulnerability : CVE-2024-29508
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure (observable in a constructed BaseFont name) in the function pdf_base_font_alloc. (CVE-2024-29508)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-29508

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
2.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.0004
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-29508

Plugin Information
Published: 2025/03/05, Modified: 2025/08/20
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- ghostscript
- ghostscript-tools-fonts
- ghostscript-tools-printing
- libgs
228503 - Linux Distros Unpatched Vulnerability : CVE-2024-43167
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs has no further information about the claim, and suggests that affected Red Hat customers refer to available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A NULL pointer dereference flaw was found in the ub_ctx_set_fwd function in Unbound. This issue could allow an attacker who can invoke specific sequences of API calls to cause a segmentation fault. When certain API functions such as ub_ctx_set_fwd and ub_ctx_resolvconf are called in a particular order, the program attempts to read from a NULL pointer, leading to a crash. This issue can result in a denial of service by causing the application to terminate unexpectedly. (CVE-2024-43167)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-43167

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
2.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
2.5 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
2.2
EPSS Score
0.0019
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-43167

Plugin Information
Published: 2025/03/05, Modified: 2025/09/04
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- unbound-libs
249436 - Linux Distros Unpatched Vulnerability : CVE-2024-46794
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix data leak in mmio_read() The mmio_read() function makes a TDVMCALL to retrieve MMIO data for an address from the VMM. Sean noticed that mmio_read() unintentionally exposes the value of an initialized variable (val) on the stack to the VMM. This variable is only needed as an output value. It did not need to be passed to the VMM in the first place. Do not send the original value of *val to the VMM. [ dhansen: clarify what 'val' is used for. ] (CVE-2024-46794)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-46794
https://ubuntu.com/security/CVE-2024-46794

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
2.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
2.2
EPSS Score
0.0004
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.6 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-46794

Plugin Information
Published: 2025/08/15, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
231583 - Linux Distros Unpatched Vulnerability : CVE-2024-50211
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- udf: refactor inode_bmap() to handle error Refactor inode_bmap() to handle error since udf_next_aext() can return error now. On situations like ftruncate, udf_extend_file() can now detect errors and bail out early without resorting to checking for particular offsets and assuming internal behavior of these functions.
(CVE-2024-50211)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-50211
https://security-tracker.debian.org/tracker/CVE-2024-50211
https://ubuntu.com/security/CVE-2024-50211

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.0003
CVSS v2.0 Base Score
6.6 (CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C)
CVSS v2.0 Temporal Score
5.6 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-50211

Plugin Information
Published: 2025/03/06, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
253571 - Linux Distros Unpatched Vulnerability : CVE-2024-8244
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress. (CVE-2024-8244)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-8244
https://security-tracker.debian.org/tracker/CVE-2024-8244
https://ubuntu.com/security/CVE-2024-8244

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
3.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0003
CVSS v2.0 Base Score
5.9 (CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:C)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-8244

Plugin Information
Published: 2025/08/22, Modified: 2025/11/24
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- buildah
- conmon
- containernetworking-plugins
- go-srpm-macros
- podman
- rhc
232121 - Linux Distros Unpatched Vulnerability : CVE-2024-8612
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set in virtio_scsi_complete_req / virtio_blk_req_complete / virito_crypto_req_complete could be larger than the true size of the data which has been sent to guest. Once virtqueue_push() finally calls dma_memory_unmap to ummap the in_iov, it may call the address_space_write function to write back the data. Some uninitialized data may exist in the bounce.buffer, leading to an information leak.
(CVE-2024-8612)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-8612
https://security-tracker.debian.org/tracker/CVE-2024-8612
https://ubuntu.com/security/CVE-2024-8612

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
3.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
3.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.6
EPSS Score
0.0004
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2024-8612

Plugin Information
Published: 2025/03/06, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- qemu-guest-agent
260204 - Linux Distros Unpatched Vulnerability : CVE-2024-9506
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability. (CVE-2024-9506)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2024-9506

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.0025
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2024-9506

Plugin Information
Published: 2025/09/01, Modified: 2025/09/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
- gjs
- polkit
- polkit-libs
232131 - Linux Distros Unpatched Vulnerability : CVE-2025-1150
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. This vulnerability affects the function bfd_malloc of the file libbfd.c of the component ld. The manipulation leads to memory leak. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master. (CVE-2025-1150)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-1150
https://security-tracker.debian.org/tracker/CVE-2025-1150
https://ubuntu.com/security/CVE-2025-1150

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.0 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.0005
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-1150

Plugin Information
Published: 2025/03/06, Modified: 2025/10/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-13-binutils
- gcc-toolset-13-binutils-devel
- gcc-toolset-13-binutils-gold
- gcc-toolset-13-gdb
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
232176 - Linux Distros Unpatched Vulnerability : CVE-2025-1151
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was found in GNU Binutils 2.43. It has been rated as problematic. This issue affects the function xmemdup of the file xmemdup.c of the component ld. The manipulation leads to memory leak. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master. (CVE-2025-1151)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-1151
https://security-tracker.debian.org/tracker/CVE-2025-1151
https://ubuntu.com/security/CVE-2025-1151

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
3.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
2.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0005
CVSS v2.0 Base Score
2.6 (CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
2.2 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-1151

Plugin Information
Published: 2025/03/06, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-13-binutils
- gcc-toolset-13-binutils-devel
- gcc-toolset-13-binutils-gold
- gcc-toolset-13-gdb
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
232164 - Linux Distros Unpatched Vulnerability : CVE-2025-1152
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability classified as problematic has been found in GNU Binutils 2.43. Affected is the function xstrdup of the file xstrdup.c of the component ld. The manipulation leads to memory leak. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master. (CVE-2025-1152)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-1152
https://security-tracker.debian.org/tracker/CVE-2025-1152
https://ubuntu.com/security/CVE-2025-1152

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.5 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.0005
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-1152

Plugin Information
Published: 2025/03/06, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- binutils
- binutils-gold
- gcc-toolset-13-binutils
- gcc-toolset-13-binutils-devel
- gcc-toolset-13-binutils-gold
- gcc-toolset-13-gdb
- gcc-toolset-14-binutils
- gcc-toolset-14-binutils-devel
- gcc-toolset-14-binutils-gold
- gcc-toolset-14-binutils-gprofng
- gdb
- gdb-doc
- gdb-gdbserver
- gdb-headless
- gdb-minimal
271566 - Linux Distros Unpatched Vulnerability : CVE-2025-11731
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT <func:result>
elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes. While difficult to exploit, the flaw could lead to application instability or denial of service. (CVE-2025-11731)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-11731
https://security-tracker.debian.org/tracker/CVE-2025-11731
https://ubuntu.com/security/CVE-2025-11731

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
2.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-11731

Plugin Information
Published: 2025/10/27, Modified: 2025/11/26
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libxslt
281502 - Linux Distros Unpatched Vulnerability : CVE-2025-11961
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer. (CVE-2025-11961)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-11961
https://security-tracker.debian.org/tracker/CVE-2025-11961

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
1.9 (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
1.8 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.9
EPSS Score
0.0001
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-11961

Plugin Information
Published: 2025/12/31, Modified: 2026/01/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libpcap
259687 - Linux Distros Unpatched Vulnerability : CVE-2025-1371
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability has been found in GNU elfutils 0.192 and classified as problematic. This vulnerability affects the function handle_dynamic_symtab of the file readelf.c of the component eu-read. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is identified as b38e562a4c907e08171c76b8b2def8464d5a104a. It is recommended to apply a patch to fix this issue.
(CVE-2025-1371)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-1371
https://security-tracker.debian.org/tracker/CVE-2025-1371

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
2.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.6
EPSS Score
0.0002
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.2 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-1371

Plugin Information
Published: 2025/08/30, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- elfutils
- elfutils-default-yama-scope
- elfutils-devel
- elfutils-libelf
- elfutils-libelf-devel
- elfutils-libs
259296 - Linux Distros Unpatched Vulnerability : CVE-2025-1377
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is recommended to apply a patch to fix this issue. (CVE-2025-1377)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-1377
https://security-tracker.debian.org/tracker/CVE-2025-1377

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
2.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.4
EPSS Score
0.0003
CVSS v2.0 Base Score
1.7 (CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-1377

Plugin Information
Published: 2025/08/30, Modified: 2025/09/05
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- elfutils
- elfutils-default-yama-scope
- elfutils-devel
- elfutils-libelf
- elfutils-libelf-devel
- elfutils-libs
248292 - Linux Distros Unpatched Vulnerability : CVE-2025-1939
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This vulnerability affects Firefox < 136. (CVE-2025-1939)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-1939
https://ubuntu.com/security/CVE-2025-1939

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.9 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
3.4 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
3.3
EPSS Score
0.0001
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-1939

Plugin Information
Published: 2025/08/11, Modified: 2025/09/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
259906 - Linux Distros Unpatched Vulnerability : CVE-2025-23050
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- QLowEnergyController in Qt before 6.8.2 mishandles malformed Bluetooth ATT commands, leading to an out-of- bounds read (or division by zero). This is fixed in 5.15.19, 6.5.9, and 6.8.2. (CVE-2025-23050)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-23050
https://security-tracker.debian.org/tracker/CVE-2025-23050
https://ubuntu.com/security/CVE-2025-23050

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.1 (CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
2.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0001
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
5.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-23050

Plugin Information
Published: 2025/08/30, Modified: 2025/11/12
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- qt5-srpm-macros
260286 - Linux Distros Unpatched Vulnerability : CVE-2025-32421
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. This issue was patched in versions 15.1.6 and 14.2.24 by stripping the `x-now-route-matches` header from incoming requests. Applications hosted on Vercel's platform are not affected by this issue, as the platform does not cache responses based solely on `200 OK` status without explicit `cache-control` headers. Those who self-host Next.js deployments and are unable to upgrade immediately can mitigate this vulnerability by stripping the `x-now-route-matches` header from all incoming requests at the content development network and setting `cache-control: no-store` for all responses under risk. The maintainers of Next.js strongly recommend only caching responses with explicit cache-control headers. (CVE-2025-32421)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-32421

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
3.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
2.2
EPSS Score
0.0003
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-32421

Plugin Information
Published: 2025/09/02, Modified: 2025/09/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- dotnet-host
- firefox
- netstandard-targeting-pack-2.1
252198 - Linux Distros Unpatched Vulnerability : CVE-2025-32728
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding. (CVE-2025-32728)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-32728
https://ubuntu.com/security/CVE-2025-32728

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
3.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
3.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.4
EPSS Score
0.0001
References

CVE | CVE-2025-32728

Plugin Information
Published: 2025/08/19, Modified: 2025/11/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- openssh
- openssh-clients
- openssh-server
251937 - Linux Distros Unpatched Vulnerability : CVE-2025-3360
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function. (CVE-2025-3360)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-3360
https://ubuntu.com/security/CVE-2025-3360

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.2 (CVSS:3.0/E:U/RL:O/RC:C)
EPSS Score
0.0004
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v2.0 Temporal Score
4.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-3360

Plugin Information
Published: 2025/08/19, Modified: 2025/09/29
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- glib2
- glib2-devel
- librsvg2
- librsvg2-tools
252222 - Linux Distros Unpatched Vulnerability : CVE-2025-3416
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string. (CVE-2025-3416)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-3416
https://security-tracker.debian.org/tracker/CVE-2025-3416
https://ubuntu.com/security/CVE-2025-3416

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
3.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0005
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-3416

Plugin Information
Published: 2025/08/19, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
- gjs
- polkit
- polkit-libs
248560 - Linux Distros Unpatched Vulnerability : CVE-2025-37990
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() The function brcmf_usb_dl_writeimage() calls the function brcmf_usb_dl_cmd() but dose not check its return value. The 'state.state' and the 'state.bytes' are uninitialized if the function brcmf_usb_dl_cmd() fails. It is dangerous to use uninitialized variables in the conditions. Add error handling for brcmf_usb_dl_cmd() to jump to error handling path if the brcmf_usb_dl_cmd() fails and the 'state.state' and the 'state.bytes'
are uninitialized. Improve the error message to report more detailed error information. (CVE-2025-37990)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-37990
https://ubuntu.com/security/CVE-2025-37990

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
3.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-37990

Plugin Information
Published: 2025/08/12, Modified: 2025/12/15
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
261567 - Linux Distros Unpatched Vulnerability : CVE-2025-38680
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() The buffer length check before calling uvc_parse_format() only ensured that the buffer has at least 3 bytes (buflen > 2), buf the function accesses buffer[3], requiring at least 4 bytes. This can lead to an out-of-bounds read if the buffer has exactly 3 bytes. Fix it by checking that the buffer has at least 4 bytes in uvc_parse_format().
(CVE-2025-38680)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-38680
https://ubuntu.com/security/CVE-2025-38680

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
3.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.0003
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C)
CVSS v2.0 Temporal Score
4.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-38680

Plugin Information
Published: 2025/09/06, Modified: 2025/12/16
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
269656 - Linux Distros Unpatched Vulnerability : CVE-2025-39911
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path If request_irq() in i40e_vsi_request_irq_msix() fails in an iteration later than the first, the error path wants to free the IRQs requested so far. However, it uses the wrong dev_id argument for free_irq(), so it does not free the IRQs correctly and instead triggers the warning: Trying to free already-free IRQ 173 WARNING: CPU: 25 PID:
1091 at kernel/irq/manage.c:1829 __free_irq+0x192/0x2c0 Modules linked in: i40e(+) [...] CPU: 25 UID: 0 PID: 1091 Comm: NetworkManager Not tainted 6.17.0-rc1+ #1 PREEMPT(lazy) Hardware name: [...] RIP:
0010:__free_irq+0x192/0x2c0 [...] Call Trace: <TASK> free_irq+0x32/0x70 i40e_vsi_request_irq_msix.cold+0x63/0x8b [i40e] i40e_vsi_request_irq+0x79/0x80 [i40e] i40e_vsi_open+0x21f/0x2f0 [i40e] i40e_open+0x63/0x130 [i40e] __dev_open+0xfc/0x210
__dev_change_flags+0x1fc/0x240 netif_change_flags+0x27/0x70 do_setlink.isra.0+0x341/0xc70 rtnl_newlink+0x468/0x860 rtnetlink_rcv_msg+0x375/0x450 netlink_rcv_skb+0x5c/0x110 netlink_unicast+0x288/0x3c0 netlink_sendmsg+0x20d/0x430 ____sys_sendmsg+0x3a2/0x3d0
___sys_sendmsg+0x99/0xe0 __sys_sendmsg+0x8a/0xf0 do_syscall_64+0x82/0x2c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] </TASK> ---[ end trace 0000000000000000 ]--- Use the same dev_id for free_irq() as for request_irq(). I tested this with inserting code to fail intentionally.
(CVE-2025-39911)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-39911
https://security-tracker.debian.org/tracker/CVE-2025-39911
https://ubuntu.com/security/CVE-2025-39911

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-39911

Plugin Information
Published: 2025/10/08, Modified: 2025/10/27
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
278815 - Linux Distros Unpatched Vulnerability : CVE-2025-40353
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- arm64: mte: Do not warn if the page is already tagged in copy_highpage() The arm64 copy_highpage() assumes that the destination page is newly allocated and not MTE-tagged (PG_mte_tagged unset) and warns accordingly. However, following commit 060913999d7a (mm: migrate: support poisoned recover from migrate folio), folio_mc_copy() is called before __folio_migrate_mapping(). If the latter fails (-EAGAIN), the copy will be done again to the same destination page. Since copy_highpage() already set the PG_mte_tagged flag, this second copy will warn. Replace the WARN_ON_ONCE(page already tagged) in the arm64 copy_highpage() with a comment. (CVE-2025-40353)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-40353
https://ubuntu.com/security/CVE-2025-40353

Solution
There is no known solution at this time.
Risk Factor
Low
VPR Score
4.4
EPSS Score
0.0002
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-40353

Plugin Information
Published: 2025/12/16, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
253086 - Linux Distros Unpatched Vulnerability : CVE-2025-46653
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Formidable (aka node-formidable) 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not cryptographically secure. (Also, there is a scenario in which only the last two characters of a hexoid string need to be guessed, but this is not often relevant.) NOTE: this does not imply that, in a typical use case, attackers will be able to exploit any hexoid behavior to upload and execute their own content. (CVE-2025-46653)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-46653
https://security-tracker.debian.org/tracker/CVE-2025-46653
https://ubuntu.com/security/CVE-2025-46653

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
3.1 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
2.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-46653

Plugin Information
Published: 2025/08/21, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- firefox
- gjs
- polkit
- polkit-libs
250491 - Linux Distros Unpatched Vulnerability : CVE-2025-48708
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- gs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the # case. A created PDF document includes its password in cleartext. (CVE-2025-48708)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-48708
https://security-tracker.debian.org/tracker/CVE-2025-48708

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
2.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.0001
CVSS v2.0 Base Score
5.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-48708

Plugin Information
Published: 2025/08/18, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- ghostscript
- ghostscript-tools-fonts
- ghostscript-tools-printing
- libgs
245950 - Linux Distros Unpatched Vulnerability : CVE-2025-4878
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption. (CVE-2025-4878)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-4878
https://security-tracker.debian.org/tracker/CVE-2025-4878

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.6 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
3.3 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.5
EPSS Score
0.0001
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-4878

Plugin Information
Published: 2025/08/08, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libssh
- libssh-config
260206 - Linux Distros Unpatched Vulnerability : CVE-2025-49005
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0 to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0, a cache poisoning vulnerability was found. The issue allowed page requests for HTML content to return a React Server Component (RSC) payload instead under certain conditions. When deployed to Vercel, this would only impact the browser cache, and would not lead to the CDN being poisoned. When self-hosted and deployed externally, this could lead to cache poisoning if the CDN does not properly distinguish between RSC / HTML in the cache keys. This issue has been resolved in Next.js 15.3.3. (CVE-2025-49005)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-49005

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVSS v3.0 Temporal Score
3.4 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
2.2
EPSS Score
0.0003
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v2.0 Temporal Score
3.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-49005

Plugin Information
Published: 2025/09/01, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- dotnet-host
- firefox
- netstandard-targeting-pack-2.1
253301 - Linux Distros Unpatched Vulnerability : CVE-2025-50422
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- Cairo through 1.18.4, as used in Poppler through 25.08.0, has an unscaled->face == NULL assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c. (CVE-2025-50422)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-50422
https://security-tracker.debian.org/tracker/CVE-2025-50422
https://ubuntu.com/security/CVE-2025-50422

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
2.9 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
2.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0004
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-50422

Plugin Information
Published: 2025/08/21, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- poppler
- poppler-cpp
- poppler-glib
- poppler-utils
258242 - Linux Distros Unpatched Vulnerability : CVE-2025-52968
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie store, although this would add substantial complexity, and would not be considered a desirable or expected behavior by all users.) NOTE: this is disputed because integrations of xdg-open typically do not provide information about whether the xdg-open command and arguments were manually entered by a user, or whether they were the result of a navigation from content in an untrusted origin. (CVE-2025-52968)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-52968
https://security-tracker.debian.org/tracker/CVE-2025-52968
https://ubuntu.com/security/CVE-2025-52968

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
2.7 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
2.5 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.6
EPSS Score
0.0001
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-52968

Plugin Information
Published: 2025/08/30, Modified: 2025/10/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- xdg-utils
275251 - Linux Distros Unpatched Vulnerability : CVE-2025-57812
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. In CUPS-Filters versions up to and including 1.28.17 and libscupsfilters versions 2.0.0 through 2.1.1, CUPS-Filters's `imagetoraster` filter has an out of bounds read/write vulnerability in the processing of TIFF image files. While the pixel buffer is allocated with the number of pixels times a pre-calculated bytes-per-pixel value, the function which processes these pixels is called with a size of the number of pixels times 3. When suitable inputs are passed, the bytes- per-pixel value can be set to 1 and bytes outside of the buffer bounds get processed. In order to trigger the bug, an attacker must issue a print job with a crafted TIFF file, and pass appropriate print job options to control the bytes-per-pixel value of the output format. They must choose a printer configuration under which the `imagetoraster` filter or its C-function equivalent `cfFilterImageToRaster()` gets invoked. The vulnerability exists in both CUPS-Filters 1.x and the successor library libcupsfilters (CUPS-Filters 2.x). In CUPS-Filters 2.x, the vulnerable function is `_cfImageReadTIFF() in libcupsfilters`. When this function is invoked as part of `cfFilterImageToRaster()`, the caller passes a look-up-table during whose processing the out of bounds memory access happens. In CUPS-Filters 1.x, the equivalent functions are all found in the cups-filters repository, which is not split into subprojects yet, and the vulnerable code is in `_cupsImageReadTIFF()`, which is called through `cupsImageOpen()` from the `imagetoraster` tool. A patch is available in commit b69dfacec7f176281782e2f7ac44f04bf9633cfa. (CVE-2025-57812)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-57812
https://security-tracker.debian.org/tracker/CVE-2025-57812

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.7 (CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
3.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.3
EPSS Score
0.0002
CVSS v2.0 Base Score
6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
5.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-57812

Plugin Information
Published: 2025/11/12, Modified: 2025/12/11
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- cups-filters
- cups-filters-libs
247785 - Linux Distros Unpatched Vulnerability : CVE-2025-6170
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files.
When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections. (CVE-2025-6170)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-6170

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
2.5 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
2.2 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
2.2
EPSS Score
0.0001
CVSS v2.0 Base Score
9.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:C/A:P)
CVSS v2.0 Temporal Score
6.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-6170

Plugin Information
Published: 2025/08/10, Modified: 2025/09/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libxml2
- libxml2-devel
- python3-libxml2
260207 - Linux Distros Unpatched Vulnerability : CVE-2025-6199
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in the GIF parser of GdkPixbuf's LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output size to the full buffer length rather than the actual number of written bytes. This logic error results in uninitialized sections of the buffer being included in the output, potentially leaking arbitrary memory contents in the processed image.
(CVE-2025-6199)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-6199

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
2.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
1.4
EPSS Score
0.0001
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:OF/RC:C)
References

CVE | CVE-2025-6199

Plugin Information
Published: 2025/09/01, Modified: 2025/09/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- gdk-pixbuf2
- gdk-pixbuf2-devel
- gdk-pixbuf2-modules
- librsvg2
- librsvg2-tools
276478 - Linux Distros Unpatched Vulnerability : CVE-2025-64524
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In versions 2.0.1 and prior, a heap-buffer-overflow vulnerability in the rastertopclx filter causes the program to crash with a segmentation fault when processing maliciously crafted input data. This issue can be exploited to trigger memory corruption, potentially leading to arbitrary code execution. This issue has been patched via commit 956283c.
(CVE-2025-64524)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-64524
https://security-tracker.debian.org/tracker/CVE-2025-64524

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
4.4
EPSS Score
0.0001
CVSS v2.0 Base Score
8.3 (CVSS2#AV:N/AC:M/Au:N/C:C/I:P/A:P)
CVSS v2.0 Temporal Score
7.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-64524

Plugin Information
Published: 2025/11/21, Modified: 2025/12/03
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- cups-filters
- cups-filters-libs
276983 - Linux Distros Unpatched Vulnerability : CVE-2025-66382
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time. (CVE-2025-66382)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-66382
https://security-tracker.debian.org/tracker/CVE-2025-66382
https://ubuntu.com/security/CVE-2025-66382

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
2.9 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
2.7 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
3.6
EPSS Score
0.0001
CVSS v2.0 Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
3.7 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-66382

Plugin Information
Published: 2025/12/01, Modified: 2025/12/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- expat
- firefox
278905 - Linux Distros Unpatched Vulnerability : CVE-2025-68178
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- blk-cgroup: fix possible deadlock while configuring policy Following deadlock can be triggered easily by lockdep: WARNING: possible circular locking dependency detected 6.17.0-rc3-00124-ga12c2658ced0 #1665 Not tainted ------------------------------------------------------ check/1334 is trying to acquire lock:
ff1100011d9d0678 (&q->sysfs_lock){+.+.}-{4:4}, at: blk_unregister_queue+0x53/0x180 but task is already holding lock: ff1100011d9d00e0 (&q->q_usage_counter(queue)#3){++++}-{0:0}, at: del_gendisk+0xba/0x110 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&q->q_usage_counter(queue)#3){++++}-{0:0}: blk_queue_enter+0x40b/0x470 blkg_conf_prep+0x7b/0x3c0 tg_set_limit+0x10a/0x3e0 cgroup_file_write+0xc6/0x420 kernfs_fop_write_iter+0x189/0x280 vfs_write+0x256/0x490 ksys_write+0x83/0x190 __x64_sys_write+0x21/0x30 x64_sys_call+0x4608/0x4630 do_syscall_64+0xdb/0x6b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e -> #1 (&q->rq_qos_mutex){+.+.}-{4:4}:
__mutex_lock+0xd8/0xf50 mutex_lock_nested+0x2b/0x40 wbt_init+0x17e/0x280 wbt_enable_default+0xe9/0x140 blk_register_queue+0x1da/0x2e0 __add_disk+0x38c/0x5d0 add_disk_fwnode+0x89/0x250 device_add_disk+0x18/0x30 virtblk_probe+0x13a3/0x1800 virtio_dev_probe+0x389/0x610 really_probe+0x136/0x620
__driver_probe_device+0xb3/0x230 driver_probe_device+0x2f/0xe0 __driver_attach+0x158/0x250 bus_for_each_dev+0xa9/0x130 driver_attach+0x26/0x40 bus_add_driver+0x178/0x3d0 driver_register+0x7d/0x1c0
__register_virtio_driver+0x2c/0x60 virtio_blk_init+0x6f/0xe0 do_one_initcall+0x94/0x540 kernel_init_freeable+0x56a/0x7b0 kernel_init+0x2b/0x270 ret_from_fork+0x268/0x4c0 ret_from_fork_asm+0x1a/0x30 -> #0 (&q->sysfs_lock){+.+.}-{4:4}: __lock_acquire+0x1835/0x2940 lock_acquire+0xf9/0x450 __mutex_lock+0xd8/0xf50 mutex_lock_nested+0x2b/0x40 blk_unregister_queue+0x53/0x180 __del_gendisk+0x226/0x690 del_gendisk+0xba/0x110 sd_remove+0x49/0xb0 [sd_mod] device_remove+0x87/0xb0 device_release_driver_internal+0x11e/0x230 device_release_driver+0x1a/0x30 bus_remove_device+0x14d/0x220 device_del+0x1e1/0x5a0
__scsi_remove_device+0x1ff/0x2f0 scsi_remove_device+0x37/0x60 sdev_store_delete+0x77/0x100 dev_attr_store+0x1f/0x40 sysfs_kf_write+0x65/0x90 kernfs_fop_write_iter+0x189/0x280 vfs_write+0x256/0x490 ksys_write+0x83/0x190 __x64_sys_write+0x21/0x30 x64_sys_call+0x4608/0x4630 do_syscall_64+0xdb/0x6b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e other info that might help us debug this: Chain exists of:
&q->sysfs_lock --> &q->rq_qos_mutex --> &q->q_usage_counter(queue)#3 Possible unsafe locking scenario:
CPU0 CPU1 ---- ---- lock(&q->q_usage_counter(queue)#3); lock(&q->rq_qos_mutex);
lock(&q->q_usage_counter(queue)#3); lock(&q->sysfs_lock); Root cause is that queue_usage_counter is grabbed with rq_qos_mutex held in blkg_conf_prep(), while queue should be freezed before rq_qos_mutex from other context. The blk_queue_enter() from blkg_conf_prep() is used to protect against policy deactivation, which is already protected with blkcg_mutex, hence convert blk_queue_enter() to blkcg_mutex to fix this problem. Meanwhile, consider that blkcg_mutex is held after queue is freezed from policy deactivation, also convert blkg_alloc() to use GFP_NOIO. (CVE-2025-68178)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-68178
https://security-tracker.debian.org/tracker/CVE-2025-68178
https://ubuntu.com/security/CVE-2025-68178

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.9
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.1 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-68178

Plugin Information
Published: 2025/12/16, Modified: 2026/01/02
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- bpftool
- kernel
- kernel-core
- kernel-devel
- kernel-headers
- kernel-modules
- kernel-modules-core
- kernel-tools
- kernel-tools-libs
- python3-perf
264494 - Linux Distros Unpatched Vulnerability : CVE-2025-8277
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability. (CVE-2025-8277)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-8277
https://security-tracker.debian.org/tracker/CVE-2025-8277
https://ubuntu.com/security/CVE-2025-8277

Solution
There is no known solution at this time.
Risk Factor
Medium
CVSS v3.0 Base Score
3.1 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
2.9 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0004
CVSS v2.0 Base Score
5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
4.3 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-8277

Plugin Information
Published: 2025/09/10, Modified: 2025/12/01
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libssh
- libssh-config
251254 - Linux Distros Unpatched Vulnerability : CVE-2025-8283
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be used as the hostname for the container itself, as the podman's search domain is not added anymore the container is using the host's resolv.conf, and the DNS resolver will try to look into the search domains contained on it. If one of the domains contain a name with the same hostname as the running container, the connection will forward to unexpected external servers. (CVE-2025-8283)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-8283
https://ubuntu.com/security/CVE-2025-8283

Solution
There is no known solution at this time.
Risk Factor
High
CVSS v3.0 Base Score
3.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVSS v3.0 Temporal Score
3.4 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
1.4
EPSS Score
0.0003
CVSS v2.0 Base Score
7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
6.4 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-8283

Plugin Information
Published: 2025/08/18, Modified: 2025/10/14
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- netavark
260125 - Linux Distros Unpatched Vulnerability : CVE-2025-9165
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A flaw has been found in LibTIFF 4.7.0. This affects the function
_TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. There is ongoing doubt regarding the real existence of this vulnerability. This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is best practice to apply a patch to resolve this issue. A researcher disputes the security impact of this issue, because this is a memory leak on a command line tool that is about to exit anyway. In the reply the project maintainer declares this issue as a simple 'bug' when leaving the command line tool and (...) not a security issue at all. (CVE-2025-9165)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-9165
https://security-tracker.debian.org/tracker/CVE-2025-9165
https://ubuntu.com/security/CVE-2025-9165

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v4.0 Base Score
2.0 (CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
2.5 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
2.4 (CVSS:3.0/E:P/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.0001
CVSS v2.0 Base Score
1.9 (CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.7 (CVSS2#E:POC/RL:U/RC:C)
References

CVE | CVE-2025-9165

Plugin Information
Published: 2025/08/31, Modified: 2025/11/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- libtiff
- libtiff-devel
260186 - Linux Distros Unpatched Vulnerability : CVE-2025-9301
-
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.
Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.
- A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue. (CVE-2025-9301)
Note that Nessus relies on the presence of the package as reported by the vendor.
See Also

https://access.redhat.com/security/cve/cve-2025-9301
https://security-tracker.debian.org/tracker/CVE-2025-9301
https://ubuntu.com/security/CVE-2025-9301

Solution
There is no known solution at this time.
Risk Factor
Low
CVSS v4.0 Base Score
4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
CVSS v3.0 Base Score
3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
CVSS v3.0 Temporal Score
3.1 (CVSS:3.0/E:U/RL:U/RC:C)
VPR Score
2.2
EPSS Score
0.0001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v2.0 Temporal Score
1.8 (CVSS2#E:U/RL:U/RC:C)
References

CVE | CVE-2025-9301

Plugin Information
Published: 2025/09/01, Modified: 2025/10/22
Plugin Output

## tcp/0

The following packages were identified as being present on the remote host:
- cmake
- cmake-data
- cmake-filesystem
- cmake-rpm-macros
278995 - RHEL 9 : openssh (RHSA-2025:23480)
-
Synopsis
The remote Red Hat host is missing one or more security updates for openssh.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23480 advisory.
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.
Security Fix(es):
* openssh: OpenSSH: Control characters in usernames can lead to code execution via ProxyCommand (CVE-2025-61984)
* openssh: OpenSSH: Null character in ssh:// URI can lead to code execution via ProxyCommand (CVE-2025-61985)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://access.redhat.com/security/updates/classification/#moderate
https://bugzilla.redhat.com/show_bug.cgi?id=2401960
https://bugzilla.redhat.com/show_bug.cgi?id=2401962
http://www.nessus.org/u?7da4aae0
https://access.redhat.com/errata/RHSA-2025:23480

Solution
Update the RHEL openssh package based on the guidance in RHSA-2025:23480.
Risk Factor
Medium
CVSS v3.0 Base Score
3.6 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
3.3 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
4.0
EPSS Score
0.0001
CVSS v2.0 Base Score
4.3 (CVSS2#AV:L/AC:L/Au:S/C:P/I:P/A:P)
CVSS v2.0 Temporal Score
3.4 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2025-61984
CVE | CVE-2025-61985
XREF | RHSA:2025:23480
XREF | CWE:158
XREF | CWE:159

Plugin Information
Published: 2025/12/17, Modified: 2025/12/17
Plugin Output

## tcp/0

Remote package installed : openssh-8.7p1-43.el9
Should be : openssh-8.7p1-47.el9_7
Remote package installed : openssh-clients-8.7p1-43.el9
Should be : openssh-clients-8.7p1-47.el9_7
Remote package installed : openssh-server-8.7p1-43.el9
Should be : openssh-server-8.7p1-47.el9_7
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
274721 - RHEL 9 : shadow-utils (RHSA-2025:20559)
-
Synopsis
The remote Red Hat host is missing a security update for shadow-utils.
Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:20559 advisory.
The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts.
Security Fix(es):
* shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise (CVE-2024-56433)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?b6159d8b
https://access.redhat.com/security/updates/classification/#low
https://bugzilla.redhat.com/show_bug.cgi?id=2334165
https://issues.redhat.com/browse/RHEL-105945
https://issues.redhat.com/browse/RHEL-70844
https://issues.redhat.com/browse/RHEL-72940
http://www.nessus.org/u?c314e0c2
https://access.redhat.com/errata/RHSA-2025:20559

Solution
Update the RHEL shadow-utils package based on the guidance in RHSA-2025:20559.
Risk Factor
Low
CVSS v3.0 Base Score
3.6 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
3.3 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
3.3
EPSS Score
0.0389
CVSS v2.0 Base Score
2.4 (CVSS2#AV:L/AC:H/Au:S/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
1.9 (CVSS2#E:POC/RL:OF/RC:C)
References

CVE | CVE-2024-56433
XREF | RHSA:2025:20559
XREF | CWE:1188

Plugin Information
Published: 2025/11/11, Modified: 2025/11/11
Plugin Output

## tcp/0

Remote package installed : shadow-utils-4.9-9.el9
Should be : shadow-utils-4.9-15.el9
Remote package installed : shadow-utils-subid-4.9-9.el9
Should be : shadow-utils-subid-4.9-15.el9
NOTE: The vulnerability information above was derived by checking the
package versions of the affected packages from this advisory. This
scan would normally rely on checking for the presence of specific
installed and enabled Red Hat repositories, but either no repositories
were found in the repository directory, the repository files were empty
or missing, or the scan account lacked permissions to access them.
Please ensure that the repository files are populated and the scanning
account has permissions to examine the files in /etc/yum.repos.d/.
34098 - BIOS Info (SSH)
-
Synopsis
BIOS info could be read.
Description
Using SMBIOS and UEFI, it was possible to get BIOS info.
Solution
N/A
Risk Factor
None
Plugin Information
Published: 2008/09/08, Modified: 2024/02/12
Plugin Output

## tcp/0

Version : VMW201.00V.21805430.B64.2305221830
Vendor : VMware, Inc.
Release Date : 05/22/2023
UUID : 712d0842-19f3-9502-b559-a116633667b1
Secure boot : enabled

##

39520 - Backported Security Patch Detection (SSH)
-
Synopsis
Security patches are backported.
Description
Security patches may have been 'backported' to the remote SSH server without changing its version number.
Banner-based checks have been disabled to avoid false positives.
Note that this test is informational only and does not denote any security problem.
See Also

https://access.redhat.com/security/updates/backporting/?sc_cid=3093

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2009/06/25, Modified: 2015/07/07
Plugin Output

## tcp/22/ssh

Local checks have been enabled.

##

45590 - Common Platform Enumeration (CPE)
-
Synopsis
It was possible to enumerate CPE names that matched on the remote system.
Description
By using information obtained from a Nessus scan, this plugin reports CPE (Common Platform Enumeration) matches for various hardware and software products found on a host.
Note that if an official CPE is not available for the product, this plugin computes the best possible CPE based on the information available from the scan.
See Also

http://cpe.mitre.org/
https://nvd.nist.gov/products/cpe

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2010/04/21, Modified: 2025/09/29
Plugin Output

## tcp/0

The remote operating system matched the following CPE :
cpe:/o:redhat:enterprise_linux:9.5::~~~~x86_64~ -> Red Hat Enterprise Linux
Following application CPE's matched on the remote system :
cpe:/a:eclipse:jetty:9.4.44 -> Eclipse Jetty
cpe:/a:exiv2:exiv2:0.27.5 -> Exiv2
cpe:/a:exiv2:libexiv2:0.27.5
cpe:/a:gnome:gnome-shell:40.10 -> GNOME gnome-shell -
cpe:/a:gnupg:libgcrypt:1.10.0 -> GnuPG Libgcrypt
cpe:/a:haxx:curl:7.76.1 -> Haxx Curl
cpe:/a:haxx:libcurl:7.76.1 -> Haxx libcurl
cpe:/a:libreswan:libreswan:4.15 -> libreswan
cpe:/a:mysql:mysql:8.4.5-1 -> MySQL MySQL
cpe:/a:openbsd:openssh:8.7 -> OpenBSD OpenSSH
cpe:/a:openssl:openssl:1.1.1k -> OpenSSL Project OpenSSL
cpe:/a:openssl:openssl:3.2.2 -> OpenSSL Project OpenSSL
cpe:/a:openssl:openssl:3.2.6 -> OpenSSL Project OpenSSL
cpe:/a:oracle:mysql:9.3.0 -> Oracle MySQL -
cpe:/a:oracle:openjdk:11.0.24.8 -> Oracle OpenJDK -
cpe:/a:oracle:openjdk:17.0.12.7 -> Oracle OpenJDK -
cpe:/a:oracle:openjdk:21.0.4.7 -> Oracle OpenJDK -
cpe:/a:oracle:openjdk:24.0.1.9 -> Oracle OpenJDK -
cpe:/a:oracle:openjdk:8.0.422.05 -> Oracle OpenJDK -
cpe:/a:pivotal_software:redis:6.2.17 -> Piviotal Software Redis
cpe:/a:podman_project:podman:5.2.2 -> Podman Project Podman
cpe:/a:smartbedded:meteobridge_firmware
cpe:/a:tukaani:xz:5.2.2 -> Tukaani XZ
cpe:/a:tukaani:xz:5.2.5 -> Tukaani XZ
cpe:/a:vim:vim:8.2 -> Vim
cpe:/a:vmware:open_vm_tools:12.4.0 -> VMware Open VM Tools
x-cpe:/a:java:jre:11.0.24.8
x-cpe:/a:java:jre:17.0.12.7
x-cpe:/a:java:jre:21.0.4.7
x-cpe:/a:java:jre:24.0.1.9
x-cpe:/a:java:jre:8.0.422.05
182774 - Curl Installed (Linux / Unix)
-
Synopsis
Curl is installed on the remote Linux / Unix host.
Description
Curl (also known as curl and cURL) is installed on the remote Linux / Unix host.
Additional information:
- More paths will be searched and the timeout for the search will be increased if 'Perform thorough tests' setting is enabled.
- The plugin timeout can be set to a custom value other than the plugin's default of 30 minutes via the 'timeout.182774' scanner setting in Nessus 8.15.1 or later.
Please see https://docs.tenable.com/nessus/Content/SettingsAdvanced.htm#Custom for more information.
See Also

https://curl.se/

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2023/10/09, Modified: 2025/12/18
Plugin Output

## tcp/0

Path : /usr/bin/curl
Version : 7.76.1
Associated Package : curl-7.76.1-31.el9
Managed by OS : True
84239 - Debugging Log Report
-
Synopsis
This plugin gathers the logs written by other plugins and reports them.
Description
Logs generated by other plugins are reported by this plugin. Plugin debugging must be enabled in the policy in order for this plugin to run.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2015/06/17, Modified: 2025/07/14
Plugin Output

## tcp/0

Plugin debug log(s) have been attached.
55472 - Device Hostname
-
Synopsis
It was possible to determine the remote system hostname.
Description
This plugin reports a device's hostname collected via SSH or WMI.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2011/06/30, Modified: 2025/12/15
Plugin Output

## tcp/0

Hostname : LKPOMSHAPRI
LKPOMSHAPRI (hostname command)
54615 - Device Type
-
Synopsis
It is possible to guess the remote device type.
Description
Based on the remote operating system, it is possible to determine what the remote system type is (eg: a printer, router, general-purpose computer, etc).
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2011/05/23, Modified: 2025/03/12
Plugin Output

## tcp/0

Remote device type : general-purpose
Confidence level : 100
194915 - Eclipse Jetty Web Server Detection
-
Synopsis
The Eclipse Jetty web server was detected on the remote host.
Description
The Eclipse Jetty web server was detected on the remote host.
See Also

https://eclipse.dev/jetty/

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2024/05/02, Modified: 2025/11/03
Plugin Output

## tcp/0

URL : http://172.17.100.54:8080/
Version : 9.4.44
Source : Server: Jetty(9.4.44.v20210927)
25203 - Enumerate IPv4 Interfaces via SSH
-
Synopsis
Nessus was able to enumerate the IPv4 interfaces on the remote host.
Description
Nessus was able to enumerate the network interfaces configured with IPv4 addresses by connecting to the remote host via SSH using the supplied credentials.
Solution
Disable any unused IPv4 interfaces.
Risk Factor
None
Plugin Information
Published: 2007/05/11, Modified: 2025/09/24
Plugin Output

## tcp/0

The following IPv4 addresses are set on the remote host :
- 172.17.100.54 (on interface ens33)
- 10.20.50.54 (on interface ens35)
- 10.113.99.54 (on interface ens36)
- 10.195.58.154 (on interface ens37)
- 10.222.207.108 (on interface ens38)
- 127.0.0.1 (on interface lo)
25202 - Enumerate IPv6 Interfaces via SSH
-
Synopsis
Nessus was able to enumerate the IPv6 interfaces on the remote host.
Description
Nessus was able to enumerate the network interfaces configured with IPv6 addresses by connecting to the remote host via SSH using the supplied credentials.
Solution
Disable IPv6 if you are not actually using it. Otherwise, disable any unused IPv6 interfaces.
Risk Factor
None
Plugin Information
Published: 2007/05/11, Modified: 2025/09/24
Plugin Output

## tcp/0

The following IPv6 interfaces are set on the remote host :
- fe80::ad3d:49f1:2e17:4ba3 (on interface ens36)
- fe80::7da5:6377:3ee0:3163 (on interface ens37)
- fe80::a13:f404:268a:de3e (on interface ens38)
33276 - Enumerate MAC Addresses via SSH
-
Synopsis
Nessus was able to enumerate MAC addresses on the remote host.
Description
Nessus was able to enumerate MAC addresses by connecting to the remote host via SSH with the supplied credentials.
Solution
Disable any unused interfaces.
Risk Factor
None
Plugin Information
Published: 2008/06/30, Modified: 2022/12/20
Plugin Output

## tcp/0

The following MAC addresses exist on the remote host :
- 00:50:56:88:97:f8 (interface ens35)
- 00:50:56:88:99:e7 (interface ens37)
- 00:50:56:88:e1:fb (interface ens38)
- 00:50:56:88:16:57 (interface ens33)
- 00:50:56:88:c8:7a (interface ens36)
170170 - Enumerate the Network Interface configuration via SSH
-
Synopsis
Nessus was able to parse the Network Interface data on the remote host.
Description
Nessus was able to parse the Network Interface data on the remote host.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2023/01/19, Modified: 2025/02/11
Plugin Output

## tcp/0

ens33:
MAC : 00:50:56:88:16:57
IPv4:
- Address : 172.17.100.54
Netmask : 255.255.255.0
Broadcast : 172.17.100.255
lo:
IPv4:
- Address : 127.0.0.1
Netmask : 255.0.0.0
ens37:
MAC : 00:50:56:88:99:e7
IPv4:
- Address : 10.195.58.154
Netmask : 255.255.255.192
Broadcast : 10.195.58.191
IPv6:
- Address : fe80::7da5:6377:3ee0:3163
Prefixlen : 64
Scope : link
ScopeID : 0x20
ens38:
MAC : 00:50:56:88:e1:fb
IPv4:
- Address : 10.222.207.108
Netmask : 255.255.255.240
Broadcast : 10.222.207.111
IPv6:
- Address : fe80::a13:f404:268a:de3e
Prefixlen : 64
Scope : link
ScopeID : 0x20
ens36:
MAC : 00:50:56:88:c8:7a
IPv4:
- Address : 10.113.99.54
Netmask : 255.255.255.0
Broadcast : 10.113.99.255
IPv6:
- Address : fe80::ad3d:49f1:2e17:4ba3
Prefixlen : 64
Scope : link
ScopeID : 0x20
ens35:
MAC : 00:50:56:88:97:f8
IPv4:
- Address : 10.20.50.54
Netmask : 255.255.255.0
Broadcast : 10.20.50.255
179200 - Enumerate the Network Routing configuration via SSH
-
Synopsis
Nessus was able to retrieve network routing information from the remote host.
Description
Nessus was able to retrieve network routing information the remote host.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2023/08/02, Modified: 2023/08/02
Plugin Output

## tcp/0

Gateway Routes:
ens33:
ipv4_gateways:
172.17.100.10:
subnets:
- 0.0.0.0/0
ens36:
ipv4_gateways:
10.113.99.1:
subnets:
- 10.1.101.0/24
- 10.255.0.0/16
- 137.0.0.0/8
- 138.0.0.0/8
ens37:
ipv4_gateways:
10.195.58.129:
subnets:
- 192.168.13.0/24
- 192.168.61.0/24
- 192.168.63.0/24
- 192.168.71.0/24
- 192.168.73.0/24
ens38:
ipv4_gateways:
10.222.207.97:
subnets:
- 172.18.0.0/16
- 172.19.0.0/16
- 172.28.0.0/16
Interface Routes:
ens33:
ipv4_subnets:
- 172.17.100.0/24
ens35:
ipv4_subnets:
- 10.20.50.0/24
ens36:
ipv4_subnets:
- 10.113.99.0/24
ipv6_subnets:
- fe80::/64
ens37:
ipv4_subnets:
- 10.195.58.128/26
ipv6_subnets:
- fe80::/64
ens38:
ipv4_subnets:
- 10.222.207.96/28
ipv6_subnets:
- fe80::/64
168980 - Enumerate the PATH Variables
-
Synopsis
Enumerates the PATH variable of the current scan user.
Description
Enumerates the PATH variables of the current scan user.
Solution
Ensure that directories listed here are in line with corporate policy.
Risk Factor
None
Plugin Information
Published: 2022/12/21, Modified: 2025/12/18
Plugin Output

## tcp/0

Nessus has enumerated the path of the current scan user :
/root/.local/bin
/root/bin
/usr/share/Modules/bin
/usr/local/sbin
/usr/local/bin
/usr/sbin
/usr/bin
/root/.dotnet/tools
117530 - Errors in nessusd.dump
-
Synopsis
This plugin parses information from the nessusd.dump log file and reports on errors.
Description
This plugin parses information from the nessusd.dump log file and reports on errors.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2018/09/17, Modified: 2024/11/04
Plugin Output

## tcp/0

The nessusd.dump log file contained errors from the following plugins:
- onvif_detect.nbin reported 3 errors
- react_CVE-2025-55182.nbin reported 1 error
35716 - Ethernet Card Manufacturer Detection
-
Synopsis
The manufacturer can be identified from the Ethernet OUI.
Description
Each ethernet MAC address starts with a 24-bit Organizationally Unique Identifier (OUI). These OUIs are registered by IEEE.
See Also

https://standards.ieee.org/faqs/regauth.html
http://www.nessus.org/u?794673b4

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2009/02/19, Modified: 2020/05/13
Plugin Output

## tcp/0

The following card manufacturers were identified :
00:50:56:88:97:F8 : VMware, Inc.
00:50:56:88:99:E7 : VMware, Inc.
00:50:56:88:E1:FB : VMware, Inc.
00:50:56:88:16:57 : VMware, Inc.
00:50:56:88:C8:7A : VMware, Inc.
86420 - Ethernet MAC Addresses
-
Synopsis
This plugin gathers MAC addresses from various sources and consolidates them into a list.
Description
This plugin gathers MAC addresses discovered from both remote probing of the host (e.g. SNMP and Netbios) and from running local checks (e.g. ifconfig). It then consolidates the MAC addresses into a single, unique, and uniform list.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2015/10/16, Modified: 2025/06/10
Plugin Output

## tcp/0

The following is a consolidated list of detected MAC addresses:
- 00:50:56:88:97:F8
- 00:50:56:88:99:E7
- 00:50:56:88:E1:FB
- 00:50:56:88:16:57
- 00:50:56:88:C8:7A
204827 - Exiv2 Installed (Linux / Unix)
-
Synopsis
Exiv2 is installed on the remote Linux / Unix host.
Description
Exiv2 is installed on the remote Linux / Unix host.
Additional information:
- More paths will be searched and the timeout for the search will be increased if 'Perform thorough tests' setting is enabled.
- The plugin timeout can be set to a custom value other than the plugin's default of 30 minutes via the 'timeout.204827' scanner setting in Nessus 8.15.1 or later.
Please see https://docs.tenable.com/nessus/Content/SettingsAdvanced.htm#Custom for more information.
See Also

https://exiv2.org/

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2024/07/29, Modified: 2025/12/18
Plugin Output

## tcp/0

Path : /usr/bin/exiv2
Version : 0.27.5
Associated Package : exiv2-0.27.5-2.el9
Managed by OS : True

##

43111 - HTTP Methods Allowed (per directory)
-
Synopsis
This plugin determines which HTTP methods are allowed on various CGI directories.
Description
By calling the OPTIONS method, it is possible to determine which HTTP methods are allowed on each directory.
The following HTTP methods are considered insecure:
PUT, DELETE, CONNECT, TRACE, HEAD
Many frameworks and languages treat 'HEAD' as a 'GET' request, albeit one without any body in the response. If a security constraint was set on 'GET' requests such that only 'authenticatedUsers' could access GET requests for a particular servlet or resource, it would be bypassed for the 'HEAD' version. This allowed unauthorized blind submission of any privileged GET request.
As this list may be incomplete, the plugin also tests - if 'Thorough tests' are enabled or 'Enable web applications tests' is set to 'yes'
in the scan policy - various known HTTP methods on each directory and considers them as unsupported if it receives a response code of 400, 403, 405, or 501.
Note that the plugin output is only informational and does not necessarily indicate the presence of any security vulnerabilities.
See Also

http://www.nessus.org/u?d9c03a9a
http://www.nessus.org/u?b019cbdb
https://www.owasp.org/index.php/Test_HTTP_Methods_(OTG-CONFIG-006)

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2009/12/10, Modified: 2022/04/11
Plugin Output

## tcp/8080/www

Based on the response to an OPTIONS request :
- HTTP methods HEAD OPTIONS TRACE GET are allowed on :
/
10107 - HTTP Server Type and Version
-
Synopsis
A web server is running on the remote host.
Description
This plugin attempts to determine the type and the version of the remote web server.
Solution
n/a
Risk Factor
None
References

XREF | IAVT:0001-T-0931

Plugin Information
Published: 2000/01/04, Modified: 2020/10/30
Plugin Output

## tcp/8080/www

The remote web server type is :
Jetty(9.4.44.v20210927)
24260 - HyperText Transfer Protocol (HTTP) Information
-
Synopsis
Some information about the remote HTTP configuration can be extracted.
Description
This test gives some information about the remote HTTP protocol - the version used, whether HTTP Keep-Alive is enabled, etc...
This test is informational only and does not denote any security problem.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/01/30, Modified: 2024/02/26
Plugin Output

## tcp/8080/www

Response Code : HTTP/1.1 404 Not Found
Protocol version : HTTP/1.1
HTTP/2 TLS Support: No
HTTP/2 Cleartext Support: No
SSL : no
Keep-Alive : no
Options allowed : GET, HEAD, TRACE, OPTIONS
Headers :
Cache-Control: must-revalidate,no-cache,no-store
Content-Type: text/html;charset=utf-8
Content-Length: 505
Server: Jetty(9.4.44.v20210927)
Response Body :

##

171410 - IP Assignment Method Detection
-
Synopsis
Enumerates the IP address assignment method(static/dynamic).
Description
Enumerates the IP address assignment method(static/dynamic).
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2023/02/14, Modified: 2025/12/15
Plugin Output

## tcp/0

+ lo
+ IPv4
- Address : 127.0.0.1
Assign Method : static
+ ens33
+ IPv4
- Address : 172.17.100.54
Assign Method : static
+ ens35
+ IPv4
- Address : 10.20.50.54
Assign Method : static
+ ens36
+ IPv4
- Address : 10.113.99.54
Assign Method : static
+ IPv6
- Address : fe80::ad3d:49f1:2e17:4ba3
Assign Method : static
+ ens37
+ IPv4
- Address : 10.195.58.154
Assign Method : static
+ IPv6
- Address : fe80::7da5:6377:3ee0:3163
Assign Method : static
+ ens38
+ IPv4
- Address : 10.222.207.108
Assign Method : static
+ IPv6
- Address : fe80::a13:f404:268a:de3e
Assign Method : static
147817 - Java Detection and Identification (Linux / Unix)
-
Synopsis
Java is installed on the remote Linux / Unix host.
Description
One or more instances of Java are installed on the remote Linux / Unix host. This may include private JREs bundled with the Java Development Kit (JDK).
Notes:
- This plugin attempts to detect Oracle and non-Oracle JRE instances such as Zulu Java, Amazon Corretto, AdoptOpenJDK, IBM Java, etc
- To discover instances of JRE that are not in PATH, or installed via a package manager, 'Perform thorough tests' setting must be enabled.
See Also

https://en.wikipedia.org/wiki/Java_(software_platform)

Solution
n/a
Risk Factor
None
References

XREF | IAVT:0001-T-0690

Plugin Information
Published: 2021/03/16, Modified: 2025/12/18
Plugin Output

## tcp/0

Nessus detected 7 installs of Java:
Path : /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.422.b05-2.el9.x86_64/
Version : 8.0.422.05
Application : OpenJDK Java
Binary Location : /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.422.b05-2.el9.x86_64/bin/java
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.422.b05-2.el9.x86_64/jre/bin/java
Details : This Java install appears to be OpenJDK due to the install directory
name (high confidence).
Detection Method : "locate" utility
Managed by OS : True
Path : /usr/lib/jvm/java-11-openjdk-11.0.24.0.8-2.el9.x86_64/
Version : 11.0.24.8
Application : OpenJDK Java
Binary Location : /usr/lib/jvm/java-11-openjdk-11.0.24.0.8-2.el9.x86_64/bin/java
Details : This Java install appears to be OpenJDK due to the install directory
name (high confidence).
Note - This install was discovered by checking the currently
running processes on the system, and it may not always
be reported in future scans.
Detection Method : "locate" utility
Managed by OS : True
Path : /usr/lib/jvm/java-17-openjdk-17.0.12.0.7-2.el9.x86_64/
Version : 17.0.12.7
Application : OpenJDK Java
Binary Location : /usr/lib/jvm/java-17-openjdk-17.0.12.0.7-2.el9.x86_64/bin/java
Details : This Java install appears to be OpenJDK due to the install directory
name (high confidence).
Detection Method : "locate" utility
Managed by OS : True
Path : /usr/lib/jvm/java-21-openjdk-21.0.4.0.7-1.el9.x86_64/
Version : 21.0.4.7
Application : OpenJDK Java
Binary Location : /usr/lib/jvm/java-21-openjdk-21.0.4.0.7-1.el9.x86_64/bin/java
Details : This Java install appears to be OpenJDK due to the install directory
name (high confidence).
Detection Method : "locate" utility
Managed by OS : True
Path : /usr/lib/jvm/java-24-openjdk-fastdebug/
Version : 24.0.1.9
Application : OpenJDK Java
Binary Location : /usr/lib/jvm/java-24-openjdk-fastdebug/bin/java
Details : This Java install appears to be OpenJDK due to the install directory
name (high confidence).
Detection Method : "locate" utility
Managed by OS : True
Path : /usr/lib/jvm/java-24-openjdk-slowdebug/
Version : 24.0.1.9
Application : OpenJDK Java
Binary Location : /usr/lib/jvm/java-24-openjdk-slowdebug/bin/java
Details : This Java install appears to be OpenJDK due to the install directory
name (high confidence).
Detection Method : "locate" utility
Managed by OS : True
Path : /usr/lib/jvm/java-24-openjdk/
Version : 24.0.1.9
Application : OpenJDK Java
Binary Location : /usr/lib/jvm/java-24-openjdk/bin/java
Details : This Java install appears to be OpenJDK due to evidence in the
binary (high confidence).
Detection Method : "locate" utility
Managed by OS : True
151883 - Libgcrypt Installed (Linux/UNIX)
-
Synopsis
Libgcrypt is installed on this host.
Description
Libgcrypt, a cryptography library, was found on the remote host.
See Also

https://gnupg.org/download/index.html

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2021/07/21, Modified: 2025/12/18
Plugin Output

## tcp/0

Nessus detected 2 installs of Libgcrypt:
Path : /usr/lib64/libgcrypt.so.20
Version : 1.10.0
Path : /usr/lib64/libgcrypt.so.20.4.0
Version : 1.10.0
193876 - Libreswan Installed (Linux / Unix)
-
Synopsis
Libreswan is installed on the remote Linux / Unix host.
Description
Libreswan, a free software implementation of the most widely supported and standardized VPN protocol using 'IPsec' and the Internet Key Exchange ('IKE'), is installed on the remote Linux / Unix host.
See Also

https://libreswan.org/

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2024/04/25, Modified: 2025/12/18
Plugin Output

## tcp/0

Path : libreswan-4.15-3.el9 (via package manager)
Version : 4.15
Managed by OS : True
157358 - Linux Mounted Devices
-
Synopsis
Use system commands to obtain the list of mounted devices on the target machine at scan time.
Description
Report the mounted devices information on the target machine at scan time using the following commands.
/bin/df -h /bin/lsblk /bin/mount -l
This plugin only reports on the tools available on the system and omits any tool that did not return information when the command was ran.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2022/02/03, Modified: 2023/11/27
Plugin Output

## tcp/0

$ df -h
Filesystem Size Used Avail Use% Mounted on
devtmpfs 4.0M 0 4.0M 0% /dev
tmpfs 32G 116K 32G 1% /dev/shm
tmpfs 13G 18M 13G 1% /run
efivarfs 256K 58K 194K 23% /sys/firmware/efi/efivars
/dev/mapper/rhel-root 522G 216G 306G 42% /
/dev/sda2 7.4G 386M 7.1G 6% /boot
/dev/sda1 7.5G 7.1M 7.5G 1% /boot/efi
tmpfs 6.3G 52K 6.3G 1% /run/user/42
tmpfs 6.3G 232K 6.3G 1% /run/user/1000
tmpfs 6.3G 36K 6.3G 1% /run/user/0
$ lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
sda 8:0 0 700G 0 disk
├─sda1 8:1 0 7.5G 0 part /boot/efi
├─sda2 8:2 0 7.5G 0 part /boot
└─sda3 8:3 0 642.6G 0 part
├─rhel-root 253:0 0 521.5G 0 lvm /
└─rhel-swap 253:1 0 121.1G 0 lvm [SWAP]
sr0 11:0 1 1024M 0 rom
$ mount -l
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
devtmpfs on /dev type devtmpfs (rw,nosuid,size=4096k,nr_inodes=8156694,mode=755,inode64)
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev,inode64)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)
tmpfs on /run type tmpfs (rw,nosuid,nodev,size=13063868k,nr_inodes=819200,mode=755,inode64)
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate,memory_recursiveprot)
pstore on /sys/fs/pstore type pstore (rw,nosuid,nodev,noexec,relatime)
efivarfs on /sys/firmware/efi/efivars type efivarfs (rw,nosuid,nodev,noexec,relatime)
bpf on /sys/fs/bpf type bpf (rw,nosuid,nodev,noexec,relatime,mode=700)
/dev/mapper/rhel-root on / type xfs (rw,relatime,attr2,inode64,logbufs=8,logbsize=32k,noquota)
systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=29,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=22853)
hugetlbfs on /dev/hugepages type hugetlbfs (rw,relatime,pagesize=2M)
mqueue on /dev/mqueue type mqueue (rw,nosuid,nodev,noexec,relatime)
debugfs on /sys/kernel/debug type debugfs (rw,nosuid,nodev,noexec,relatime)
tracefs on /sys/kernel/tracing type tracefs (rw,nosuid,nodev,noexec,relatime)
fusectl on /sys/fs/fuse/connections type fusectl (rw,nosuid,nodev,noexec,relatime)
configfs on /sys/kernel/config type configfs (rw,nosuid,nodev,noexec,relatime)
none on /run/credentials/systemd-sysctl.service type ramfs (ro,nosuid,nodev,noexec,relatime,mode=700)
none on /run/credentials/systemd-tmpfiles-setup-dev.service type ramfs (ro,nosuid,nodev,noexec,relatime,mode=700)
/dev/sda2 on /boot type xfs (rw,relatime,attr2,inode64,logbufs=8,logbsize=32k,noquota)
/dev/sda1 on /boot/efi type vfat (rw,relatime,fmask=0077,dmask=0077,codepage=437,iocharset=ascii,shortname=winnt,errors=remount-ro)
none on /run/credentials/systemd-tmpfiles-setup.service type ramfs (ro,nosuid,nodev,noexec,relatime,mode=700)
tmpfs on /run/user/42 type tmpfs (rw,nosuid,nodev,relatime,size=6531932k,nr_inodes=1632983,mode=700,uid=42,gid=42,inode64)
tmpfs on /run/user/1000 type tmpfs (rw,nosuid,nodev,relatime,size=6531932k,nr_inodes=1632983,mode=700,uid=1000,gid=1000,inode64)
gvfsd-fuse on /run/user/1000/gvfs type fuse.gvfsd-fuse (rw,nosuid,nodev,relatime,user_id=1000,group_id=1000)
portal on /run/user/1000/doc type fuse.portal (rw,nosuid,nodev,relatime,user_id=1000,group_id=1000)
xrdp-chansrv on /home/odin/thinclient_drives type fuse (rw,nosuid,nodev,relatime,user_id=1000,group_id=1000)
tmpfs on /run/user/0 type tmpfs (rw,nosuid,nodev,relatime,size=6531932k,nr_inodes=1632983,mode=700,inode64)
193143 - Linux Time Zone Information
-
Synopsis
Nessus was able to collect and report time zone information from the remote host.
Description
Nessus was able to collect time zone information from the remote Linux host.
Solution
None
Risk Factor
None
Plugin Information
Published: 2024/04/10, Modified: 2024/04/10
Plugin Output

## tcp/0

Via date: IST +0530
Via timedatectl: Time zone: Asia/Kolkata (IST, +0530)
Via /etc/localtime: IST-5:30
95928 - Linux User List Enumeration
-
Synopsis
Nessus was able to enumerate local users and groups on the remote Linux host.
Description
Using the supplied credentials, Nessus was able to enumerate the local users and groups on the remote Linux host.
Solution
None
Risk Factor
None
Plugin Information
Published: 2016/12/19, Modified: 2025/03/26
Plugin Output

## tcp/0

-----------[ User Accounts ]-----------
User : odin
Home folder : /home/odin
Start script : /bin/bash
Groups : odin
wheel
----------[ System Accounts ]----------
User : root
Home folder : /root
Start script : /bin/bash
Groups : root
User : bin
Home folder : /bin
Start script : /sbin/nologin
Groups : bin
User : daemon
Home folder : /sbin
Start script : /sbin/nologin
Groups : daemon
User : adm
Home folder : /var/adm
Start script : /sbin/nologin
Groups : adm
User : lp
Home folder : /var/spool/lpd
Start script : /sbin/nologin
Groups : lp
User : sync
Home folder : /sbin
Start script : /bin/sync
Groups : root
User : shutdown
Home folder : /sbin
Start script : /sbin/shutdown
Groups : root
User : halt
Home folder : /sbin
Start script : /sbin/halt
Groups : root
User : mail
Home folder : /var/spool/mail
Start script : /sbin/nologin
Groups : mail
User : operator
Home folder : /root
Start script : /sbin/nologin
Groups : root
User : games
Home folder : /usr/games
Start script : /sbin/nologin
Groups : users
User : ftp
Home folder : /var/ftp
Start script : /sbin/nologin
Groups : ftp
User : nobody
Home folder : /
Start script : /sbin/nologin
Groups : nobody
User : tss
Home folder : /
Start script : /usr/sbin/nologin
Groups : tss
User : systemd-coredump
Home folder : /
Start script : /sbin/nologin
Groups : systemd-coredump
User : dbus
Home folder : /
Start script : /sbin/nologin
Groups : dbus
User : polkitd
Home folder : /
Start script : /sbin/nologin
Groups : polkitd
User : avahi
Home folder : /var/run/avahi-daemon
Start script : /sbin/nologin
Groups : avahi
User : colord
Home folder : /var/lib/colord
Start script : /sbin/nologin
Groups : colord
User : rtkit
Home folder : /
Start script : /sbin/nologin
Groups : rtkit
User : pipewire
Home folder : /run/pipewire
Start script : /usr/sbin/nologin
Groups : pipewire
User : clevis
Home folder : /var/cache/clevis
Start script : /usr/sbin/nologin
Groups : tss
clevis
User : sssd
Home folder : /
Start script : /sbin/nologin
Groups : sssd
User : geoclue
Home folder : /var/lib/geoclue
Start script : /sbin/nologin
Groups : geoclue
User : flatpak
Home folder : /
Start script : /sbin/nologin
Groups : flatpak
User : setroubleshoot
Home folder : /var/lib/setroubleshoot
Start script : /usr/sbin/nologin
Groups : setroubleshoot
User : libstoragemgmt
Home folder : /
Start script : /usr/sbin/nologin
Groups : libstoragemgmt
User : gdm
Home folder : /var/lib/gdm
Start script : /sbin/nologin
Groups : gdm
User : cockpit-wsinstance
Home folder : /nonexisting
Start script : /sbin/nologin
Groups : cockpit-wsinstance
User : gnome-initial-setup
Home folder : /run/gnome-initial-setup/
Start script : /sbin/nologin
Groups : gnome-initial-setup
User : sshd
Home folder : /usr/share/empty.sshd
Start script : /usr/sbin/nologin
Groups : sshd
User : chrony
Home folder : /var/lib/chrony
Start script : /sbin/nologin
Groups : chrony
User : dnsmasq
Home folder : /var/lib/dnsmasq
Start script : /usr/sbin/nologin
Groups : dnsmasq
User : tcpdump
Home folder : /
Start script : /sbin/nologin
Groups : tcpdump
User : dovecot
Home folder : /usr/libexec/dovecot
Start script : /sbin/nologin
Groups : dovecot
User : dovenull
Home folder : /usr/libexec/dovecot
Start script : /sbin/nologin
Groups : dovenull
User : mysql
Home folder : /var/lib/mysql
Start script : /sbin/nologin
Groups : mysql
User : xrdp
Home folder : /run/xrdp
Start script : /sbin/nologin
Groups : xrdp
User : stapunpriv
Home folder : /var/lib/stapunpriv
Start script : /sbin/nologin
Groups : stapunpriv
User : pesign
Home folder : /run/pesign
Start script : /sbin/nologin
Groups : pesign
User : unbound
Home folder : /etc/unbound
Start script : /sbin/nologin
Groups : unbound
User : site24x7-agent
Home folder : /opt/site24x7/monagent
Start script : /sbin/nologin
Groups : site24x7-group
----------[ Domain Accounts ]----------
45433 - Memory Information (via DMI)
-
Synopsis
Information about the remote system's memory devices can be read.
Description
Using the SMBIOS (aka DMI) interface, it was possible to retrieve information about the remote system's memory devices, such as the total amount of installed memory.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2010/04/06, Modified: 2018/03/29
Plugin Output

## tcp/0

Total memory : 65536 MB
129468 - MySQL Server Installed (Linux)
-
Synopsis
MySQL Server is installed on the remote Linux host.
Description
MySQL Server is installed on the remote Linux host.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2019/09/30, Modified: 2025/04/18
Plugin Output

## tcp/0

Path : /usr/sbin/mysqld
Version : 8.4.5-1
19506 - Nessus Scan Information
-
Synopsis
This plugin displays information about the Nessus scan.
Description
This plugin displays, for each tested host, information about the scan itself :
- The version of the plugin set.
- The type of scanner (Nessus or Nessus Home).
- The version of the Nessus Engine.
- The port scanner(s) used.
- The port range scanned.
- The ping round trip time
- Whether credentialed or third-party patch management checks are possible.
- Whether the display of superseded patches is enabled
- The date of the scan.
- The duration of the scan.
- The number of hosts scanned in parallel.
- The number of checks done in parallel.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2005/08/26, Modified: 2025/10/29
Plugin Output

## tcp/0

Information about this scan :
Nessus version : 10.11.1
Nessus build : 20021
Plugin feed version : 202601041845
Scanner edition used : Nessus
Scanner OS : WINDOWS
Scanner distribution : win-x86-64
Scan type : Normal
Scan name : linux 5
Scan policy used : linux
Scanner IP : 172.17.100.38
Port scanner(s) : netstat
Port range : 1-65535
Ping RTT : Unavailable
Thorough tests : no
Experimental tests : no
Scan for Unpatched Vulnerabilities : yes
Plugin debugging enabled : yes (at debugging level 4)
Paranoia level : 0
Report verbosity : 2
Safe checks : yes
Optimize the test : yes
Credentialed checks : yes, as 'root' via ssh
Attempt Least Privilege : no
Patch management checks : None
Display superseded patches : yes (supersedence plugin did not launch)
CGI scanning : disabled
Web application tests : disabled
Max hosts : 1
Max checks : 1
Recv timeout : 5
Backports : Detected
Allow post-scan editing : Yes
Nessus Plugin Signature Checking : Enabled
Audit File Signature Checking : Disabled
Scan Start Date : 2026/1/25 15:12 India Standard Time (UTC +05:30)
Scan duration : 4436 sec
Scan for malware : no
58651 - Netstat Active Connections
-
Synopsis
Active connections are enumerated via the 'netstat' command.
Description
This plugin runs 'netstat' on the remote machine to enumerate all active 'ESTABLISHED' or 'LISTENING' tcp/udp connections.
Note: The output for this plugin can be very long, and is not shown by default. To display it, enable verbose reporting in scan settings.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2012/04/10, Modified: 2021/06/29
Plugin Output

## tcp/0

Netstat output :
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:7777 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:6379 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:5910 0.0.0.0:* LISTEN
tcp 0 0 172.17.100.54:7013 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 172.17.100.54:45402 172.17.100.65:5050 ESTABLISHED
tcp 0 0 10.20.50.54:38712 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:38468 10.20.50.54:9094 ESTABLISHED
tcp 0 102 10.20.50.54:38246 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:40996 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:55240 10.20.50.68:1433 ESTABLISHED
tcp 24 0 10.20.50.54:34449 10.20.50.54:7777 ESTABLISHED
tcp 0 0 10.20.50.54:43220 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:56458 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:55238 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:38416 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:60420 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:38322 10.20.50.54:9094 ESTABLISHED
tcp 0 102 10.20.50.54:38994 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:56628 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:7777 10.20.50.54:34415 ESTABLISHED
tcp 0 0 10.20.50.54:40994 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:38874 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:56676 10.20.50.68:1433 ESTABLISHED
tcp 0 102 10.20.50.54:60040 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:41018 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:39040 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:56794 10.20.50.68:1433 ESTABLISHED
tcp 0 102 10.20.50.54:38946 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:43166 10.20.50.68:1433 ESTABLISHED
tcp 0 102 10.20.50.54:38922 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:57614 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:56644 10.20.50.68:1433 ESTABLISHED
tcp 0 0 172.17.100.54:7013 172.17.100.81:52172 ESTABLISHED
tcp 0 106 172.17.100.54:53346 172.17.100.65:5050 ESTABLISHED
tcp 0 0 172.17.100.54:44884 172.17.100.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:57212 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:48150 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:55264 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:57398 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:57340 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:57172 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:57616 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:43180 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:38266 10.20.50.54:9094 ESTABLISHED
tcp 0 102 10.20.50.54:39048 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:38680 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:53520 10.20.50.54:9094 ESTABLISHED
tcp 0 102 10.20.50.54:38282 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:38782 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:57178 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:7777 10.20.50.54:45703 ESTABLISHED
tcp 0 0 10.20.50.54:38844 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:56478 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:38774 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:55176 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:55214 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:56516 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:57304 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:40724 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:54348 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:38870 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:55226 10.20.50.68:1433 ESTABLISHED
tcp 0 0 172.17.100.54:7013 172.17.100.81:52080 ESTABLISHED
tcp 0 0 10.20.50.54:38328 10.20.50.54:9094 ESTABLISHED
tcp 0 0 172.17.100.54:45418 172.17.100.65:5050 ESTABLISHED
tcp 0 0 10.20.50.54:55252 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:40990 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:38378 10.20.50.54:9094 ESTABLISHED
tcp 0 100 172.17.100.54:45440 172.17.100.65:5050 ESTABLISHED
tcp 0 0 10.20.50.54:56472 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:56744 10.20.50.68:1433 ESTABLISHED
tcp 0 0 172.17.100.54:7013 172.17.100.54:48068 ESTABLISHED
tcp 0 0 10.20.50.54:40944 10.20.50.54:9094 ESTABLISHED
tcp 0 0 172.17.100.54:7013 172.17.100.53:50582 ESTABLISHED
tcp 0 0 10.20.50.54:38752 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:6379 10.20.50.55:36607 ESTABLISHED
tcp 0 0 10.20.50.54:51478 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:55216 10.20.50.68:1433 ESTABLISHED
tcp 0 0 172.17.100.54:58746 172.17.100.80:6383 ESTABLISHED
tcp 0 0 10.20.50.54:38700 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:43196 10.20.50.68:1433 ESTABLISHED
tcp 0 592 172.17.100.54:22 172.17.100.38:48882 ESTABLISHED
tcp 0 102 10.20.50.54:38986 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:34415 10.20.50.54:7777 ESTABLISHED
tcp 0 0 10.20.50.54:57598 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:56522 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:7777 10.20.50.54:45293 ESTABLISHED
tcp 0 0 10.20.50.54:38868 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:38834 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:56564 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:37852 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:56806 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:6379 10.20.50.54:44996 ESTABLISHED
tcp 0 102 10.20.50.54:53488 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:56292 10.20.50.54:9094 ESTABLISHED
tcp 0 100 172.17.100.54:53334 172.17.100.65:5050 ESTABLISHED
tcp 0 0 10.20.50.54:56470 10.20.50.54:7777 ESTABLISHED
tcp 0 102 10.20.50.54:39150 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:40960 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:40886 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:60434 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:55172 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:57174 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:38792 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:56698 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:38740 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:38442 10.20.50.54:9094 ESTABLISHED
tcp 0 0 172.17.100.54:45236 172.17.100.54:7013 ESTABLISHED
tcp 0 0 10.20.50.54:40982 10.20.50.54:9094 ESTABLISHED
tcp 0 0 172.17.100.54:7777 172.17.100.81:52168 ESTABLISHED
tcp 0 0 10.20.50.54:38852 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:48144 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:6379 10.20.50.54:49990 ESTABLISHED
tcp 0 0 172.17.100.54:7777 172.17.100.54:33174 ESTABLISHED
tcp 0 0 172.17.100.54:7777 223.178.81.93:14116 ESTABLISHED
tcp 0 0 172.17.100.54:40758 172.17.100.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:60770 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:45293 10.20.50.54:7777 ESTABLISHED
tcp 0 102 10.20.50.54:39114 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:56658 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:57628 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:38802 10.20.50.54:9094 ESTABLISHED
tcp 0 0 172.17.100.54:7013 172.17.100.54:45236 ESTABLISHED
tcp 0 0 10.20.50.54:40912 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:55156 10.20.50.68:1433 ESTABLISHED
tcp 0 0 172.17.100.54:7777 172.17.100.81:52178 ESTABLISHED
tcp 0 0 172.17.100.54:34438 172.17.100.54:7013 ESTABLISHED
tcp 0 0 10.20.50.54:52884 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:39092 10.20.50.54:9094 ESTABLISHED
tcp 0 102 10.20.50.54:38896 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:57192 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:38406 10.20.50.54:9094 ESTABLISHED
tcp 0 102 10.20.50.54:38240 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:57268 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:7777 10.20.50.54:56490 ESTABLISHED
tcp 0 0 10.20.50.54:38224 10.20.50.54:9094 ESTABLISHED
tcp 0 0 172.17.100.54:47274 172.17.100.54:7013 ESTABLISHED
tcp 0 0 10.20.50.54:42164 10.20.50.68:1433 ESTABLISHED
tcp 0 0 172.17.100.54:36710 172.17.100.65:5050 ESTABLISHED
tcp 2091 0 10.20.50.54:45703 10.20.50.54:7777 ESTABLISHED
tcp 0 0 10.20.50.54:56666 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:59466 10.20.50.54:6379 ESTABLISHED
tcp 0 0 10.20.50.54:57316 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:57322 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:56768 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:57290 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:41110 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:56754 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:60062 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:57356 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:45032 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:6379 10.20.50.54:59466 ESTABLISHED
tcp 0 0 10.20.50.54:40922 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:41038 10.20.50.54:9094 ESTABLISHED
tcp 0 102 10.20.50.54:54836 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:55204 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:38356 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:56692 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:38410 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:38474 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:56530 10.20.50.68:1433 ESTABLISHED
tcp 0 0 172.17.100.54:7013 172.17.100.54:47274 ESTABLISHED
tcp 0 0 10.20.50.54:57200 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:57182 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:56690 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:55180 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:44996 10.20.50.54:6379 ESTABLISHED
tcp 0 0 172.17.100.54:44476 172.17.100.54:7013 ESTABLISHED
tcp 0 0 10.20.50.54:40934 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:57330 10.20.50.68:1433 ESTABLISHED
tcp 0 0 172.17.100.54:48808 172.17.100.80:6383 ESTABLISHED
tcp 0 0 10.20.50.54:38214 10.20.50.54:9094 ESTABLISHED
tcp 0 0 172.17.100.54:58758 172.17.100.80:6383 ESTABLISHED
tcp 0 0 10.20.50.54:38368 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:7777 10.20.50.54:42315 ESTABLISHED
tcp 0 0 172.17.100.54:48068 172.17.100.54:7013 ESTABLISHED
tcp 0 0 10.20.50.54:38886 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:44616 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:57428 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:56502 10.20.50.54:7777 ESTABLISHED
tcp 0 0 10.20.50.54:57228 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:56546 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:57238 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:38370 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:56548 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:55232 10.20.50.68:1433 ESTABLISHED
tcp 0 0 172.17.100.54:36700 172.17.100.65:5050 ESTABLISHED
tcp 0 0 10.20.50.54:56594 10.20.50.68:1433 ESTABLISHED
tcp 0 102 10.20.50.54:39122 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:7777 10.20.50.81:52179 ESTABLISHED
tcp 0 0 10.20.50.54:38796 10.20.50.54:9094 ESTABLISHED
tcp 0 102 10.20.50.54:38962 10.20.50.54:9094 ESTABLISHED
tcp 0 102 10.20.50.54:38930 10.20.50.54:9094 ESTABLISHED
tcp 0 0 172.17.100.54:7013 172.17.100.55:41084 ESTABLISHED
tcp 0 0 10.20.50.54:32880 10.20.50.68:1433 ESTABLISHED
tcp 0 0 172.17.100.54:56697 172.17.100.65:7070 ESTABLISHED
tcp 0 0 10.20.50.54:55174 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:41012 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:57642 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:57592 10.20.50.54:9094 ESTABLISHED
tcp 0 0 172.17.100.54:58235 172.17.100.65:7070 ESTABLISHED
tcp 0 0 10.20.50.54:38812 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:56680 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:40970 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:56268 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:56714 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:57280 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:43206 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:38484 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:37832 10.20.50.54:9094 ESTABLISHED
tcp 0 0 172.17.100.54:46386 172.17.100.80:6383 ESTABLISHED
tcp 0 0 10.20.50.54:60450 10.20.50.54:9094 ESTABLISHED
tcp 0 102 10.20.50.54:38668 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:56480 10.20.50.54:7777 ESTABLISHED
tcp 0 0 10.20.50.54:57162 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:57392 10.20.50.68:1433 ESTABLISHED
tcp 0 0 172.17.100.54:7777 172.17.100.81:52076 ESTABLISHED
tcp 0 0 10.20.50.54:56446 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:56490 10.20.50.54:7777 ESTABLISHED
tcp 0 0 10.20.50.54:38420 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:38388 10.20.50.54:9094 ESTABLISHED
tcp 0 612 10.20.50.54:38392 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:56798 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:57252 10.20.50.68:1433 ESTABLISHED
tcp 0 0 172.17.100.54:7777 172.17.100.53:50580 ESTABLISHED
tcp 0 0 10.20.50.54:57414 10.20.50.68:1433 ESTABLISHED
tcp 0 0 172.17.100.54:33174 172.17.100.54:7777 ESTABLISHED
tcp 0 0 10.20.50.54:38428 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:7777 10.20.50.54:56470 ESTABLISHED
tcp 0 0 10.20.50.54:57606 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:38452 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:38760 10.20.50.54:9094 ESTABLISHED
tcp 0 102 10.20.50.54:39072 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:56466 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:56578 10.20.50.68:1433 ESTABLISHED
tcp 0 102 10.20.50.54:38918 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:42194 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:7777 10.20.50.54:33455 ESTABLISHED
tcp 0 0 172.17.100.54:7013 172.17.100.54:34438 ESTABLISHED
tcp 0 0 10.20.50.54:56500 10.20.50.68:1433 ESTABLISHED
tcp 0 0 172.17.100.54:46412 172.17.100.80:6383 ESTABLISHED
tcp 0 0 10.20.50.54:42315 10.20.50.54:7777 ESTABLISHED
tcp 0 0 10.20.50.54:38644 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:38340 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:57378 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:56778 10.20.50.68:1433 ESTABLISHED
tcp 0 102 10.20.50.54:38632 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:60026 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:38724 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:55196 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:57194 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:54356 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:56730 10.20.50.68:1433 ESTABLISHED
tcp 0 102 10.20.50.54:39108 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:7777 10.20.50.54:56480 ESTABLISHED
tcp 0 0 10.20.50.54:7777 10.20.50.54:56502 ESTABLISHED
tcp 0 0 10.20.50.54:56308 10.20.50.54:9094 ESTABLISHED
tcp 0 0 172.17.100.54:46424 172.17.100.80:6383 ESTABLISHED
tcp 0 0 172.17.100.54:53324 172.17.100.65:5050 ESTABLISHED
tcp 0 0 172.17.100.54:7013 172.17.100.54:44476 ESTABLISHED
tcp 0 0 10.20.50.54:44172 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:57434 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:56618 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:38824 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:42140 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:40902 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:57406 10.20.50.68:1433 ESTABLISHED
tcp 0 102 10.20.50.54:44624 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:50844 10.20.50.68:1433 ESTABLISHED
tcp 0 102 10.20.50.54:48158 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:38482 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:57236 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:38212 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:56656 10.20.50.68:1433 ESTABLISHED
tcp 0 102 10.20.50.54:39102 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:39190 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:56608 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:56280 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:57368 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:57418 10.20.50.68:1433 ESTABLISHED
tcp 0 0 172.17.100.54:46402 172.17.100.80:6383 ESTABLISHED
tcp 0 0 10.20.50.54:56784 10.20.50.68:1433 ESTABLISHED
tcp 0 0 172.17.100.54:53350 172.17.100.65:5050 ESTABLISHED
tcp 0 102 10.20.50.54:37838 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:56436 10.20.50.68:1433 ESTABLISHED
tcp 0 0 172.17.100.54:46366 172.17.100.80:6383 ESTABLISHED
tcp 0 0 10.20.50.54:57400 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:56774 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:56634 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:39038 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:41002 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:38768 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:60056 10.20.50.54:9094 ESTABLISHED
tcp 0 102 10.20.50.54:60780 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:39036 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:38296 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:7777 10.20.50.54:34449 ESTABLISHED
tcp 0 0 10.20.50.54:38208 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:40916 10.20.50.54:9094 ESTABLISHED
tcp 0 102 10.20.50.54:39016 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:54340 10.20.50.68:1433 ESTABLISHED
tcp 0 0 172.17.100.54:51844 172.17.100.54:7013 ESTABLISHED
tcp 0 0 10.20.50.54:56484 10.20.50.68:1433 ESTABLISHED
tcp 0 0 172.17.100.54:58782 172.17.100.80:6383 ESTABLISHED
tcp 0 0 172.17.100.54:58474 172.17.100.65:5050 ESTABLISHED
tcp 0 0 172.17.100.54:7013 172.17.100.54:51844 ESTABLISHED
tcp 0 0 172.17.100.54:58798 172.17.100.80:6383 ESTABLISHED
tcp 0 0 10.20.50.54:44576 10.20.50.68:1433 ESTABLISHED
tcp 0 0 172.17.100.54:45416 172.17.100.65:5050 ESTABLISHED
tcp 0 0 172.17.100.54:36712 172.17.100.65:5050 ESTABLISHED
tcp 0 0 10.20.50.54:38686 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:57238 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:49990 10.20.50.54:6379 ESTABLISHED
tcp 0 0 10.20.50.54:41034 10.20.50.54:9094 ESTABLISHED
tcp 2091 0 10.20.50.54:33455 10.20.50.54:7777 ESTABLISHED
tcp 0 0 10.20.50.54:56508 10.20.50.68:1433 ESTABLISHED
tcp 0 0 10.20.50.54:50706 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:54822 10.20.50.54:9094 ESTABLISHED
tcp 0 0 10.20.50.54:41024 10.20.50.54:9094 ESTABLISHED
tcp6 0 0 :::8080 :::* LISTEN
tcp6 0 0 :::3389 :::* LISTEN
tcp6 0 0 :::36407 :::* LISTEN
tcp6 0 0 :::2182 :::* LISTEN
tcp6 0 0 :::22 :::* LISTEN
tcp6 0 0 ::1:631 :::* LISTEN
tcp6 0 0 :::41557 :::* LISTEN
tcp6 0 0 :::9094 :::* LISTEN
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38322 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:60770 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:57598 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:39114 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38852 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:39040 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38812 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:37832 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:60056 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:44624 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.81:51785 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:57642 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38246 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38768 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38340 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38482 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:37852 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:33066 TIME_WAIT
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38802 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:40916 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:39072 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:57238 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38724 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:53488 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:40994 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38208 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:60040 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:50706 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38686 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38214 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:55172 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:56280 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:40982 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:39092 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:39016 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:40970 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38896 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:41038 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38868 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38792 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38406 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38994 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:40912 ESTABLISHED
tcp6 0 0 10.20.50.54:51960 10.20.50.54:2182 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:39108 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:56268 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:57616 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38644 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:51478 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38870 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38484 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38212 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38416 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38918 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38668 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:40922 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38740 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38874 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:44172 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:39036 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38224 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:54836 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:48158 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:44616 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:41012 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38700 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38410 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38370 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:37838 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:40990 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:48144 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38680 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:52884 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38452 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:53520 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38796 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38752 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38328 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:40886 ESTABLISHED
tcp6 0 0 10.20.50.54:3389 10.20.50.68:51366 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38420 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38388 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38368 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:40944 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38378 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:60434 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:39150 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38240 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:57628 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38834 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38824 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38428 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38962 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:54822 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38474 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38930 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:39102 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38468 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:41002 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38922 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:33076 TIME_WAIT
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38392 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:60780 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:40724 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38282 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38782 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38266 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38760 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:56308 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38296 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:60450 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38632 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:40902 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38886 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:57592 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38442 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38712 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:60420 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:39048 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:41024 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38774 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:39190 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:60026 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:41034 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:39122 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38946 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38356 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:33052 TIME_WAIT
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38986 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:38844 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:56292 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:57614 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:40960 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:57606 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:40934 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:40996 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:39038 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:45032 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:60062 ESTABLISHED
tcp6 0 0 10.20.50.54:9094 10.20.50.54:48150 ESTABLISHED
tcp6 0 0 10.20.50.54:2182 10.20.50.54:51960 ESTABLISHED
udp 0 0 0.0.0.0:5353 0.0.0.0:*
udp 0 0 0.0.0.0:7777 0.0.0.0:*
udp 0 0 172.17.100.54:8013 0.0.0.0:*
udp 0 0 0.0.0.0:9999 0.0.0.0:*
udp 0 0 0.0.0.0:9999 0.0.0.0:*
udp 0 0 0.0.0.0:9999 0.0.0.0:*
udp 0 0 0.0.0.0:9999 0.0.0.0:*
udp 0 0 0.0.0.0:9999 0.0.0.0:*
udp 0 0 0.0.0.0:9999 0.0.0.0:*
udp 0 0 172.17.100.54:9999 0.0.0.0:*
udp 0 0 0.0.0.0:13901 0.0.0.0:*
udp 0 0 0.0.0.0:15902 0.0.0.0:*
udp 0 0 0.0.0.0:18901 0.0.0.0:*
udp 0 0 0.0.0.0:19096 0.0.0.0:*
udp 0 0 0.0.0.0:19096 0.0.0.0:*
udp 0 0 0.0.0.0:53111 0.0.0.0:*
udp 0 0 0.0.0.0:28446 0.0.0.0:*
udp 0 0 0.0.0.0:28702 0.0.0.0:*
udp 0 0 0.0.0.0:28958 0.0.0.0:*
udp 0 0 0.0.0.0:29214 0.0.0.0:*
udp 0 0 0.0.0.0:29982 0.0.0.0:*
udp 0 0 0.0.0.0:33860 0.0.0.0:*
udp6 0 0 :::5353 :::*
udp6 0 0 :::58618 :::*
raw6 0 0 :::58 :::* 7
raw6 0 0 :::58 :::* 7
raw6 0 0 :::58 :::* 7
64582 - Netstat Connection Information
-
Synopsis
Nessus was able to parse the results of the 'netstat' command on the remote host.
Description
The remote host has listening ports or established connections that Nessus was able to extract from the results of the 'netstat' command.
Note: The output for this plugin can be very long, and is not shown by default. To display it, enable verbose reporting in scan settings.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2013/02/13, Modified: 2023/05/23
Plugin Output

## tcp/0

tcp4 (listen)
src: [host=0.0.0.0, port=7777]
dst: [host=0.0.0.0, port=*]
tcp4 (listen)
src: [host=0.0.0.0, port=6379]
dst: [host=0.0.0.0, port=*]
tcp4 (listen)
src: [host=127.0.0.1, port=631]
dst: [host=0.0.0.0, port=*]
tcp4 (listen)
src: [host=127.0.0.1, port=5910]
dst: [host=0.0.0.0, port=*]
tcp4 (listen)
src: [host=172.17.100.54, port=7013]
dst: [host=0.0.0.0, port=*]
tcp4 (listen)
src: [host=0.0.0.0, port=22]
dst: [host=0.0.0.0, port=*]
tcp4 (established)
src: [host=172.17.100.54, port=45402]
dst: [host=172.17.100.65, port=5050]
tcp4 (established)
src: [host=10.20.50.54, port=38712]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38468]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38246]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=40996]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=55240]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=34449]
dst: [host=10.20.50.54, port=7777]
tcp4 (established)
src: [host=10.20.50.54, port=43220]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=56458]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=55238]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=38416]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=60420]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38322]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38994]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=56628]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=7777]
dst: [host=10.20.50.54, port=34415]
tcp4 (established)
src: [host=10.20.50.54, port=40994]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38874]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=56676]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=60040]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=41018]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=39040]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=56794]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=38946]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=43166]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=38922]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=57614]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=56644]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=172.17.100.54, port=7013]
dst: [host=172.17.100.81, port=52172]
tcp4 (established)
src: [host=172.17.100.54, port=53346]
dst: [host=172.17.100.65, port=5050]
tcp4 (established)
src: [host=172.17.100.54, port=44884]
dst: [host=172.17.100.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=57212]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=48150]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=55264]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=57398]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=57340]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=57172]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=57616]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=43180]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=38266]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=39048]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38680]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=53520]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38282]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38782]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=57178]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=7777]
dst: [host=10.20.50.54, port=45703]
tcp4 (established)
src: [host=10.20.50.54, port=38844]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=56478]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=38774]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=55176]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=55214]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=56516]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=57304]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=40724]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=54348]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=38870]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=55226]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=172.17.100.54, port=7013]
dst: [host=172.17.100.81, port=52080]
tcp4 (established)
src: [host=10.20.50.54, port=38328]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=172.17.100.54, port=45418]
dst: [host=172.17.100.65, port=5050]
tcp4 (established)
src: [host=10.20.50.54, port=55252]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=40990]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38378]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=172.17.100.54, port=45440]
dst: [host=172.17.100.65, port=5050]
tcp4 (established)
src: [host=10.20.50.54, port=56472]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=56744]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=172.17.100.54, port=7013]
dst: [host=172.17.100.54, port=48068]
tcp4 (established)
src: [host=10.20.50.54, port=40944]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=172.17.100.54, port=7013]
dst: [host=172.17.100.53, port=50582]
tcp4 (established)
src: [host=10.20.50.54, port=38752]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=6379]
dst: [host=10.20.50.55, port=36607]
tcp4 (established)
src: [host=10.20.50.54, port=51478]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=55216]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=172.17.100.54, port=58746]
dst: [host=172.17.100.80, port=6383]
tcp4 (established)
src: [host=10.20.50.54, port=38700]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=43196]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=172.17.100.54, port=22]
dst: [host=172.17.100.38, port=48882]
tcp4 (established)
src: [host=10.20.50.54, port=38986]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=34415]
dst: [host=10.20.50.54, port=7777]
tcp4 (established)
src: [host=10.20.50.54, port=57598]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=56522]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=7777]
dst: [host=10.20.50.54, port=45293]
tcp4 (established)
src: [host=10.20.50.54, port=38868]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38834]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=56564]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=37852]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=56806]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=6379]
dst: [host=10.20.50.54, port=44996]
tcp4 (established)
src: [host=10.20.50.54, port=53488]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=56292]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=172.17.100.54, port=53334]
dst: [host=172.17.100.65, port=5050]
tcp4 (established)
src: [host=10.20.50.54, port=56470]
dst: [host=10.20.50.54, port=7777]
tcp4 (established)
src: [host=10.20.50.54, port=39150]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=40960]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=40886]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=60434]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=55172]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=57174]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=38792]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=56698]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=38740]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38442]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=172.17.100.54, port=45236]
dst: [host=172.17.100.54, port=7013]
tcp4 (established)
src: [host=10.20.50.54, port=40982]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=172.17.100.54, port=7777]
dst: [host=172.17.100.81, port=52168]
tcp4 (established)
src: [host=10.20.50.54, port=38852]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=48144]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=6379]
dst: [host=10.20.50.54, port=49990]
tcp4 (established)
src: [host=172.17.100.54, port=7777]
dst: [host=172.17.100.54, port=33174]
tcp4 (established)
src: [host=172.17.100.54, port=7777]
dst: [host=223.178.81.93, port=14116]
tcp4 (established)
src: [host=172.17.100.54, port=40758]
dst: [host=172.17.100.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=60770]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=45293]
dst: [host=10.20.50.54, port=7777]
tcp4 (established)
src: [host=10.20.50.54, port=39114]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=56658]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=57628]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38802]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=172.17.100.54, port=7013]
dst: [host=172.17.100.54, port=45236]
tcp4 (established)
src: [host=10.20.50.54, port=40912]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=55156]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=172.17.100.54, port=7777]
dst: [host=172.17.100.81, port=52178]
tcp4 (established)
src: [host=172.17.100.54, port=34438]
dst: [host=172.17.100.54, port=7013]
tcp4 (established)
src: [host=10.20.50.54, port=52884]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=39092]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38896]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=57192]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=38406]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38240]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=57268]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=7777]
dst: [host=10.20.50.54, port=56490]
tcp4 (established)
src: [host=10.20.50.54, port=38224]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=172.17.100.54, port=47274]
dst: [host=172.17.100.54, port=7013]
tcp4 (established)
src: [host=10.20.50.54, port=42164]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=172.17.100.54, port=36710]
dst: [host=172.17.100.65, port=5050]
tcp4 (established)
src: [host=10.20.50.54, port=45703]
dst: [host=10.20.50.54, port=7777]
tcp4 (established)
src: [host=10.20.50.54, port=56666]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=59466]
dst: [host=10.20.50.54, port=6379]
tcp4 (established)
src: [host=10.20.50.54, port=57316]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=57322]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=56768]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=57290]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=41110]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=56754]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=60062]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=57356]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=45032]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=6379]
dst: [host=10.20.50.54, port=59466]
tcp4 (established)
src: [host=10.20.50.54, port=40922]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=41038]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=54836]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=55204]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=38356]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=56692]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=38410]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38474]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=56530]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=172.17.100.54, port=7013]
dst: [host=172.17.100.54, port=47274]
tcp4 (established)
src: [host=10.20.50.54, port=57200]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=57182]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=56690]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=55180]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=44996]
dst: [host=10.20.50.54, port=6379]
tcp4 (established)
src: [host=172.17.100.54, port=44476]
dst: [host=172.17.100.54, port=7013]
tcp4 (established)
src: [host=10.20.50.54, port=40934]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=57330]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=172.17.100.54, port=48808]
dst: [host=172.17.100.80, port=6383]
tcp4 (established)
src: [host=10.20.50.54, port=38214]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=172.17.100.54, port=58758]
dst: [host=172.17.100.80, port=6383]
tcp4 (established)
src: [host=10.20.50.54, port=38368]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=7777]
dst: [host=10.20.50.54, port=42315]
tcp4 (established)
src: [host=172.17.100.54, port=48068]
dst: [host=172.17.100.54, port=7013]
tcp4 (established)
src: [host=10.20.50.54, port=38886]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=44616]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=57428]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=56502]
dst: [host=10.20.50.54, port=7777]
tcp4 (established)
src: [host=10.20.50.54, port=57228]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=56546]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=57238]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38370]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=56548]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=55232]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=172.17.100.54, port=36700]
dst: [host=172.17.100.65, port=5050]
tcp4 (established)
src: [host=10.20.50.54, port=56594]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=39122]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=7777]
dst: [host=10.20.50.81, port=52179]
tcp4 (established)
src: [host=10.20.50.54, port=38796]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38962]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38930]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=172.17.100.54, port=7013]
dst: [host=172.17.100.55, port=41084]
tcp4 (established)
src: [host=10.20.50.54, port=32880]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=172.17.100.54, port=56697]
dst: [host=172.17.100.65, port=7070]
tcp4 (established)
src: [host=10.20.50.54, port=55174]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=41012]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=57642]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=57592]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=172.17.100.54, port=58235]
dst: [host=172.17.100.65, port=7070]
tcp4 (established)
src: [host=10.20.50.54, port=38812]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=56680]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=40970]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=56268]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=56714]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=57280]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=43206]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=38484]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=37832]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=172.17.100.54, port=46386]
dst: [host=172.17.100.80, port=6383]
tcp4 (established)
src: [host=10.20.50.54, port=60450]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38668]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=56480]
dst: [host=10.20.50.54, port=7777]
tcp4 (established)
src: [host=10.20.50.54, port=57162]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=57392]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=172.17.100.54, port=7777]
dst: [host=172.17.100.81, port=52076]
tcp4 (established)
src: [host=10.20.50.54, port=56446]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=56490]
dst: [host=10.20.50.54, port=7777]
tcp4 (established)
src: [host=10.20.50.54, port=38420]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38388]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38392]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=56798]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=57252]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=172.17.100.54, port=7777]
dst: [host=172.17.100.53, port=50580]
tcp4 (established)
src: [host=10.20.50.54, port=57414]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=172.17.100.54, port=33174]
dst: [host=172.17.100.54, port=7777]
tcp4 (established)
src: [host=10.20.50.54, port=38428]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=7777]
dst: [host=10.20.50.54, port=56470]
tcp4 (established)
src: [host=10.20.50.54, port=57606]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38452]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38760]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=39072]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=56466]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=56578]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=38918]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=42194]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=7777]
dst: [host=10.20.50.54, port=33455]
tcp4 (established)
src: [host=172.17.100.54, port=7013]
dst: [host=172.17.100.54, port=34438]
tcp4 (established)
src: [host=10.20.50.54, port=56500]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=172.17.100.54, port=46412]
dst: [host=172.17.100.80, port=6383]
tcp4 (established)
src: [host=10.20.50.54, port=42315]
dst: [host=10.20.50.54, port=7777]
tcp4 (established)
src: [host=10.20.50.54, port=38644]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38340]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=57378]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=56778]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=38632]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=60026]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38724]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=55196]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=57194]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=54356]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=56730]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=39108]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=7777]
dst: [host=10.20.50.54, port=56480]
tcp4 (established)
src: [host=10.20.50.54, port=7777]
dst: [host=10.20.50.54, port=56502]
tcp4 (established)
src: [host=10.20.50.54, port=56308]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=172.17.100.54, port=46424]
dst: [host=172.17.100.80, port=6383]
tcp4 (established)
src: [host=172.17.100.54, port=53324]
dst: [host=172.17.100.65, port=5050]
tcp4 (established)
src: [host=172.17.100.54, port=7013]
dst: [host=172.17.100.54, port=44476]
tcp4 (established)
src: [host=10.20.50.54, port=44172]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=57434]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=56618]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=38824]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=42140]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=40902]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=57406]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=44624]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=50844]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=48158]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38482]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=57236]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=38212]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=56656]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=39102]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=39190]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=56608]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=56280]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=57368]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=57418]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=172.17.100.54, port=46402]
dst: [host=172.17.100.80, port=6383]
tcp4 (established)
src: [host=10.20.50.54, port=56784]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=172.17.100.54, port=53350]
dst: [host=172.17.100.65, port=5050]
tcp4 (established)
src: [host=10.20.50.54, port=37838]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=56436]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=172.17.100.54, port=46366]
dst: [host=172.17.100.80, port=6383]
tcp4 (established)
src: [host=10.20.50.54, port=57400]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=56774]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=56634]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=39038]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=41002]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38768]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=60056]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=60780]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=39036]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=38296]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=7777]
dst: [host=10.20.50.54, port=34449]
tcp4 (established)
src: [host=10.20.50.54, port=38208]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=40916]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=39016]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=54340]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=172.17.100.54, port=51844]
dst: [host=172.17.100.54, port=7013]
tcp4 (established)
src: [host=10.20.50.54, port=56484]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=172.17.100.54, port=58782]
dst: [host=172.17.100.80, port=6383]
tcp4 (established)
src: [host=172.17.100.54, port=58474]
dst: [host=172.17.100.65, port=5050]
tcp4 (established)
src: [host=172.17.100.54, port=7013]
dst: [host=172.17.100.54, port=51844]
tcp4 (established)
src: [host=172.17.100.54, port=58798]
dst: [host=172.17.100.80, port=6383]
tcp4 (established)
src: [host=10.20.50.54, port=44576]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=172.17.100.54, port=45416]
dst: [host=172.17.100.65, port=5050]
tcp4 (established)
src: [host=172.17.100.54, port=36712]
dst: [host=172.17.100.65, port=5050]
tcp4 (established)
src: [host=10.20.50.54, port=38686]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=57238]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=49990]
dst: [host=10.20.50.54, port=6379]
tcp4 (established)
src: [host=10.20.50.54, port=41034]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=33455]
dst: [host=10.20.50.54, port=7777]
tcp4 (established)
src: [host=10.20.50.54, port=56508]
dst: [host=10.20.50.68, port=1433]
tcp4 (established)
src: [host=10.20.50.54, port=50706]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=54822]
dst: [host=10.20.50.54, port=9094]
tcp4 (established)
src: [host=10.20.50.54, port=41024]
dst: [host=10.20.50.54, port=9094]
tcp6 (listen)
src: [host=::, port=8080]
dst: [host=::, port=*]
tcp6 (listen)
src: [host=::, port=3389]
dst: [host=::, port=*]
tcp6 (listen)
src: [host=::, port=36407]
dst: [host=::, port=*]
tcp6 (listen)
src: [host=::, port=2182]
dst: [host=::, port=*]
tcp6 (listen)
src: [host=::, port=22]
dst: [host=::, port=*]
tcp6 (listen)
src: [host=::1, port=631]
dst: [host=::, port=*]
tcp6 (listen)
src: [host=::, port=41557]
dst: [host=::, port=*]
tcp6 (listen)
src: [host=::, port=9094]
dst: [host=::, port=*]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38322]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=60770]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=57598]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=39114]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38852]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=39040]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38812]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=37832]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=60056]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=44624]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.81, port=51785]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=57642]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38246]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38768]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38340]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38482]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=37852]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=33066]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38802]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=40916]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=39072]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=57238]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38724]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=53488]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=40994]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38208]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=60040]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=50706]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38686]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38214]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=55172]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=56280]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=40982]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=39092]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=39016]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=40970]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38896]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=41038]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38868]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38792]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38406]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38994]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=40912]
tcp46 (established)
src: [host=10.20.50.54, port=51960]
dst: [host=10.20.50.54, port=2182]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=39108]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=56268]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=57616]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38644]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=51478]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38870]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38484]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38212]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38416]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38918]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38668]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=40922]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38740]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38874]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=44172]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=39036]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38224]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=54836]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=48158]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=44616]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=41012]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38700]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38410]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38370]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=37838]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=40990]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=48144]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38680]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=52884]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38452]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=53520]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38796]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38752]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38328]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=40886]
tcp46 (established)
src: [host=10.20.50.54, port=3389]
dst: [host=10.20.50.68, port=51366]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38420]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38388]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38368]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=40944]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38378]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=60434]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=39150]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38240]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=57628]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38834]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38824]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38428]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38962]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=54822]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38474]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38930]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=39102]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38468]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=41002]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38922]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=33076]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38392]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=60780]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=40724]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38282]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38782]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38266]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38760]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=56308]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38296]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=60450]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38632]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=40902]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38886]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=57592]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38442]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38712]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=60420]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=39048]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=41024]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38774]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=39190]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=60026]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=41034]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=39122]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38946]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38356]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=33052]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38986]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=38844]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=56292]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=57614]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=40960]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=57606]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=40934]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=40996]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=39038]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=45032]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=60062]
tcp46 (established)
src: [host=10.20.50.54, port=9094]
dst: [host=10.20.50.54, port=48150]
tcp46 (established)
src: [host=10.20.50.54, port=2182]
dst: [host=10.20.50.54, port=51960]
udp4 (listen)
src: [host=0.0.0.0, port=5353]
dst: [host=0.0.0.0, port=*]
udp4 (listen)
src: [host=0.0.0.0, port=7777]
dst: [host=0.0.0.0, port=*]
udp4 (listen)
src: [host=172.17.100.54, port=8013]
dst: [host=0.0.0.0, port=*]
udp4 (listen)
src: [host=0.0.0.0, port=9999]
dst: [host=0.0.0.0, port=*]
udp4 (listen)
src: [host=0.0.0.0, port=9999]
dst: [host=0.0.0.0, port=*]
udp4 (listen)
src: [host=0.0.0.0, port=9999]
dst: [host=0.0.0.0, port=*]
udp4 (listen)
src: [host=0.0.0.0, port=9999]
dst: [host=0.0.0.0, port=*]
udp4 (listen)
src: [host=0.0.0.0, port=9999]
dst: [host=0.0.0.0, port=*]
udp4 (listen)
src: [host=0.0.0.0, port=9999]
dst: [host=0.0.0.0, port=*]
udp4 (listen)
src: [host=172.17.100.54, port=9999]
dst: [host=0.0.0.0, port=*]
udp4 (listen)
src: [host=0.0.0.0, port=13901]
dst: [host=0.0.0.0, port=*]
udp4 (listen)
src: [host=0.0.0.0, port=15902]
dst: [host=0.0.0.0, port=*]
udp4 (listen)
src: [host=0.0.0.0, port=18901]
dst: [host=0.0.0.0, port=*]
udp4 (listen)
src: [host=0.0.0.0, port=19096]
dst: [host=0.0.0.0, port=*]
udp4 (listen)
src: [host=0.0.0.0, port=19096]
dst: [host=0.0.0.0, port=*]
udp4 (listen)
src: [host=0.0.0.0, port=53111]
dst: [host=0.0.0.0, port=*]
udp4 (listen)
src: [host=0.0.0.0, port=28446]
dst: [host=0.0.0.0, port=*]
udp4 (listen)
src: [host=0.0.0.0, port=28702]
dst: [host=0.0.0.0, port=*]
udp4 (listen)
src: [host=0.0.0.0, port=28958]
dst: [host=0.0.0.0, port=*]
udp4 (listen)
src: [host=0.0.0.0, port=29214]
dst: [host=0.0.0.0, port=*]
udp4 (listen)
src: [host=0.0.0.0, port=29982]
dst: [host=0.0.0.0, port=*]
udp4 (listen)
src: [host=0.0.0.0, port=33860]
dst: [host=0.0.0.0, port=*]
udp6 (listen)
src: [host=::, port=5353]
dst: [host=::, port=*]
udp6 (listen)
src: [host=::, port=58618]
dst: [host=::, port=*]
udp6 (listen)
src: [host=::, port=58]
dst: [host=::, port=*]
udp6 (listen)
src: [host=::, port=58]
dst: [host=::, port=*]
udp6 (listen)
src: [host=::, port=58]
dst: [host=::, port=*]
174736 - Netstat Ingress Connections
-
Synopsis
External connections are enumerated via the 'netstat' command.
Description
This plugin runs 'netstat' to enumerate any non-private connections to the scan target.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2023/04/25, Modified: 2025/12/15
Plugin Output

## tcp/0

Netstat output indicated the following connections from non-private IP addresses:
223.178.81.93 connected to port 7777 on the scan target.
NOTE: This list may be truncated depending on the scan verbosity settings.

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## tcp/22/ssh

Port 22/tcp was found to be open

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## tcp/2182

Port 2182/tcp was found to be open

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## tcp/3389/msrdp

Port 3389/tcp was found to be open

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## udp/5353/mdns

Port 5353/udp was found to be open

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## tcp/6379/redis_server

Port 6379/tcp was found to be open

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## tcp/7013

Port 7013/tcp was found to be open

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## tcp/7777

Port 7777/tcp was found to be open

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## udp/7777

Port 7777/udp was found to be open

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## udp/8013

Port 8013/udp was found to be open

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## tcp/8080/www

Port 8080/tcp was found to be open

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## tcp/9094

Port 9094/tcp was found to be open

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## udp/9999

Port 9999/udp was found to be open

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## udp/13901

Port 13901/udp was found to be open

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## udp/15902

Port 15902/udp was found to be open

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## udp/18901

Port 18901/udp was found to be open

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## udp/19096

Port 19096/udp was found to be open

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## udp/28446

Port 28446/udp was found to be open

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## udp/28702

Port 28702/udp was found to be open

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## udp/28958

Port 28958/udp was found to be open

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## udp/29214

Port 29214/udp was found to be open

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## udp/29982

Port 29982/udp was found to be open

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## udp/33860

Port 33860/udp was found to be open

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## tcp/36407

Port 36407/tcp was found to be open

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## tcp/41557

Port 41557/tcp was found to be open

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## udp/53111

Port 53111/udp was found to be open

##

14272 - Netstat Portscanner (SSH)
-
Synopsis
Remote open ports can be enumerated via SSH.
Description
Nessus was able to run 'netstat' on the remote host to enumerate the open ports. If 'netstat' is not available, the plugin will attempt to use 'ss'.
See the section 'plugins options' about configuring this plugin.
Note: This plugin runs on Windows using netstat.exe if the target is localhost (scanner scanning itself) or a Windows host authenticated via SSH with the ability to run netstat.exe.
See Also

https://en.wikipedia.org/wiki/Netstat

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2004/08/15, Modified: 2025/10/29
Plugin Output

## udp/58618

Port 58618/udp was found to be open

##

33851 - Network daemons not managed by the package system
-
Synopsis
Some daemon processes on the remote host are associated with programs that have been installed manually.
Description
Some daemon processes on the remote host are associated with programs that have been installed manually.
System administration best practice dictates that an operating system's native package management tools be used to manage software installation, updates, and removal whenever possible.
Solution
Use packages supplied by the operating system vendor whenever possible.
And make sure that manual software installation agrees with your organization's acceptable use and security policies.
Risk Factor
None
Plugin Information
Published: 2008/08/08, Modified: 2024/03/06
Plugin Output

## tcp/0

The following running daemons are not managed by RPM :
/home/odin/manager/Bin/ExchangeAdaptor
/home/odin/manager/Bin/MCXMDF/FIXMDBGateway
/home/odin/manager/Bin/MarketInformationServer
/home/odin/manager/Bin/Surveillance
/home/odin/manager/Bin/odinmgr_Linux
/home/odin/manager/Bin/redis-server/redis-server
209654 - OS Fingerprints Detected
-
Synopsis
Multiple OS fingerprints were detected.
Description
Using a combination of remote probes (TCP/IP, SMB, HTTP, NTP, SNMP, etc), it was possible to gather one or more fingerprints from the remote system. While the highest-confidence result was reported in plugin 11936, “OS Identification”, the complete set of fingerprints detected are reported here.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2025/02/26, Modified: 2025/03/03
Plugin Output

## tcp/0

Following OS Fingerprints were found
Remote operating system : Arista EOS
Confidence level : 56
Method : MLSinFP
Type : unknown
Fingerprint : unknown
Remote operating system : Linux Kernel 5.14.0-503.11.1.el9_5.x86_64
Confidence level : 99
Method : uname
Type : general-purpose
Fingerprint : uname:Linux LKPOMSHAPRI 5.14.0-503.11.1.el9_5.x86_64 #1 SMP PREEMPT_DYNAMIC Mon Sep 30 11:54:45 EDT 2024 x86_64 x86_64 x86_64 GNU/Linux
Remote operating system : Linux Kernel 5.14.0-503.11.1.el9_5.x86_64 on Red Hat Enterprise Linux release 9.5 (Plow)
Confidence level : 100
Method : LinuxDistribution
Type : general-purpose
Fingerprint : unknown
Following fingerprints could not be used to determine OS :
SSH:!:SSH-2.0-OpenSSH_8.7
HTTP:!:Server: Jetty(9.4.44.v20210927)
SinFP:!:
P1:B10113:F0x12:W2920:O0204ffff:M1460:
P2:B10113:F0x12:W2920:O0204ffff0101040201030300:M1460:
P3:B00000:F0x00:W0:O0:M0
P4:191601_7_p=7777
SSLcert:!:i/CN:XRDPs/CN:XRDP
8e77cfc85966d55eccceacdc5de2893096999cd9
11936 - OS Identification
-
Synopsis
It is possible to guess the remote operating system.
Description
Using a combination of remote probes (e.g., TCP/IP, SMB, HTTP, NTP, SNMP, etc.), it is possible to guess the name of the remote operating system in use. It is also possible sometimes to guess the version of the operating system.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2003/12/09, Modified: 2025/06/03
Plugin Output

## tcp/0

Remote operating system : Linux Kernel 5.14.0-503.11.1.el9_5.x86_64 on Red Hat Enterprise Linux release 9.5 (Plow)
Confidence level : 100
Method : LinuxDistribution
Not all fingerprints could give a match. If you think that these
signatures would help us improve OS fingerprinting, please submit
them by visiting https://www.tenable.com/research/submitsignatures.
SSH:!:SSH-2.0-OpenSSH_8.7
uname:Linux LKPOMSHAPRI 5.14.0-503.11.1.el9_5.x86_64 #1 SMP PREEMPT_DYNAMIC Mon Sep 30 11:54:45 EDT 2024 x86_64 x86_64 x86_64 GNU/Linux
HTTP:!:Server: Jetty(9.4.44.v20210927)
SinFP:!:
P1:B10113:F0x12:W2920:O0204ffff:M1460:
P2:B10113:F0x12:W2920:O0204ffff0101040201030300:M1460:
P3:B00000:F0x00:W0:O0:M0
P4:191601_7_p=7777
SSLcert:!:i/CN:XRDPs/CN:XRDP
8e77cfc85966d55eccceacdc5de2893096999cd9
The remote host is running Linux Kernel 5.14.0-503.11.1.el9_5.x86_64 on Red Hat Enterprise Linux release 9.5 (Plow)
97993 - OS Identification and Installed Software Enumeration over SSH v2 (Using New SSH Library)
-
Synopsis
Information about the remote host can be disclosed via an authenticated session.
Description
Nessus was able to login to the remote host using SSH or local commands and extract the list of installed packages.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2017/05/30, Modified: 2025/02/11
Plugin Output

## tcp/0

It was possible to log into the remote host via SSH using 'password' authentication.
The output of "uname -a" is :
Linux LKPOMSHAPRI 5.14.0-503.11.1.el9_5.x86_64 #1 SMP PREEMPT_DYNAMIC Mon Sep 30 11:54:45 EDT 2024 x86_64 x86_64 x86_64 GNU/Linux
Local checks have been enabled for this host.
The remote Red Hat system is :
Red Hat Enterprise Linux release 9.5 (Plow)
OS Security Patch Assessment is available for this Red Hat release.
Runtime : 17.812776 seconds
117887 - OS Security Patch Assessment Available
-
Synopsis
Nessus was able to log in to the remote host using the provided credentials and enumerate OS security patch levels.
Description
Nessus was able to determine OS security patch levels by logging into the remote host and running commands to determine the version of the operating system and its components. The remote host was identified as an operating system or device that Nessus supports for patch and update assessment. The necessary information was obtained to perform these checks.
Solution
n/a
Risk Factor
None
References

XREF | IAVB:0001-B-0516

Plugin Information
Published: 2018/10/02, Modified: 2021/07/12
Plugin Output

## tcp/0

OS Security Patch Assessment is available.
Account : root
Protocol : SSH
148373 - OpenJDK Java Detection (Linux / Unix)
-
Synopsis
A distribution of Java is installed on the remote Linux / Unix host.
Description
One or more instances of OpenJDK Java are installed on the remote host. This may include private JREs bundled with the Java Development Kit (JDK).
Notes:
- Addition information provided in plugin Java Detection and Identification (Unix)
- Additional instances of Java may be discovered by enabling thorough tests
See Also

https://openjdk.java.net/

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2021/04/07, Modified: 2025/09/29
Plugin Output

## tcp/0

Path : /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.422.b05-2.el9.x86_64/
Version : 8.0.422.05
Binary Location : /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.422.b05-2.el9.x86_64/bin/java
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.422.b05-2.el9.x86_64/jre/bin/java
Managed by OS : True

## tcp/0

Path : /usr/lib/jvm/java-11-openjdk-11.0.24.0.8-2.el9.x86_64/
Version : 11.0.24.8
Binary Location : /usr/lib/jvm/java-11-openjdk-11.0.24.0.8-2.el9.x86_64/bin/java
Details : This install was discovered by checking the currently
running processes on the system, and it may not always
be reported in future scans.
Managed by OS : True

## tcp/0

Path : /usr/lib/jvm/java-17-openjdk-17.0.12.0.7-2.el9.x86_64/
Version : 17.0.12.7
Binary Location : /usr/lib/jvm/java-17-openjdk-17.0.12.0.7-2.el9.x86_64/bin/java
Managed by OS : True

## tcp/0

Path : /usr/lib/jvm/java-21-openjdk-21.0.4.0.7-1.el9.x86_64/
Version : 21.0.4.7
Binary Location : /usr/lib/jvm/java-21-openjdk-21.0.4.0.7-1.el9.x86_64/bin/java
Managed by OS : True

## tcp/0

Path : /usr/lib/jvm/java-24-openjdk-fastdebug/
Version : 24.0.1.9
Binary Location : /usr/lib/jvm/java-24-openjdk-fastdebug/bin/java
Managed by OS : True

## tcp/0

Path : /usr/lib/jvm/java-24-openjdk-slowdebug/
Version : 24.0.1.9
Binary Location : /usr/lib/jvm/java-24-openjdk-slowdebug/bin/java
Managed by OS : True

## tcp/0

Path : /usr/lib/jvm/java-24-openjdk/
Version : 24.0.1.9
Binary Location : /usr/lib/jvm/java-24-openjdk/bin/java
Managed by OS : True

##

181418 - OpenSSH Detection
-
Synopsis
An OpenSSH-based SSH server was detected on the remote host.
Description
An OpenSSH-based SSH server was detected on the remote host.
See Also

https://www.openssh.com/

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2023/09/14, Modified: 2025/12/15
Plugin Output

## tcp/22/ssh

Service : ssh
Version : 8.7
Banner : SSH-2.0-OpenSSH_8.7

##

168007 - OpenSSL Installed (Linux)
-
Synopsis
OpenSSL was detected on the remote Linux host.
Description
OpenSSL was detected on the remote Linux host.
The plugin timeout can be set to a custom value other than the plugin's default of 15 minutes via the 'timeout.168007' scanner setting in Nessus 8.15.1 or later.
Please see https://docs.tenable.com/nessus/Content/SettingsAdvanced.htm#Custom for more information.
Note: This plugin leverages the '-maxdepth' find command option, which is a feature implemented by the GNU find binary. If the target does not support this option, such as HP-UX and AIX devices, users will need to enable 'thorough tests' in their scan policy to run the find command without using a '-maxdepth' argument.
See Also

https://openssl.org/

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2022/11/21, Modified: 2025/12/18
Plugin Output

## tcp/0

Nessus detected 4 installs of OpenSSL:
Path : /usr/bin/openssl
Version : 3.2.2
Associated Package : openssl-3.2.2-6.el9_5
Managed by OS : True
Path : /opt/site24x7/monagent/lib/lib/libcrypto.so.3
Version : 3.2.6
Path : /usr/lib64/libcrypto.so.3.2.2
Version : 3.2.2
Associated Package : openssl-libs-3.2.2-6.el9_5.x86_64
Path : /usr/lib64/libcrypto.so.1.1.1k
Version : 1.1.1k
Associated Package : compat-openssl11-1.1.1k-4.el9_0.x86_64
We are unable to retrieve version info from the following list of OpenSSL files. However, these installs may include their version within the filename or the filename of the Associated Package.
e.g. libssl.so.3 (OpenSSL 3.x), libssl.so.1.1 (OpenSSL 1.1.x)
/usr/lib64/libssl.so.1.1.1k
/usr/lib64/libssl.so.3.2.2
/opt/site24x7/monagent/lib/lib/libssl.so.3
124174 - Oracle MySQL Connectors Installed (Linux)
-
Synopsis
One or more connectors for Oracle MySQL are available on the remote Linux host.
Description
Oracle MySQL connectors, drivers for connecting to MySQL databases, are available on the remote Linux host.
Note: Thorough tests may be required for an in-depth search of all connectors.
See Also

https://www.mysql.com/products/connector/

Solution
n/a
Risk Factor
None
References

XREF | IAVT:0001-T-0801

Plugin Information
Published: 2019/04/19, Modified: 2025/12/18
Plugin Output

## tcp/0

Nessus detected 10 installs of MySQL Connector:
Path : mysql-connector-odbc-9.3.0-1.el9|(none) Tue 03 Jun 2025 06:25:52 PM IST|Oracle and/or its affiliates|Oracle and/or its affiliates Product Engineering Team <mysql-build@oss.oracle.com>
(via package manager)
Version : 9.3.0
Product : MySQL Connector odbc
Path : mysql-connector-c++-jdbc-9.3.0-1.el9|(none) Tue 03 Jun 2025 06:25:52 PM IST|(none)|(none)
(via package manager)
Version : 9.3.0
Product : MySQL Connector c++-jdbc
Path : mysql-connector-c++-9.3.0-1.el9|(none) Tue 03 Jun 2025 06:25:52 PM IST|(none)|(none)
(via package manager)
Version : 9.3.0
Product : MySQL Connector c++
Path : mysql-connector-c++-devel-9.3.0-1.el9|(none) Tue 03 Jun 2025 06:25:52 PM IST|(none)|(none)
(via package manager)
Version : 9.3.0
Product : MySQL Connector c++-devel
Path : mysql-connector-odbc-setup-9.3.0-1.el9|(none) Tue 03 Jun 2025 06:25:52 PM IST|Oracle and/or its affiliates|Oracle and/or its affiliates Product Engineering Team <mysql-build@oss.oracle.com>
(via package manager)
Version : 9.3.0
Product : MySQL Connector odbc-setup
Path : mysql-connector-python3-9.3.0-1.el9|(none) Tue 03 Jun 2025 06:25:53 PM IST|(none)|(none)
(via package manager)
Version : 9.3.0
Product : MySQL Connector python3
Path : mysql-connector-odbc-debugsource-9.3.0-1.el9|(none) Tue 03 Jun 2025 06:25:53 PM IST|Oracle and/or its affiliates|Oracle and/or its affiliates Product Engineering Team <mysql-build@oss.oracle.com>
(via package manager)
Version : 9.3.0
Product : MySQL Connector odbc-debugsource
Path : mysql-connector-j-9.3.0-1.el9|1 Tue 03 Jun 2025 06:25:53 PM IST|(none)|(none)
(via package manager)
Version : 9.3.0
Product : MySQL Connector j
Path : mysql-connector-c++-debugsource-9.3.0-1.el9|(none) Tue 03 Jun 2025 06:25:53 PM IST|(none)|(none)
(via package manager)
Version : 9.3.0
Product : MySQL Connector c++-debugsource
Path : mysql-connector-c++-compat-9.3.0-1.el9|(none) Tue 03 Jun 2025 06:25:53 PM IST|(none)|(none)
(via package manager)
Version : 9.3.0
Product : MySQL Connector c++-compat
179139 - Package Manager Packages Report (nix)
-
Synopsis
Reports details about packages installed via package managers.
Description
Reports details about packages installed via package managers
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2023/08/01, Modified: 2025/05/07
Plugin Output

## tcp/0

Successfully retrieved and stored package data.
66334 - Patch Report
-
Synopsis
The remote host is missing several patches.
Description
The remote host is missing one or more security patches. This plugin lists the newest version of each patch to install to make sure the remote host is up-to-date.
Note: Because the 'Show missing patches that have been superseded' setting in your scan policy depends on this plugin, it will always run and cannot be disabled.
Solution
Install the patches listed below.
Risk Factor
None
Plugin Information
Published: 2013/07/08, Modified: 2025/12/15
Plugin Output

## tcp/0

. You need to take the following 131 actions :
[ RHEL 10 / 8 / 9 : java-21-openjdk (RHSA-2025:18824) (271222) ]
+ Action to take : Update the RHEL java-21-openjdk package based on the guidance in RHSA-2025:18824.
+ Impact : Taking this action will resolve the following 7 different vulnerabilities :
CVE-2025-61748, CVE-2025-53066, CVE-2025-53057, CVE-2025-50106, CVE-2025-50059
CVE-2025-30754, CVE-2025-30749
[ RHEL 7 / 8 / 9 : java-11-openjdk ELS (RHSA-2025:18818) (271267) ]
+ Action to take : Update the RHEL java-11-openjdk ELS package based on the guidance in RHSA-2025:18818.
+ Impact : Taking this action will resolve the following 11 different vulnerabilities :
CVE-2025-53066, CVE-2025-53057, CVE-2025-50106, CVE-2025-50059, CVE-2025-30761
CVE-2025-30754, CVE-2025-30749, CVE-2025-30698, CVE-2025-30691, CVE-2025-21587
CVE-2025-21502
[ RHEL 8 / 9 : java-1.8.0-openjdk (RHSA-2025:18815) (271273) ]
+ Action to take : Update the RHEL java-1.8.0-openjdk package based on the guidance in RHSA-2025:18815.
+ Impact : Taking this action will resolve the following 6 different vulnerabilities :
CVE-2025-53066, CVE-2025-53057, CVE-2025-50106, CVE-2025-30761, CVE-2025-30754
CVE-2025-30749
[ RHEL 8 / 9 : java-1.8.0-openjdk (RHSA-2025:3845) (234662) ]
+ Action to take : Update the RHEL java-1.8.0-openjdk package based on the guidance in RHSA-2025:3845.
+ Impact : Taking this action will resolve the following 8 different vulnerabilities :
CVE-2025-30698, CVE-2025-30691, CVE-2025-21587, CVE-2024-21235, CVE-2024-21217
CVE-2024-21210, CVE-2024-21208, CVE-2023-48161
[ RHEL 8 / 9 : java-11-openjdk (RHSA-2024:8121) (209158) ]
+ Action to take : Update the RHEL java-11-openjdk package based on the guidance in RHSA-2024:8121.
+ Impact : Taking this action will resolve the following 5 different vulnerabilities :
CVE-2024-21235, CVE-2024-21217, CVE-2024-21210, CVE-2024-21208, CVE-2023-48161
[ RHEL 8 / 9 : java-17-openjdk (RHSA-2025:18821) (271219) ]
+ Action to take : Update the RHEL java-17-openjdk package based on the guidance in RHSA-2025:18821.
+ Impact : Taking this action will resolve the following 15 different vulnerabilities :
CVE-2025-53066, CVE-2025-53057, CVE-2025-50106, CVE-2025-50059, CVE-2025-30754
CVE-2025-30749, CVE-2025-30698, CVE-2025-30691, CVE-2025-21587, CVE-2025-21502
CVE-2024-21235, CVE-2024-21217, CVE-2024-21210, CVE-2024-21208, CVE-2023-48161
[ RHEL 8 / 9 : java-21-openjdk (RHSA-2025:3855) (234672) ]
+ Action to take : Update the RHEL java-21-openjdk package based on the guidance in RHSA-2025:3855.
+ Impact : Taking this action will resolve the following 9 different vulnerabilities :
CVE-2025-30698, CVE-2025-30691, CVE-2025-21587, CVE-2025-21502, CVE-2024-21235
CVE-2024-21217, CVE-2024-21210, CVE-2024-21208, CVE-2023-48161
[ RHEL 8 / 9 : texlive (RHSA-2023:3661) (177428) ]
+ Action to take : Update the RHEL texlive package based on the guidance in RHSA-2023:3661.
[ RHEL 9 : .NET 9.0 (RHSA-2025:18151) (270585) ]
+ Action to take : Update the RHEL .NET 9.0 package based on the guidance in RHSA-2025:18151.
+ Impact : Taking this action will resolve the following 5 different vulnerabilities :
CVE-2025-55315, CVE-2025-55248, CVE-2025-55247, CVE-2025-30399, CVE-2025-26646
[ RHEL 9 : .NET 9.0 (RHSA-2025:2668) (232790) ]
+ Action to take : Update the affected packages.
[ RHEL 9 : Securityes for NetworkManager (Moderate) (RHSA-2025:0377) (214280) ]
+ Action to take : Update the affected packages.
[ RHEL 9 : aardvark-dns (RHSA-2025:7094) (235831) ]
+ Action to take : Update the RHEL aardvark-dns package based on the guidance in RHSA-2025:7094.
[ RHEL 9 : avahi (RHSA-2025:11402) (242422) ]
+ Action to take : Update the RHEL avahi package based on the guidance in RHSA-2025:11402.
+ Impact : Taking this action will resolve the following 2 different vulnerabilities :
CVE-2024-52616, CVE-2024-52615
[ RHEL 9 : bind (RHSA-2025:19951) (274563) ]
+ Action to take : Update the RHEL bind package based on the guidance in RHSA-2025:19951.
+ Impact : Taking this action will resolve the following 2 different vulnerabilities :
CVE-2025-40780, CVE-2025-40778
[ RHEL 9 : bind (RHSA-2025:21110) (275162) ]
+ Action to take : Update the RHEL bind package based on the guidance in RHSA-2025:21110.
+ Impact : Taking this action will resolve the following 3 different vulnerabilities :
CVE-2025-40780, CVE-2025-40778, CVE-2024-11187
[ RHEL 9 : binutils (RHSA-2025:23343) (279124) ]
+ Action to take : Update the RHEL binutils package based on the guidance in RHSA-2025:23343.
[ RHEL 9 : bubblewrap and flatpak (RHSA-2024:6356) (206621) ]
+ Action to take : Update the RHEL bubblewrap / flatpak packages based on the guidance in RHSA-2024:6356.
[ RHEL 9 : bubblewrap and flatpak (RHSA-2024:9449) (210809) ]
+ Action to take : Update the RHEL bubblewrap / flatpak packages based on the guidance in RHSA-2024:9449.
[ RHEL 9 : buildah (RHSA-2025:22011) (276718) ]
+ Action to take : Update the RHEL buildah package based on the guidance in RHSA-2025:22011.
+ Impact : Taking this action will resolve the following 10 different vulnerabilities :
CVE-2025-58183, CVE-2025-52881, CVE-2024-9676, CVE-2024-9675, CVE-2024-9407
CVE-2024-9341, CVE-2024-34158, CVE-2024-34156, CVE-2024-34155, CVE-2024-11218
[ RHEL 9 : buildah (RHSA-2025:9147) (240079) ]
+ Action to take : Update the RHEL buildah package based on the guidance in RHSA-2025:9147.
+ Impact : Taking this action will resolve the following 2 different vulnerabilities :
CVE-2025-27144, CVE-2025-22871
[ RHEL 9 : bzip2 (RHSA-2025:0925) (233458) ]
+ Action to take : Update the RHEL bzip2 package based on the guidance in RHSA-2025:0925.
[ RHEL 9 : compat-openssl11 (RHSA-2025:7937) (237360) ]
+ Action to take : Update the RHEL compat-openssl11 package based on the guidance in RHSA-2025:7937.
[ RHEL 9 : containernetworking-plugins (RHSA-2024:11216) (213157) ]
+ Action to take : Update the RHEL containernetworking-plugins package based on the guidance in RHSA-2024:11216.
[ RHEL 9 : containernetworking-plugins (RHSA-2025:9143) (240087) ]
+ Action to take : Update the RHEL containernetworking-plugins package based on the guidance in RHSA-2025:9143.
[ RHEL 9 : cups (RHSA-2024:9470) (210836) ]
+ Action to take : Update the RHEL cups package based on the guidance in RHSA-2024:9470.
[ RHEL 9 : cups (RHSA-2025:15700) (264555) ]
+ Action to take : Update the RHEL cups package based on the guidance in RHSA-2025:15700.
+ Impact : Taking this action will resolve the following 2 different vulnerabilities :
CVE-2025-58364, CVE-2025-58060
[ RHEL 9 : emacs (RHSA-2024:6510) (206802) ]
+ Action to take : Update the RHEL emacs package based on the guidance in RHSA-2024:6510.
[ RHEL 9 : emacs (RHSA-2025:4787) (235700) ]
+ Action to take : Update the RHEL emacs package based on the guidance in RHSA-2025:4787.
+ Impact : Taking this action will resolve the following 2 different vulnerabilities :
CVE-2025-1244, CVE-2024-53920
[ RHEL 9 : emacs (RHSA-2025:9448) (240478) ]
+ Action to take : Update the RHEL emacs package based on the guidance in RHSA-2025:9448.
[ RHEL 9 : expat (RHSA-2025:22175) (277357) ]
+ Action to take : Update the RHEL expat package based on the guidance in RHSA-2025:22175.
+ Impact : Taking this action will resolve the following 3 different vulnerabilities :
CVE-2025-59375, CVE-2024-8176, CVE-2024-50602
[ RHEL 9 : expat (RHSA-2025:7444) (237372) ]
+ Action to take : Update the RHEL expat package based on the guidance in RHSA-2025:7444.
[ RHEL 9 : firefox (RHSA-2024:8726) (210031) ]
+ Action to take : Update the RHEL firefox package based on the guidance in RHSA-2024:8726.
+ Impact : Taking this action will resolve the following 11 different vulnerabilities :
CVE-2024-9680, CVE-2024-10467, CVE-2024-10466, CVE-2024-10465, CVE-2024-10464
CVE-2024-10463, CVE-2024-10462, CVE-2024-10461, CVE-2024-10460, CVE-2024-10459
CVE-2024-10458
[ RHEL 9 : firefox (RHSA-2025:18155) (270588) ]
+ Action to take : Update the RHEL firefox package based on the guidance in RHSA-2025:18155.
+ Impact : Taking this action will resolve the following 46 different vulnerabilities :
CVE-2025-9185, CVE-2025-9182, CVE-2025-9181, CVE-2025-9180, CVE-2025-9179
CVE-2025-8035, CVE-2025-8034, CVE-2025-8033, CVE-2025-8032, CVE-2025-8031
CVE-2025-8030, CVE-2025-8029, CVE-2025-8028, CVE-2025-8027, CVE-2025-6430
CVE-2025-6429, CVE-2025-6425, CVE-2025-6424, CVE-2025-5283, CVE-2025-5269
CVE-2025-5268, CVE-2025-5267, CVE-2025-5266, CVE-2025-5264, CVE-2025-5263
CVE-2025-4919, CVE-2025-4918, CVE-2025-4093, CVE-2025-4091, CVE-2025-4087
CVE-2025-4083, CVE-2025-2817, CVE-2025-11715, CVE-2025-11714, CVE-2025-11712
CVE-2025-11711, CVE-2025-11710, CVE-2025-11709, CVE-2025-11708, CVE-2025-10537
CVE-2025-10536, CVE-2025-10533, CVE-2025-10532, CVE-2025-10529, CVE-2025-10528
CVE-2025-10527
[ RHEL 9 : firefox (RHSA-2025:23034) (278145) ]
+ Action to take : Update the RHEL firefox package based on the guidance in RHSA-2025:23034.
+ Impact : Taking this action will resolve the following 68 different vulnerabilities :
CVE-2025-4093, CVE-2025-4091, CVE-2025-4087, CVE-2025-4083, CVE-2025-3030
CVE-2025-3029, CVE-2025-3028, CVE-2025-2817, CVE-2025-1938, CVE-2025-1937
CVE-2025-1936, CVE-2025-1935, CVE-2025-1934, CVE-2025-1933, CVE-2025-1932
CVE-2025-1931, CVE-2025-1930, CVE-2025-14333, CVE-2025-14331, CVE-2025-14330
CVE-2025-14329, CVE-2025-14328, CVE-2025-14325, CVE-2025-14324, CVE-2025-14323
CVE-2025-14322, CVE-2025-14321, CVE-2025-13020, CVE-2025-13019, CVE-2025-13018
CVE-2025-13017, CVE-2025-13016, CVE-2025-13015, CVE-2025-13014, CVE-2025-13013
CVE-2025-13012, CVE-2025-1017, CVE-2025-1016, CVE-2025-1014, CVE-2025-1013
CVE-2025-1012, CVE-2025-1011, CVE-2025-1010, CVE-2025-1009, CVE-2025-0243
CVE-2025-0242, CVE-2025-0241, CVE-2025-0240, CVE-2025-0239, CVE-2025-0238
CVE-2025-0237, CVE-2024-9680, CVE-2024-11699, CVE-2024-11697, CVE-2024-11696
CVE-2024-11695, CVE-2024-11694, CVE-2024-11692, CVE-2024-10467, CVE-2024-10466
CVE-2024-10465, CVE-2024-10464, CVE-2024-10463, CVE-2024-10462, CVE-2024-10461
CVE-2024-10460, CVE-2024-10459, CVE-2024-10458
[ RHEL 9 : flatpak (RHSA-2024:3959) (200663) ]
+ Action to take : Update the RHEL flatpak package based on the guidance in RHSA-2024:3959.
[ RHEL 9 : freetype (RHSA-2025:3407) (233901) ]
+ Action to take : Update the RHEL freetype package based on the guidance in RHSA-2025:3407.
[ RHEL 9 : gcc (RHSA-2025:1346) (216204) ]
+ Action to take : Update the RHEL gcc package based on the guidance in RHSA-2025:1346.
[ RHEL 9 : gcc-toolset-13-binutils (RHSA-2025:23336) (279114) ]
+ Action to take : Update the RHEL gcc-toolset-13-binutils package based on the guidance in RHSA-2025:23336.
[ RHEL 9 : gcc-toolset-13-gcc (RHSA-2025:1309) (216101) ]
+ Action to take : Update the RHEL gcc-toolset-13-gcc package based on the guidance in RHSA-2025:1309.
[ RHEL 9 : gcc-toolset-14-gcc (RHSA-2025:1300) (216103) ]
+ Action to take : Update the RHEL gcc-toolset-14-gcc package based on the guidance in RHSA-2025:1300.
[ RHEL 9 : gdk-pixbuf2 (RHSA-2025:12841) (243562) ]
+ Action to take : Update the RHEL gdk-pixbuf2 package based on the guidance in RHSA-2025:12841.
[ RHEL 9 : ghostscript (RHSA-2025:7586) (237139) ]
+ Action to take : Update the RHEL ghostscript package based on the guidance in RHSA-2025:7586.
+ Impact : Taking this action will resolve the following 7 different vulnerabilities :
CVE-2025-27832, CVE-2024-46956, CVE-2024-46954, CVE-2024-46953, CVE-2024-46952
CVE-2024-46951, CVE-2023-46751
[ RHEL 9 : git (RHSA-2025:11462) (242476) ]
+ Action to take : Update the RHEL git package based on the guidance in RHSA-2025:11462.
+ Impact : Taking this action will resolve the following 8 different vulnerabilities :
CVE-2025-48385, CVE-2025-48384, CVE-2025-46835, CVE-2025-27614, CVE-2025-27613
CVE-2024-52006, CVE-2024-52005, CVE-2024-50349
[ RHEL 9 : glib2 (RHSA-2025:11140) (242125) ]
+ Action to take : Update the RHEL glib2 package based on the guidance in RHSA-2025:11140.
+ Impact : Taking this action will resolve the following 2 different vulnerabilities :
CVE-2025-4373, CVE-2024-52533
[ RHEL 9 : glibc (RHSA-2025:12748) (243450) ]
+ Action to take : Update the RHEL glibc package based on the guidance in RHSA-2025:12748.
+ Impact : Taking this action will resolve the following 3 different vulnerabilities :
CVE-2025-8058, CVE-2025-5702, CVE-2025-4802
[ RHEL 9 : glibc (RHSA-2025:4244) (234897) ]
+ Action to take : Update the RHEL glibc package based on the guidance in RHSA-2025:4244.
[ RHEL 9 : gnome-remote-desktop (RHSA-2025:10631) (241528) ]
+ Action to take : Update the RHEL gnome-remote-desktop package based on the guidance in RHSA-2025:10631.
[ RHEL 9 : gnutls (RHSA-2025:16116) (265352) ]
+ Action to take : Update the affected packages.
+ Impact : Taking this action will resolve the following 4 different vulnerabilities :
CVE-2025-6395, CVE-2025-32990, CVE-2025-32989, CVE-2025-32988
[ RHEL 9 : gnutls (RHSA-2025:7076) (237370) ]
+ Action to take : Update the RHEL gnutls package based on the guidance in RHSA-2025:7076.
[ RHEL 9 : go-rpm-macros (RHSA-2025:22005) (276688) ]
+ Action to take : Update the RHEL go-rpm-macros package based on the guidance in RHSA-2025:22005.
[ RHEL 9 : grub2 (RHSA-2025:20532) (274776) ]
+ Action to take : Update the RHEL grub2 package based on the guidance in RHSA-2025:20532.
+ Impact : Taking this action will resolve the following 11 different vulnerabilities :
CVE-2025-0690, CVE-2025-0677, CVE-2025-0624, CVE-2025-0622, CVE-2024-45783
CVE-2024-45781, CVE-2024-45777, CVE-2024-45776, CVE-2024-45775, CVE-2024-45774
CVE-2020-11023
[ RHEL 9 : gstreamer1, gstreamer1-plugins-bad-free, gstreamer1-plugins-ugly-free, and gstreamer1-rtsp-server (RHSA-2025:7178) (235807) ]
+ Action to take : Update the RHEL gstreamer1 / gstreamer1-plugins-bad-free / gstreamer1-plugins-ugly-free / gstreamer1-rtsp-server packages based on the guidance in RHSA-2025:7178.
+ Impact : Taking this action will resolve the following 2 different vulnerabilities :
CVE-2024-4453, CVE-2024-0444
[ RHEL 9 : gstreamer1-plugins-bad-free (RHSA-2025:8183) (237267) ]
+ Action to take : Update the RHEL gstreamer1-plugins-bad-free package based on the guidance in RHSA-2025:8183.
[ RHEL 9 : gstreamer1-plugins-base (RHSA-2025:7243) (235804) ]
+ Action to take : Update the RHEL gstreamer1-plugins-base package based on the guidance in RHSA-2025:7243.
+ Impact : Taking this action will resolve the following 7 different vulnerabilities :
CVE-2024-47835, CVE-2024-47615, CVE-2024-47607, CVE-2024-47600, CVE-2024-47542
CVE-2024-47541, CVE-2024-47538
[ RHEL 9 : gstreamer1-plugins-good (RHSA-2025:7242) (235801) ]
+ Action to take : Update the RHEL gstreamer1-plugins-good package based on the guidance in RHSA-2025:7242.
+ Impact : Taking this action will resolve the following 22 different vulnerabilities :
CVE-2024-47834, CVE-2024-47778, CVE-2024-47777, CVE-2024-47776, CVE-2024-47775
CVE-2024-47774, CVE-2024-47613, CVE-2024-47606, CVE-2024-47603, CVE-2024-47602
CVE-2024-47601, CVE-2024-47599, CVE-2024-47598, CVE-2024-47597, CVE-2024-47596
CVE-2024-47546, CVE-2024-47545, CVE-2024-47544, CVE-2024-47543, CVE-2024-47540
CVE-2024-47539, CVE-2024-47537
[ RHEL 9 : icu (RHSA-2025:12083) (242992) ]
+ Action to take : Update the RHEL icu package based on the guidance in RHSA-2025:12083.
[ RHEL 9 : iputils (RHSA-2025:17558) (269744) ]
+ Action to take : Update the RHEL iputils package based on the guidance in RHSA-2025:17558.
+ Impact : Taking this action will resolve the following 2 different vulnerabilities :
CVE-2025-48964, CVE-2025-47268
[ RHEL 9 : jq (RHSA-2025:10585) (241526) ]
+ Action to take : Update the RHEL jq package based on the guidance in RHSA-2025:10585.
+ Impact : Taking this action will resolve the following 2 different vulnerabilities :
CVE-2025-48060, CVE-2024-23337
[ RHEL 9 : kernel (RHSA-2025:19930) (274565) ]
+ Action to take : Update the RHEL kernel package based on the guidance in RHSA-2025:19930.
+ Impact : Taking this action will resolve the following 119 different vulnerabilities :
CVE-2025-40300, CVE-2025-39849, CVE-2025-39841, CVE-2025-39825, CVE-2025-39819
CVE-2025-39817, CVE-2025-39761, CVE-2025-39757, CVE-2025-39730, CVE-2025-39718
CVE-2025-39702, CVE-2025-39698, CVE-2025-39694, CVE-2025-39682, CVE-2025-38718
CVE-2025-38684, CVE-2025-38614, CVE-2025-38571, CVE-2025-38566, CVE-2025-38556
CVE-2025-38550, CVE-2025-38527, CVE-2025-38500, CVE-2025-38498, CVE-2025-38472
CVE-2025-38471, CVE-2025-38464, CVE-2025-38461, CVE-2025-38449, CVE-2025-38417
CVE-2025-38392, CVE-2025-38352, CVE-2025-38351, CVE-2025-38350, CVE-2025-38332
CVE-2025-38292, CVE-2025-38250, CVE-2025-38211, CVE-2025-38200, CVE-2025-38159
CVE-2025-38124, CVE-2025-38110, CVE-2025-38089, CVE-2025-38087, CVE-2025-38086
CVE-2025-38085, CVE-2025-38084, CVE-2025-38079, CVE-2025-38052, CVE-2025-37958
CVE-2025-37943, CVE-2025-37914, CVE-2025-37890, CVE-2025-37823, CVE-2025-37810
CVE-2025-37803, CVE-2025-37799, CVE-2025-37797, CVE-2025-37785, CVE-2025-37750
CVE-2025-37749, CVE-2025-37738, CVE-2025-23150, CVE-2025-22126, CVE-2025-22121
CVE-2025-22113, CVE-2025-22104, CVE-2025-22097, CVE-2025-22091, CVE-2025-22085
CVE-2025-22058, CVE-2025-22055, CVE-2025-22026, CVE-2025-22020, CVE-2025-22004
CVE-2025-21999, CVE-2025-21997, CVE-2025-21993, CVE-2025-21991, CVE-2025-21979
CVE-2025-21969, CVE-2025-21966, CVE-2025-21964, CVE-2025-21963, CVE-2025-21962
CVE-2025-21961, CVE-2025-21929, CVE-2025-21928, CVE-2025-21927, CVE-2025-21926
CVE-2025-21920, CVE-2025-21919, CVE-2025-21905, CVE-2025-21887, CVE-2025-21883
CVE-2025-21867, CVE-2025-21764, CVE-2025-21759, CVE-2025-21756, CVE-2025-21727
CVE-2024-58069, CVE-2024-58007, CVE-2024-58005, CVE-2024-58002, CVE-2024-57980
CVE-2024-50301, CVE-2024-36357, CVE-2024-36350, CVE-2024-28956, CVE-2023-53494
CVE-2023-53373, CVE-2023-53331, CVE-2023-53125, CVE-2023-52933, CVE-2022-50367
CVE-2022-50087, CVE-2022-49846, CVE-2022-49788, CVE-2022-3424
[ RHEL 9 : kernel (RHSA-2025:23241) (278951) ]
+ Action to take : Update the RHEL kernel package based on the guidance in RHSA-2025:23241.
+ Impact : Taking this action will resolve the following 502 different vulnerabilities :
CVE-2025-40300, CVE-2025-40185, CVE-2025-40176, CVE-2025-40058, CVE-2025-40047
CVE-2025-39983, CVE-2025-39982, CVE-2025-39981, CVE-2025-39979, CVE-2025-39971
CVE-2025-39966, CVE-2025-39955, CVE-2025-39925, CVE-2025-39918, CVE-2025-39881
CVE-2025-39864, CVE-2025-39849, CVE-2025-39843, CVE-2025-39841, CVE-2025-39817
CVE-2025-39718, CVE-2025-39702, CVE-2025-39697, CVE-2025-38724, CVE-2025-38571
CVE-2025-38566, CVE-2025-38499, CVE-2025-38498, CVE-2025-38396, CVE-2025-38351
CVE-2025-38116, CVE-2025-37994, CVE-2025-22097, CVE-2025-22087, CVE-2025-22056
CVE-2025-21864, CVE-2025-21863, CVE-2025-21861, CVE-2025-21855, CVE-2025-21853
CVE-2025-21851, CVE-2025-21848, CVE-2025-21847, CVE-2025-21846, CVE-2025-21844
CVE-2025-21839, CVE-2025-21829, CVE-2025-21828, CVE-2025-21826, CVE-2025-21806
CVE-2025-21796, CVE-2025-21795, CVE-2025-21791, CVE-2025-21790, CVE-2025-21787
CVE-2025-21786, CVE-2025-21765, CVE-2025-21746, CVE-2025-21745, CVE-2025-21739
CVE-2025-21738, CVE-2025-21729, CVE-2025-21728, CVE-2025-21726, CVE-2025-21714
CVE-2025-21702, CVE-2025-21696, CVE-2025-21694, CVE-2025-21693, CVE-2025-21691
CVE-2025-21689, CVE-2025-21672, CVE-2025-21671, CVE-2025-21669, CVE-2025-21668
CVE-2025-21666, CVE-2025-21663, CVE-2025-21648, CVE-2025-21647, CVE-2025-21646
CVE-2025-21631, CVE-2025-1272, CVE-2024-58099, CVE-2024-58088, CVE-2024-58083
CVE-2024-58077, CVE-2024-58075, CVE-2024-58072, CVE-2024-58068, CVE-2024-58064
CVE-2024-58062, CVE-2024-58057, CVE-2024-58015, CVE-2024-58014, CVE-2024-58012
CVE-2024-58009, CVE-2024-57998, CVE-2024-57995, CVE-2024-57993, CVE-2024-57990
CVE-2024-57989, CVE-2024-57988, CVE-2024-57987, CVE-2024-57986, CVE-2024-57981
CVE-2024-57940, CVE-2024-57931, CVE-2024-57929, CVE-2024-57903, CVE-2024-57898
CVE-2024-57890, CVE-2024-57888, CVE-2024-57885, CVE-2024-57884, CVE-2024-57879
CVE-2024-57852, CVE-2024-57843, CVE-2024-57809, CVE-2024-57798, CVE-2024-56783
CVE-2024-56779, CVE-2024-56760, CVE-2024-56757, CVE-2024-56739, CVE-2024-56729
CVE-2024-56709, CVE-2024-56693, CVE-2024-56690, CVE-2024-56688, CVE-2024-56675
CVE-2024-56672, CVE-2024-56667, CVE-2024-56664, CVE-2024-56663, CVE-2024-56662
CVE-2024-56654, CVE-2024-56653, CVE-2024-56647, CVE-2024-56645, CVE-2024-56644
CVE-2024-56642, CVE-2024-56631, CVE-2024-56623, CVE-2024-56616, CVE-2024-56614
CVE-2024-56611, CVE-2024-56605, CVE-2024-56604, CVE-2024-56603, CVE-2024-56602
CVE-2024-56601, CVE-2024-56600, CVE-2024-56591, CVE-2024-56590, CVE-2024-56570
CVE-2024-56566, CVE-2024-56562, CVE-2024-56558, CVE-2024-56551, CVE-2024-56544
CVE-2024-56535, CVE-2024-54460, CVE-2024-54456, CVE-2024-53681, CVE-2024-53680
CVE-2024-53241, CVE-2024-53237, CVE-2024-53232, CVE-2024-53229, CVE-2024-53224
CVE-2024-53222, CVE-2024-53216, CVE-2024-53213, CVE-2024-53208, CVE-2024-53203
CVE-2024-53194, CVE-2024-53190, CVE-2024-53174, CVE-2024-53173, CVE-2024-53170
CVE-2024-53166, CVE-2024-53164, CVE-2024-53161, CVE-2024-53160, CVE-2024-53156
CVE-2024-53152, CVE-2024-53146, CVE-2024-53142, CVE-2024-53141, CVE-2024-53136
CVE-2024-53135, CVE-2024-53134, CVE-2024-53124, CVE-2024-53123, CVE-2024-53121
CVE-2024-53120, CVE-2024-53119, CVE-2024-53118, CVE-2024-53117, CVE-2024-53110
CVE-2024-53105, CVE-2024-53103, CVE-2024-53097, CVE-2024-53096, CVE-2024-53095
CVE-2024-53093, CVE-2024-53091, CVE-2024-53090, CVE-2024-53085, CVE-2024-53082
CVE-2024-53074, CVE-2024-53072, CVE-2024-53070, CVE-2024-53060, CVE-2024-53059
CVE-2024-53057, CVE-2024-53055, CVE-2024-53052, CVE-2024-53051, CVE-2024-53050
CVE-2024-53047, CVE-2024-53044, CVE-2024-53042, CVE-2024-52332, CVE-2024-50304
CVE-2024-50299, CVE-2024-50294, CVE-2024-50282, CVE-2024-50278, CVE-2024-50272
CVE-2024-50271, CVE-2024-50261, CVE-2024-50256, CVE-2024-50237, CVE-2024-50236
CVE-2024-50235, CVE-2024-50216, CVE-2024-50215, CVE-2024-50201, CVE-2024-50200
CVE-2024-50199, CVE-2024-50197, CVE-2024-50195, CVE-2024-50191, CVE-2024-50189
CVE-2024-50186, CVE-2024-50182, CVE-2024-50169, CVE-2024-50163, CVE-2024-50162
CVE-2024-50153, CVE-2024-50152, CVE-2024-50151, CVE-2024-50150, CVE-2024-50143
CVE-2024-50141, CVE-2024-50130, CVE-2024-50128, CVE-2024-50127, CVE-2024-50126
CVE-2024-50121, CVE-2024-50120, CVE-2024-50117, CVE-2024-50109, CVE-2024-50107
CVE-2024-50106, CVE-2024-50102, CVE-2024-50101, CVE-2024-50093, CVE-2024-50082
CVE-2024-50081, CVE-2024-50078, CVE-2024-50077, CVE-2024-50075, CVE-2024-50074
CVE-2024-50073, CVE-2024-50067, CVE-2024-50064, CVE-2024-50060, CVE-2024-50058
CVE-2024-50057, CVE-2024-50055, CVE-2024-50047, CVE-2024-50046, CVE-2024-50044
CVE-2024-50039, CVE-2024-50038, CVE-2024-50035, CVE-2024-50033, CVE-2024-50029
CVE-2024-50028, CVE-2024-50027, CVE-2024-50024, CVE-2024-50023, CVE-2024-50022
CVE-2024-50019, CVE-2024-50015, CVE-2024-50014, CVE-2024-50013, CVE-2024-50009
CVE-2024-50008, CVE-2024-50006, CVE-2024-50002, CVE-2024-49999, CVE-2024-49994
CVE-2024-49991, CVE-2024-49983, CVE-2024-49977, CVE-2024-49975, CVE-2024-49974
CVE-2024-49973, CVE-2024-49971, CVE-2024-49968, CVE-2024-49962, CVE-2024-49960
CVE-2024-49959, CVE-2024-49954, CVE-2024-49951, CVE-2024-49950, CVE-2024-49948
CVE-2024-49946, CVE-2024-49939, CVE-2024-49938, CVE-2024-49937, CVE-2024-49935
CVE-2024-49934, CVE-2024-49933, CVE-2024-49930, CVE-2024-49929, CVE-2024-49928
CVE-2024-49927, CVE-2024-49904, CVE-2024-49889, CVE-2024-49886, CVE-2024-49885
CVE-2024-49884, CVE-2024-49883, CVE-2024-49882, CVE-2024-49881, CVE-2024-49878
CVE-2024-49875, CVE-2024-49870, CVE-2024-49864, CVE-2024-49862, CVE-2024-49860
CVE-2024-49856, CVE-2024-49851, CVE-2024-49570, CVE-2024-49569, CVE-2024-48873
CVE-2024-47748, CVE-2024-47745, CVE-2024-47739, CVE-2024-47738, CVE-2024-47737
CVE-2024-47727, CVE-2024-47719, CVE-2024-47718, CVE-2024-47715, CVE-2024-47713
CVE-2024-47710, CVE-2024-47706, CVE-2024-47705, CVE-2024-47703, CVE-2024-47700
CVE-2024-47692, CVE-2024-47687, CVE-2024-47685, CVE-2024-47679, CVE-2024-47678
CVE-2024-47668, CVE-2024-47660, CVE-2024-47141, CVE-2024-46871, CVE-2024-46864
CVE-2024-46853, CVE-2024-46835, CVE-2024-46828, CVE-2024-46822, CVE-2024-46820
CVE-2024-46819, CVE-2024-46807, CVE-2024-46806, CVE-2024-46805, CVE-2024-46800
CVE-2024-46787, CVE-2024-46786, CVE-2024-46783, CVE-2024-46761, CVE-2024-46759
CVE-2024-46754, CVE-2024-46750, CVE-2024-46747, CVE-2024-46745, CVE-2024-46744
CVE-2024-46743, CVE-2024-46725, CVE-2024-46724, CVE-2024-46723, CVE-2024-46722
CVE-2024-46711, CVE-2024-46689, CVE-2024-46675, CVE-2024-46673, CVE-2024-45022
CVE-2024-45016, CVE-2024-45010, CVE-2024-45009, CVE-2024-45000, CVE-2024-44989
CVE-2024-44987, CVE-2024-44975, CVE-2024-44964, CVE-2024-44958, CVE-2024-44934
CVE-2024-44932, CVE-2024-44931, CVE-2024-43914, CVE-2024-43910, CVE-2024-43889
CVE-2024-43884, CVE-2024-43882, CVE-2024-43873, CVE-2024-43871, CVE-2024-43853
CVE-2024-43846, CVE-2024-43834, CVE-2024-43828, CVE-2024-43823, CVE-2024-43821
CVE-2024-43820, CVE-2024-42321, CVE-2024-42316, CVE-2024-42315, CVE-2024-42312
CVE-2024-42305, CVE-2024-42304, CVE-2024-42302, CVE-2024-42294, CVE-2024-42291
CVE-2024-42278, CVE-2024-42265, CVE-2024-42253, CVE-2024-42133, CVE-2024-42094
CVE-2024-41062, CVE-2024-41010, CVE-2024-40956, CVE-2024-39500, CVE-2024-38541
CVE-2024-36968, CVE-2024-36880, CVE-2024-36357, CVE-2024-36350, CVE-2024-36013
CVE-2024-36012, CVE-2024-36011, CVE-2024-35978, CVE-2024-35967, CVE-2024-35966
CVE-2024-35965, CVE-2024-35964, CVE-2024-35963, CVE-2024-35934, CVE-2024-35933
CVE-2024-35891, CVE-2024-27398, CVE-2024-27008, CVE-2023-53494, CVE-2023-53373
CVE-2023-53331, CVE-2023-53117, CVE-2023-53066, CVE-2023-52672, CVE-2022-50367
CVE-2022-50159, CVE-2022-50112, CVE-2022-50087, CVE-2022-49845, CVE-2022-49815
CVE-2022-49804, CVE-2022-49778, CVE-2022-49672, CVE-2022-49670, CVE-2022-49657
CVE-2022-49648, CVE-2022-49643, CVE-2022-49627, CVE-2022-49623, CVE-2022-49443
CVE-2022-49437, CVE-2022-49432, CVE-2022-49357, CVE-2022-49353, CVE-2022-49269
CVE-2022-49029, CVE-2022-49024, CVE-2022-49014, CVE-2022-49006, CVE-2022-48989
CVE-2022-48969, CVE-2022-48830
[ RHEL 9 : kernel (RHSA-2025:4341) (235002) ]
+ Action to take : Update the RHEL kernel package based on the guidance in RHSA-2025:4341.
+ Impact : Taking this action will resolve the following 50 different vulnerabilities :
CVE-2025-21927, CVE-2025-21785, CVE-2024-57947, CVE-2024-53197, CVE-2024-53150
CVE-2024-53122, CVE-2024-53113, CVE-2024-53104, CVE-2024-53088, CVE-2024-50302
CVE-2024-50275, CVE-2024-50264, CVE-2024-50262, CVE-2024-50255, CVE-2024-50252
CVE-2024-50251, CVE-2024-50226, CVE-2024-50223, CVE-2024-50208, CVE-2024-50192
CVE-2024-50154, CVE-2024-50148, CVE-2024-50142, CVE-2024-50125, CVE-2024-50124
CVE-2024-50115, CVE-2024-50110, CVE-2024-50099, CVE-2024-49949, CVE-2024-49888
CVE-2024-47675, CVE-2024-46826, CVE-2024-46713, CVE-2024-46697, CVE-2024-46695
CVE-2024-45020, CVE-2024-45018, CVE-2024-44994, CVE-2024-44990, CVE-2024-43855
CVE-2024-43854, CVE-2024-42322, CVE-2024-42292, CVE-2024-42244, CVE-2024-41009
CVE-2024-38564, CVE-2024-27399, CVE-2024-26615, CVE-2023-52922, CVE-2023-52490
[ RHEL 9 : krb5 (RHSA-2025:7067) (235815) ]
+ Action to take : Update the RHEL krb5 package based on the guidance in RHSA-2025:7067.
+ Impact : Taking this action will resolve the following 2 different vulnerabilities :
CVE-2025-24528, CVE-2024-3596
[ RHEL 9 : krb5 (RHSA-2025:9430) (240472) ]
+ Action to take : Update the RHEL krb5 package based on the guidance in RHSA-2025:9430.
[ RHEL 9 : libarchive (RHSA-2025:14130) (252954) ]
+ Action to take : Update the RHEL libarchive package based on the guidance in RHSA-2025:14130.
+ Impact : Taking this action will resolve the following 2 different vulnerabilities :
CVE-2025-5914, CVE-2025-25724
[ RHEL 9 : libblockdev (RHSA-2025:9327) (240242) ]
+ Action to take : Update the RHEL libblockdev package based on the guidance in RHSA-2025:9327.
[ RHEL 9 : libsndfile:1.0.31 (RHSA-2024:11237) (213161) ]
+ Action to take : Update the RHEL libsndfile:1.0.31 package based on the guidance in RHSA-2024:11237.
[ RHEL 9 : libsoup (RHSA-2025:19713) (272284) ]
+ Action to take : Update the RHEL libsoup package based on the guidance in RHSA-2025:19713.
+ Impact : Taking this action will resolve the following 15 different vulnerabilities :
CVE-2025-4948, CVE-2025-4945, CVE-2025-46421, CVE-2025-46420, CVE-2025-32914
CVE-2025-32913, CVE-2025-32911, CVE-2025-32907, CVE-2025-32906, CVE-2025-32053
CVE-2025-32052, CVE-2025-32050, CVE-2025-32049, CVE-2025-2784, CVE-2025-11021
[ RHEL 9 : libsoup (RHSA-2025:20959) (274820) ]
+ Action to take : Update the RHEL libsoup package based on the guidance in RHSA-2025:20959.
+ Impact : Taking this action will resolve the following 5 different vulnerabilities :
CVE-2025-4945, CVE-2025-11021, CVE-2024-52532, CVE-2024-52531, CVE-2024-52530
[ RHEL 9 : libssh (RHSA-2025:18275) (270705) ]
+ Action to take : Update the RHEL libssh package based on the guidance in RHSA-2025:18275.
[ RHEL 9 : libssh (RHSA-2025:23483) (279084) ]
+ Action to take : Update the RHEL libssh package based on the guidance in RHSA-2025:23483.
+ Impact : Taking this action will resolve the following 2 different vulnerabilities :
CVE-2025-5987, CVE-2025-5318
[ RHEL 9 : libtasn1 (RHSA-2025:7077) (235813) ]
+ Action to take : Update the RHEL libtasn1 package based on the guidance in RHSA-2025:7077.
[ RHEL 9 : libtiff (RHSA-2025:19113) (271847) ]
+ Action to take : Update the RHEL libtiff package based on the guidance in RHSA-2025:19113.
+ Impact : Taking this action will resolve the following 2 different vulnerabilities :
CVE-2025-9900, CVE-2025-8176
[ RHEL 9 : libtiff (RHSA-2025:20801) (274775) ]
+ Action to take : Update the RHEL libtiff package based on the guidance in RHSA-2025:20801.
+ Impact : Taking this action will resolve the following 2 different vulnerabilities :
CVE-2023-52356, CVE-2023-52355
[ RHEL 9 : libtiff (RHSA-2025:20956) (274752) ]
+ Action to take : Update the RHEL libtiff package based on the guidance in RHSA-2025:20956.
+ Impact : Taking this action will resolve the following 2 different vulnerabilities :
CVE-2025-9900, CVE-2025-8176
[ RHEL 9 : libvpx (RHSA-2024:9827) (211767) ]
+ Action to take : Update the RHEL libvpx package based on the guidance in RHSA-2024:9827.
[ RHEL 9 : libvpx (RHSA-2025:9118) (240065) ]
+ Action to take : Update the RHEL libvpx package based on the guidance in RHSA-2025:9118.
[ RHEL 9 : libxml2 (RHSA-2025:13428) (245207) ]
+ Action to take : Update the RHEL libxml2 package based on the guidance in RHSA-2025:13428.
+ Impact : Taking this action will resolve the following 6 different vulnerabilities :
CVE-2025-7425, CVE-2025-6021, CVE-2025-49796, CVE-2025-49794, CVE-2025-32415
CVE-2025-32414
[ RHEL 9 : libxml2 (RHSA-2025:22376) (277206) ]
+ Action to take : Update the RHEL libxml2 package based on the guidance in RHSA-2025:22376.
+ Impact : Taking this action will resolve the following 6 different vulnerabilities :
CVE-2025-9900, CVE-2025-9714, CVE-2025-8176, CVE-2025-24928, CVE-2024-56171
CVE-2022-49043
[ RHEL 9 : libxslt (RHSA-2025:4025) (234772) ]
+ Action to take : Update the RHEL libxslt package based on the guidance in RHSA-2025:4025.
+ Impact : Taking this action will resolve the following 2 different vulnerabilities :
CVE-2025-24855, CVE-2024-55549
[ RHEL 9 : libxslt (RHSA-2025:7410) (237326) ]
+ Action to take : Update the RHEL libxslt package based on the guidance in RHSA-2025:7410.
[ RHEL 9 : microcode_ctl (RHSA-2025:7043) (235814) ]
+ Action to take : Update the RHEL microcode_ctl package based on the guidance in RHSA-2025:7043.
+ Impact : Taking this action will resolve the following 3 different vulnerabilities :
CVE-2024-39279, CVE-2024-31157, CVE-2024-28047
[ RHEL 9 : mpg123:1.32.9 (RHSA-2024:11242) (213162) ]
+ Action to take : Update the RHEL mpg123:1.32.9 package based on the guidance in RHSA-2024:11242.
[ RHEL 9 : mysql (RHSA-2025:16086) (265353) ]
+ Action to take : Update the RHEL mysql package based on the guidance in RHSA-2025:16086.
+ Impact : Taking this action will resolve the following 51 different vulnerabilities :
CVE-2025-53023, CVE-2025-50104, CVE-2025-50102, CVE-2025-50101, CVE-2025-50100
CVE-2025-50099, CVE-2025-50098, CVE-2025-50097, CVE-2025-50096, CVE-2025-50094
CVE-2025-50093, CVE-2025-50092, CVE-2025-50091, CVE-2025-50088, CVE-2025-50087
CVE-2025-50086, CVE-2025-50085, CVE-2025-50084, CVE-2025-50083, CVE-2025-50082
CVE-2025-50081, CVE-2025-50080, CVE-2025-50079, CVE-2025-50078, CVE-2025-50077
CVE-2025-30722, CVE-2025-30721, CVE-2025-30715, CVE-2025-30705, CVE-2025-30704
CVE-2025-30703, CVE-2025-30699, CVE-2025-30696, CVE-2025-30695, CVE-2025-30693
CVE-2025-30689, CVE-2025-30688, CVE-2025-30687, CVE-2025-30685, CVE-2025-30684
CVE-2025-30683, CVE-2025-30682, CVE-2025-30681, CVE-2025-21585, CVE-2025-21584
CVE-2025-21581, CVE-2025-21580, CVE-2025-21579, CVE-2025-21577, CVE-2025-21575
CVE-2025-21574
[ RHEL 9 : mysql (RHSA-2025:23109) (278342) ]
+ Action to take : Update the RHEL mysql package based on the guidance in RHSA-2025:23109.
+ Impact : Taking this action will resolve the following 57 different vulnerabilities :
CVE-2025-53069, CVE-2025-53062, CVE-2025-53054, CVE-2025-53053, CVE-2025-53045
CVE-2025-53044, CVE-2025-53042, CVE-2025-53040, CVE-2025-21559, CVE-2025-21555
CVE-2025-21546, CVE-2025-21543, CVE-2025-21540, CVE-2025-21536, CVE-2025-21534
CVE-2025-21531, CVE-2025-21529, CVE-2025-21525, CVE-2025-21523, CVE-2025-21522
CVE-2025-21521, CVE-2025-21520, CVE-2025-21519, CVE-2025-21518, CVE-2025-21505
CVE-2025-21504, CVE-2025-21503, CVE-2025-21501, CVE-2025-21500, CVE-2025-21497
CVE-2025-21494, CVE-2025-21491, CVE-2025-21490, CVE-2024-7264, CVE-2024-5535
CVE-2024-37371, CVE-2024-21247, CVE-2024-21241, CVE-2024-21239, CVE-2024-21238
CVE-2024-21237, CVE-2024-21236, CVE-2024-21231, CVE-2024-21230, CVE-2024-21219
CVE-2024-21218, CVE-2024-21213, CVE-2024-21212, CVE-2024-21203, CVE-2024-21201
CVE-2024-21199, CVE-2024-21198, CVE-2024-21197, CVE-2024-21196, CVE-2024-21194
CVE-2024-21193, CVE-2024-11053
[ RHEL 9 : ncurses (RHSA-2025:12876) (243554) ]
+ Action to take : Update the RHEL ncurses package based on the guidance in RHSA-2025:12876.
[ RHEL 9 : open-vm-tools (RHSA-2025:17428) (269220) ]
+ Action to take : Update the RHEL open-vm-tools package based on the guidance in RHSA-2025:17428.
[ RHEL 9 : openjpeg2 (RHSA-2025:7309) (235812) ]
+ Action to take : Update the RHEL openjpeg2 package based on the guidance in RHSA-2025:7309.
+ Impact : Taking this action will resolve the following 2 different vulnerabilities :
CVE-2024-56827, CVE-2024-56826
[ RHEL 9 : openssh (RHSA-2025:23480) (278995) ]
+ Action to take : Update the RHEL openssh package based on the guidance in RHSA-2025:23480.
+ Impact : Taking this action will resolve the following 3 different vulnerabilities :
CVE-2025-61985, CVE-2025-61984, CVE-2025-26465
[ RHEL 9 : openssl (RHSA-2025:21255) (275299) ]
+ Action to take : Update the RHEL openssl package based on the guidance in RHSA-2025:21255.
+ Impact : Taking this action will resolve the following 2 different vulnerabilities :
CVE-2025-9230, CVE-2024-12797
[ RHEL 9 : pam (RHSA-2024:11250) (213155) ]
+ Action to take : Update the RHEL pam package based on the guidance in RHSA-2024:11250.
+ Impact : Taking this action will resolve the following 2 different vulnerabilities :
CVE-2024-10963, CVE-2024-10041
[ RHEL 9 : pam (RHSA-2025:15099) (261135) ]
+ Action to take : Update the RHEL pam package based on the guidance in RHSA-2025:15099.
+ Impact : Taking this action will resolve the following 2 different vulnerabilities :
CVE-2025-8941, CVE-2025-6020
[ RHEL 9 : perl (RHSA-2025:11804) (242909) ]
+ Action to take : Update the RHEL perl package based on the guidance in RHSA-2025:11804.
[ RHEL 9 : pesign (RHSA-2023:1067) (172117) ]
+ Action to take : Update the RHEL pesign package based on the guidance in RHSA-2023:1067.
[ RHEL 9 : pixman (RHSA-2023:7754) (186804) ]
+ Action to take : Update the RHEL pixman package based on the guidance in RHSA-2023:7754.
[ RHEL 9 : podman (RHSA-2024:9051) (210749) ]
+ Action to take : Update the RHEL podman package based on the guidance in RHSA-2024:9051.
+ Impact : Taking this action will resolve the following 16 different vulnerabilities :
CVE-2024-9676, CVE-2024-9675, CVE-2024-9407, CVE-2024-9341, CVE-2024-6104
CVE-2024-37298, CVE-2024-34158, CVE-2024-34156, CVE-2024-34155, CVE-2024-28180
CVE-2024-28176, CVE-2024-24786, CVE-2024-24783, CVE-2024-1753, CVE-2024-1394
CVE-2023-45290
[ RHEL 9 : podman (RHSA-2025:15900) (264871) ]
+ Action to take : Update the RHEL podman package based on the guidance in RHSA-2025:15900.
+ Impact : Taking this action will resolve the following 5 different vulnerabilities :
CVE-2025-9566, CVE-2025-6032, CVE-2025-27144, CVE-2025-22871, CVE-2025-22869
[ RHEL 9 : podman (RHSA-2025:23325) (279118) ]
+ Action to take : Update the RHEL podman package based on the guidance in RHSA-2025:23325.
+ Impact : Taking this action will resolve the following 13 different vulnerabilities :
CVE-2025-9566, CVE-2025-58183, CVE-2025-52881, CVE-2025-47907, CVE-2025-22869
CVE-2024-9676, CVE-2024-9675, CVE-2024-9407, CVE-2024-9341, CVE-2024-34158
CVE-2024-34156, CVE-2024-34155, CVE-2024-11218
[ RHEL 9 : protobuf (RHSA-2025:7138) (235830) ]
+ Action to take : Update the RHEL protobuf package based on the guidance in RHSA-2025:7138.
[ RHEL 9 : python-requests (RHSA-2025:12519) (243456) ]
+ Action to take : Update the RHEL python-requests package based on the guidance in RHSA-2025:12519.
[ RHEL 9 : python-requests (RHSA-2025:7049) (235796) ]
+ Action to take : Update the RHEL python-requests package based on the guidance in RHSA-2025:7049.
[ RHEL 9 : python-setuptools (RHSA-2025:10407) (241448) ]
+ Action to take : Update the RHEL python-setuptools package based on the guidance in RHSA-2025:10407.
[ RHEL 9 : python3.9 (RHSA-2025:15019) (260451) ]
+ Action to take : Update the RHEL python3.9 package based on the guidance in RHSA-2025:15019.
+ Impact : Taking this action will resolve the following 6 different vulnerabilities :
CVE-2025-8194, CVE-2025-4517, CVE-2025-4435, CVE-2025-4330, CVE-2025-4138
CVE-2024-12718
[ RHEL 9 : python3.9 (RHSA-2025:23342) (279115) ]
+ Action to take : Update the RHEL python3.9 package based on the guidance in RHSA-2025:23342.
+ Impact : Taking this action will resolve the following 8 different vulnerabilities :
CVE-2025-8291, CVE-2025-6075, CVE-2025-6069, CVE-2025-0938, CVE-2024-9287
CVE-2024-6232, CVE-2024-5642, CVE-2024-11168
[ RHEL 9 : qemu-kvm (RHSA-2025:4492) (235344) ]
+ Action to take : Update the RHEL qemu-kvm package based on the guidance in RHSA-2025:4492.
+ Impact : Taking this action will resolve the following 2 different vulnerabilities :
CVE-2024-3567, CVE-2023-6693
[ RHEL 9 : rhc (RHSA-2025:7326) (235809) ]
+ Action to take : Update the RHEL rhc package based on the guidance in RHSA-2025:7326.
+ Impact : Taking this action will resolve the following 3 different vulnerabilities :
CVE-2025-22866, CVE-2024-45336, CVE-2022-3064
[ RHEL 9 : rsync (RHSA-2025:7050) (235800) ]
+ Action to take : Update the RHEL rsync package based on the guidance in RHSA-2025:7050.
+ Impact : Taking this action will resolve the following 4 different vulnerabilities :
CVE-2024-12747, CVE-2024-12088, CVE-2024-12087, CVE-2024-12085
[ RHEL 9 : shadow-utils (RHSA-2025:20559) (274721) ]
+ Action to take : Update the RHEL shadow-utils package based on the guidance in RHSA-2025:20559.
[ RHEL 9 : shim update (Important) (RHSA-2024:1903) (193660) ]
+ Action to take : Update the affected shim-aa64 and / or shim-x64 packages.
+ Impact : Taking this action will resolve the following 6 different vulnerabilities :
CVE-2023-40551, CVE-2023-40550, CVE-2023-40549, CVE-2023-40548, CVE-2023-40547
CVE-2023-40546
[ RHEL 9 : sqlite (RHSA-2025:11992) (242957) ]
+ Action to take : Update the RHEL sqlite package based on the guidance in RHSA-2025:11992.
[ RHEL 9 : sqlite (RHSA-2025:20936) (274798) ]
+ Action to take : Update the RHEL sqlite package based on the guidance in RHSA-2025:20936.
[ RHEL 9 : sssd (RHSA-2025:20954) (274829) ]
+ Action to take : Update the RHEL sssd package based on the guidance in RHSA-2025:20954.
[ RHEL 9 : sudo (RHSA-2025:9978) (241023) ]
+ Action to take : Update the RHEL sudo package based on the guidance in RHSA-2025:9978.
[ RHEL 9 : systemd (RHSA-2025:22660) (277373) ]
+ Action to take : Update the RHEL systemd package based on the guidance in RHSA-2025:22660.
[ RHEL 9 : tbb (RHSA-2025:1210) (215456) ]
+ Action to take : Update the RHEL tbb package based on the guidance in RHSA-2025:1210.
[ RHEL 9 : tigervnc (RHSA-2025:19489) (272222) ]
+ Action to take : Update the RHEL tigervnc package based on the guidance in RHSA-2025:19489.
+ Impact : Taking this action will resolve the following 8 different vulnerabilities :
CVE-2025-62231, CVE-2025-62230, CVE-2025-62229, CVE-2025-49180, CVE-2025-49179
CVE-2025-49178, CVE-2025-49176, CVE-2025-49175
[ RHEL 9 : tigervnc (RHSA-2025:20958) (274821) ]
+ Action to take : Update the RHEL tigervnc package based on the guidance in RHSA-2025:20958.
+ Impact : Taking this action will resolve the following 12 different vulnerabilities :
CVE-2025-62231, CVE-2025-62230, CVE-2025-62229, CVE-2025-26601, CVE-2025-26600
CVE-2025-26599, CVE-2025-26598, CVE-2025-26597, CVE-2025-26596, CVE-2025-26595
CVE-2025-26594, CVE-2024-9632
[ RHEL 9 : tuned (RHSA-2024:10384) (211878) ]
+ Action to take : Update the RHEL tuned package based on the guidance in RHSA-2024:10384.
+ Impact : Taking this action will resolve the following 2 different vulnerabilities :
CVE-2024-52337, CVE-2024-52336
[ RHEL 9 : udisks2 (RHSA-2025:15018) (260445) ]
+ Action to take : Update the RHEL udisks2 package based on the guidance in RHSA-2025:15018.
[ RHEL 9 : unbound (RHSA-2025:11849) (242904) ]
+ Action to take : Update the RHEL unbound package based on the guidance in RHSA-2025:11849.
+ Impact : Taking this action will resolve the following 2 different vulnerabilities :
CVE-2025-5994, CVE-2024-8508
[ RHEL 9 : unbound:1.16.2 (RHSA-2024:11232) (213152) ]
+ Action to take : Update the RHEL unbound:1.16.2 package based on the guidance in RHSA-2024:11232.
[ RHEL 9 : vim (RHSA-2025:17742) (270117) ]
+ Action to take : Update the RHEL vim package based on the guidance in RHSA-2025:17742.
+ Impact : Taking this action will resolve the following 3 different vulnerabilities :
CVE-2025-53906, CVE-2025-53905, CVE-2023-4752
[ RHEL 9 : vim (RHSA-2025:20945) (274774) ]
+ Action to take : Update the RHEL vim package based on the guidance in RHSA-2025:20945.
+ Impact : Taking this action will resolve the following 2 different vulnerabilities :
CVE-2025-53906, CVE-2025-53905
[ RHEL 9 : webkit2gtk3 (RHSA-2024:8180) (209157) ]
+ Action to take : Update the RHEL webkit2gtk3 package based on the guidance in RHSA-2024:8180.
+ Impact : Taking this action will resolve the following 18 different vulnerabilities :
CVE-2024-54534, CVE-2024-4558, CVE-2024-44187, CVE-2024-44185, CVE-2024-40866
CVE-2024-40789, CVE-2024-40782, CVE-2024-40780, CVE-2024-40779, CVE-2024-40776
CVE-2024-27856, CVE-2024-27851, CVE-2024-27838, CVE-2024-27820, CVE-2024-23284
CVE-2024-23280, CVE-2024-23263, CVE-2024-23254
[ RHEL 9 : webkit2gtk3 (RHSA-2025:18097) (270564) ]
+ Action to take : Update the RHEL webkit2gtk3 package based on the guidance in RHSA-2025:18097.
+ Impact : Taking this action will resolve the following 23 different vulnerabilities :
CVE-2025-6558, CVE-2025-43368, CVE-2025-43356, CVE-2025-43343, CVE-2025-43342
CVE-2025-43272, CVE-2025-43265, CVE-2025-43240, CVE-2025-43227, CVE-2025-43216
CVE-2025-43212, CVE-2025-43211, CVE-2025-31278, CVE-2025-31273, CVE-2025-31257
CVE-2025-31205, CVE-2025-30427, CVE-2025-24216, CVE-2025-24209, CVE-2025-24208
CVE-2024-54551, CVE-2024-54467, CVE-2024-44192
[ RHEL 9 : webkit2gtk3 (RHSA-2025:23700) (279266) ]
+ Action to take : Update the RHEL webkit2gtk3 package based on the guidance in RHSA-2025:23700.
+ Impact : Taking this action will resolve the following 48 different vulnerabilities :
CVE-2025-66287, CVE-2025-43541, CVE-2025-43536, CVE-2025-43535, CVE-2025-43531
CVE-2025-43529, CVE-2025-43501, CVE-2025-43458, CVE-2025-43443, CVE-2025-43440
CVE-2025-43434, CVE-2025-43432, CVE-2025-43431, CVE-2025-43430, CVE-2025-43429
CVE-2025-43427, CVE-2025-43425, CVE-2025-43421, CVE-2025-43392, CVE-2025-43368
CVE-2025-43356, CVE-2025-43343, CVE-2025-43342, CVE-2025-43272, CVE-2025-30427
CVE-2025-24216, CVE-2025-24209, CVE-2025-24208, CVE-2025-24201, CVE-2025-24189
CVE-2025-24162, CVE-2025-13947, CVE-2025-13502, CVE-2024-54551, CVE-2024-54543
CVE-2024-54534, CVE-2024-54508, CVE-2024-54505, CVE-2024-54502, CVE-2024-54479
CVE-2024-54467, CVE-2024-44309, CVE-2024-44244, CVE-2024-44192, CVE-2024-44187
CVE-2024-44185, CVE-2024-40866, CVE-2024-27856
[ RHEL 9 : xdg-utils (RHSA-2025:7672) (236806) ]
+ Action to take : Update the RHEL xdg-utils package based on the guidance in RHSA-2025:7672.
[ RHEL 9 : xorg-x11-server (RHSA-2025:20961) (274822) ]
+ Action to take : Update the RHEL xorg-x11-server package based on the guidance in RHSA-2025:20961.
+ Impact : Taking this action will resolve the following 12 different vulnerabilities :
CVE-2025-62231, CVE-2025-62230, CVE-2025-62229, CVE-2025-26601, CVE-2025-26600
CVE-2025-26599, CVE-2025-26598, CVE-2025-26597, CVE-2025-26596, CVE-2025-26595
CVE-2025-26594, CVE-2024-9632
[ RHEL 9 : xorg-x11-server update (Moderate) (RHSA-2025:19433) (272189) ]
+ Action to take : Update the affected packages.
+ Impact : Taking this action will resolve the following 8 different vulnerabilities :
CVE-2025-62231, CVE-2025-62230, CVE-2025-62229, CVE-2025-49180, CVE-2025-49179
CVE-2025-49178, CVE-2025-49176, CVE-2025-49175
[ RHEL 9 : xorg-x11-server-Xwayland (RHSA-2025:20960) (274762) ]
+ Action to take : Update the RHEL xorg-x11-server-Xwayland packages based on the guidance in RHSA-2025:20960.
+ Impact : Taking this action will resolve the following 9 different vulnerabilities :
CVE-2025-26601, CVE-2025-26600, CVE-2025-26599, CVE-2025-26598, CVE-2025-26597
CVE-2025-26596, CVE-2025-26595, CVE-2025-26594, CVE-2024-9632
[ RHEL 9 : xorg-x11-server-Xwayland update (Moderate) (RHSA-2025:19623) (272261) ]
+ Action to take : Update the affected xorg-x11-server-Xwayland and / or xorg-x11-server-Xwayland-devel packages.
+ Impact : Taking this action will resolve the following 3 different vulnerabilities :
CVE-2025-62231, CVE-2025-62230, CVE-2025-62229
[ RHEL 9 : yelp (RHSA-2025:7430) (237368) ]
+ Action to take : Update the RHEL yelp package based on the guidance in RHSA-2025:7430.
233359 - Podman Installed (Linux)
-
Synopsis
Podman was detected on the remote host.
Description
Podman, a daemonless, open source, Linux native tool designed to make it easy to find, run, build, share and deploy applications using Open Containers Initiative (OCI) Containers and Container Images, is installed on the remote host.
See Also

https://docs.podman.io/en/latest/

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2025/03/26, Modified: 2025/12/18
Plugin Output

## tcp/0

Path : podman-5.2.2-1.el9 (via package manager)
Version : 5.2.2
Managed by OS : True
45432 - Processor Information (via DMI)
-
Synopsis
Nessus was able to read information about the remote system's processor.
Description
Nessus was able to retrieve information about the remote system's hardware, such as its processor type, by using the SMBIOS (aka DMI) interface.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2010/04/06, Modified: 2016/02/25
Plugin Output

## tcp/0

Nessus detected 16 processors :
Current Speed : 3433 MHz
Version : INTEL(R) XEON(R) GOLD 6544Y
Manufacturer : GenuineIntel
External Clock : Unknown
Status : Populated, Enabled
Family : Unknown
Type : Central Processor
Current Speed : 3433 MHz
Version : INTEL(R) XEON(R) GOLD 6544Y
Manufacturer : GenuineIntel
External Clock : Unknown
Status : Populated, Enabled
Family : Unknown
Type : Central Processor
Current Speed : 3433 MHz
Version : INTEL(R) XEON(R) GOLD 6544Y
Manufacturer : GenuineIntel
External Clock : Unknown
Status : Populated, Enabled
Family : Unknown
Type : Central Processor
Current Speed : 3433 MHz
Version : INTEL(R) XEON(R) GOLD 6544Y
Manufacturer : GenuineIntel
External Clock : Unknown
Status : Populated, Enabled
Family : Unknown
Type : Central Processor
Current Speed : 3433 MHz
Version : INTEL(R) XEON(R) GOLD 6544Y
Manufacturer : GenuineIntel
External Clock : Unknown
Status : Populated, Enabled
Family : Unknown
Type : Central Processor
Current Speed : 3433 MHz
Version : INTEL(R) XEON(R) GOLD 6544Y
Manufacturer : GenuineIntel
External Clock : Unknown
Status : Populated, Enabled
Family : Unknown
Type : Central Processor
Current Speed : 3433 MHz
Version : INTEL(R) XEON(R) GOLD 6544Y
Manufacturer : GenuineIntel
External Clock : Unknown
Status : Populated, Enabled
Family : Unknown
Type : Central Processor
Current Speed : 3433 MHz
Version : INTEL(R) XEON(R) GOLD 6544Y
Manufacturer : GenuineIntel
External Clock : Unknown
Status : Populated, Enabled
Family : Unknown
Type : Central Processor
Current Speed : 3433 MHz
Version : INTEL(R) XEON(R) GOLD 6544Y
Manufacturer : GenuineIntel
External Clock : Unknown
Status : Populated, Enabled
Family : Unknown
Type : Central Processor
Current Speed : 3433 MHz
Version : INTEL(R) XEON(R) GOLD 6544Y
Manufacturer : GenuineIntel
External Clock : Unknown
Status : Populated, Enabled
Family : Unknown
Type : Central Processor
Current Speed : 3433 MHz
Version : INTEL(R) XEON(R) GOLD 6544Y
Manufacturer : GenuineIntel
External Clock : Unknown
Status : Populated, Enabled
Family : Unknown
Type : Central Processor
Current Speed : 3433 MHz
Version : INTEL(R) XEON(R) GOLD 6544Y
Manufacturer : GenuineIntel
External Clock : Unknown
Status : Populated, Enabled
Family : Unknown
Type : Central Processor
Current Speed : 3433 MHz
Version : INTEL(R) XEON(R) GOLD 6544Y
Manufacturer : GenuineIntel
External Clock : Unknown
Status : Populated, Enabled
Family : Unknown
Type : Central Processor
Current Speed : 3433 MHz
Version : INTEL(R) XEON(R) GOLD 6544Y
Manufacturer : GenuineIntel
External Clock : Unknown
Status : Populated, Enabled
Family : Unknown
Type : Central Processor
Current Speed : 3433 MHz
Version : INTEL(R) XEON(R) GOLD 6544Y
Manufacturer : GenuineIntel
External Clock : Unknown
Status : Populated, Enabled
Family : Unknown
Type : Central Processor
Current Speed : 3433 MHz
Version : INTEL(R) XEON(R) GOLD 6544Y
Manufacturer : VMware Virtual RAM
External Clock : Unknown
Status : No errors detected
Family : Unknown
Type : OK
149983 - Red Hat Enterprise Linux : Enabled Official Repositories
-
Synopsis
The remote host is using one or more official Red Hat repositories to install packages.
Description
The remote host is using one or more official Red Hat repositories to install packages.
These repositories will be used in conjunction with Red Hat OS package level assessment security advisories to determine whether or not relevant repositories are installed before checking package versions for vulnerable ranges.
See Also

https://www.redhat.com/security/data/metrics/repository-to-cpe.json

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2021/05/26, Modified: 2025/07/22
Plugin Output

## tcp/0

The following invalid RHEL repo labels were found with no accompanying relative URL.
Host Invalid Repo Label : mysql-connectors-community
Host Invalid Repo Label : epel-cisco-openh264
Host Invalid Repo Label : epel
Host Invalid Repo Label : packages-microsoft-com-prod
Host Invalid Repo Label : RHEL-9.5-APPSTREAM
Host Invalid Repo Label : RHEL-9.5-BASEOS
Host Invalid Repo Label : mysql-tools-8.4-lts-community
Host Invalid Repo Label : mysql-8.4-lts-community
As there were no official RHEL repository labels or relative URLs found to be enabled,
vulnerability dectection plugins in the Red Hat Local Security Checks family will be
unabled to tell if the fixed packages referenced by their respective advisories are
enabled on this host or not. Please note that this could potentially result in false
positive findings. Tenable recommends using either official labels and/or relative URLs
where possible, to ensure that Nessus can accurately validate one or the other.

##

100635 - Redis Server Detection
-
Synopsis
A document-oriented database system is running on the remote host.
Description
Redis, a document-oriented database system, is running on the remote host.
See Also

https://redis.io

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2017/06/06, Modified: 2025/09/29
Plugin Output

## tcp/6379/redis_server

Service : redis_server
Version : 6.2.17

##

10940 - Remote Desktop Protocol Service Detection
-
Synopsis
The remote host has an remote desktop protocol service enabled.
Description
The Remote Desktop Protocol allows a user to remotely obtain a graphical login (and therefore act as a local user on the remote host).
If an attacker gains a valid login and password, this service could be used to gain further access on the remote host. An attacker may also use this service to mount a dictionary attack against the remote host to try to log in remotely.
Note that RDP (the Remote Desktop Protocol) is vulnerable to Man-in-the-middle attacks, making it easy for attackers to steal the credentials of legitimate users by impersonating the Windows server.
Solution
Disable the service if you do not use it, and do not allow this service to run across the Internet.
Risk Factor
None
Plugin Information
Published: 2002/04/20, Modified: 2023/08/21
Plugin Output

## tcp/3389/msrdp

##

277650 - Remote Services Not Using Post-Quantum Ciphers
-
Synopsis
Reports remote services that do not offer post-quantum ciphers.
Description
This plugin reports network services that do not offer post-quantum ciphers. Tenable makes no attempt to determine whether the remote service would be vulnerable to a post-quantum attack.
However, cryptography that depends on the classic difficulty of solving the discrete logarithm problem or on the classic difficulty of large prime factorization is broken by Shor's algorithm. Examples of this are RSA asymmetric encryption and Diffie-Hellman key exchange.
See Also

http://www.nessus.org/u?7a390f87
http://www.nessus.org/u?ad7d6b3b
http://www.nessus.org/u?1c0c61e0
http://www.nessus.org/u?5eec4b28

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2025/12/08, Modified: 2025/12/08
Plugin Output

## tcp/22/ssh

The target SSH server offers no post-quantum ciphers.

##

277650 - Remote Services Not Using Post-Quantum Ciphers
-
Synopsis
Reports remote services that do not offer post-quantum ciphers.
Description
This plugin reports network services that do not offer post-quantum ciphers. Tenable makes no attempt to determine whether the remote service would be vulnerable to a post-quantum attack.
However, cryptography that depends on the classic difficulty of solving the discrete logarithm problem or on the classic difficulty of large prime factorization is broken by Shor's algorithm. Examples of this are RSA asymmetric encryption and Diffie-Hellman key exchange.
See Also

http://www.nessus.org/u?7a390f87
http://www.nessus.org/u?ad7d6b3b
http://www.nessus.org/u?1c0c61e0
http://www.nessus.org/u?5eec4b28

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2025/12/08, Modified: 2025/12/08
Plugin Output

## tcp/3389/msrdp

The target TLS server offers no post-quantum ciphers.

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## tcp/22/ssh

Process ID : 1202
Executable : /usr/sbin/sshd
Command line : sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## tcp/2182

Process ID : 76527
Executable : /usr/lib/jvm/java-11-openjdk-11.0.24.0.8-2.el9.x86_64/bin/java
Command line : java -Xmx512M -Xms512M -server -XX:+UseG1GC -XX:MaxGCPauseMillis=20 -XX:InitiatingHeapOccupancyPercent=35 -XX:+ExplicitGCInvokesConcurrent -XX:MaxInlineLevel=15 -Djava.awt.headless=true -Xlog:gc*:file=/home/odin/manager/kafka/bin/../logs/zookeeper-gc.log:time,tags:filecount=10,filesize=100M -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false -Dkafka.logs.dir=/home/odin/manager/kafka/bin/../logs -Dlog4j.configuration=file:/home/odin/manager/kafka/bin/../config/log4j.properties -cp /home/odin/manager/kafka/bin/../libs/activation-1.1.1.jar:/home/odin/manager/kafka/bin/../libs/aopalliance-repackaged-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/argparse4j-0.7.0.jar:/home/odin/manager/kafka/bin/../libs/audience-annotations-0.5.0.jar:/home/odin/manager/kafka/bin/../libs/commons-cli-1.4.jar:/home/odin/manager/kafka/bin/../libs/commons-lang3-3.8.1.jar:/home/odin/manager/kafka/bin/../libs/connect-api-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-basic-auth-extension-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-json-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-mirror-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-mirror-client-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-runtime-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-transforms-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/hk2-api-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/hk2-locator-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/hk2-utils-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/jackson-annotations-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-core-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-databind-2.12.6.1.jar:/home/odin/manager/kafka/bin/../libs/jackson-dataformat-csv-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-datatype-jdk8-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-jaxrs-base-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-jaxrs-json-provider-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-module-jaxb-annotations-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-module-scala_2.13-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jakarta.activation-api-1.2.1.jar:/home/odin/manager/kafka/bin/../libs/jakarta.annotation-api-1.3.5.jar:/home/odin/manager/kafka/bin/../libs/jakarta.inject-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/jakarta.validation-api-2.0.2.jar:/home/odin/manager/kafka/bin/../libs/jakarta.ws.rs-api-2.1.6.jar:/home/odin/manager/kafka/bin/../libs/jakarta.xml.bind-api-2.3.2.jar:/home/odin/manager/kafka/bin/../libs/javassist-3.27.0-GA.jar:/home/odin/manager/kafka/bin/../libs/javax.servlet-api-3.1.0.jar:/home/odin/manager/kafka/bin/../libs/javax.ws.rs-api-2.1.1.jar:/home/odin/manager/kafka/bin/../libs/jaxb-api-2.3.0.jar:/home/odin/manager/kafka/bin/../libs/jersey-client-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-common-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-container-servlet-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-container-servlet-core-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-hk2-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-server-2.34.jar:/home/odin/manager/kafka/bin/../libs/jetty-client-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-continuation-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-http-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-io-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-security-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-server-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-servlet-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-servlets-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-util-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-util-ajax-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jline-3.21.0.jar:/home/odin/manager/kafka/bin/../libs/jopt-simple-5.0.4.jar:/home/odin/manager/kafka/bin/../libs/jose4j-0.7.9.jar:/home/odin/manager/kafka/bin/../libs/kafka_2.13-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-clients-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-log4j-appender-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-metadata-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-raft-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-server-common-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-shell-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-storage-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-storage-api-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-examples-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-scala_2.13-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-test-utils-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-tools-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/lz4-java-1.8.0.jar:/home/odin/manager/kafka/bin/../libs/maven-artifact-3.8.4.jar:/home/odin/manager/kafka/bin/../libs/metrics-core-2.2.0.jar:/home/odin/manager/kafka/bin/../libs/metrics-core-4.1.12.1.jar:/home/odin/manager/kafka/bin/../libs/netty-buffer-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-codec-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-common-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-handler-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-resolver-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-tcnative-classes-2.0.46.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-classes-epoll-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-native-epoll-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-native-unix-common-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/osgi-resource-locator-1.0.3.jar:/home/odin/manager/kafka/bin/../libs/paranamer-2.8.jar:/home/odin/manager/kafka/bin/../libs/plexus-utils-3.3.0.jar:/home/odin/manager/kafka/bin/../libs/reflections-0.9.12.jar:/home/odin/manager/kafka/bin/../libs/reload4j-1.2.19.jar:/home/odin/manager/kafka/bin/../libs/rocksdbjni-6.29.4.1.jar:/home/odin/manager/kafka/bin/../libs/scala-collection-compat_2.13-2.6.0.jar:/home/odin/manager/kafka/bin/../libs/scala-java8-compat_2.13-1.0.2.jar:/home/odin/manager/kafka/bin/../libs/scala-library-2.13.8.jar:/home/odin/manager/kafka/bin/../libs/scala-logging_2.13-3.9.4.jar:/home/odin/manager/kafka/bin/../libs/scala-reflect-2.13.8.jar:/home/odin/manager/kafka/bin/../libs/slf4j-api-1.7.36.jar:/home/odin/manager/kafka/bin/../libs/slf4j-reload4j-1.7.36.jar:/home/odin/manager/kafka/bin/../libs/snappy-java-1.1.8.4.jar:/home/odin/manager/kafka/bin/../libs/trogdor-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/zookeeper-3.6.3.jar:/home/odin/manager/kafka/bin/../libs/zookeeper-jute-3.6.3.jar:/home/odin/manager/kafka/bin/../libs/zstd-jni-1.5.2-1.jar org.apache.zookeeper.server.quorum.QuorumPeerMain /home/odin/manager/kafka/config/zookeeper.properties

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## tcp/3389/msrdp

Process ID : 1243
Executable : /usr/sbin/xrdp
Command line : /usr/sbin/xrdp --nodaemon

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## udp/5353/mdns

Process ID : 1063
Executable : /usr/sbin/avahi-daemon
Command line : avahi-daemon: running [LKPOMSHAPRI.local]

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## tcp/6379/redis_server

Process ID : 82163
Executable : /home/odin/manager/Bin/redis-server/redis-server
Command line : ./redis-server 0.0.0.0:6379

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## tcp/7013

Process ID : 100387
Executable : /home/odin/manager/Bin/MarketInformationServer
Command line : ./MarketInformationServer

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## tcp/7777

Process ID : 91075
Executable : /home/odin/manager/Bin/odinmgr_Linux
Command line : ./odinmgr_Linux auto

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## udp/7777

Process ID : 91075
Executable : /home/odin/manager/Bin/odinmgr_Linux
Command line : ./odinmgr_Linux auto

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## udp/8013

Process ID : 100387
Executable : /home/odin/manager/Bin/MarketInformationServer
Command line : ./MarketInformationServer

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## tcp/8080/www

Process ID : 76527
Executable : /usr/lib/jvm/java-11-openjdk-11.0.24.0.8-2.el9.x86_64/bin/java
Command line : java -Xmx512M -Xms512M -server -XX:+UseG1GC -XX:MaxGCPauseMillis=20 -XX:InitiatingHeapOccupancyPercent=35 -XX:+ExplicitGCInvokesConcurrent -XX:MaxInlineLevel=15 -Djava.awt.headless=true -Xlog:gc*:file=/home/odin/manager/kafka/bin/../logs/zookeeper-gc.log:time,tags:filecount=10,filesize=100M -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false -Dkafka.logs.dir=/home/odin/manager/kafka/bin/../logs -Dlog4j.configuration=file:/home/odin/manager/kafka/bin/../config/log4j.properties -cp /home/odin/manager/kafka/bin/../libs/activation-1.1.1.jar:/home/odin/manager/kafka/bin/../libs/aopalliance-repackaged-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/argparse4j-0.7.0.jar:/home/odin/manager/kafka/bin/../libs/audience-annotations-0.5.0.jar:/home/odin/manager/kafka/bin/../libs/commons-cli-1.4.jar:/home/odin/manager/kafka/bin/../libs/commons-lang3-3.8.1.jar:/home/odin/manager/kafka/bin/../libs/connect-api-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-basic-auth-extension-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-json-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-mirror-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-mirror-client-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-runtime-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-transforms-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/hk2-api-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/hk2-locator-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/hk2-utils-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/jackson-annotations-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-core-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-databind-2.12.6.1.jar:/home/odin/manager/kafka/bin/../libs/jackson-dataformat-csv-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-datatype-jdk8-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-jaxrs-base-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-jaxrs-json-provider-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-module-jaxb-annotations-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-module-scala_2.13-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jakarta.activation-api-1.2.1.jar:/home/odin/manager/kafka/bin/../libs/jakarta.annotation-api-1.3.5.jar:/home/odin/manager/kafka/bin/../libs/jakarta.inject-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/jakarta.validation-api-2.0.2.jar:/home/odin/manager/kafka/bin/../libs/jakarta.ws.rs-api-2.1.6.jar:/home/odin/manager/kafka/bin/../libs/jakarta.xml.bind-api-2.3.2.jar:/home/odin/manager/kafka/bin/../libs/javassist-3.27.0-GA.jar:/home/odin/manager/kafka/bin/../libs/javax.servlet-api-3.1.0.jar:/home/odin/manager/kafka/bin/../libs/javax.ws.rs-api-2.1.1.jar:/home/odin/manager/kafka/bin/../libs/jaxb-api-2.3.0.jar:/home/odin/manager/kafka/bin/../libs/jersey-client-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-common-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-container-servlet-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-container-servlet-core-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-hk2-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-server-2.34.jar:/home/odin/manager/kafka/bin/../libs/jetty-client-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-continuation-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-http-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-io-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-security-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-server-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-servlet-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-servlets-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-util-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-util-ajax-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jline-3.21.0.jar:/home/odin/manager/kafka/bin/../libs/jopt-simple-5.0.4.jar:/home/odin/manager/kafka/bin/../libs/jose4j-0.7.9.jar:/home/odin/manager/kafka/bin/../libs/kafka_2.13-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-clients-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-log4j-appender-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-metadata-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-raft-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-server-common-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-shell-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-storage-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-storage-api-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-examples-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-scala_2.13-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-test-utils-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-tools-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/lz4-java-1.8.0.jar:/home/odin/manager/kafka/bin/../libs/maven-artifact-3.8.4.jar:/home/odin/manager/kafka/bin/../libs/metrics-core-2.2.0.jar:/home/odin/manager/kafka/bin/../libs/metrics-core-4.1.12.1.jar:/home/odin/manager/kafka/bin/../libs/netty-buffer-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-codec-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-common-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-handler-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-resolver-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-tcnative-classes-2.0.46.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-classes-epoll-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-native-epoll-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-native-unix-common-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/osgi-resource-locator-1.0.3.jar:/home/odin/manager/kafka/bin/../libs/paranamer-2.8.jar:/home/odin/manager/kafka/bin/../libs/plexus-utils-3.3.0.jar:/home/odin/manager/kafka/bin/../libs/reflections-0.9.12.jar:/home/odin/manager/kafka/bin/../libs/reload4j-1.2.19.jar:/home/odin/manager/kafka/bin/../libs/rocksdbjni-6.29.4.1.jar:/home/odin/manager/kafka/bin/../libs/scala-collection-compat_2.13-2.6.0.jar:/home/odin/manager/kafka/bin/../libs/scala-java8-compat_2.13-1.0.2.jar:/home/odin/manager/kafka/bin/../libs/scala-library-2.13.8.jar:/home/odin/manager/kafka/bin/../libs/scala-logging_2.13-3.9.4.jar:/home/odin/manager/kafka/bin/../libs/scala-reflect-2.13.8.jar:/home/odin/manager/kafka/bin/../libs/slf4j-api-1.7.36.jar:/home/odin/manager/kafka/bin/../libs/slf4j-reload4j-1.7.36.jar:/home/odin/manager/kafka/bin/../libs/snappy-java-1.1.8.4.jar:/home/odin/manager/kafka/bin/../libs/trogdor-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/zookeeper-3.6.3.jar:/home/odin/manager/kafka/bin/../libs/zookeeper-jute-3.6.3.jar:/home/odin/manager/kafka/bin/../libs/zstd-jni-1.5.2-1.jar org.apache.zookeeper.server.quorum.QuorumPeerMain /home/odin/manager/kafka/config/zookeeper.properties

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## tcp/9094

Process ID : 78605
Executable : /usr/lib/jvm/java-11-openjdk-11.0.24.0.8-2.el9.x86_64/bin/java
Command line : java -Xmx1G -Xms1G -server -XX:+UseG1GC -XX:MaxGCPauseMillis=20 -XX:InitiatingHeapOccupancyPercent=35 -XX:+ExplicitGCInvokesConcurrent -XX:MaxInlineLevel=15 -Djava.awt.headless=true -Xlog:gc*:file=/home/odin/manager/kafka/bin/../logs/kafkaServer-gc.log:time,tags:filecount=10,filesize=100M -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false -Dkafka.logs.dir=/home/odin/manager/kafka/bin/../logs -Dlog4j.configuration=file:/home/odin/manager/kafka/bin/../config/log4j.properties -cp /home/odin/manager/kafka/bin/../libs/activation-1.1.1.jar:/home/odin/manager/kafka/bin/../libs/aopalliance-repackaged-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/argparse4j-0.7.0.jar:/home/odin/manager/kafka/bin/../libs/audience-annotations-0.5.0.jar:/home/odin/manager/kafka/bin/../libs/commons-cli-1.4.jar:/home/odin/manager/kafka/bin/../libs/commons-lang3-3.8.1.jar:/home/odin/manager/kafka/bin/../libs/connect-api-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-basic-auth-extension-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-json-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-mirror-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-mirror-client-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-runtime-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-transforms-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/hk2-api-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/hk2-locator-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/hk2-utils-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/jackson-annotations-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-core-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-databind-2.12.6.1.jar:/home/odin/manager/kafka/bin/../libs/jackson-dataformat-csv-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-datatype-jdk8-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-jaxrs-base-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-jaxrs-json-provider-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-module-jaxb-annotations-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-module-scala_2.13-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jakarta.activation-api-1.2.1.jar:/home/odin/manager/kafka/bin/../libs/jakarta.annotation-api-1.3.5.jar:/home/odin/manager/kafka/bin/../libs/jakarta.inject-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/jakarta.validation-api-2.0.2.jar:/home/odin/manager/kafka/bin/../libs/jakarta.ws.rs-api-2.1.6.jar:/home/odin/manager/kafka/bin/../libs/jakarta.xml.bind-api-2.3.2.jar:/home/odin/manager/kafka/bin/../libs/javassist-3.27.0-GA.jar:/home/odin/manager/kafka/bin/../libs/javax.servlet-api-3.1.0.jar:/home/odin/manager/kafka/bin/../libs/javax.ws.rs-api-2.1.1.jar:/home/odin/manager/kafka/bin/../libs/jaxb-api-2.3.0.jar:/home/odin/manager/kafka/bin/../libs/jersey-client-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-common-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-container-servlet-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-container-servlet-core-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-hk2-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-server-2.34.jar:/home/odin/manager/kafka/bin/../libs/jetty-client-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-continuation-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-http-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-io-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-security-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-server-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-servlet-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-servlets-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-util-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-util-ajax-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jline-3.21.0.jar:/home/odin/manager/kafka/bin/../libs/jopt-simple-5.0.4.jar:/home/odin/manager/kafka/bin/../libs/jose4j-0.7.9.jar:/home/odin/manager/kafka/bin/../libs/kafka_2.13-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-clients-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-log4j-appender-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-metadata-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-raft-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-server-common-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-shell-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-storage-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-storage-api-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-examples-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-scala_2.13-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-test-utils-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-tools-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/lz4-java-1.8.0.jar:/home/odin/manager/kafka/bin/../libs/maven-artifact-3.8.4.jar:/home/odin/manager/kafka/bin/../libs/metrics-core-2.2.0.jar:/home/odin/manager/kafka/bin/../libs/metrics-core-4.1.12.1.jar:/home/odin/manager/kafka/bin/../libs/netty-buffer-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-codec-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-common-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-handler-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-resolver-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-tcnative-classes-2.0.46.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-classes-epoll-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-native-epoll-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-native-unix-common-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/osgi-resource-locator-1.0.3.jar:/home/odin/manager/kafka/bin/../libs/paranamer-2.8.jar:/home/odin/manager/kafka/bin/../libs/plexus-utils-3.3.0.jar:/home/odin/manager/kafka/bin/../libs/reflections-0.9.12.jar:/home/odin/manager/kafka/bin/../libs/reload4j-1.2.19.jar:/home/odin/manager/kafka/bin/../libs/rocksdbjni-6.29.4.1.jar:/home/odin/manager/kafka/bin/../libs/scala-collection-compat_2.13-2.6.0.jar:/home/odin/manager/kafka/bin/../libs/scala-java8-compat_2.13-1.0.2.jar:/home/odin/manager/kafka/bin/../libs/scala-library-2.13.8.jar:/home/odin/manager/kafka/bin/../libs/scala-logging_2.13-3.9.4.jar:/home/odin/manager/kafka/bin/../libs/scala-reflect-2.13.8.jar:/home/odin/manager/kafka/bin/../libs/slf4j-api-1.7.36.jar:/home/odin/manager/kafka/bin/../libs/slf4j-reload4j-1.7.36.jar:/home/odin/manager/kafka/bin/../libs/snappy-java-1.1.8.4.jar:/home/odin/manager/kafka/bin/../libs/trogdor-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/zookeeper-3.6.3.jar:/home/odin/manager/kafka/bin/../libs/zookeeper-jute-3.6.3.jar:/home/odin/manager/kafka/bin/../libs/zstd-jni-1.5.2-1.jar kafka.Kafka /home/odin/manager/kafka/config/server.properties

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## udp/9999

Process ID : 100389
Executable : /home/odin/manager/Bin/Surveillance
Command line : ./Surveillance 1

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## udp/13901

Process ID : 100677
Executable : /home/odin/manager/Bin/ExchangeAdaptor
Command line : ./ExchangeAdaptor -i268435456 -b

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## udp/15902

Process ID : 100674
Executable : /home/odin/manager/Bin/ExchangeAdaptor
Command line : ./ExchangeAdaptor -i4 -b

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## udp/18901

Process ID : 100655
Executable : /home/odin/manager/Bin/ExchangeAdaptor
Command line : ./ExchangeAdaptor -i8 -b

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## udp/19096

Process ID : 100803
Executable : /home/odin/manager/Bin/MCXMDF/FIXMDBGateway
Command line : ./FIXMDBGateway

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## udp/28446

Process ID : 100558
Executable : /home/odin/manager/Bin/ExchangeAdaptor
Command line : ./ExchangeAdaptor -i1 -b

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## udp/28702

Process ID : 100579
Executable : /home/odin/manager/Bin/ExchangeAdaptor
Command line : ./ExchangeAdaptor -i2 -b

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## udp/28958

Process ID : 100581
Executable : /home/odin/manager/Bin/ExchangeAdaptor
Command line : ./ExchangeAdaptor -i2048 -b

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## udp/29214

Process ID : 100627
Executable : /home/odin/manager/Bin/ExchangeAdaptor
Command line : ./ExchangeAdaptor -i32768 -b

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## udp/29982

Process ID : 100624
Executable : /home/odin/manager/Bin/ExchangeAdaptor
Command line : ./ExchangeAdaptor -i8192 -b

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## udp/33860

Process ID : 1063
Executable : /usr/sbin/avahi-daemon
Command line : avahi-daemon: running [LKPOMSHAPRI.local]

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## tcp/36407

Process ID : 78605
Executable : /usr/lib/jvm/java-11-openjdk-11.0.24.0.8-2.el9.x86_64/bin/java
Command line : java -Xmx1G -Xms1G -server -XX:+UseG1GC -XX:MaxGCPauseMillis=20 -XX:InitiatingHeapOccupancyPercent=35 -XX:+ExplicitGCInvokesConcurrent -XX:MaxInlineLevel=15 -Djava.awt.headless=true -Xlog:gc*:file=/home/odin/manager/kafka/bin/../logs/kafkaServer-gc.log:time,tags:filecount=10,filesize=100M -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false -Dkafka.logs.dir=/home/odin/manager/kafka/bin/../logs -Dlog4j.configuration=file:/home/odin/manager/kafka/bin/../config/log4j.properties -cp /home/odin/manager/kafka/bin/../libs/activation-1.1.1.jar:/home/odin/manager/kafka/bin/../libs/aopalliance-repackaged-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/argparse4j-0.7.0.jar:/home/odin/manager/kafka/bin/../libs/audience-annotations-0.5.0.jar:/home/odin/manager/kafka/bin/../libs/commons-cli-1.4.jar:/home/odin/manager/kafka/bin/../libs/commons-lang3-3.8.1.jar:/home/odin/manager/kafka/bin/../libs/connect-api-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-basic-auth-extension-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-json-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-mirror-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-mirror-client-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-runtime-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-transforms-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/hk2-api-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/hk2-locator-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/hk2-utils-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/jackson-annotations-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-core-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-databind-2.12.6.1.jar:/home/odin/manager/kafka/bin/../libs/jackson-dataformat-csv-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-datatype-jdk8-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-jaxrs-base-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-jaxrs-json-provider-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-module-jaxb-annotations-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-module-scala_2.13-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jakarta.activation-api-1.2.1.jar:/home/odin/manager/kafka/bin/../libs/jakarta.annotation-api-1.3.5.jar:/home/odin/manager/kafka/bin/../libs/jakarta.inject-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/jakarta.validation-api-2.0.2.jar:/home/odin/manager/kafka/bin/../libs/jakarta.ws.rs-api-2.1.6.jar:/home/odin/manager/kafka/bin/../libs/jakarta.xml.bind-api-2.3.2.jar:/home/odin/manager/kafka/bin/../libs/javassist-3.27.0-GA.jar:/home/odin/manager/kafka/bin/../libs/javax.servlet-api-3.1.0.jar:/home/odin/manager/kafka/bin/../libs/javax.ws.rs-api-2.1.1.jar:/home/odin/manager/kafka/bin/../libs/jaxb-api-2.3.0.jar:/home/odin/manager/kafka/bin/../libs/jersey-client-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-common-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-container-servlet-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-container-servlet-core-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-hk2-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-server-2.34.jar:/home/odin/manager/kafka/bin/../libs/jetty-client-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-continuation-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-http-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-io-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-security-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-server-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-servlet-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-servlets-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-util-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-util-ajax-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jline-3.21.0.jar:/home/odin/manager/kafka/bin/../libs/jopt-simple-5.0.4.jar:/home/odin/manager/kafka/bin/../libs/jose4j-0.7.9.jar:/home/odin/manager/kafka/bin/../libs/kafka_2.13-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-clients-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-log4j-appender-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-metadata-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-raft-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-server-common-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-shell-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-storage-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-storage-api-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-examples-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-scala_2.13-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-test-utils-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-tools-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/lz4-java-1.8.0.jar:/home/odin/manager/kafka/bin/../libs/maven-artifact-3.8.4.jar:/home/odin/manager/kafka/bin/../libs/metrics-core-2.2.0.jar:/home/odin/manager/kafka/bin/../libs/metrics-core-4.1.12.1.jar:/home/odin/manager/kafka/bin/../libs/netty-buffer-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-codec-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-common-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-handler-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-resolver-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-tcnative-classes-2.0.46.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-classes-epoll-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-native-epoll-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-native-unix-common-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/osgi-resource-locator-1.0.3.jar:/home/odin/manager/kafka/bin/../libs/paranamer-2.8.jar:/home/odin/manager/kafka/bin/../libs/plexus-utils-3.3.0.jar:/home/odin/manager/kafka/bin/../libs/reflections-0.9.12.jar:/home/odin/manager/kafka/bin/../libs/reload4j-1.2.19.jar:/home/odin/manager/kafka/bin/../libs/rocksdbjni-6.29.4.1.jar:/home/odin/manager/kafka/bin/../libs/scala-collection-compat_2.13-2.6.0.jar:/home/odin/manager/kafka/bin/../libs/scala-java8-compat_2.13-1.0.2.jar:/home/odin/manager/kafka/bin/../libs/scala-library-2.13.8.jar:/home/odin/manager/kafka/bin/../libs/scala-logging_2.13-3.9.4.jar:/home/odin/manager/kafka/bin/../libs/scala-reflect-2.13.8.jar:/home/odin/manager/kafka/bin/../libs/slf4j-api-1.7.36.jar:/home/odin/manager/kafka/bin/../libs/slf4j-reload4j-1.7.36.jar:/home/odin/manager/kafka/bin/../libs/snappy-java-1.1.8.4.jar:/home/odin/manager/kafka/bin/../libs/trogdor-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/zookeeper-3.6.3.jar:/home/odin/manager/kafka/bin/../libs/zookeeper-jute-3.6.3.jar:/home/odin/manager/kafka/bin/../libs/zstd-jni-1.5.2-1.jar kafka.Kafka /home/odin/manager/kafka/config/server.properties

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## tcp/41557

Process ID : 76527
Executable : /usr/lib/jvm/java-11-openjdk-11.0.24.0.8-2.el9.x86_64/bin/java
Command line : java -Xmx512M -Xms512M -server -XX:+UseG1GC -XX:MaxGCPauseMillis=20 -XX:InitiatingHeapOccupancyPercent=35 -XX:+ExplicitGCInvokesConcurrent -XX:MaxInlineLevel=15 -Djava.awt.headless=true -Xlog:gc*:file=/home/odin/manager/kafka/bin/../logs/zookeeper-gc.log:time,tags:filecount=10,filesize=100M -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false -Dkafka.logs.dir=/home/odin/manager/kafka/bin/../logs -Dlog4j.configuration=file:/home/odin/manager/kafka/bin/../config/log4j.properties -cp /home/odin/manager/kafka/bin/../libs/activation-1.1.1.jar:/home/odin/manager/kafka/bin/../libs/aopalliance-repackaged-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/argparse4j-0.7.0.jar:/home/odin/manager/kafka/bin/../libs/audience-annotations-0.5.0.jar:/home/odin/manager/kafka/bin/../libs/commons-cli-1.4.jar:/home/odin/manager/kafka/bin/../libs/commons-lang3-3.8.1.jar:/home/odin/manager/kafka/bin/../libs/connect-api-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-basic-auth-extension-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-json-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-mirror-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-mirror-client-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-runtime-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-transforms-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/hk2-api-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/hk2-locator-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/hk2-utils-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/jackson-annotations-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-core-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-databind-2.12.6.1.jar:/home/odin/manager/kafka/bin/../libs/jackson-dataformat-csv-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-datatype-jdk8-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-jaxrs-base-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-jaxrs-json-provider-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-module-jaxb-annotations-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-module-scala_2.13-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jakarta.activation-api-1.2.1.jar:/home/odin/manager/kafka/bin/../libs/jakarta.annotation-api-1.3.5.jar:/home/odin/manager/kafka/bin/../libs/jakarta.inject-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/jakarta.validation-api-2.0.2.jar:/home/odin/manager/kafka/bin/../libs/jakarta.ws.rs-api-2.1.6.jar:/home/odin/manager/kafka/bin/../libs/jakarta.xml.bind-api-2.3.2.jar:/home/odin/manager/kafka/bin/../libs/javassist-3.27.0-GA.jar:/home/odin/manager/kafka/bin/../libs/javax.servlet-api-3.1.0.jar:/home/odin/manager/kafka/bin/../libs/javax.ws.rs-api-2.1.1.jar:/home/odin/manager/kafka/bin/../libs/jaxb-api-2.3.0.jar:/home/odin/manager/kafka/bin/../libs/jersey-client-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-common-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-container-servlet-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-container-servlet-core-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-hk2-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-server-2.34.jar:/home/odin/manager/kafka/bin/../libs/jetty-client-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-continuation-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-http-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-io-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-security-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-server-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-servlet-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-servlets-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-util-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-util-ajax-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jline-3.21.0.jar:/home/odin/manager/kafka/bin/../libs/jopt-simple-5.0.4.jar:/home/odin/manager/kafka/bin/../libs/jose4j-0.7.9.jar:/home/odin/manager/kafka/bin/../libs/kafka_2.13-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-clients-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-log4j-appender-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-metadata-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-raft-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-server-common-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-shell-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-storage-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-storage-api-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-examples-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-scala_2.13-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-test-utils-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-tools-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/lz4-java-1.8.0.jar:/home/odin/manager/kafka/bin/../libs/maven-artifact-3.8.4.jar:/home/odin/manager/kafka/bin/../libs/metrics-core-2.2.0.jar:/home/odin/manager/kafka/bin/../libs/metrics-core-4.1.12.1.jar:/home/odin/manager/kafka/bin/../libs/netty-buffer-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-codec-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-common-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-handler-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-resolver-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-tcnative-classes-2.0.46.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-classes-epoll-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-native-epoll-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-native-unix-common-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/osgi-resource-locator-1.0.3.jar:/home/odin/manager/kafka/bin/../libs/paranamer-2.8.jar:/home/odin/manager/kafka/bin/../libs/plexus-utils-3.3.0.jar:/home/odin/manager/kafka/bin/../libs/reflections-0.9.12.jar:/home/odin/manager/kafka/bin/../libs/reload4j-1.2.19.jar:/home/odin/manager/kafka/bin/../libs/rocksdbjni-6.29.4.1.jar:/home/odin/manager/kafka/bin/../libs/scala-collection-compat_2.13-2.6.0.jar:/home/odin/manager/kafka/bin/../libs/scala-java8-compat_2.13-1.0.2.jar:/home/odin/manager/kafka/bin/../libs/scala-library-2.13.8.jar:/home/odin/manager/kafka/bin/../libs/scala-logging_2.13-3.9.4.jar:/home/odin/manager/kafka/bin/../libs/scala-reflect-2.13.8.jar:/home/odin/manager/kafka/bin/../libs/slf4j-api-1.7.36.jar:/home/odin/manager/kafka/bin/../libs/slf4j-reload4j-1.7.36.jar:/home/odin/manager/kafka/bin/../libs/snappy-java-1.1.8.4.jar:/home/odin/manager/kafka/bin/../libs/trogdor-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/zookeeper-3.6.3.jar:/home/odin/manager/kafka/bin/../libs/zookeeper-jute-3.6.3.jar:/home/odin/manager/kafka/bin/../libs/zstd-jni-1.5.2-1.jar org.apache.zookeeper.server.quorum.QuorumPeerMain /home/odin/manager/kafka/config/zookeeper.properties

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## udp/53111

Process ID : 1235
Executable : /usr/sbin/rsyslogd
Command line : /usr/sbin/rsyslogd -n

##

25221 - Remote listeners enumeration (Linux / AIX)
-
Synopsis
Using the supplied credentials, it was possible to identify the process listening on the remote port.
Description
By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port.
Note that the method used by this plugin only works for hosts running Linux or AIX.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2024/07/05
Plugin Output

## udp/58618

Process ID : 1063
Executable : /usr/sbin/avahi-daemon
Command line : avahi-daemon: running [LKPOMSHAPRI.local]

##

133964 - SELinux Status Check
-
Synopsis
SELinux is available on the host and plugin was able to check if it is enabled.
Description
SELinux is available on the host and plugin was able to check if it is enabled.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2020/02/25, Modified: 2025/12/18
Plugin Output

## tcp/0

SELinux config has been found on the host.
SELinux is disabled.

##

70657 - SSH Algorithms and Languages Supported
-
Synopsis
An SSH server is listening on this port.
Description
This script detects which algorithms and languages are supported by the remote service for encrypting communications.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2013/10/28, Modified: 2025/12/08
Plugin Output

## tcp/22/ssh

Nessus negotiated the following encryption algorithm(s) with the server :
Client to Server: aes256-ctr
Server to Client: aes256-ctr
The server supports the following options for compression_algorithms_server_to_client :
none
zlib@openssh.com
The server supports the following options for mac_algorithms_client_to_server :
hmac-sha1
hmac-sha1-etm@openssh.com
hmac-sha2-256
hmac-sha2-256-etm@openssh.com
hmac-sha2-512
hmac-sha2-512-etm@openssh.com
umac-128-etm@openssh.com
umac-128@openssh.com
The server supports the following options for server_host_key_algorithms :
ecdsa-sha2-nistp256
rsa-sha2-256
rsa-sha2-512
ssh-ed25519
The server supports the following options for encryption_algorithms_client_to_server :
aes128-ctr
aes128-gcm@openssh.com
aes256-ctr
aes256-gcm@openssh.com
chacha20-poly1305@openssh.com
The server supports the following options for mac_algorithms_server_to_client :
hmac-sha1
hmac-sha1-etm@openssh.com
hmac-sha2-256
hmac-sha2-256-etm@openssh.com
hmac-sha2-512
hmac-sha2-512-etm@openssh.com
umac-128-etm@openssh.com
umac-128@openssh.com
The server supports the following options for kex_algorithms :
curve25519-sha256
curve25519-sha256@libssh.org
diffie-hellman-group-exchange-sha256
diffie-hellman-group14-sha256
diffie-hellman-group16-sha512
diffie-hellman-group18-sha512
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
kex-strict-s-v00@openssh.com
The server supports the following options for compression_algorithms_client_to_server :
none
zlib@openssh.com
The server supports the following options for encryption_algorithms_server_to_client :
aes128-ctr
aes128-gcm@openssh.com
aes256-ctr
aes256-gcm@openssh.com
chacha20-poly1305@openssh.com

##

100158 - SSH Combined Host Command Logging (Plugin Debugging)
-
Synopsis
If plugin debugging is enabled, this plugin writes the SSH commands run on the host to a combined log file in a machine readable format.
Description
If plugin debugging is enabled, this plugin writes the SSH commands run on the host to a combined log file in a machine readable format.
This log file resides on the scanner host itself.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2017/05/12, Modified: 2022/11/21
Plugin Output

## tcp/0

Combined log file location :
C:\ProgramData\Tenable\Nessus\nessus\tmp\ssh_commands-7be69f19-c89e-41e1-b542-d073507af09f.log

##

149334 - SSH Password Authentication Accepted
-
Synopsis
The SSH server on the remote host accepts password authentication.
Description
The SSH server on the remote host accepts password authentication.
See Also

https://tools.ietf.org/html/rfc4252#section-8

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2021/05/07, Modified: 2021/05/07
Plugin Output

## tcp/22/ssh

##

168017 - SSH Per-Host Command Logging
-
Synopsis
If the 'Always report SSH commands' advanced preference is selected in the scan policy, this plugin will report all commands run over SSH on the host in a machine readable format.
Description
If the 'Always report SSH commands' advanced preference is selected in the scan policy, this plugin will report all commands run over SSH on the host in a machine readable format.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2022/11/21, Modified: 2022/11/21
Plugin Output

## tcp/0

The SSH commands run on this host have been attached:

##

10881 - SSH Protocol Versions Supported
-
Synopsis
A SSH server is running on the remote host.
Description
This plugin determines the versions of the SSH protocol supported by the remote SSH daemon.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2002/03/06, Modified: 2024/07/24
Plugin Output

## tcp/22/ssh

The remote SSH daemon supports the following versions of the
SSH protocol :
- 1.99
- 2.0
90707 - SSH SCP Protocol Detection
-
Synopsis
The remote host supports the SCP protocol over SSH.
Description
The remote host supports the Secure Copy (SCP) protocol over SSH.
See Also

https://en.wikipedia.org/wiki/Secure_copy

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2016/04/26, Modified: 2024/07/24
Plugin Output

## tcp/22/ssh

10267 - SSH Server Type and Version Information
-
Synopsis
An SSH server is listening on this port.
Description
It is possible to obtain information about the remote SSH server by sending an empty authentication request.
Solution
n/a
Risk Factor
None
References

XREF | IAVT:0001-T-0933

Plugin Information
Published: 1999/10/12, Modified: 2024/07/24
Plugin Output

## tcp/22/ssh

SSH version : SSH-2.0-OpenSSH_8.7
SSH supported authentication : publickey,gssapi-keyex,gssapi-with-mic,password

##

56984 - SSL / TLS Versions Supported
-
Synopsis
The remote service encrypts communications.
Description
This plugin detects which SSL and TLS versions are supported by the remote service for encrypting communications.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2011/12/01, Modified: 2025/06/16
Plugin Output

## tcp/3389/msrdp

This port supports TLSv1.3/TLSv1.2.
10863 - SSL Certificate Information
-
Synopsis
This plugin displays the SSL certificate.
Description
This plugin connects to every SSL-related port and attempts to extract and dump the X.509 certificate.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2008/05/19, Modified: 2021/02/03
Plugin Output

## tcp/3389/msrdp

Subject Name:
Common Name: XRDP
Issuer Name:
Common Name: XRDP
Serial Number: 73 56 59 09 54 0A EE 61 13 ED 2D F8 00 69 AA C7 2D E5 BB 73
Version: 3
Signature Algorithm: SHA-256 With RSA Encryption
Not Valid Before: Jun 03 12:49:33 2025 GMT
Not Valid After: Jun 03 12:49:33 2035 GMT
Public Key Info:
Algorithm: RSA Encryption
Key Length: 2048 bits
Public Key: 00 BB 30 A4 30 D7 86 AC 1E B4 63 A9 FB 94 42 A7 65 F9 83 6B
C4 7F 6C BB C6 C1 99 82 DA DB 2F A1 EE 4D 81 1D 82 77 96 C5
36 FE E2 0A AE 62 52 53 56 87 A1 A6 C6 EE C5 3A 16 9E B7 12
49 71 3D 57 36 37 6E 05 96 C5 DB 82 A2 36 60 C6 18 7A 39 9C
AB 50 69 09 08 14 42 6A 60 13 18 9E FD 7A B2 85 AA A6 87 22
CA 14 34 C6 0F A3 03 7E D1 5A CE 51 CD C5 ED FD B0 22 C6 AF
85 3D B6 ED DB 5C 99 21 8E 2B 0B 43 D7 A7 12 31 35 6B EA 94
A4 C8 DD EE B2 5F 84 45 8F AD F4 16 44 85 14 59 9E FF D2 4E
FD BB 4D F9 4E 09 66 C9 6E 95 7C 1A 01 0A 25 4D 2C 3F 9D 79
3B 48 70 BB E3 60 9E 4C AA CF 44 07 37 BD 05 72 72 59 DD 5E
42 E3 BB BF 82 62 60 C7 BE B4 88 6B 50 FB 68 66 B0 D2 F1 FD
0C DF CF 58 73 24 56 D3 52 27 04 0A E7 02 1C 68 93 7C 9B 55
ED 60 3D A0 40 CF 2D 6F 51 8D 48 A7 64 80 36 B5 97
Exponent: 01 00 01
Signature Length: 256 bytes / 2048 bits
Signature: 00 9F 7E 15 54 69 2A 45 D9 B9 88 40 E1 75 BC 82 DB 90 A1 83
48 CD A9 52 5B 4D 0F 95 61 7F 40 BD 13 FA D4 41 7E EB 3A D6
EF E4 F8 74 75 B2 74 95 A7 B5 58 A8 8B 6E FA F1 D6 68 A3 4A
46 F8 75 D2 B0 2B AB 4C 1D 50 64 08 79 91 29 AD 07 63 B7 B6
9C 53 32 D0 1A BA E1 70 A8 8A 01 02 AF FE 62 C8 1C 8B 48 AD
0C 24 8E 5C F6 0E A6 A8 B8 CC 53 17 38 75 53 A5 72 6B BF D0
E9 94 27 A0 2F 36 6D CC DA 33 E2 6C CC 93 6F E6 67 DA 83 65
95 A0 4D CB 45 CF A6 89 3F 17 91 32 19 15 7D F3 21 5A BC A2
A8 C0 A4 AB B5 70 C6 5A 9C 69 60 7A EE E3 9F 48 4B 97 01 54
EC A6 CB F6 58 85 04 FE DD E9 D1 1D 0C 5E 7E 46 8C D3 19 C0
16 EB 9C 9A 06 EA 64 95 C5 AA 23 A6 CE AD 2B 32 95 12 93 77
77 59 2A A9 65 17 00 54 92 09 25 C2 F4 80 A4 34 58 F9 95 4C
D7 DD FA F8 80 29 DA EA BE E4 9D 2B 26 52 F1 E3 F3
Extension: Subject Key Identifier(2.5.29.14)
Critical: 0
Subject Key Identifier: 00 AB 6D B2 BD 3F 8B AA 75 60 71 64 C6 1B E8 D1 BE 30 9A 80
Extension: Authority Key Identifier(2.5.29.35)
Critical: 0
Key Identifier: 00 AB 6D B2 BD 3F 8B AA 75 60 71 64 C6 1B E8 D1 BE 30 9A 80
Extension: Basic Constraints(2.5.29.19)
Critical: 0
CA: TRUE
Fingerprints :
SHA-256 Fingerprint: 24 92 1C 23 CC 27 FB EB E8 B7 8A 0D 4A C2 A0 84 D9 98 3D 0B
1E 9F 10 40 34 EB C0 42 6B 31 6B 70
SHA-1 Fingerprint: 8E 77 CF C8 59 66 D5 5E CC CE AC DC 5D E2 89 30 96 99 9C D9
MD5 Fingerprint: 56 24 EA D7 58 42 01 78 2E 74 1C B3 30 5C 75 4C
PEM certificate :
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
70544 - SSL Cipher Block Chaining Cipher Suites Supported
-
Synopsis
The remote service supports the use of SSL Cipher Block Chaining ciphers, which combine previous blocks with subsequent ones.
Description
The remote host supports the use of SSL ciphers that operate in Cipher Block Chaining (CBC) mode. These cipher suites offer additional security over Electronic Codebook (ECB) mode, but have the potential to leak information if used improperly.
See Also

https://www.openssl.org/docs/manmaster/man1/ciphers.html
http://www.nessus.org/u?cc4a822a
https://www.openssl.org/~bodo/tls-cbc.txt

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2013/10/22, Modified: 2021/02/03
Plugin Output

## tcp/3389/msrdp

Here is the list of SSL CBC ciphers supported by the remote server :
High Strength Ciphers (>= 112-bit key)
Name Code KEX Auth Encryption MAC
---------------------- ---------- --- ---- --------------------- ---
ECDHE-RSA-AES128-SHA 0xC0, 0x13 ECDHE RSA AES-CBC(128) SHA1
ECDHE-RSA-AES256-SHA 0xC0, 0x14 ECDHE RSA AES-CBC(256) SHA1
AES128-SHA 0x00, 0x2F RSA RSA AES-CBC(128) SHA1
AES256-SHA 0x00, 0x35 RSA RSA AES-CBC(256) SHA1
ECDHE-RSA-AES128-SHA256 0xC0, 0x27 ECDHE RSA AES-CBC(128) SHA256
RSA-AES128-SHA256 0x00, 0x3C RSA RSA AES-CBC(128) SHA256
RSA-AES256-SHA256 0x00, 0x3D RSA RSA AES-CBC(256) SHA256
The fields above are :
{Tenable ciphername}
{Cipher ID code}
Kex={key exchange}
Auth={authentication}
Encrypt={symmetric encryption method}
MAC={message authentication code}
{export flag}
21643 - SSL Cipher Suites Supported
-
Synopsis
The remote service encrypts communications using SSL.
Description
This plugin detects which SSL ciphers are supported by the remote service for encrypting communications.
See Also

https://www.openssl.org/docs/man1.0.2/man1/ciphers.html
http://www.nessus.org/u?e17ffced

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2006/06/05, Modified: 2024/09/11
Plugin Output

## tcp/3389/msrdp

Here is the list of SSL ciphers supported by the remote server :
Each group is reported per SSL Version.
SSL Version : TLSv13
High Strength Ciphers (>= 112-bit key)
Name Code KEX Auth Encryption MAC
---------------------- ---------- --- ---- --------------------- ---
TLS_AES_256_GCM_SHA384 0x13, 0x02 - - AES-GCM(256) SHA384
SSL Version : TLSv12
High Strength Ciphers (>= 112-bit key)
Name Code KEX Auth Encryption MAC
---------------------- ---------- --- ---- --------------------- ---
ECDHE-RSA-AES128-SHA256 0xC0, 0x2F ECDHE RSA AES-GCM(128) SHA256
ECDHE-RSA-AES256-SHA384 0xC0, 0x30 ECDHE RSA AES-GCM(256) SHA384
ECDHE-RSA-CHACHA20-POLY1305 0xCC, 0xA8 ECDHE RSA ChaCha20-Poly1305(256) SHA256
RSA-AES-128-CCM-AEAD 0xC0, 0x9C RSA RSA AES-CCM(128) SHA-256
RSA-AES128-SHA256 0x00, 0x9C RSA RSA AES-GCM(128) SHA256
RSA-AES-256-CCM-AEAD 0xC0, 0x9D RSA RSA AES-CCM(256) SHA-384
RSA-AES256-SHA384 0x00, 0x9D RSA RSA AES-GCM(256) SHA384
ECDHE-RSA-AES128-SHA 0xC0, 0x13 ECDHE RSA AES-CBC(128) SHA1
ECDHE-RSA-AES256-SHA 0xC0, 0x14 ECDHE RSA AES-CBC(256) SHA1
AES128-SHA 0x00, 0x2F RSA RSA AES-CBC(128) SHA1
AES256-SHA 0x00, 0x35 RSA RSA AES-CBC(256) SHA1
ECDHE-RSA-AES128-SHA256 0xC0, 0x27 ECDHE RSA AES-CBC(128) SHA256
RSA-AES128-SHA256 0x00, 0x3C RSA RSA AES-CBC(128) SHA256
RSA-AES256-SHA256 0x00, 0x3D RSA RSA AES-CBC(256) SHA256
The fields above are :
{Tenable ciphername}
{Cipher ID code}
Kex={key exchange}
Auth={authentication}
Encrypt={symmetric encryption method}
MAC={message authentication code}
{export flag}
Note that this service does not encrypt traffic by default but does
support upgrading to an encrypted connection using STARTTLS.
57041 - SSL Perfect Forward Secrecy Cipher Suites Supported
-
Synopsis
The remote service supports the use of SSL Perfect Forward Secrecy ciphers, which maintain confidentiality even if the key is stolen.
Description
The remote host supports the use of SSL ciphers that offer Perfect Forward Secrecy (PFS) encryption. These cipher suites ensure that recorded SSL traffic cannot be broken at a future date if the server's private key is compromised.
See Also

https://www.openssl.org/docs/manmaster/man1/ciphers.html
https://en.wikipedia.org/wiki/Diffie-Hellman_key_exchange
https://en.wikipedia.org/wiki/Perfect_forward_secrecy

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2011/12/07, Modified: 2021/03/09
Plugin Output

## tcp/3389/msrdp

Here is the list of SSL PFS ciphers supported by the remote server :
High Strength Ciphers (>= 112-bit key)
Name Code KEX Auth Encryption MAC
---------------------- ---------- --- ---- --------------------- ---
ECDHE-RSA-AES128-SHA256 0xC0, 0x2F ECDHE RSA AES-GCM(128) SHA256
ECDHE-RSA-AES256-SHA384 0xC0, 0x30 ECDHE RSA AES-GCM(256) SHA384
ECDHE-RSA-CHACHA20-POLY1305 0xCC, 0xA8 ECDHE RSA ChaCha20-Poly1305(256) SHA256
ECDHE-RSA-AES128-SHA 0xC0, 0x13 ECDHE RSA AES-CBC(128) SHA1
ECDHE-RSA-AES256-SHA 0xC0, 0x14 ECDHE RSA AES-CBC(256) SHA1
ECDHE-RSA-AES128-SHA256 0xC0, 0x27 ECDHE RSA AES-CBC(128) SHA256
The fields above are :
{Tenable ciphername}
{Cipher ID code}
Kex={key exchange}
Auth={authentication}
Encrypt={symmetric encryption method}
MAC={message authentication code}
{export flag}
94761 - SSL Root Certification Authority Certificate Information
-
Synopsis
A root Certification Authority certificate was found at the top of the certificate chain.
Description
The remote service uses an SSL certificate chain that contains a self-signed root Certification Authority certificate at the top of the chain.
See Also

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc778623(v=ws.10)

Solution
Ensure that use of this root Certification Authority certificate complies with your organization's acceptable use and security policies.
Risk Factor
None
Plugin Information
Published: 2016/11/14, Modified: 2018/11/15
Plugin Output

## tcp/3389/msrdp

The following root Certification Authority certificate was found :
|-Subject : CN=XRDP
|-Issuer : CN=XRDP
|-Valid From : Jun 03 12:49:33 2025 GMT
|-Valid To : Jun 03 12:49:33 2035 GMT
|-Signature Algorithm : SHA-256 With RSA Encryption
156899 - SSL/TLS Recommended Cipher Suites
-
Synopsis
The remote host advertises discouraged SSL/TLS ciphers.
Description
The remote host has open SSL/TLS ports which advertise discouraged cipher suites. It is recommended to only enable support for the following cipher suites:
TLSv1.3:
- 0x13,0x01 TLS13_AES_128_GCM_SHA256
- 0x13,0x02 TLS13_AES_256_GCM_SHA384
- 0x13,0x03 TLS13_CHACHA20_POLY1305_SHA256
TLSv1.2:
- 0xC0,0x2B ECDHE-ECDSA-AES128-GCM-SHA256
- 0xC0,0x2F ECDHE-RSA-AES128-GCM-SHA256
- 0xC0,0x2C ECDHE-ECDSA-AES256-GCM-SHA384
- 0xC0,0x30 ECDHE-RSA-AES256-GCM-SHA384
- 0xCC,0xA9 ECDHE-ECDSA-CHACHA20-POLY1305
- 0xCC,0xA8 ECDHE-RSA-CHACHA20-POLY1305
This is the recommended configuration for the vast majority of services, as it is highly secure and compatible with nearly every client released in the last five (or more) years.
See Also

https://wiki.mozilla.org/Security/Server_Side_TLS
https://ssl-config.mozilla.org/

Solution
Only enable support for recommened cipher suites.
Risk Factor
None
Plugin Information
Published: 2022/01/20, Modified: 2024/02/12
Plugin Output

## tcp/3389/msrdp

The remote host has listening SSL/TLS ports which advertise the discouraged cipher suites outlined below:
High Strength Ciphers (>= 112-bit key)
Name Code KEX Auth Encryption MAC
---------------------- ---------- --- ---- --------------------- ---
RSA-AES-128-CCM-AEAD 0xC0, 0x9C RSA RSA AES-CCM(128) SHA-256
RSA-AES128-SHA256 0x00, 0x9C RSA RSA AES-GCM(128) SHA256
RSA-AES-256-CCM-AEAD 0xC0, 0x9D RSA RSA AES-CCM(256) SHA-384
RSA-AES256-SHA384 0x00, 0x9D RSA RSA AES-GCM(256) SHA384
ECDHE-RSA-AES128-SHA 0xC0, 0x13 ECDHE RSA AES-CBC(128) SHA1
ECDHE-RSA-AES256-SHA 0xC0, 0x14 ECDHE RSA AES-CBC(256) SHA1
AES128-SHA 0x00, 0x2F RSA RSA AES-CBC(128) SHA1
AES256-SHA 0x00, 0x35 RSA RSA AES-CBC(256) SHA1
ECDHE-RSA-AES128-SHA256 0xC0, 0x27 ECDHE RSA AES-CBC(128) SHA256
RSA-AES128-SHA256 0x00, 0x3C RSA RSA AES-CBC(128) SHA256
RSA-AES256-SHA256 0x00, 0x3D RSA RSA AES-CBC(256) SHA256
The fields above are :
{Tenable ciphername}
{Cipher ID code}
Kex={key exchange}
Auth={authentication}
Encrypt={symmetric encryption method}
MAC={message authentication code}
{export flag}

##

22964 - Service Detection
-
Synopsis
The remote service could be identified.
Description
Nessus was able to identify the remote service by its banner or by looking at the error message it sends when it receives an HTTP request.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/08/19, Modified: 2025/12/08
Plugin Output

## tcp/22/ssh

An SSH server is running on this port.

##

22964 - Service Detection
-
Synopsis
The remote service could be identified.
Description
Nessus was able to identify the remote service by its banner or by looking at the error message it sends when it receives an HTTP request.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/08/19, Modified: 2025/12/08
Plugin Output

## tcp/8080/www

A web server is running on this port.

##

22964 - Service Detection
-
Synopsis
The remote service could be identified.
Description
Nessus was able to identify the remote service by its banner or by looking at the error message it sends when it receives an HTTP request.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/08/19, Modified: 2025/12/08
Plugin Output

## tcp/36407

The service closed the connection without sending any data.
It might be protected by some sort of TCP wrapper.

##

22964 - Service Detection
-
Synopsis
The remote service could be identified.
Description
Nessus was able to identify the remote service by its banner or by looking at the error message it sends when it receives an HTTP request.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/08/19, Modified: 2025/12/08
Plugin Output

## tcp/41557

The service closed the connection without sending any data.
It might be protected by some sort of TCP wrapper.

##

17975 - Service Detection (GET request)
-
Synopsis
The remote service could be identified.
Description
It was possible to identify the remote service by its banner or by looking at the error message it sends when it receives an HTTP request.
Solution
n/a
Risk Factor
None
References

XREF | IAVT:0001-T-0935

Plugin Information
Published: 2005/04/06, Modified: 2021/10/27
Plugin Output

## tcp/6379/redis_server

The remote service appears to be a Redis server, an open source,
persistent key-value data store.

##

278501 - Smartbedded Meteobridge Web Detection
-
Synopsis
The web UI for Smartbedded Meteobridge was detected on the remote host.
Description
Smartbedded Meteobridge, a dedicated weather monitoring application, is running on the remote host.
Note: Basic HTTP Authentication credentials are required to obtain the version.
See Also

https://www.meteobridge.com/wiki/index.php?title=Meteobridge_VM
http://www.nessus.org/u?5ceb65be

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2025/12/12, Modified: 2025/12/15
Plugin Output

## tcp/8080/www

URL : http://172.17.100.54:8080/cgi-bin/meteobridge
Version : unknown
Authenticated : False

##

22869 - Software Enumeration (SSH)
-
Synopsis
It was possible to enumerate installed software on the remote host via SSH.
Description
Nessus was able to list the software installed on the remote host by calling the appropriate command (e.g., 'rpm -qa' on RPM-based Linux distributions, qpkg, dpkg, etc.).
Solution
Remove any software that is not in compliance with your organization's acceptable use and security policies.
Risk Factor
None
References

XREF | IAVT:0001-T-0502

Plugin Information
Published: 2006/10/15, Modified: 2025/03/26
Plugin Output

## tcp/0

## report output too big - ending list here

35351 - System Information Enumeration (via DMI)
-
Synopsis
Information about the remote system's hardware can be read.
Description
Using the SMBIOS (aka DMI) interface, it was possible to retrieve information about the remote system's hardware, such as its product name and serial number.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2009/01/12, Modified: 2025/03/18
Plugin Output

## tcp/0

Chassis Information
Serial Number : None
Version : N/A
Manufacturer : No Enclosure
Lock : Not Present
Type : Other
System Information
Serial Number : VMware-42 08 2d 71 f3 19 02 95-b5 59 a1 16 63 36 67 b1
Version : None
Manufacturer : VMware, Inc.
Product Name : VMware20,1
Family : Not Specified

##

277654 - TLS Supported Groups
-
Synopsis
The remote service negotiates TLS supported curve groups.
Description
This plugin detects which TLS supported groups entries are supported by the remote service.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2025/12/08, Modified: 2025/12/10
Plugin Output

## tcp/3389/msrdp

These are the TLS supported groups offered by the remote server :
TLS supported groups :
Name Code
--------------------------
x25519 0x001d
secp256r1 0x0017
x448 0x001e
secp521r1 0x0019
secp384r1 0x0018
ffdhe2048 0x0100
ffdhe3072 0x0101
ffdhe4096 0x0102
ffdhe6144 0x0103
ffdhe8192 0x0104
136318 - TLS Version 1.2 Protocol Detection
-
Synopsis
The remote service encrypts traffic using a version of TLS.
Description
The remote service accepts connections encrypted using TLS 1.2.
See Also

https://tools.ietf.org/html/rfc5246

Solution
N/A
Risk Factor
None
Plugin Information
Published: 2020/05/04, Modified: 2020/05/04
Plugin Output

## tcp/3389/msrdp

TLSv1.2 is enabled and the server supports at least one cipher.
138330 - TLS Version 1.3 Protocol Detection
-
Synopsis
The remote service encrypts traffic using a version of TLS.
Description
The remote service accepts connections encrypted using TLS 1.3.
See Also

https://tools.ietf.org/html/rfc8446

Solution
N/A
Risk Factor
None
Plugin Information
Published: 2020/07/09, Modified: 2023/12/13
Plugin Output

## tcp/3389/msrdp

TLSv1.3 is enabled and the server supports at least one cipher.

##

110095 - Target Credential Issues by Authentication Protocol - No Issues Found
-
Synopsis
Nessus was able to log in to the remote host using the provided credentials. No issues were reported with access, privilege, or intermittent failure.
Description
Valid credentials were provided for an authentication protocol on the remote target and Nessus did not log any subsequent errors or failures for the authentication protocol.
When possible, Nessus tracks errors or failures related to otherwise valid credentials in order to highlight issues that may result in incomplete scan results or limited scan coverage. The types of issues that are tracked include errors that indicate that the account used for scanning did not have sufficient permissions for a particular check, intermittent protocol failures which are unexpected after the protocol has been negotiated successfully earlier in the scan, and intermittent authentication failures which are unexpected after a credential set has been accepted as valid earlier in the scan. This plugin reports when none of the above issues have been logged during the course of the scan for at least one authenticated protocol. See plugin output for details, including protocol, port, and account.
Please note the following :
- This plugin reports per protocol, so it is possible for issues to be encountered for one protocol and not another.
For example, authentication to the SSH service on the remote target may have consistently succeeded with no privilege errors encountered, while connections to the SMB service on the remote target may have failed intermittently.
- Resolving logged issues for all available authentication protocols may improve scan coverage, but the value of resolving each issue for a particular protocol may vary from target to target depending upon what data (if any) is gathered from the target via that protocol and what particular check failed. For example, consistently successful checks via SSH are more critical for Linux targets than for Windows targets, and likewise consistently successful checks via SMB are more critical for Windows targets than for Linux targets.
Solution
n/a
Risk Factor
None
References

XREF | IAVB:0001-B-0520

Plugin Information
Published: 2018/05/24, Modified: 2025/08/28
Plugin Output

## tcp/22/ssh

Nessus was able to log into the remote host with no privilege or access
problems via the following :
User: 'root'
Port: 22
Proto: SSH
Method: password
141118 - Target Credential Status by Authentication Protocol - Valid Credentials Provided
-
Synopsis
Valid credentials were provided for an available authentication protocol.
Description
Nessus was able to determine that valid credentials were provided for an authentication protocol available on the remote target because it was able to successfully authenticate directly to the remote target using that authentication protocol at least once. Authentication was successful because the authentication protocol service was available remotely, the service was able to be identified, the authentication protocol was able to be negotiated successfully, and a set of credentials provided in the scan policy for that authentication protocol was accepted by the remote service. See plugin output for details, including protocol, port, and account.
Please note the following :
- This plugin reports per protocol, so it is possible for valid credentials to be provided for one protocol and not another. For example, authentication may succeed via SSH but fail via SMB, while no credentials were provided for an available SNMP service.
- Providing valid credentials for all available authentication protocols may improve scan coverage, but the value of successful authentication for a given protocol may vary from target to target depending upon what data (if any) is gathered from the target via that protocol. For example, successful authentication via SSH is more valuable for Linux targets than for Windows targets, and likewise successful authentication via SMB is more valuable for Windows targets than for Linux targets.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2020/10/15, Modified: 2024/03/25
Plugin Output

## tcp/22/ssh

Nessus was able to log in to the remote host via the following :
User: 'root'
Port: 22
Proto: SSH
Method: password

##

64814 - Terminal Services Use SSL/TLS
-
Synopsis
The remote Terminal Services use SSL/TLS.
Description
The remote Terminal Services is configured to use SSL/TLS.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2013/02/22, Modified: 2023/07/10
Plugin Output

## tcp/3389/msrdp

Subject Name:
Common Name: XRDP
Issuer Name:
Common Name: XRDP
Serial Number: 73 56 59 09 54 0A EE 61 13 ED 2D F8 00 69 AA C7 2D E5 BB 73
Version: 3
Signature Algorithm: SHA-256 With RSA Encryption
Not Valid Before: Jun 03 12:49:33 2025 GMT
Not Valid After: Jun 03 12:49:33 2035 GMT
Public Key Info:
Algorithm: RSA Encryption
Key Length: 2048 bits
Public Key: 00 BB 30 A4 30 D7 86 AC 1E B4 63 A9 FB 94 42 A7 65 F9 83 6B
C4 7F 6C BB C6 C1 99 82 DA DB 2F A1 EE 4D 81 1D 82 77 96 C5
36 FE E2 0A AE 62 52 53 56 87 A1 A6 C6 EE C5 3A 16 9E B7 12
49 71 3D 57 36 37 6E 05 96 C5 DB 82 A2 36 60 C6 18 7A 39 9C
AB 50 69 09 08 14 42 6A 60 13 18 9E FD 7A B2 85 AA A6 87 22
CA 14 34 C6 0F A3 03 7E D1 5A CE 51 CD C5 ED FD B0 22 C6 AF
85 3D B6 ED DB 5C 99 21 8E 2B 0B 43 D7 A7 12 31 35 6B EA 94
A4 C8 DD EE B2 5F 84 45 8F AD F4 16 44 85 14 59 9E FF D2 4E
FD BB 4D F9 4E 09 66 C9 6E 95 7C 1A 01 0A 25 4D 2C 3F 9D 79
3B 48 70 BB E3 60 9E 4C AA CF 44 07 37 BD 05 72 72 59 DD 5E
42 E3 BB BF 82 62 60 C7 BE B4 88 6B 50 FB 68 66 B0 D2 F1 FD
0C DF CF 58 73 24 56 D3 52 27 04 0A E7 02 1C 68 93 7C 9B 55
ED 60 3D A0 40 CF 2D 6F 51 8D 48 A7 64 80 36 B5 97
Exponent: 01 00 01
Signature Length: 256 bytes / 2048 bits
Signature: 00 9F 7E 15 54 69 2A 45 D9 B9 88 40 E1 75 BC 82 DB 90 A1 83
48 CD A9 52 5B 4D 0F 95 61 7F 40 BD 13 FA D4 41 7E EB 3A D6
EF E4 F8 74 75 B2 74 95 A7 B5 58 A8 8B 6E FA F1 D6 68 A3 4A
46 F8 75 D2 B0 2B AB 4C 1D 50 64 08 79 91 29 AD 07 63 B7 B6
9C 53 32 D0 1A BA E1 70 A8 8A 01 02 AF FE 62 C8 1C 8B 48 AD
0C 24 8E 5C F6 0E A6 A8 B8 CC 53 17 38 75 53 A5 72 6B BF D0
E9 94 27 A0 2F 36 6D CC DA 33 E2 6C CC 93 6F E6 67 DA 83 65
95 A0 4D CB 45 CF A6 89 3F 17 91 32 19 15 7D F3 21 5A BC A2
A8 C0 A4 AB B5 70 C6 5A 9C 69 60 7A EE E3 9F 48 4B 97 01 54
EC A6 CB F6 58 85 04 FE DD E9 D1 1D 0C 5E 7E 46 8C D3 19 C0
16 EB 9C 9A 06 EA 64 95 C5 AA 23 A6 CE AD 2B 32 95 12 93 77
77 59 2A A9 65 17 00 54 92 09 25 C2 F4 80 A4 34 58 F9 95 4C
D7 DD FA F8 80 29 DA EA BE E4 9D 2B 26 52 F1 E3 F3
Extension: Subject Key Identifier(2.5.29.14)
Critical: 0
Subject Key Identifier: 00 AB 6D B2 BD 3F 8B AA 75 60 71 64 C6 1B E8 D1 BE 30 9A 80
Extension: Authority Key Identifier(2.5.29.35)
Critical: 0
Key Identifier: 00 AB 6D B2 BD 3F 8B AA 75 60 71 64 C6 1B E8 D1 BE 30 9A 80
Extension: Basic Constraints(2.5.29.19)
Critical: 0
CA: TRUE

##

56468 - Time of Last System Startup
-
Synopsis
The system has been started.
Description
Using the supplied credentials, Nessus was able to determine when the host was last started.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2011/10/12, Modified: 2018/06/19
Plugin Output

## tcp/0

reboot system boot 5.14.0-503.11.1. Sat Jan 24 06:59 still running
reboot system boot 5.14.0-503.11.1. Fri Jan 23 06:50 - 06:59 (1+00:09)
reboot system boot 5.14.0-503.11.1. Thu Jan 22 06:48 - 06:49 (1+00:01)
reboot system boot 5.14.0-503.11.1. Wed Jan 21 06:54 - 06:48 (23:53)
reboot system boot 5.14.0-503.11.1. Tue Jan 20 07:08 - 06:54 (23:45)
reboot system boot 5.14.0-503.11.1. Mon Jan 19 06:55 - 07:08 (1+00:12)
reboot system boot 5.14.0-503.11.1. Sat Jan 17 06:54 - 06:55 (2+00:00)
reboot system boot 5.14.0-503.11.1. Fri Jan 16 06:55 - 06:54 (23:58)
reboot system boot 5.14.0-503.11.1. Thu Jan 15 09:47 - 06:55 (21:08)
reboot system boot 5.14.0-503.11.1. Thu Jan 15 09:27 - 09:47 (00:19)
reboot system boot 5.14.0-503.11.1. Wed Jan 14 07:27 - 09:27 (1+01:59)
reboot system boot 5.14.0-503.11.1. Wed Jan 14 06:55 - 07:27 (00:31)
reboot system boot 5.14.0-503.11.1. Tue Jan 13 06:51 - 06:55 (1+00:04)
reboot system boot 5.14.0-503.11.1. Mon Jan 12 07:15 - 06:50 (23:35)
reboot system boot 5.14.0-503.11.1. Mon Jan 12 06:57 - 07:15 (00:18)
reboot system boot 5.14.0-503.11.1. Sat Jan 10 18:35 - 06:57 (1+12:21)
reboot system boot 5.14.0-503.11.1. Sat Jan 10 10:04 - 18:35 (08:30)
reboot system boot 5.14.0-503.11.1. Sat Jan 10 07:54 - 10:04 (02:10)
reboot system boot 5.14.0-503.11.1. Sat Jan 10 07:33 - 07:54 (00:20)
reboot system boot 5.14.0-503.11.1. Sat Jan 10 07:05 - 07:33 (00:27)
reboot system boot 5.14.0-503.11.1. Fri Jan 9 06:55 - 07:05 (1+00:09)
reboot system boot 5.14.0-503.11.1. Thu Jan 8 06:54 - 06:55 (1+00:01)
reboot system boot 5.14.0-503.11.1. Wed Jan 7 06:47 - 06:53 (1+00:06)
reboot system boot 5.14.0-503.11.1. Tue Jan 6 06:49 - 06:47 (23:57)
reboot system boot 5.14.0-503.11.1. Mon Jan 5 07:17 - 06:49 (23:31)
reboot system boot 5.14.0-503.11.1. Mon Jan 5 07:13 - 07:17 (00:03)
reboot system boot 5.14.0-503.11.1. Mon Jan 5 06:40 - 07:13 (00:32)
reboot system boot 5.14.0-503.11.1. Sat Jan 3 16:01 - 06:40 (1+14:38)
reboot system boot 5.14.0-503.11.1. Sat Jan 3 10:46 - 16:01 (05:15)
reboot system boot 5.14.0-503.11.1. Fri Jan 2 07:02 - 10:45 (1+03:43)
reboot system boot 5.14.0-503.11.1. Thu Jan 1 07:00 - 07:01 (1+00:01)
reboot system boot 5.14.0-503.11.1. Wed Dec 31 06:58 - 06:59 (1+00:01)
reboot system boot 5.14.0-503.11.1. Tue Dec 30 07:02 - 06:57 (23:55)
reboot system boot 5.14.0-503.11.1. Mon Dec 29 07:01 - 07:01 (1+00:00)
reboot system boot 5.14.0-503.11.1. Mon Dec 29 06:47 - 07:01 (00:13)
reboot system boot 5.14.0-503.11.1. Sat Dec 27 07:35 - 06:47 (1+23:12)
reboot system boot 5.14.0-503.11.1. Fri Dec 26 06:49 - 07:35 (1+00:45)
reboot system boot 5.14.0-503.11.1. Thu Dec 25 12:28 - 06:49 (18:20)
reboot system boot 5.14.0-503.11.1. Wed Dec 24 06:58 - 12:28 (1+05:29)
reboot system boot 5.14.0-503.11.1. Tue Dec 23 06:50 - 06:58 (1+00:07)
reboot system boot 5.14.0-503.11.1. Mon Dec 22 07:01 - 06:49 (23:48)
reboot system boot 5.14.0-503.11.1. Mon Dec 22 06:53 - 07:01 (00:08)
reboot system boot 5.14.0-503.11.1. Mon Dec 22 06:51 - 06:52 (00:01)
reboot system boot 5.14.0-503.11.1. Sat Dec 20 16:12 - 06:51 (1+14:38)
reboot system boot 5.14.0-503.11.1. Sat Dec 20 07:10 - 16:11 (09:01)
reboot system boot 5.14.0-503.11.1. Fri Dec 19 06:51 - 07:09 (1+00:18)
reboot system boot 5.14.0-503.11.1. Thu Dec 18 06:59 - 06:50 (23:50)
reboot system boot 5.14.0-503.11.1. Wed Dec 17 06:49 - 06:59 (1+00:10)
reboot system boot 5.14.0-503.11.1. Tue Dec 16 06:49 - 06:48 (23:59)
reboot system boot 5.14.0-503.11.1. Mon Dec 15 06:41 - 06:48 (1+00:06)
reboot system boot 5.14.0-503.11.1. Sat Dec 13 21:18 - 06:41 (1+09:23)
reboot system boot 5.14.0-503.11.1. Sat Dec 13 08:57 - 21:17 (12:20)
reboot system boot 5.14.0-503.11.1. Sat Dec 13 08:19 - 08:57 (00:38)
reboot system boot 5.14.0-503.11.1. Fri Dec 12 07:06 - 08:18 (1+01:11)
reboot system boot 5.14.0-503.11.1. Thu Dec 11 06:58 - 07:06 (1+00:07)
reboot system boot 5.14.0-503.11.1. Wed Dec 10 06:49 - 06:58 (1+00:09)
reboot system boot 5.14.0-503.11.1. Tue Dec 9 06:55 - 06:48 (23:53)
reboot system boot 5.14.0-503.11.1. Mon Dec 8 06:50 - 06:55 (1+00:04)
reboot system boot 5.14.0-503.11.1. Sat Dec 6 18:01 - 06:50 (1+12:49)
reboot system boot 5.14.0-503.11.1. Sat Dec 6 00:49 - 18:00 (17:11)
reboot system boot 5.14.0-503.11.1. Fri Dec 5 06:49 - 00:49 (17:59)
reboot system boot 5.14.0-503.11.1. Thu Dec 4 06:57 - 06:49 (23:51)
reboot system boot 5.14.0-503.11.1. Wed Dec 3 07:08 - 06:57 (23:49)
reboot system boot 5.14.0-503.11.1. Tue Dec 2 06:40 - 07:08 (1+00:27)
reboot system boot 5.14.0-503.11.1. Mon Dec 1 06:51 - 06:40 (23:48)
reboot system boot 5.14.0-503.11.1. Sat Nov 29 16:08 - 06:51 (1+14:43)
reboot system boot 5.14.0-503.11.1. Sat Nov 29 07:42 - 16:07 (08:25)
reboot system boot 5.14.0-503.11.1. Fri Nov 28 07:12 - 07:42 (1+00:29)
reboot system boot 5.14.0-503.11.1. Thu Nov 27 07:08 - 07:12 (1+00:03)
reboot system boot 5.14.0-503.11.1. Wed Nov 26 06:57 - 07:08 (1+00:10)
reboot system boot 5.14.0-503.11.1. Tue Nov 25 06:56 - 06:57 (1+00:00)
reboot system boot 5.14.0-503.11.1. Mon Nov 24 06:55 - 06:56 (1+00:00)
reboot system boot 5.14.0-503.11.1. Sat Nov 22 15:03 - 06:55 (1+15:51)
reboot system boot 5.14.0-503.11.1. Sat Nov 22 07:28 - 15:03 (07:34)
reboot system boot 5.14.0-503.11.1. Fri Nov 21 07:12 - 07:28 (1+00:16)
reboot system boot 5.14.0-503.11.1. Thu Nov 20 07:02 - 07:11 (1+00:09)
reboot system boot 5.14.0-503.11.1. Wed Nov 19 07:03 - 07:02 (23:58)
reboot system boot 5.14.0-503.11.1. Tue Nov 18 06:46 - 07:03 (1+00:16)
reboot system boot 5.14.0-503.11.1. Mon Nov 17 06:52 - 06:46 (23:53)
reboot system boot 5.14.0-503.11.1. Sat Nov 15 11:20 - 06:52 (1+19:32)
reboot system boot 5.14.0-503.11.1. Fri Nov 14 06:53 - 11:19 (1+04:25)
reboot system boot 5.14.0-503.11.1. Thu Nov 13 06:51 - 06:53 (1+00:01)
reboot system boot 5.14.0-503.11.1. Wed Nov 12 06:52 - 06:51 (23:58)
reboot system boot 5.14.0-503.11.1. Tue Nov 11 07:26 - 06:52 (23:25)
reboot system boot 5.14.0-503.11.1. Mon Nov 10 06:46 - 07:26 (1+00:39)
reboot system boot 5.14.0-503.11.1. Sat Nov 8 16:34 - 06:46 (1+14:12)
reboot system boot 5.14.0-503.11.1. Sat Nov 8 13:31 - 16:33 (03:01)
reboot system boot 5.14.0-503.11.1. Sat Nov 8 13:01 - 13:31 (00:29)
reboot system boot 5.14.0-503.11.1. Sat Nov 8 12:02 - 13:01 (00:59)
reboot system boot 5.14.0-503.11.1. Fri Nov 7 06:54 - 12:02 (1+05:08)
reboot system boot 5.14.0-503.11.1. Thu Nov 6 06:48 - 06:53 (1+00:04)
reboot system boot 5.14.0-503.11.1. Wed Nov 5 07:48 - 06:48 (23:00)
reboot system boot 5.14.0-503.11.1. Tue Nov 4 07:11 - 07:47 (1+00:36)
reboot system boot 5.14.0-503.11.1. Mon Nov 3 07:01 - 07:11 (1+00:09)
reboot system boot 5.14.0-503.11.1. Mon Nov 3 06:52 - 07:01 (00:09)
reboot system boot 5.14.0-503.11.1. Sat Nov 1 17:19 - 06:52 (1+13:32)
reboot system boot 5.14.0-503.11.1. Sat Nov 1 10:54 - 17:19 (06:25)
reboot system boot 5.14.0-503.11.1. Fri Oct 31 06:54 - 10:53 (1+03:58)
reboot system boot 5.14.0-503.11.1. Thu Oct 30 07:01 - 06:54 (23:53)
reboot system boot 5.14.0-503.11.1. Wed Oct 29 06:57 - 07:00 (1+00:03)
reboot system boot 5.14.0-503.11.1. Tue Oct 28 06:52 - 06:56 (1+00:04)
reboot system boot 5.14.0-503.11.1. Mon Oct 27 07:02 - 06:52 (23:50)
reboot system boot 5.14.0-503.11.1. Mon Oct 27 06:53 - 07:02 (00:09)
reboot system boot 5.14.0-503.11.1. Sat Oct 25 19:17 - 06:53 (1+11:35)
reboot system boot 5.14.0-503.11.1. Sat Oct 25 08:48 - 19:17 (10:29)
reboot system boot 5.14.0-503.11.1. Sat Oct 25 06:12 - 08:48 (02:36)
reboot system boot 5.14.0-503.11.1. Fri Oct 24 06:58 - 06:11 (23:13)
reboot system boot 5.14.0-503.11.1. Thu Oct 23 06:49 - 06:57 (1+00:08)
reboot system boot 5.14.0-503.11.1. Wed Oct 22 07:25 - 06:49 (23:23)
reboot system boot 5.14.0-503.11.1. Tue Oct 21 06:46 - 07:25 (1+00:38)
reboot system boot 5.14.0-503.11.1. Mon Oct 20 07:16 - 06:46 (23:29)
reboot system boot 5.14.0-503.11.1. Sat Oct 18 11:38 - 07:16 (1+19:38)
reboot system boot 5.14.0-503.11.1. Fri Oct 17 07:25 - 11:37 (1+04:12)
reboot system boot 5.14.0-503.11.1. Thu Oct 16 06:54 - 07:25 (1+00:31)
reboot system boot 5.14.0-503.11.1. Wed Oct 15 07:14 - 06:53 (23:39)
reboot system boot 5.14.0-503.11.1. Tue Oct 14 06:49 - 07:14 (1+00:25)
reboot system boot 5.14.0-503.11.1. Mon Oct 13 07:03 - 06:48 (23:45)
reboot system boot 5.14.0-503.11.1. Mon Oct 13 06:42 - 07:03 (00:20)
reboot system boot 5.14.0-503.11.1. Sat Oct 11 22:03 - 06:42 (1+08:38)
reboot system boot 5.14.0-503.11.1. Sat Oct 11 15:58 - 22:03 (06:05)
reboot system boot 5.14.0-503.11.1. Sat Oct 11 12:04 - 15:58 (03:53)
reboot system boot 5.14.0-503.11.1. Sat Oct 11 09:37 - 12:04 (02:26)
reboot system boot 5.14.0-503.11.1. Sat Oct 11 08:22 - 09:37 (01:15)
reboot system boot 5.14.0-503.11.1. Fri Oct 10 07:02 - 08:21 (1+01:19)
reboot system boot 5.14.0-503.11.1. Thu Oct 9 07:00 - 07:02 (1+00:02)
reboot system boot 5.14.0-503.11.1. Wed Oct 8 07:08 - 06:59 (23:51)
reboot system boot 5.14.0-503.11.1. Tue Oct 7 06:53 - 07:07 (1+00:14)
reboot system boot 5.14.0-503.11.1. Mon Oct 6 06:48 - 06:53 (1+00:04)
reboot system boot 5.14.0-503.11.1. Sat Oct 4 17:28 - 06:48 (1+13:20)
reboot system boot 5.14.0-503.11.1. Sat Oct 4 07:11 - 17:27 (10:16)
reboot system boot 5.14.0-503.11.1. Fri Oct 3 06:55 - 07:10 (1+00:15)
reboot system boot 5.14.0-503.11.1. Thu Oct 2 07:12 - 06:54 (23:42)
reboot system boot 5.14.0-503.11.1. Wed Oct 1 06:58 - 07:12 (1+00:13)
reboot system boot 5.14.0-503.11.1. Tue Sep 30 06:40 - 06:58 (1+00:17)
reboot system boot 5.14.0-503.11.1. Mon Sep 29 07:10 - 06:40 (23:29)
reboot system boot 5.14.0-503.11.1. Mon Sep 29 06:57 - 07:10 (00:13)
reboot system boot 5.14.0-503.11.1. Sat Sep 27 19:47 - 06:57 (1+11:09)
reboot system boot 5.14.0-503.11.1. Sat Sep 27 06:03 - 19:47 (13:44)
reboot system boot 5.14.0-503.11.1. Fri Sep 26 06:38 - 06:02 (23:24)
reboot system boot 5.14.0-503.11.1. Thu Sep 25 06:58 - 06:38 (23:39)
reboot system boot 5.14.0-503.11.1. Wed Sep 24 06:58 - 06:58 (1+00:00)
reboot system boot 5.14.0-503.11.1. Tue Sep 23 06:46 - 06:58 (1+00:11)
reboot system boot 5.14.0-503.11.1. Mon Sep 22 07:07 - 06:46 (23:38)
reboot system boot 5.14.0-503.11.1. Sat Sep 20 18:26 - 07:07 (1+12:40)
reboot system boot 5.14.0-503.11.1. Sat Sep 20 08:19 - 18:26 (10:06)
reboot system boot 5.14.0-503.11.1. Fri Sep 19 06:56 - 08:19 (1+01:22)
reboot system boot 5.14.0-503.11.1. Thu Sep 18 06:49 - 06:56 (1+00:07)
reboot system boot 5.14.0-503.11.1. Wed Sep 17 07:01 - 06:48 (23:47)
reboot system boot 5.14.0-503.11.1. Tue Sep 16 06:47 - 07:00 (1+00:13)
reboot system boot 5.14.0-503.11.1. Mon Sep 15 07:21 - 06:47 (23:25)
reboot system boot 5.14.0-503.11.1. Mon Sep 15 07:10 - 07:21 (00:11)
reboot system boot 5.14.0-503.11.1. Sat Sep 13 17:49 - 07:10 (1+13:21)
reboot system boot 5.14.0-503.11.1. Sat Sep 13 14:34 - 17:49 (03:14)
reboot system boot 5.14.0-503.11.1. Sat Sep 13 08:42 - 14:34 (05:51)
reboot system boot 5.14.0-503.11.1. Fri Sep 12 07:03 - 08:41 (1+01:38)
reboot system boot 5.14.0-503.11.1. Thu Sep 11 06:31 - 07:03 (1+00:31)
reboot system boot 5.14.0-503.11.1. Wed Sep 10 06:57 - 06:31 (23:34)
reboot system boot 5.14.0-503.11.1. Tue Sep 9 06:53 - 06:57 (1+00:03)
reboot system boot 5.14.0-503.11.1. Mon Sep 8 07:09 - 06:53 (23:43)
reboot system boot 5.14.0-503.11.1. Mon Sep 8 06:58 - 07:09 (00:11)
reboot system boot 5.14.0-503.11.1. Sat Sep 6 18:08 - 06:58 (1+12:50)
reboot system boot 5.14.0-503.11.1. Sat Sep 6 10:17 - 18:07 (07:50)
reboot system boot 5.14.0-503.11.1. Sat Sep 6 08:42 - 10:17 (01:34)
reboot system boot 5.14.0-503.11.1. Fri Sep 5 07:01 - 08:42 (1+01:40)
reboot system boot 5.14.0-503.11.1. Thu Sep 4 06:55 - 07:00 (1+00:04)
reboot system boot 5.14.0-503.11.1. Wed Sep 3 06:43 - 06:55 (1+00:11)
reboot system boot 5.14.0-503.11.1. Tue Sep 2 06:52 - 06:43 (23:50)
reboot system boot 5.14.0-503.11.1. Mon Sep 1 07:17 - 06:52 (23:35)
reboot system boot 5.14.0-503.11.1. Mon Sep 1 06:58 - 07:17 (00:18)
reboot system boot 5.14.0-503.11.1. Sat Aug 30 13:52 - 06:58 (1+17:05)
reboot system boot 5.14.0-503.11.1. Sat Aug 30 11:31 - 13:52 (02:21)
reboot system boot 5.14.0-503.11.1. Sat Aug 30 07:10 - 11:31 (04:20)
reboot system boot 5.14.0-503.11.1. Fri Aug 29 06:47 - 07:10 (1+00:22)
reboot system boot 5.14.0-503.11.1. Thu Aug 28 06:56 - 06:47 (23:50)
reboot system boot 5.14.0-503.11.1. Wed Aug 27 14:14 - 06:56 (16:42)
reboot system boot 5.14.0-503.11.1. Tue Aug 26 07:03 - 14:13 (1+07:10)
reboot system boot 5.14.0-503.11.1. Mon Aug 25 07:42 - 07:03 (23:20)
reboot system boot 5.14.0-503.11.1. Sat Aug 23 16:07 - 07:42 (1+15:34)
reboot system boot 5.14.0-503.11.1. Sat Aug 23 07:11 - 16:07 (08:55)
reboot system boot 5.14.0-503.11.1. Fri Aug 22 06:49 - 07:11 (1+00:21)
reboot system boot 5.14.0-503.11.1. Thu Aug 21 06:55 - 06:49 (23:54)
reboot system boot 5.14.0-503.11.1. Wed Aug 20 05:23 - 06:55 (1+01:31)
reboot system boot 5.14.0-503.11.1. Tue Aug 19 07:39 - 05:23 (21:44)
reboot system boot 5.14.0-503.11.1. Mon Aug 18 08:26 - 07:39 (23:12)
reboot system boot 5.14.0-503.11.1. Mon Aug 18 06:44 - 08:26 (01:42)
reboot system boot 5.14.0-503.11.1. Fri Aug 15 09:56 - 06:44 (2+20:47)
reboot system boot 5.14.0-503.11.1. Thu Aug 14 07:01 - 09:56 (1+02:54)
reboot system boot 5.14.0-503.11.1. Wed Aug 13 06:55 - 07:01 (1+00:05)
reboot system boot 5.14.0-503.11.1. Tue Aug 12 07:01 - 06:55 (23:54)
reboot system boot 5.14.0-503.11.1. Tue Aug 12 06:43 - 07:01 (00:17)
reboot system boot 5.14.0-503.11.1. Mon Aug 11 07:02 - 06:42 (23:40)
reboot system boot 5.14.0-503.11.1. Mon Aug 11 06:44 - 07:02 (00:18)
reboot system boot 5.14.0-503.11.1. Sat Aug 9 09:04 - 06:44 (1+21:39)
reboot system boot 5.14.0-503.11.1. Fri Aug 8 06:45 - 09:04 (1+02:19)
reboot system boot 5.14.0-503.11.1. Thu Aug 7 07:09 - 06:44 (23:35)
reboot system boot 5.14.0-503.11.1. Wed Aug 6 06:48 - 07:09 (1+00:20)
reboot system boot 5.14.0-503.11.1. Tue Aug 5 06:35 - 06:48 (1+00:13)
reboot system boot 5.14.0-503.11.1. Mon Aug 4 06:50 - 06:34 (23:44)
reboot system boot 5.14.0-503.11.1. Sat Aug 2 17:32 - 06:50 (1+13:17)
reboot system boot 5.14.0-503.11.1. Sat Aug 2 07:40 - 17:31 (09:51)
reboot system boot 5.14.0-503.11.1. Fri Aug 1 06:43 - 07:40 (1+00:57)
reboot system boot 5.14.0-503.11.1. Thu Jul 31 06:51 - 06:42 (23:50)
reboot system boot 5.14.0-503.11.1. Wed Jul 30 07:13 - 06:51 (23:38)
reboot system boot 5.14.0-503.11.1. Tue Jul 29 06:47 - 07:13 (1+00:25)
reboot system boot 5.14.0-503.11.1. Mon Jul 28 06:38 - 06:47 (1+00:08)
reboot system boot 5.14.0-503.11.1. Sat Jul 26 09:03 - 06:38 (1+21:35)
reboot system boot 5.14.0-503.11.1. Fri Jul 25 06:42 - 09:03 (1+02:20)
reboot system boot 5.14.0-503.11.1. Thu Jul 24 06:43 - 06:41 (23:57)
reboot system boot 5.14.0-503.11.1. Wed Jul 23 06:38 - 06:43 (1+00:05)
reboot system boot 5.14.0-503.11.1. Tue Jul 22 06:42 - 06:38 (23:55)
reboot system boot 5.14.0-503.11.1. Mon Jul 21 06:37 - 06:41 (1+00:04)
reboot system boot 5.14.0-503.11.1. Sat Jul 19 17:39 - 06:37 (1+12:58)
reboot system boot 5.14.0-503.11.1. Sat Jul 19 06:13 - 17:39 (11:25)
reboot system boot 5.14.0-503.11.1. Fri Jul 18 06:38 - 06:13 (23:34)
reboot system boot 5.14.0-503.11.1. Thu Jul 17 06:26 - 06:38 (1+00:11)
reboot system boot 5.14.0-503.11.1. Wed Jul 16 06:35 - 06:25 (23:50)
reboot system boot 5.14.0-503.11.1. Tue Jul 15 06:52 - 06:34 (23:42)
reboot system boot 5.14.0-503.11.1. Mon Jul 14 06:30 - 06:52 (1+00:21)
reboot system boot 5.14.0-503.11.1. Sat Jul 12 17:38 - 06:30 (1+12:51)
reboot system boot 5.14.0-503.11.1. Sat Jul 12 06:25 - 17:37 (11:12)
reboot system boot 5.14.0-503.11.1. Fri Jul 11 06:41 - 06:25 (23:44)
reboot system boot 5.14.0-503.11.1. Thu Jul 10 06:38 - 06:40 (1+00:02)
reboot system boot 5.14.0-503.11.1. Wed Jul 9 06:42 - 06:38 (23:56)
reboot system boot 5.14.0-503.11.1. Tue Jul 8 06:32 - 06:41 (1+00:09)
reboot system boot 5.14.0-503.11.1. Mon Jul 7 06:57 - 06:31 (23:34)
reboot system boot 5.14.0-503.11.1. Sat Jul 5 16:09 - 06:57 (1+14:48)
reboot system boot 5.14.0-503.11.1. Sat Jul 5 06:37 - 16:09 (09:31)
reboot system boot 5.14.0-503.11.1. Fri Jul 4 06:34 - 06:37 (1+00:02)
reboot system boot 5.14.0-503.11.1. Thu Jul 3 06:59 - 06:33 (23:33)
reboot system boot 5.14.0-503.11.1. Wed Jul 2 06:29 - 06:59 (1+00:30)
reboot system boot 5.14.0-503.11.1. Tue Jul 1 06:34 - 06:28 (23:54)
reboot system boot 5.14.0-503.11.1. Mon Jun 30 06:38 - 06:34 (23:55)
reboot system boot 5.14.0-503.11.1. Sat Jun 28 17:04 - 06:38 (1+13:33)
reboot system boot 5.14.0-503.11.1. Sat Jun 28 07:32 - 17:04 (09:31)
reboot system boot 5.14.0-503.11.1. Fri Jun 27 06:46 - 07:32 (1+00:46)
reboot system boot 5.14.0-503.11.1. Thu Jun 26 07:04 - 06:45 (23:41)
reboot system boot 5.14.0-503.11.1. Wed Jun 25 07:21 - 07:03 (23:42)
reboot system boot 5.14.0-503.11.1. Tue Jun 24 06:38 - 07:21 (1+00:42)
reboot system boot 5.14.0-503.11.1. Mon Jun 23 06:23 - 06:38 (1+00:15)
reboot system boot 5.14.0-503.11.1. Sat Jun 21 07:03 - 06:23 (1+23:20)
reboot system boot 5.14.0-503.11.1. Fri Jun 20 06:43 - 07:02 (1+00:19)
reboot system boot 5.14.0-503.11.1. Thu Jun 19 06:51 - 06:43 (23:51)
reboot system boot 5.14.0-503.11.1. Wed Jun 18 06:35 - 06:51 (1+00:15)
reboot system boot 5.14.0-503.11.1. Tue Jun 17 06:54 - 06:35 (23:40)
reboot system boot 5.14.0-503.11.1. Mon Jun 16 07:09 - 06:54 (23:45)
reboot system boot 5.14.0-503.11.1. Sat Jun 14 19:29 - 07:09 (1+11:39)
reboot system boot 5.14.0-503.11.1. Sat Jun 14 08:28 - 19:28 (11:00)
reboot system boot 5.14.0-503.11.1. Sat Jun 14 07:54 - 08:26 (00:31)
reboot system boot 5.14.0-503.11.1. Fri Jun 13 06:16 - 07:54 (1+01:38)
reboot system boot 5.14.0-503.11.1. Thu Jun 12 06:22 - 06:15 (23:53)
reboot system boot 5.14.0-503.11.1. Wed Jun 11 07:26 - 06:21 (22:55)
reboot system boot 5.14.0-503.11.1. Tue Jun 10 07:08 - 07:26 (1+00:18)
reboot system boot 5.14.0-503.11.1. Mon Jun 9 07:02 - 07:08 (1+00:05)
reboot system boot 5.14.0-503.11.1. Sat Jun 7 16:26 - 07:02 (1+14:36)
reboot system boot 5.14.0-503.11.1. Mon Jun 2 18:41 - 16:26 (4+21:44)
reboot system boot 5.14.0-503.11.1. Thu May 29 15:40 - 15:31 (23:50)
wtmp begins Thu May 29 15:40:40 2025

##

10287 - Traceroute Information
-
Synopsis
It was possible to obtain traceroute information.
Description
Makes a traceroute to the remote host.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 1999/11/27, Modified: 2023/12/04
Plugin Output

## udp/0

For your information, here is the traceroute from 172.17.100.38 to 172.17.100.54 :
172.17.100.38
172.17.100.54
Hop Count: 1

##

192709 - Tukaani XZ Utils Installed (Linux / Unix)
-
Synopsis
Tukaani XZ Utils is installed on the remote Linux / Unix host.
Description
Tukaani XZ Utils is installed on the remote Linux / Unix host.
XZ Utils consists of several components, including:
- liblzma
- xz
Additional information:
- More paths will be searched and the timeout for the search will be increased if 'Perform thorough tests' setting is enabled.
- The plugin timeout can be set to a custom value other than the plugin's default of 30 minutes via the 'timeout.192709' scanner setting in Nessus 8.15.1 or later.
Please see https://docs.tenable.com/nessus/Content/SettingsAdvanced.htm#Custom for more information.
See Also

https://xz.tukaani.org/xz-utils/

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2024/03/29, Modified: 2025/12/18
Plugin Output

## tcp/0

Nessus detected 3 installs of XZ Utils:
Path : /usr/bin/xz
Version : 5.2.5
Associated Package : xz-5.2.5-8.el9_0.x86_64
Confidence : High
Version Source : Package
Path : /usr/local/aws-cli/v2/2.24.15/dist/liblzma.so.5
Version : 5.2.2
Confidence : Low
Version Source : File contents
Path : /usr/lib64/liblzma.so.5.2.5
Version : 5.2.5
Associated Package : xz-libs-5.2.5-8.el9_0.x86_64
Confidence : High
Version Source : Package
83303 - Unix / Linux - Local Users Information : Passwords Never Expire
-
Synopsis
At least one local user has a password that never expires.
Description
Using the supplied credentials, Nessus was able to list local users that are enabled and whose passwords never expire.
Solution
Allow or require users to change their passwords regularly.
Risk Factor
None
Plugin Information
Published: 2015/05/10, Modified: 2023/11/27
Plugin Output

## tcp/0

Nessus found the following unlocked users with passwords that do not expire :
- root
- odin
110483 - Unix / Linux Running Processes Information
-
Synopsis
Uses /bin/ps auxww command to obtain the list of running processes on the target machine at scan time.
Description
Generated report details the running processes on the target machine at scan time.
This plugin is informative only and could be used for forensic investigation, malware detection, and to confirm that your system processes conform to your system policies.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2018/06/12, Modified: 2023/11/27
Plugin Output

## tcp/0

USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.0 171460 13776 ? Ss Jan24 0:03 /usr/lib/systemd/systemd rhgb --switched-root --system --deserialize 31
root 2 0.0 0.0 0 0 ? S Jan24 0:00 [kthreadd]
root 3 0.0 0.0 0 0 ? S Jan24 0:00 [pool_workqueue_]
root 4 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-rcu_g]
root 5 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-rcu_p]
root 6 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-slub_]
root 7 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-netns]
root 9 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/0:0H-events_highpri]
root 11 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-mm_pe]
root 13 0.0 0.0 0 0 ? I Jan24 0:00 [rcu_tasks_kthre]
root 14 0.0 0.0 0 0 ? I Jan24 0:00 [rcu_tasks_rude_]
root 15 0.0 0.0 0 0 ? I Jan24 0:00 [rcu_tasks_trace]
root 16 0.0 0.0 0 0 ? S Jan24 0:03 [ksoftirqd/0]
root 17 0.0 0.0 0 0 ? I Jan24 0:55 [rcu_preempt]
root 18 0.0 0.0 0 0 ? S Jan24 0:00 [migration/0]
root 19 0.0 0.0 0 0 ? S Jan24 0:00 [idle_inject/0]
root 21 0.0 0.0 0 0 ? S Jan24 0:00 [cpuhp/0]
root 22 0.0 0.0 0 0 ? S Jan24 0:00 [cpuhp/1]
root 23 0.0 0.0 0 0 ? S Jan24 0:00 [idle_inject/1]
root 24 0.0 0.0 0 0 ? S Jan24 0:00 [migration/1]
root 25 0.0 0.0 0 0 ? S Jan24 0:03 [ksoftirqd/1]
root 27 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/1:0H-events_highpri]
root 28 0.0 0.0 0 0 ? S Jan24 0:00 [cpuhp/2]
root 29 0.0 0.0 0 0 ? S Jan24 0:00 [idle_inject/2]
root 30 0.0 0.0 0 0 ? S Jan24 0:00 [migration/2]
root 31 0.0 0.0 0 0 ? S Jan24 0:02 [ksoftirqd/2]
root 33 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/2:0H-events_highpri]
root 34 0.0 0.0 0 0 ? S Jan24 0:00 [cpuhp/3]
root 35 0.0 0.0 0 0 ? S Jan24 0:00 [idle_inject/3]
root 36 0.0 0.0 0 0 ? S Jan24 0:00 [migration/3]
root 37 0.0 0.0 0 0 ? S Jan24 0:02 [ksoftirqd/3]
root 39 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/3:0H-events_highpri]
root 40 0.0 0.0 0 0 ? S Jan24 0:00 [cpuhp/4]
root 41 0.0 0.0 0 0 ? S Jan24 0:00 [idle_inject/4]
root 42 0.0 0.0 0 0 ? S Jan24 0:00 [migration/4]
root 43 0.0 0.0 0 0 ? S Jan24 0:01 [ksoftirqd/4]
root 45 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/4:0H-events_highpri]
root 46 0.0 0.0 0 0 ? S Jan24 0:00 [cpuhp/5]
root 47 0.0 0.0 0 0 ? S Jan24 0:00 [idle_inject/5]
root 48 0.0 0.0 0 0 ? S Jan24 0:00 [migration/5]
root 49 0.0 0.0 0 0 ? S Jan24 0:01 [ksoftirqd/5]
root 51 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/5:0H-events_highpri]
root 52 0.0 0.0 0 0 ? S Jan24 0:00 [cpuhp/6]
root 53 0.0 0.0 0 0 ? S Jan24 0:00 [idle_inject/6]
root 54 0.0 0.0 0 0 ? S Jan24 0:00 [migration/6]
root 55 0.0 0.0 0 0 ? S Jan24 0:01 [ksoftirqd/6]
root 57 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/6:0H-events_highpri]
root 58 0.0 0.0 0 0 ? S Jan24 0:00 [cpuhp/7]
root 59 0.0 0.0 0 0 ? S Jan24 0:00 [idle_inject/7]
root 60 0.0 0.0 0 0 ? S Jan24 0:00 [migration/7]
root 61 0.0 0.0 0 0 ? S Jan24 0:02 [ksoftirqd/7]
root 63 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/7:0H-events_highpri]
root 64 0.0 0.0 0 0 ? S Jan24 0:00 [cpuhp/8]
root 65 0.0 0.0 0 0 ? S Jan24 0:00 [idle_inject/8]
root 66 0.0 0.0 0 0 ? S Jan24 0:00 [migration/8]
root 67 0.0 0.0 0 0 ? S Jan24 0:01 [ksoftirqd/8]
root 69 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/8:0H-events_highpri]
root 70 0.0 0.0 0 0 ? S Jan24 0:00 [cpuhp/9]
root 71 0.0 0.0 0 0 ? S Jan24 0:00 [idle_inject/9]
root 72 0.0 0.0 0 0 ? S Jan24 0:00 [migration/9]
root 73 0.0 0.0 0 0 ? S Jan24 0:01 [ksoftirqd/9]
root 75 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/9:0H-events_highpri]
root 76 0.0 0.0 0 0 ? S Jan24 0:00 [cpuhp/10]
root 77 0.0 0.0 0 0 ? S Jan24 0:00 [idle_inject/10]
root 78 0.0 0.0 0 0 ? S Jan24 0:00 [migration/10]
root 79 0.0 0.0 0 0 ? S Jan24 0:01 [ksoftirqd/10]
root 81 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/10:0H-events_highpri]
root 82 0.0 0.0 0 0 ? S Jan24 0:00 [cpuhp/11]
root 83 0.0 0.0 0 0 ? S Jan24 0:00 [idle_inject/11]
root 84 0.0 0.0 0 0 ? S Jan24 0:00 [migration/11]
root 85 0.0 0.0 0 0 ? S Jan24 0:02 [ksoftirqd/11]
root 88 0.0 0.0 0 0 ? S Jan24 0:00 [cpuhp/12]
root 89 0.0 0.0 0 0 ? S Jan24 0:00 [idle_inject/12]
root 90 0.0 0.0 0 0 ? S Jan24 0:00 [migration/12]
root 91 0.0 0.0 0 0 ? S Jan24 0:01 [ksoftirqd/12]
root 93 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/12:0H-events_highpri]
root 94 0.0 0.0 0 0 ? S Jan24 0:00 [cpuhp/13]
root 95 0.0 0.0 0 0 ? S Jan24 0:00 [idle_inject/13]
root 96 0.0 0.0 0 0 ? S Jan24 0:00 [migration/13]
root 97 0.0 0.0 0 0 ? S Jan24 0:01 [ksoftirqd/13]
root 99 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/13:0H-events_highpri]
root 100 0.0 0.0 0 0 ? S Jan24 0:00 [cpuhp/14]
root 101 0.0 0.0 0 0 ? S Jan24 0:00 [idle_inject/14]
root 102 0.0 0.0 0 0 ? S Jan24 0:00 [migration/14]
root 103 0.0 0.0 0 0 ? S Jan24 0:01 [ksoftirqd/14]
root 105 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/14:0H-events_highpri]
root 106 0.0 0.0 0 0 ? S Jan24 0:00 [cpuhp/15]
root 107 0.0 0.0 0 0 ? S Jan24 0:00 [idle_inject/15]
root 108 0.0 0.0 0 0 ? S Jan24 0:00 [migration/15]
root 109 0.0 0.0 0 0 ? S Jan24 0:01 [ksoftirqd/15]
root 111 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/15:0H-events_highpri]
root 127 0.0 0.0 0 0 ? S Jan24 0:00 [kdevtmpfs]
root 128 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-inet_]
root 129 0.0 0.0 0 0 ? S Jan24 0:00 [kauditd]
root 130 0.0 0.0 0 0 ? S Jan24 0:00 [khungtaskd]
root 131 0.0 0.0 0 0 ? S Jan24 0:00 [oom_reaper]
root 132 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-write]
root 133 0.0 0.0 0 0 ? S Jan24 0:00 [kcompactd0]
root 134 0.0 0.0 0 0 ? SN Jan24 0:00 [ksmd]
root 136 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-crypt]
root 137 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-kinte]
root 138 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-kbloc]
root 139 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-blkcg]
root 140 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-tpm_d]
root 141 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-md]
root 142 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-md_bi]
root 143 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-edac-]
root 144 0.0 0.0 0 0 ? S Jan24 0:00 [watchdogd]
root 146 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/0:1H-kblockd]
root 148 0.0 0.0 0 0 ? S Jan24 0:00 [kswapd0]
root 155 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-kthro]
root 164 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-acpi_]
root 165 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-kmpat]
root 166 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-kalua]
root 167 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-mld]
root 168 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-ipv6_]
root 177 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-kstrp]
root 301 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/9:1H-kblockd]
root 340 0.0 0.0 0 0 ? I< Jan24 0:01 [kworker/7:1H-kblockd]
root 342 0.0 0.0 0 0 ? I< Jan24 0:02 [kworker/2:1H-xfs-log/dm-0]
root 344 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/4:1H-kblockd]
root 346 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/10:1H-kblockd]
root 349 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/12:1H-kblockd]
root 350 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/1:1H-kblockd]
root 354 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/14:1H-kblockd]
root 358 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/5:1H-kblockd]
root 359 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/8:1H-kblockd]
root 362 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/13:1H-kblockd]
root 365 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/11:1H-kblockd]
root 370 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/15:1H-kblockd]
root 462 0.0 0.0 0 0 ? I< Jan24 0:01 [kworker/3:1H-kblockd]
root 469 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/6:1H-kblockd]
root 510 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_0]
root 511 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 512 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-vmw_p]
root 572 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-ata_s]
root 575 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_1]
root 576 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 577 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_2]
root 578 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 579 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_3]
root 580 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 581 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_4]
root 582 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 583 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_5]
root 584 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 585 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_6]
root 586 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 587 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_7]
root 588 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 589 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_8]
root 590 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 591 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_9]
root 592 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 593 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_10]
root 594 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 595 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_11]
root 596 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 597 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_12]
root 598 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 599 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_13]
root 600 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 601 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_14]
root 602 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 603 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_15]
root 604 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 605 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_16]
root 606 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 607 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_17]
root 608 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 610 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_18]
root 611 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 612 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_19]
root 613 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 614 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_20]
root 615 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 616 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_21]
root 617 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 618 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_22]
root 619 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 620 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_23]
root 621 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 622 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_24]
root 623 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 624 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_25]
root 625 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 626 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_26]
root 627 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 628 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_27]
root 629 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 630 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_28]
root 631 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 632 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_29]
root 633 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 634 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_30]
root 635 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 636 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_31]
root 637 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 638 0.0 0.0 0 0 ? S Jan24 0:00 [scsi_eh_32]
root 639 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-scsi_]
root 675 0.0 0.0 0 0 ? S Jan24 0:00 [irq/16-vmwgfx]
root 676 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-ttm]
root 742 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-kdmfl]
root 749 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-kdmfl]
root 767 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-xfsal]
root 768 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-xfs_m]
root 769 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-xfs-b]
root 770 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-xfs-c]
root 771 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-xfs-r]
root 772 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-xfs-b]
root 773 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-xfs-i]
root 774 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-xfs-l]
root 775 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-xfs-c]
root 776 0.0 0.0 0 0 ? S Jan24 0:08 [xfsaild/dm-0]
root 848 0.0 0.0 44752 28160 ? Ss Jan24 0:01 /usr/lib/systemd/systemd-journald
root 863 0.0 0.0 35772 10752 ? Ss Jan24 0:00 /usr/lib/systemd/systemd-udevd
root 955 0.0 0.0 0 0 ? S Jan24 0:00 [irq/71-vmw_vmci]
root 956 0.0 0.0 0 0 ? S Jan24 0:00 [irq/72-vmw_vmci]
root 957 0.0 0.0 0 0 ? S Jan24 0:00 [irq/73-vmw_vmci]
root 971 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-nfit]
root 1014 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-xfs-b]
root 1015 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-xfs-c]
root 1016 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-xfs-r]
root 1017 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-xfs-b]
root 1018 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-xfs-i]
root 1019 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-xfs-l]
root 1020 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-xfs-c]
root 1021 0.0 0.0 0 0 ? S Jan24 0:00 [xfsaild/sda2]
root 1032 0.0 0.0 92776 4252 ? S<sl Jan24 0:02 /sbin/auditd
root 1034 0.0 0.0 7960 3328 ? S< Jan24 0:00 /usr/sbin/sedispatch
dbus 1060 0.0 0.0 11068 4900 ? Ss Jan24 0:00 /usr/bin/dbus-broker-launch --scope system --audit
dbus 1061 0.0 0.0 8212 5156 ? S Jan24 0:01 dbus-broker --log 4 --controller 9 --machine-id ee3985a45f994c5591637d39774da397 --max-bytes 536870912 --max-fds 4096 --max-matches 131072 --audit
root 1062 0.0 0.0 477016 22960 ? Ssl Jan24 0:16 /usr/sbin/NetworkManager --no-daemon
avahi 1063 0.0 0.0 16872 6784 ? Ss Jan24 0:27 avahi-daemon: running [LKPOMSHAPRI.local]
root 1065 0.0 0.0 82888 4096 ? Ssl Jan24 0:02 /usr/sbin/irqbalance
libstor+ 1066 0.0 0.0 2704 1792 ? Ss Jan24 0:00 /usr/bin/lsmd -d
root 1067 0.0 0.0 2816 2048 ? Ss Jan24 0:00 /usr/sbin/mcelog --daemon --foreground
polkitd 1068 0.0 0.0 2985072 27336 ? Ssl Jan24 0:01 /usr/lib/polkit-1/polkitd --no-debug
rtkit 1069 0.0 0.0 154124 3456 ? SNsl Jan24 0:00 /usr/libexec/rtkit-daemon
root 1070 0.0 0.0 453600 11304 ? Ssl Jan24 0:00 /usr/libexec/accounts-daemon
root 1071 0.0 0.0 448168 8356 ? Ssl Jan24 0:00 /usr/libexec/switcheroo-control
root 1073 0.0 0.0 411036 17472 ? Ssl Jan24 0:00 /usr/sbin/syslog-ng -F -p /var/run/syslogd.pid
root 1076 0.0 0.0 20212 9584 ? Ss Jan24 0:01 /usr/lib/systemd/systemd-logind
root 1077 0.0 0.0 395684 15200 ? Ssl Jan24 0:00 /usr/libexec/udisks2/udisksd
root 1078 0.0 0.0 448680 8776 ? Ssl Jan24 0:00 /usr/libexec/upowerd
root 1079 0.0 0.0 233520 9856 ? Ss Jan24 0:00 /usr/bin/VGAuthService -s
root 1080 0.0 0.0 457812 11124 ? Ssl Jan24 0:42 /usr/bin/vmtoolsd
avahi 1082 0.0 0.0 16596 1964 ? S Jan24 0:00 avahi-daemon: chroot helper
root 1119 0.0 0.0 244012 12256 ? Ssl Jan24 0:00 /usr/sbin/ModemManager
root 1194 0.0 0.0 248796 10880 ? Ss Jan24 0:00 /usr/sbin/cupsd -l
root 1202 0.0 0.0 16756 8832 ? Ss Jan24 0:00 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
root 1205 0.0 0.0 296424 4232 ? Ssl Jan24 0:00 /usr/bin/rhsmcertd
root 1217 0.0 0.0 4696 2560 ? Ss Jan24 0:00 /usr/sbin/atd -f
root 1221 0.0 0.0 223948 3584 ? Ss Jan24 0:00 /usr/sbin/crond -n
root 1224 0.0 0.0 453136 10452 ? Ssl Jan24 0:00 /usr/sbin/gdm
root 1235 0.0 0.0 255200 13184 ? Ssl Jan24 0:03 /usr/sbin/rsyslogd -n
root 1237 0.0 0.0 10372 4224 ? Ss Jan24 0:00 /usr/sbin/xrdp-sesman --nodaemon
xrdp 1243 0.0 0.0 24104 10496 ? Ss Jan24 0:00 /usr/sbin/xrdp --nodaemon
root 1329 0.0 0.0 388200 13040 ? Sl Jan24 0:00 gdm-session-worker [pam/gdm-launch-environment]
root 1373 0.0 0.0 507576 57696 ? Sl Jan24 0:01 /opt/site24x7/monagent/lib/MonitoringAgentWatchdog
gdm 1412 0.0 0.0 22080 11776 ? Ss Jan24 0:00 /usr/lib/systemd/systemd --user
gdm 1431 0.0 0.0 25380 5836 ? S Jan24 0:00 (sd-pam)
gdm 1557 0.0 0.0 374152 7912 tty1 Ssl+ Jan24 0:00 /usr/libexec/gdm-wayland-session --register-session dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart
gdm 1560 0.0 0.0 10572 4352 ? Ss Jan24 0:00 /usr/bin/dbus-broker-launch --scope user
gdm 1593 0.0 0.0 4888 2432 ? S Jan24 0:00 dbus-broker --log 4 --controller 9 --machine-id ee3985a45f994c5591637d39774da397 --max-bytes 100000000000000 --max-fds 25000000000000 --max-matches 5000000000
gdm 1601 0.0 0.0 6612 2688 tty1 S+ Jan24 0:00 dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart
gdm 1606 0.0 0.0 17184 7040 tty1 S+ Jan24 0:00 dbus-daemon --nofork --print-address 4 --session
gdm 1616 0.0 0.0 661072 17792 tty1 Sl+ Jan24 0:00 /usr/libexec/gnome-session-binary --autostart /usr/share/gdm/greeter/autostart
gdm 1656 0.0 0.3 6619792 240680 tty1 Sl+ Jan24 0:20 /usr/bin/gnome-shell
gdm 1862 0.0 0.0 308648 7296 tty1 Sl+ Jan24 0:00 /usr/libexec/at-spi-bus-launcher
gdm 1867 0.0 0.0 16708 7040 tty1 S+ Jan24 0:00 /usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 3
gdm 1877 0.0 0.0 171316 45636 tty1 S+ Jan24 0:00 /usr/bin/Xwayland :1024 -rootless -noreset -accessx -core -auth /run/user/42/.mutter-Xwaylandauth.NHRQJ3 -listenfd 4 -listenfd 5 -displayfd 6 -initfd 7
gdm 1892 0.0 0.0 448096 5888 tty1 Sl+ Jan24 0:00 /usr/libexec/xdg-permission-store
root 1898 0.0 0.0 452044 7296 ? Ssl Jan24 0:00 /usr/libexec/power-profiles-daemon
gdm 1899 0.0 0.0 326040 11264 ? S<sl Jan24 0:00 /usr/bin/pipewire
gdm 1900 0.0 0.0 545188 17728 ? S<sl Jan24 0:00 /usr/bin/wireplumber
gdm 1902 0.0 0.0 316384 11124 ? S<sl Jan24 0:00 /usr/bin/pipewire-pulse
root 1913 0.0 0.0 0 0 ? SN Jan24 0:04 [khugepaged]
root 1924 0.0 0.0 16480 6528 ? Ss Jan24 0:00 /usr/sbin/wpa_supplicant -c /etc/wpa_supplicant/wpa_supplicant.conf -u -s
gdm 1953 0.0 0.0 3128192 25876 tty1 Sl+ Jan24 0:00 /usr/bin/gjs /usr/share/gnome-shell/org.gnome.Shell.Notifications
gdm 1955 0.0 0.0 161732 7296 tty1 Sl+ Jan24 0:00 /usr/libexec/at-spi2-registryd --use-gnome-session
gdm 1959 0.0 0.0 678296 14708 tty1 Sl+ Jan24 0:00 /usr/libexec/gsd-sharing
gdm 1970 0.0 0.0 664688 26908 tty1 Sl+ Jan24 0:00 /usr/libexec/gsd-wacom
gdm 1971 0.0 0.0 666300 27776 tty1 Sl+ Jan24 0:00 /usr/libexec/gsd-color
gdm 1973 0.0 0.0 590348 28688 tty1 Sl+ Jan24 0:00 /usr/libexec/gsd-keyboard
gdm 1974 0.0 0.0 468224 15024 tty1 Sl+ Jan24 0:00 /usr/libexec/gsd-print-notifications
gdm 1975 0.0 0.0 669652 8428 tty1 Sl+ Jan24 0:00 /usr/libexec/gsd-rfkill
gdm 1976 0.0 0.0 603496 13512 tty1 Sl+ Jan24 0:03 /usr/libexec/gsd-smartcard
gdm 1979 0.0 0.0 595372 22728 tty1 Sl+ Jan24 0:00 /usr/libexec/gsd-datetime
gdm 1981 0.0 0.0 882808 31592 tty1 Sl+ Jan24 0:00 /usr/libexec/gsd-media-keys
gdm 1983 0.0 0.0 448052 10028 tty1 Sl+ Jan24 0:00 /usr/libexec/gsd-screensaver-proxy
gdm 1986 0.0 0.0 530744 11216 tty1 Sl+ Jan24 0:00 /usr/libexec/gsd-sound
gdm 1989 0.0 0.0 522196 8408 tty1 Sl+ Jan24 0:00 /usr/libexec/gsd-a11y-settings
gdm 1991 0.0 0.0 524556 11476 tty1 Sl+ Jan24 0:01 /usr/libexec/gsd-housekeeping
gdm 1995 0.0 0.0 665704 27884 tty1 Sl+ Jan24 0:00 /usr/libexec/gsd-power
colord 2112 0.0 0.0 456692 13684 ? Ssl Jan24 0:00 /usr/libexec/colord
gdm 2148 0.0 0.0 3201924 26392 tty1 Sl+ Jan24 0:00 /usr/bin/gjs /usr/share/gnome-shell/org.gnome.ScreenSaver
gdm 2158 0.0 0.0 526624 13124 tty1 Sl Jan24 0:00 ibus-daemon --panel disable -r --xim
gdm 2167 0.0 0.0 449108 9060 tty1 Sl Jan24 0:00 /usr/libexec/ibus-dconf
gdm 2169 0.0 0.0 581800 52944 tty1 Sl Jan24 0:00 /usr/libexec/ibus-x11 --kill-daemon
gdm 2172 0.0 0.0 449040 10888 tty1 Sl+ Jan24 0:00 /usr/libexec/ibus-portal
gdm 2185 0.0 0.0 599484 23880 tty1 Sl+ Jan24 0:00 /usr/libexec/gsd-printer
root 2211 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/u65:1]
root 2212 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/u65:2]
gdm 2217 0.0 0.0 375252 6912 tty1 Sl Jan24 0:00 /usr/libexec/ibus-engine-simple
root 2280 0.2 0.2 2483740 176412 ? Sl Jan24 4:51 /opt/site24x7/monagent/lib/MonitoringAgent
root 4844 0.0 0.0 583876 64780 ? Sl Jan24 0:05 /opt/site24x7/monagent/lib/applog/Site24x7Applog
xrdp 68495 0.0 0.0 52284 23352 ? Sl Jan24 0:04 /usr/sbin/xrdp --nodaemon
root 68498 0.0 0.0 15152 7168 ? S Jan24 0:00 xrdp-sesexec
odin 68500 0.0 0.0 22692 12032 ? Ss Jan24 0:00 /usr/lib/systemd/systemd --user
odin 68501 0.0 0.0 172844 5884 ? S Jan24 0:00 (sd-pam)
odin 68515 0.0 0.1 254980 122812 ? S Jan24 0:55 Xvnc :10 -auth .Xauthority -geometry 1364x768 -depth 32 -rfbunixpath /run/xrdp/1000/xrdp_display_10 -rfbunixmode 432 -SecurityTypes None -bs -nolisten tcp -localhost -dpi 96
odin 68520 0.0 0.0 513232 19396 ? Sl Jan24 0:00 /usr/libexec/gnome-session-binary
odin 68521 0.0 0.0 87508 5760 ? Sl Jan24 0:00 /usr/sbin/xrdp-chansrv
odin 68595 0.0 0.0 10700 4480 ? Ss Jan24 0:00 /usr/bin/dbus-broker-launch --scope user
odin 68596 0.0 0.0 6724 3328 ? S Jan24 0:00 dbus-broker --log 4 --controller 9 --machine-id ee3985a45f994c5591637d39774da397 --max-bytes 100000000000000 --max-fds 25000000000000 --max-matches 5000000000
odin 68629 0.0 0.0 9400 1844 ? Ss Jan24 0:00 /usr/bin/ssh-agent /etc/X11/xinit/Xclients
odin 68640 0.0 0.0 308740 9764 ? Ssl Jan24 0:00 /usr/libexec/at-spi-bus-launcher
odin 68645 0.0 0.0 10572 4224 ? S Jan24 0:00 /usr/bin/dbus-broker-launch --config-file=/usr/share/defaults/at-spi2/accessibility.conf --scope user
odin 68646 0.0 0.0 5008 2560 ? S Jan24 0:00 dbus-broker --log 4 --controller 9 --machine-id ee3985a45f994c5591637d39774da397 --max-bytes 100000000000000 --max-fds 6400000 --max-matches 5000000000
odin 68716 0.0 0.0 303808 7624 ? Ssl Jan24 0:00 /usr/libexec/gnome-session-ctl --monitor
odin 68718 0.0 0.0 661332 20388 ? Ssl Jan24 0:00 /usr/libexec/gnome-session-binary --systemd-service --session=gnome
odin 68727 0.0 0.0 452808 9808 ? Sl Jan24 0:00 /usr/bin/gnome-keyring-daemon --start --components=secrets
odin 68780 0.0 0.0 452588 9692 ? Ssl Jan24 0:00 /usr/libexec/gvfsd
odin 68785 0.0 0.0 379928 8192 ? Sl Jan24 0:00 /usr/libexec/gvfsd-fuse /run/user/1000/gvfs -f
odin 68818 0.0 0.0 586564 21200 ? Ssl Jan24 0:00 /usr/libexec/gnome-shell-calendar-server
odin 68820 0.0 0.0 448096 9848 ? Ssl Jan24 0:00 /usr/libexec/xdg-permission-store
odin 68826 0.0 0.0 161864 9964 ? Ssl Jan24 0:00 /usr/libexec/at-spi2-registryd --use-gnome-session
odin 68837 0.0 0.0 1287572 32620 ? Ssl Jan24 0:00 /usr/libexec/evolution-source-registry
odin 68841 0.0 0.0 323688 9824 ? Ssl Jan24 0:00 /usr/bin/pipewire
odin 68842 0.0 0.0 545196 18204 ? Ssl Jan24 0:00 /usr/bin/wireplumber
odin 68843 0.0 0.0 322300 11436 ? Ssl Jan24 0:00 /usr/bin/pipewire-pulse
odin 68858 0.0 0.0 820508 22724 ? Ssl Jan24 0:00 /usr/libexec/goa-daemon
odin 68860 0.0 0.0 156004 5504 ? Ssl Jan24 0:00 /usr/libexec/dconf-service
odin 68875 0.0 0.0 532468 13956 ? Ssl Jan24 0:03 /usr/libexec/goa-identity-service
odin 68881 0.0 0.0 1330068 33068 ? Ssl Jan24 0:00 /usr/libexec/evolution-calendar-factory
root 68897 0.0 0.0 241712 9856 ? Ss Jan24 0:05 /usr/libexec/sssd/sssd_kcm --uid 0 --gid 0 --logger=files
odin 68905 0.0 0.0 889552 32180 ? Ssl Jan24 0:00 /usr/libexec/evolution-addressbook-factory
odin 68918 0.0 0.0 601508 12008 ? Ssl Jan24 0:00 /usr/libexec/gvfs-udisks2-volume-monitor
odin 68932 0.0 0.0 448216 10248 ? Ssl Jan24 0:00 /usr/libexec/gvfs-mtp-volume-monitor
odin 68937 0.0 0.0 450044 8972 ? Ssl Jan24 0:00 /usr/libexec/gvfs-gphoto2-volume-monitor
odin 68942 0.0 0.0 448292 8332 ? Ssl Jan24 0:00 /usr/libexec/gvfs-goa-volume-monitor
odin 69015 0.0 0.0 522188 8540 ? Ssl Jan24 0:00 /usr/libexec/gsd-a11y-settings
odin 69016 0.0 0.0 739660 32320 ? Ssl Jan24 0:00 /usr/libexec/gsd-color
odin 69017 0.0 0.0 595368 22768 ? Ssl Jan24 0:00 /usr/libexec/gsd-datetime
odin 69018 0.0 0.0 524552 9860 ? Ssl Jan24 0:00 /usr/libexec/gsd-housekeeping
odin 69020 0.0 0.0 664172 31272 ? Ssl Jan24 0:00 /usr/libexec/gsd-keyboard
odin 69023 0.0 0.0 882516 32160 ? Ssl Jan24 0:00 /usr/libexec/gsd-media-keys
odin 69025 0.0 0.0 665280 30844 ? Ssl Jan24 0:00 /usr/libexec/gsd-power
odin 69029 0.0 0.0 468224 14896 ? Ssl Jan24 0:00 /usr/libexec/gsd-print-notifications
odin 69032 0.0 0.0 669652 10492 ? Ssl Jan24 0:00 /usr/libexec/gsd-rfkill
odin 69034 0.0 0.0 448052 7900 ? Ssl Jan24 0:00 /usr/libexec/gsd-screensaver-proxy
odin 69036 0.0 0.0 678296 12720 ? Ssl Jan24 0:00 /usr/libexec/gsd-sharing
odin 69039 0.0 0.0 603488 13764 ? Ssl Jan24 0:03 /usr/libexec/gsd-smartcard
odin 69040 0.0 0.0 530740 11344 ? Ssl Jan24 0:00 /usr/libexec/gsd-sound
odin 69044 0.0 0.0 590324 29684 ? Ssl Jan24 0:00 /usr/libexec/gsd-subman
odin 69045 0.0 0.0 836604 45076 ? Sl Jan24 0:00 /usr/libexec/evolution-data-server/evolution-alarm-notify
odin 69056 0.0 0.0 597796 11344 ? Ssl Jan24 0:00 /usr/libexec/gsd-usb-protection
odin 69070 0.0 0.0 388488 39200 ? S Jan24 1:26 /usr/bin/vmtoolsd -n vmusr
odin 69071 0.0 0.3 3649384 198068 ? Sl Jan24 0:05 /usr/bin/gnome-software --gapplication-service
odin 69074 0.0 0.0 664508 31836 ? Ssl Jan24 0:00 /usr/libexec/gsd-wacom
odin 69075 0.0 0.0 232044 6912 ? Sl Jan24 0:00 /usr/libexec/gsd-disk-utility-notify
odin 69076 0.0 0.0 664688 31644 ? Ssl Jan24 0:00 /usr/libexec/gsd-xsettings
root 69130 0.0 0.0 378340 59012 ? Ssl Jan24 0:11 /usr/bin/python3 /usr/libexec/rhsm-service
odin 69267 0.0 0.0 689048 15204 ? Ssl Jan24 0:00 /usr/libexec/xdg-desktop-portal
odin 69308 0.0 0.0 743796 10200 ? Ssl Jan24 0:00 /usr/libexec/xdg-document-portal
root 69314 0.0 0.0 2652 1664 ? Ss Jan24 0:00 fusermount -o rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal -- /run/user/1000/doc
odin 69320 0.0 0.1 3433668 111520 ? Ssl Jan24 0:00 /usr/libexec/xdg-desktop-portal-gnome
odin 69385 0.0 0.1 1453472 73516 ? Ssl Jan24 0:02 /usr/bin/nautilus --gapplication-service
odin 69388 0.0 0.0 599488 22052 ? Sl Jan24 0:00 /usr/libexec/gsd-printer
odin 69420 0.0 0.0 600512 10448 ? Sl Jan24 0:00 /usr/libexec/gvfsd-trash --spawner :1.24 /org/gtk/gvfs/exec_spaw/0
odin 69439 0.0 0.0 590332 30400 ? Ssl Jan24 0:00 /usr/libexec/xdg-desktop-portal-gtk
root 69482 0.0 0.0 566120 31220 ? Ssl Jan24 0:02 /usr/libexec/fwupd/fwupd
odin 69647 0.0 0.0 374736 8068 ? Ssl Jan24 0:00 /usr/libexec/gvfsd-metadata
odin 69898 0.0 0.0 954852 55180 ? SNsl Jan24 0:00 /usr/libexec/tracker-miner-fs-3
odin 71248 0.0 0.1 705300 67508 ? Ssl Jan24 0:38 /usr/libexec/gnome-terminal-server
odin 71266 0.0 0.0 224380 5760 pts/0 Ss+ Jan24 0:00 bash
root 76508 0.0 0.0 222520 3328 ? Ss Jan24 0:00 /bin/sh -c sudo /home/odin/manager/kafka/bin/zookeeper-server-start.sh /home/odin/manager/kafka/config/zookeeper.properties > /home/odin/manager/kafka/zk.log 2>&1
root 76509 0.0 0.0 240192 9984 ? S Jan24 0:00 sudo /home/odin/manager/kafka/bin/zookeeper-server-start.sh /home/odin/manager/kafka/config/zookeeper.properties
root 76512 0.0 0.0 21900 11776 ? Ss Jan24 0:00 /usr/lib/systemd/systemd --user
root 76513 0.0 0.0 172844 5888 ? S Jan24 0:00 (sd-pam)
root 76527 0.0 0.5 8391816 384076 ? Sl Jan24 1:06 java -Xmx512M -Xms512M -server -XX:+UseG1GC -XX:MaxGCPauseMillis=20 -XX:InitiatingHeapOccupancyPercent=35 -XX:+ExplicitGCInvokesConcurrent -XX:MaxInlineLevel=15 -Djava.awt.headless=true -Xlog:gc*:file=/home/odin/manager/kafka/bin/../logs/zookeeper-gc.log:time,tags:filecount=10,filesize=100M -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false -Dkafka.logs.dir=/home/odin/manager/kafka/bin/../logs -Dlog4j.configuration=file:/home/odin/manager/kafka/bin/../config/log4j.properties -cp /home/odin/manager/kafka/bin/../libs/activation-1.1.1.jar:/home/odin/manager/kafka/bin/../libs/aopalliance-repackaged-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/argparse4j-0.7.0.jar:/home/odin/manager/kafka/bin/../libs/audience-annotations-0.5.0.jar:/home/odin/manager/kafka/bin/../libs/commons-cli-1.4.jar:/home/odin/manager/kafka/bin/../libs/commons-lang3-3.8.1.jar:/home/odin/manager/kafka/bin/../libs/connect-api-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-basic-auth-extension-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-json-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-mirror-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-mirror-client-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-runtime-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-transforms-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/hk2-api-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/hk2-locator-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/hk2-utils-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/jackson-annotations-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-core-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-databind-2.12.6.1.jar:/home/odin/manager/kafka/bin/../libs/jackson-dataformat-csv-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-datatype-jdk8-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-jaxrs-base-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-jaxrs-json-provider-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-module-jaxb-annotations-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-module-scala_2.13-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jakarta.activation-api-1.2.1.jar:/home/odin/manager/kafka/bin/../libs/jakarta.annotation-api-1.3.5.jar:/home/odin/manager/kafka/bin/../libs/jakarta.inject-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/jakarta.validation-api-2.0.2.jar:/home/odin/manager/kafka/bin/../libs/jakarta.ws.rs-api-2.1.6.jar:/home/odin/manager/kafka/bin/../libs/jakarta.xml.bind-api-2.3.2.jar:/home/odin/manager/kafka/bin/../libs/javassist-3.27.0-GA.jar:/home/odin/manager/kafka/bin/../libs/javax.servlet-api-3.1.0.jar:/home/odin/manager/kafka/bin/../libs/javax.ws.rs-api-2.1.1.jar:/home/odin/manager/kafka/bin/../libs/jaxb-api-2.3.0.jar:/home/odin/manager/kafka/bin/../libs/jersey-client-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-common-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-container-servlet-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-container-servlet-core-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-hk2-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-server-2.34.jar:/home/odin/manager/kafka/bin/../libs/jetty-client-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-continuation-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-http-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-io-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-security-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-server-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-servlet-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-servlets-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-util-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-util-ajax-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jline-3.21.0.jar:/home/odin/manager/kafka/bin/../libs/jopt-simple-5.0.4.jar:/home/odin/manager/kafka/bin/../libs/jose4j-0.7.9.jar:/home/odin/manager/kafka/bin/../libs/kafka_2.13-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-clients-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-log4j-appender-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-metadata-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-raft-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-server-common-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-shell-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-storage-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-storage-api-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-examples-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-scala_2.13-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-test-utils-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-tools-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/lz4-java-1.8.0.jar:/home/odin/manager/kafka/bin/../libs/maven-artifact-3.8.4.jar:/home/odin/manager/kafka/bin/../libs/metrics-core-2.2.0.jar:/home/odin/manager/kafka/bin/../libs/metrics-core-4.1.12.1.jar:/home/odin/manager/kafka/bin/../libs/netty-buffer-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-codec-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-common-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-handler-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-resolver-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-tcnative-classes-2.0.46.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-classes-epoll-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-native-epoll-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-native-unix-common-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/osgi-resource-locator-1.0.3.jar:/home/odin/manager/kafka/bin/../libs/paranamer-2.8.jar:/home/odin/manager/kafka/bin/../libs/plexus-utils-3.3.0.jar:/home/odin/manager/kafka/bin/../libs/reflections-0.9.12.jar:/home/odin/manager/kafka/bin/../libs/reload4j-1.2.19.jar:/home/odin/manager/kafka/bin/../libs/rocksdbjni-6.29.4.1.jar:/home/odin/manager/kafka/bin/../libs/scala-collection-compat_2.13-2.6.0.jar:/home/odin/manager/kafka/bin/../libs/scala-java8-compat_2.13-1.0.2.jar:/home/odin/manager/kafka/bin/../libs/scala-library-2.13.8.jar:/home/odin/manager/kafka/bin/../libs/scala-logging_2.13-3.9.4.jar:/home/odin/manager/kafka/bin/../libs/scala-reflect-2.13.8.jar:/home/odin/manager/kafka/bin/../libs/slf4j-api-1.7.36.jar:/home/odin/manager/kafka/bin/../libs/slf4j-reload4j-1.7.36.jar:/home/odin/manager/kafka/bin/../libs/snappy-java-1.1.8.4.jar:/home/odin/manager/kafka/bin/../libs/trogdor-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/zookeeper-3.6.3.jar:/home/odin/manager/kafka/bin/../libs/zookeeper-jute-3.6.3.jar:/home/odin/manager/kafka/bin/../libs/zstd-jni-1.5.2-1.jar org.apache.zookeeper.server.quorum.QuorumPeerMain /home/odin/manager/kafka/config/zookeeper.properties
root 78602 0.0 0.0 222520 3328 ? Ss Jan24 0:00 /bin/sh -c sudo /home/odin/manager/kafka/bin/kafka-server-start.sh /home/odin/manager/kafka/config/server.properties > /home/odin/manager/kafka/kafka.log 2>&1
root 78604 0.0 0.0 240192 9728 ? S Jan24 0:00 sudo /home/odin/manager/kafka/bin/kafka-server-start.sh /home/odin/manager/kafka/config/server.properties
root 78605 11.2 2.3 17321788 1560264 ? Sl Jan24 216:24 java -Xmx1G -Xms1G -server -XX:+UseG1GC -XX:MaxGCPauseMillis=20 -XX:InitiatingHeapOccupancyPercent=35 -XX:+ExplicitGCInvokesConcurrent -XX:MaxInlineLevel=15 -Djava.awt.headless=true -Xlog:gc*:file=/home/odin/manager/kafka/bin/../logs/kafkaServer-gc.log:time,tags:filecount=10,filesize=100M -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false -Dkafka.logs.dir=/home/odin/manager/kafka/bin/../logs -Dlog4j.configuration=file:/home/odin/manager/kafka/bin/../config/log4j.properties -cp /home/odin/manager/kafka/bin/../libs/activation-1.1.1.jar:/home/odin/manager/kafka/bin/../libs/aopalliance-repackaged-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/argparse4j-0.7.0.jar:/home/odin/manager/kafka/bin/../libs/audience-annotations-0.5.0.jar:/home/odin/manager/kafka/bin/../libs/commons-cli-1.4.jar:/home/odin/manager/kafka/bin/../libs/commons-lang3-3.8.1.jar:/home/odin/manager/kafka/bin/../libs/connect-api-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-basic-auth-extension-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-json-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-mirror-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-mirror-client-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-runtime-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/connect-transforms-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/hk2-api-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/hk2-locator-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/hk2-utils-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/jackson-annotations-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-core-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-databind-2.12.6.1.jar:/home/odin/manager/kafka/bin/../libs/jackson-dataformat-csv-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-datatype-jdk8-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-jaxrs-base-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-jaxrs-json-provider-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-module-jaxb-annotations-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jackson-module-scala_2.13-2.12.6.jar:/home/odin/manager/kafka/bin/../libs/jakarta.activation-api-1.2.1.jar:/home/odin/manager/kafka/bin/../libs/jakarta.annotation-api-1.3.5.jar:/home/odin/manager/kafka/bin/../libs/jakarta.inject-2.6.1.jar:/home/odin/manager/kafka/bin/../libs/jakarta.validation-api-2.0.2.jar:/home/odin/manager/kafka/bin/../libs/jakarta.ws.rs-api-2.1.6.jar:/home/odin/manager/kafka/bin/../libs/jakarta.xml.bind-api-2.3.2.jar:/home/odin/manager/kafka/bin/../libs/javassist-3.27.0-GA.jar:/home/odin/manager/kafka/bin/../libs/javax.servlet-api-3.1.0.jar:/home/odin/manager/kafka/bin/../libs/javax.ws.rs-api-2.1.1.jar:/home/odin/manager/kafka/bin/../libs/jaxb-api-2.3.0.jar:/home/odin/manager/kafka/bin/../libs/jersey-client-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-common-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-container-servlet-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-container-servlet-core-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-hk2-2.34.jar:/home/odin/manager/kafka/bin/../libs/jersey-server-2.34.jar:/home/odin/manager/kafka/bin/../libs/jetty-client-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-continuation-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-http-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-io-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-security-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-server-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-servlet-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-servlets-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-util-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jetty-util-ajax-9.4.44.v20210927.jar:/home/odin/manager/kafka/bin/../libs/jline-3.21.0.jar:/home/odin/manager/kafka/bin/../libs/jopt-simple-5.0.4.jar:/home/odin/manager/kafka/bin/../libs/jose4j-0.7.9.jar:/home/odin/manager/kafka/bin/../libs/kafka_2.13-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-clients-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-log4j-appender-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-metadata-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-raft-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-server-common-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-shell-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-storage-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-storage-api-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-examples-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-scala_2.13-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-streams-test-utils-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/kafka-tools-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/lz4-java-1.8.0.jar:/home/odin/manager/kafka/bin/../libs/maven-artifact-3.8.4.jar:/home/odin/manager/kafka/bin/../libs/metrics-core-2.2.0.jar:/home/odin/manager/kafka/bin/../libs/metrics-core-4.1.12.1.jar:/home/odin/manager/kafka/bin/../libs/netty-buffer-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-codec-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-common-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-handler-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-resolver-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-tcnative-classes-2.0.46.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-classes-epoll-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-native-epoll-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/netty-transport-native-unix-common-4.1.73.Final.jar:/home/odin/manager/kafka/bin/../libs/osgi-resource-locator-1.0.3.jar:/home/odin/manager/kafka/bin/../libs/paranamer-2.8.jar:/home/odin/manager/kafka/bin/../libs/plexus-utils-3.3.0.jar:/home/odin/manager/kafka/bin/../libs/reflections-0.9.12.jar:/home/odin/manager/kafka/bin/../libs/reload4j-1.2.19.jar:/home/odin/manager/kafka/bin/../libs/rocksdbjni-6.29.4.1.jar:/home/odin/manager/kafka/bin/../libs/scala-collection-compat_2.13-2.6.0.jar:/home/odin/manager/kafka/bin/../libs/scala-java8-compat_2.13-1.0.2.jar:/home/odin/manager/kafka/bin/../libs/scala-library-2.13.8.jar:/home/odin/manager/kafka/bin/../libs/scala-logging_2.13-3.9.4.jar:/home/odin/manager/kafka/bin/../libs/scala-reflect-2.13.8.jar:/home/odin/manager/kafka/bin/../libs/slf4j-api-1.7.36.jar:/home/odin/manager/kafka/bin/../libs/slf4j-reload4j-1.7.36.jar:/home/odin/manager/kafka/bin/../libs/snappy-java-1.1.8.4.jar:/home/odin/manager/kafka/bin/../libs/trogdor-3.2.0.jar:/home/odin/manager/kafka/bin/../libs/zookeeper-3.6.3.jar:/home/odin/manager/kafka/bin/../libs/zookeeper-jute-3.6.3.jar:/home/odin/manager/kafka/bin/../libs/zstd-jni-1.5.2-1.jar kafka.Kafka /home/odin/manager/kafka/config/server.properties
odin 82163 0.0 0.0 290896 24272 pts/1 Ssl+ Jan24 1:22 ./redis-server 0.0.0.0:6379
odin 89225 0.0 0.0 222524 3456 pts/2 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; ulimit -n 65535; echo ulimit = unlimited; echo ulimit = 65535; echo ========; ./OdinAppInfoView 2> ../Logs/ConsoleLogs/2026-01-24/2026-01-24_07-50-28_OdinAppInfoConsole.log;
odin 89227 0.4 0.1 1698300 83336 pts/2 Sl+ Jan24 8:17 ./OdinAppInfoView
odin 91073 0.0 0.0 222524 3456 pts/3 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; ulimit -n 65535; echo ulimit = unlimited; echo ulimit = 65535; echo ========; ./odinmgr_Linux auto 2> ../Logs/ConsoleLogs/2026-01-24/2026-01-24_07-50-28_OdinMgrConsole.log;
odin 91075 2.9 8.9 16136532 5818788 pts/3 Sl+ Jan24 56:04 ./odinmgr_Linux auto
odin 91125 0.0 0.0 224400 5760 pts/4 Ss+ Jan24 0:00 bash
odin 91201 0.0 0.0 222524 3456 pts/5 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./Recovery 1; exec bash;
odin 91202 0.2 1.3 2141032 875684 pts/5 Sl+ Jan24 3:55 ./Recovery 1
odin 91244 0.0 0.0 222524 3456 pts/6 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./Recovery 2; exec bash;
odin 91245 0.1 0.7 1678952 478076 pts/6 Sl+ Jan24 3:50 ./Recovery 2
root 100150 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/11:2H-kblockd]
odin 100385 0.0 0.0 222524 3456 pts/7 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./MarketInformationServer;exec bash;
odin 100387 24.5 2.1 279187404 1404600 pts/7 Sl+ Jan24 471:59 ./MarketInformationServer
odin 100388 0.0 0.0 222524 3456 pts/8 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./Surveillance 1;exec bash;
odin 100389 1.1 7.7 8739792 5087536 pts/8 Sl+ Jan24 22:09 ./Surveillance 1
odin 100390 0.0 0.0 222524 3456 pts/9 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./AuthenticationServer;exec bash;
odin 100391 0.2 0.0 799952 32076 pts/9 Sl+ Jan24 3:54 ./AuthenticationServer
odin 100392 0.0 0.0 222524 3456 pts/10 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./RMSQServer;exec bash;
odin 100393 99.6 12.2 11882036 8012620 pts/10 Sl+ Jan24 1916:20 ./RMSQServer
odin 100394 0.0 0.0 222524 3456 pts/11 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./FeedCli;exec bash;
odin 100396 0.0 0.6 2285016 394300 pts/11 Sl+ Jan24 0:10 ./FeedCli
odin 100398 0.0 0.0 222524 3456 pts/12 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./GraphFeedCli;exec bash;
odin 100399 0.0 0.6 2355068 392844 pts/12 Sl+ Jan24 0:09 ./GraphFeedCli
odin 100400 0.0 0.0 222524 3456 pts/13 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./BOTracker;exec bash;
odin 100404 0.3 0.6 2125332 439496 pts/13 Sl+ Jan24 7:07 ./BOTracker
odin 100468 0.0 0.0 222524 3456 pts/14 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./ExchangeAdaptor -i1;exec bash;
odin 100469 3.7 0.0 1453708 23332 pts/14 Sl+ Jan24 73:01 ./ExchangeAdaptor -i1
odin 100470 0.0 0.0 222524 3456 pts/15 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./ExchangeAdaptor -i2;exec bash;
odin 100472 3.7 0.0 1453808 23384 pts/15 Sl+ Jan24 72:40 ./ExchangeAdaptor -i2
odin 100487 0.0 0.0 222524 3456 pts/16 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./ExchangeAdaptor -i2048;exec bash;
odin 100489 3.7 0.0 1453808 21344 pts/16 Sl+ Jan24 72:33 ./ExchangeAdaptor -i2048
odin 100503 0.0 0.0 222524 3456 pts/17 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./ExchangeAdaptor -i8192;exec bash;
odin 100504 3.7 0.0 1453856 23536 pts/17 Sl+ Jan24 72:42 ./ExchangeAdaptor -i8192
odin 100505 0.0 0.0 222524 3456 pts/18 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./ExchangeAdaptor -i32768;exec bash;
odin 100506 3.8 0.0 1453820 23560 pts/18 Sl+ Jan24 73:12 ./ExchangeAdaptor -i32768
odin 100557 0.0 0.0 222524 3456 pts/19 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./ExchangeAdaptor -i1 -b;exec bash;
odin 100558 0.0 0.0 988480 16716 pts/19 Sl+ Jan24 0:07 ./ExchangeAdaptor -i1 -b
odin 100577 0.0 0.0 222524 3456 pts/20 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./ExchangeAdaptor -i2 -b;exec bash;
odin 100579 0.0 0.0 988376 14748 pts/20 Sl+ Jan24 0:07 ./ExchangeAdaptor -i2 -b
odin 100580 0.0 0.0 222524 3456 pts/21 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./ExchangeAdaptor -i2048 -b;exec bash;
odin 100581 0.0 0.0 988340 16588 pts/21 Sl+ Jan24 0:07 ./ExchangeAdaptor -i2048 -b
odin 100617 0.0 0.0 222524 3456 pts/22 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./ExchangeAdaptor -i8192 -b;exec bash;
odin 100624 0.0 0.0 988344 16640 pts/22 Sl+ Jan24 0:07 ./ExchangeAdaptor -i8192 -b
odin 100626 0.0 0.0 222524 3456 pts/23 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./ExchangeAdaptor -i32768 -b;exec bash;
odin 100627 0.0 0.0 988340 16708 pts/23 Sl+ Jan24 0:07 ./ExchangeAdaptor -i32768 -b
odin 100648 0.0 0.0 222524 3456 pts/24 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./ExchangeAdaptor -i8 -b;exec bash;
odin 100655 0.0 0.0 694328 14660 pts/24 Sl+ Jan24 0:07 ./ExchangeAdaptor -i8 -b
odin 100673 0.0 0.0 222524 3456 pts/25 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./ExchangeAdaptor -i4 -b;exec bash;
odin 100674 0.0 0.0 694364 14868 pts/25 Sl+ Jan24 0:07 ./ExchangeAdaptor -i4 -b
odin 100675 0.0 0.0 222524 3456 pts/26 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./ExchangeAdaptor -i268435456 -b;exec bash;
odin 100677 0.0 0.0 694508 14904 pts/26 Sl+ Jan24 0:07 ./ExchangeAdaptor -i268435456 -b
odin 100712 0.0 0.0 222524 3456 pts/27 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./FIXRecovery/RecoveryManager;exec bash;
odin 100713 0.9 0.2 5807292 163528 pts/27 Sl+ Jan24 18:06 ./FIXRecovery/RecoveryManager
odin 100727 0.0 0.0 222524 3456 pts/28 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./BSEEQFIXCOMM;exec bash;
odin 100730 0.2 0.2 5305920 143568 pts/28 Sl+ Jan24 4:21 ./BSEEQFIXCOMM
odin 100745 0.0 0.0 222524 3456 pts/29 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./BSEFOFIXCOMM;exec bash;
odin 100746 0.2 0.2 4974496 135984 pts/29 Sl+ Jan24 3:53 ./BSEFOFIXCOMM
odin 100759 0.0 0.0 222524 3456 pts/30 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./BSECDSFIXCOMM;exec bash;
odin 100760 0.2 0.2 4974496 141864 pts/30 Sl+ Jan24 4:06 ./BSECDSFIXCOMM
odin 100775 0.0 0.0 222524 3456 pts/31 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./MCXFIXCOMM;exec bash;
odin 100777 0.2 0.2 4679808 163092 pts/31 Sl+ Jan24 4:00 ./MCXFIXCOMM
odin 100802 0.0 0.0 222524 3456 pts/32 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./FIXMDBGateway;exec bash;
odin 100803 0.0 0.1 275044808 127316 pts/32 Sl+ Jan24 0:13 ./FIXMDBGateway
odin 103049 0.0 0.0 222524 3456 pts/33 Ss+ Jan24 0:00 bash -c ulimit -S -c unlimited; echo ulimit = unlimited; echo ========; ./MarketToday.UI;exec bash;
odin 103051 0.0 0.5 277902400 332904 pts/33 Sl+ Jan24 0:17 ./MarketToday.UI
root 334915 0.0 0.0 0 0 ? I< Jan24 0:00 [kworker/R-tls-s]
root 1923060 0.0 0.0 0 0 ? I Jan24 0:00 [kworker/3:2-cgroup_destroy]
root 1923062 0.0 0.0 0 0 ? I Jan24 0:00 [kworker/9:0-cgroup_destroy]
root 2115322 0.0 0.0 0 0 ? I Jan24 0:00 [kworker/1:1-cgroup_destroy]
root 2803524 0.0 0.0 0 0 ? I 05:04 0:00 [kworker/8:0-cgroup_destroy]
root 3008552 0.0 0.0 0 0 ? I 06:51 0:00 [kworker/4:0-cgroup_destroy]
root 3056466 0.0 0.0 0 0 ? I 07:16 0:00 [kworker/5:0-mm_percpu_wq]
root 3152371 0.0 0.0 0 0 ? I 08:06 0:00 [kworker/15:0-events]
root 3255393 0.0 0.0 0 0 ? I 09:00 0:00 [kworker/11:2-cgroup_destroy]
root 3484641 0.0 0.0 0 0 ? I 11:00 0:00 [kworker/6:0-cgroup_destroy]
root 3484657 0.0 0.0 0 0 ? I 11:00 0:00 [kworker/10:0-cgroup_destroy]
odin 3547708 1.0 0.5 6530740 378740 ? Ssl 11:33 2:53 /usr/bin/gnome-shell
odin 3547764 0.0 0.0 526604 13080 ? Sl 11:33 0:00 ibus-daemon --panel disable --xim
odin 3547768 0.0 0.0 449096 11056 ? Sl 11:33 0:00 /usr/libexec/ibus-dconf
odin 3547769 0.0 0.0 595592 34888 ? Sl 11:33 0:00 /usr/libexec/ibus-extension-gtk3
odin 3547771 0.0 0.0 516616 29316 ? Sl 11:33 0:00 /usr/libexec/ibus-x11 --kill-daemon
odin 3547774 0.0 0.0 449036 11196 ? Ssl 11:33 0:00 /usr/libexec/ibus-portal
odin 3547861 0.0 0.0 3202024 28188 ? Ssl 11:33 0:00 /usr/bin/gjs /usr/share/gnome-shell/org.gnome.Shell.Notifications
odin 3547915 0.0 0.0 375252 6784 ? Sl 11:33 0:00 /usr/libexec/ibus-engine-simple
root 3607113 0.0 0.0 0 0 ? I 12:04 0:00 [kworker/12:2-events]
root 3721632 0.0 0.0 0 0 ? I 13:04 0:00 [kworker/12:1-events]
root 3836166 0.0 0.0 0 0 ? I 14:04 0:00 [kworker/0:2-cgroup_destroy]
root 3866709 0.0 0.0 0 0 ? I 14:20 0:01 [kworker/u64:2-writeback]
root 3967952 0.0 0.0 0 0 ? I 15:13 0:00 [kworker/2:0-events]
root 4002415 0.0 0.0 0 0 ? I 15:30 0:00 [kworker/10:2-cgroup_destroy]
root 4003973 0.0 0.0 0 0 ? I 15:31 0:00 [kworker/14:0-mm_percpu_wq]
root 4013535 0.0 0.0 0 0 ? I 15:36 0:00 [kworker/u64:3-events_unbound]
root 4013628 0.0 0.0 0 0 ? I 15:36 0:00 [kworker/13:0-mm_percpu_wq]
root 4026918 0.0 0.0 0 0 ? I 15:43 0:00 [kworker/7:2-cgroup_destroy]
root 4026954 0.0 0.0 0 0 ? I 15:43 0:00 [kworker/u64:0-events_unbound]
root 4044373 0.0 0.0 0 0 ? I 15:52 0:00 [kworker/14:1-events]
root 4044439 0.0 0.0 0 0 ? I 15:52 0:00 [kworker/6:1-cgroup_destroy]
root 4044504 0.0 0.0 0 0 ? I 15:52 0:00 [kworker/5:1-cgroup_destroy]
root 4044853 0.0 0.0 0 0 ? I 15:52 0:00 [kworker/0:0-events]
root 4045020 0.0 0.0 0 0 ? I 15:52 0:00 [kworker/15:1-cgroup_destroy]
root 4045484 0.0 0.0 0 0 ? I 15:52 0:00 [kworker/4:1-cgroup_destroy]
root 4049892 0.0 0.0 0 0 ? I 15:53 0:00 [kworker/1:2-events]
root 4050279 0.0 0.0 0 0 ? I 15:53 0:00 [kworker/9:1-cgroup_destroy]
root 4050371 0.0 0.0 0 0 ? I 15:53 0:00 [kworker/11:0-events]
root 4050745 0.0 0.0 0 0 ? I 15:53 0:00 [kworker/2:2-cgroup_destroy]
root 4056990 0.0 0.0 0 0 ? I 15:54 0:00 [kworker/u64:1-flush-253:0]
root 4057134 0.0 0.0 0 0 ? I 15:54 0:00 [kworker/3:0-events]
root 4057217 0.0 0.0 0 0 ? I 15:54 0:00 [kworker/13:2-events_freezable_pwr_ef]
root 4057314 0.0 0.0 0 0 ? I 15:54 0:00 [kworker/7:1-events]
root 4057475 0.0 0.0 0 0 ? I 15:54 0:00 [kworker/8:1-cgroup_destroy]
root 4066030 0.0 0.0 0 0 ? I 15:55 0:00 [kworker/10:1-events]
root 4091250 0.0 0.0 0 0 ? I 15:58 0:00 [kworker/6:2-events]
root 4091414 0.0 0.0 0 0 ? I 15:58 0:00 [kworker/15:2-cgroup_destroy]
root 4093438 0.0 0.0 0 0 ? I 15:58 0:00 [kworker/0:1]
root 4093482 0.0 0.0 0 0 ? I 15:58 0:00 [kworker/1:0-cgroup_destroy]
root 4093748 0.0 0.0 0 0 ? I 15:58 0:00 [kworker/15:3-mm_percpu_wq]
root 4093845 0.0 0.0 0 0 ? I 15:58 0:00 [kworker/2:1-events]
root 4093943 0.0 0.0 0 0 ? I 15:58 0:00 [kworker/5:2]
root 4095224 0.0 0.0 0 0 ? I 15:59 0:00 [kworker/11:1-cgroup_destroy]
root 4096889 0.0 0.0 0 0 ? I 15:59 0:00 [kworker/9:2-events_power_efficient]
root 4097081 0.0 0.0 0 0 ? I 15:59 0:00 [kworker/4:2-mm_percpu_wq]
root 4097458 0.0 0.0 0 0 ? I 15:59 0:00 [kworker/3:1-cgroup_destroy]
root 4097494 0.0 0.0 0 0 ? I 15:59 0:00 [kworker/8:2-events]
root 4097708 0.0 0.0 20312 11776 ? Ss 15:59 0:00 sshd: root [priv]
root 4097710 0.0 0.0 20652 6980 ? S 15:59 0:00 sshd: root@notty
root 4097711 0.0 0.0 222652 3584 ? Ss 15:59 0:00 bash -c /bin/ps auxww 2>/dev/null
root 4097740 0.0 0.0 225496 3456 ? R 15:59 0:00 /bin/ps auxww
152742 - Unix Software Discovery Commands Available
-
Synopsis
Nessus was able to log in to the remote host using the provided credentials and is able to execute all commands used to find unmanaged software.
Description
Nessus was able to determine that it is possible for plugins to find and identify versions of software on the target host. Software that is not managed by the operating system is typically found and characterized using these commands. This was measured by running commands used by unmanaged software plugins and validating their output against expected results.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2021/08/23, Modified: 2021/08/23
Plugin Output

## tcp/0

Unix software discovery checks are available.
Account : root
Protocol : SSH
186361 - VMWare Tools or Open VM Tools Installed (Linux)
-
Synopsis
VMWare Tools or Open VM Tools were detected on the remote Linux host.
Description
VMWare Tools or Open VM Tools were detected on the remote Linux host.
See Also

https://kb.vmware.com/s/article/340
http://www.nessus.org/u?c0628155

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2023/11/28, Modified: 2025/12/18
Plugin Output

## tcp/0

Path : /usr/bin/vmtoolsd
Version : 12.4.0
20094 - VMware Virtual Machine Detection
-
Synopsis
The remote host is a VMware virtual machine.
Description
According to the MAC address of its network adapter, the remote host is a VMware virtual machine.
Solution
Since it is physically accessible through the network, ensure that its configuration matches your organization's security policy.
Risk Factor
None
Plugin Information
Published: 2005/10/27, Modified: 2019/12/11
Plugin Output

## tcp/0

The remote host is a VMware virtual machine.
189731 - Vim Installed (Linux)
-
Synopsis
Vim is installed on the remote Linux host.
Description
Vim is installed on the remote Linux host.
See Also

https://www.vim.org/

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2024/01/29, Modified: 2025/12/18
Plugin Output

## tcp/0

Path : /usr/bin/vim
Version : 8.2
198234 - gnome-shell Installed (Linux / UNIX)
-
Synopsis
gnome-shell is installed on the remote Linux / UNIX host.
Description
gnome-shell is installed on the remote Linux / UNIX host.
See Also

https://gitlab.gnome.org/GNOME/gnome-shell/

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2024/05/31, Modified: 2025/12/18
Plugin Output

## tcp/0

Path : /usr/bin/gnome-shell
Version : 40.10
Managed : 1
138014 - kpatch : Installed Patches
-
Synopsis
The remote host is using kpatch to maintain the OS kernel.
Description
kpatch is being used to maintain the remote host's operating system kernel without requiring reboots.
See Also

https://github.com/dynup/kpatch

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2020/07/01, Modified: 2021/05/10
Plugin Output

## tcp/0

kpatch is installed, but no loaded patch modules appear to cover any CVEs.
kpatch list output:
Loaded patch modules:
Installed patch modules:
182848 - libcurl Installed (Linux / Unix)
-
Synopsis
libcurl is installed on the remote Linux / Unix host.
Description
libcurl is installed on the remote Linux / Unix host.
Additional information:
- More paths will be searched and the timeout for the search will be increased if 'Perform thorough tests' setting is enabled.
- The plugin timeout can be set to a custom value other than the plugin's default of 30 minutes via the 'timeout.182848' scanner setting in Nessus 8.15.1 or later.
Please see https://docs.tenable.com/nessus/Content/SettingsAdvanced.htm#Custom for more information.
See Also

https://curl.se/

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2023/10/10, Modified: 2025/12/18
Plugin Output

## tcp/0

Path : /usr/lib64/libcurl.so.4.7.0
Version : 7.76.1
Associated Package : libcurl-7.76.1-31.el9
Managed by OS : True
204828 - libexiv2 Installed (Linux / Unix)
-
Synopsis
libexiv2 is installed on the remote Linux / Unix host.
Description
libexiv2 is installed on the remote Linux / Unix host.
Additional information:
- More paths will be searched and the timeout for the search will be increased if 'Perform thorough tests' setting is enabled.
- The plugin timeout can be set to a custom value other than the plugin's default of 30 minutes via the 'timeout.204828' scanner setting in Nessus 8.15.1 or later.
Please see https://docs.tenable.com/nessus/Content/SettingsAdvanced.htm#Custom for more information.
See Also

https://exiv2.org/

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2024/07/29, Modified: 2025/12/18
Plugin Output

## tcp/0

Path : /usr/lib64/libexiv2.so.0.27.5
Version : 0.27.5
Associated Package : exiv2-libs-0.27.5-2.el9
Managed by OS : True

##

66717 - mDNS Detection (Local Network)
-
Synopsis
It is possible to obtain information about the remote host.
Description
The remote service understands the Bonjour (also known as ZeroConf or mDNS) protocol, which allows anyone to uncover information from the remote host such as its operating system type and exact version, its hostname, and the list of services it is running.
This plugin attempts to discover mDNS used by hosts residing on the same network segment as Nessus.
Solution
Filter incoming traffic to UDP port 5353, if desired.
Risk Factor
None
Plugin Information
Published: 2013/05/31, Modified: 2013/05/31
Plugin Output

## udp/5353/mdns

Nessus was able to extract the following information :
- mDNS hostname : LKPOMSHAPRI.local.

###### Compliance 'FAILED'

###### Compliance 'SKIPPED'

###### Compliance 'PASSED'

###### Compliance 'INFO', 'WARNING', 'ERROR'

###### Remediations

Suggested Remediations
Taking the following actions across 1 hosts would resolve 28% of the vulnerabilities on the network.

| Action to take |  | Vulns | Hosts
| RHEL 9 : kernel (RHSA-2025:23241): Update the RHEL kernel package based on the guidance in RHSA-2025:23241. |  | 502 | 1
| RHEL 9 : kernel (RHSA-2025:19930): Update the RHEL kernel package based on the guidance in RHSA-2025:19930. |  | 119 | 1
| RHEL 9 : firefox (RHSA-2025:23034): Update the RHEL firefox package based on the guidance in RHSA-2025:23034. |  | 68 | 1
| RHEL 9 : mysql (RHSA-2025:23109): Update the RHEL mysql package based on the guidance in RHSA-2025:23109. |  | 57 | 1
| RHEL 9 : mysql (RHSA-2025:16086): Update the RHEL mysql package based on the guidance in RHSA-2025:16086. |  | 51 | 1
| RHEL 9 : kernel (RHSA-2025:4341): Update the RHEL kernel package based on the guidance in RHSA-2025:4341. |  | 50 | 1
| RHEL 9 : webkit2gtk3 (RHSA-2025:23700): Update the RHEL webkit2gtk3 package based on the guidance in RHSA-2025:23700. |  | 48 | 1
| RHEL 9 : firefox (RHSA-2025:18155): Update the RHEL firefox package based on the guidance in RHSA-2025:18155. |  | 46 | 1
| RHEL 9 : webkit2gtk3 (RHSA-2025:18097): Update the RHEL webkit2gtk3 package based on the guidance in RHSA-2025:18097. |  | 23 | 1
| RHEL 9 : gstreamer1-plugins-good (RHSA-2025:7242): Update the RHEL gstreamer1-plugins-good package based on the guidance in RHSA-2025:7242. |  | 22 | 1
| RHEL 9 : webkit2gtk3 (RHSA-2024:8180): Update the RHEL webkit2gtk3 package based on the guidance in RHSA-2024:8180. |  | 18 | 1
| RHEL 9 : podman (RHSA-2024:9051): Update the RHEL podman package based on the guidance in RHSA-2024:9051. |  | 16 | 1
| RHEL 8 / 9 : java-17-openjdk (RHSA-2025:18821): Update the RHEL java-17-openjdk package based on the guidance in RHSA-2025:18821. |  | 15 | 1
| RHEL 9 : libsoup (RHSA-2025:19713): Update the RHEL libsoup package based on the guidance in RHSA-2025:19713. |  | 15 | 1
| RHEL 9 : podman (RHSA-2025:23325): Update the RHEL podman package based on the guidance in RHSA-2025:23325. |  | 13 | 1
| RHEL 9 : tigervnc (RHSA-2025:20958): Update the RHEL tigervnc package based on the guidance in RHSA-2025:20958. |  | 12 | 1
| RHEL 9 : xorg-x11-server (RHSA-2025:20961): Update the RHEL xorg-x11-server package based on the guidance in RHSA-2025:20961. |  | 12 | 1
| RHEL 7 / 8 / 9 : java-11-openjdk ELS (RHSA-2025:18818): Update the RHEL java-11-openjdk ELS package based on the guidance in RHSA-2025:18818. |  | 11 | 1
| RHEL 9 : firefox (RHSA-2024:8726): Update the RHEL firefox package based on the guidance in RHSA-2024:8726. |  | 11 | 1
| RHEL 9 : grub2 (RHSA-2025:20532): Update the RHEL grub2 package based on the guidance in RHSA-2025:20532. |  | 11 | 1
| RHEL 9 : buildah (RHSA-2025:22011): Update the RHEL buildah package based on the guidance in RHSA-2025:22011. |  | 10 | 1
| RHEL 8 / 9 : java-21-openjdk (RHSA-2025:3855): Update the RHEL java-21-openjdk package based on the guidance in RHSA-2025:3855. |  | 9 | 1
| RHEL 9 : xorg-x11-server-Xwayland (RHSA-2025:20960): Update the RHEL xorg-x11-server-Xwayland packages based on the guidance in RHSA-2025:20960. |  | 9 | 1
| RHEL 8 / 9 : java-1.8.0-openjdk (RHSA-2025:3845): Update the RHEL java-1.8.0-openjdk package based on the guidance in RHSA-2025:3845. |  | 8 | 1
| RHEL 9 : git (RHSA-2025:11462): Update the RHEL git package based on the guidance in RHSA-2025:11462. |  | 8 | 1
| RHEL 9 : python3.9 (RHSA-2025:23342): Update the RHEL python3.9 package based on the guidance in RHSA-2025:23342. |  | 8 | 1
| RHEL 9 : tigervnc (RHSA-2025:19489): Update the RHEL tigervnc package based on the guidance in RHSA-2025:19489. |  | 8 | 1
| RHEL 9 : xorg-x11-server update (Moderate) (RHSA-2025:19433): Update the affected packages. |  | 8 | 1
| RHEL 10 / 8 / 9 : java-21-openjdk (RHSA-2025:18824): Update the RHEL java-21-openjdk package based on the guidance in RHSA-2025:18824. |  | 7 | 1
| RHEL 9 : ghostscript (RHSA-2025:7586): Update the RHEL ghostscript package based on the guidance in RHSA-2025:7586. |  | 7 | 1
| RHEL 9 : gstreamer1-plugins-base (RHSA-2025:7243): Update the RHEL gstreamer1-plugins-base package based on the guidance in RHSA-2025:7243. |  | 7 | 1
| RHEL 8 / 9 : java-1.8.0-openjdk (RHSA-2025:18815): Update the RHEL java-1.8.0-openjdk package based on the guidance in RHSA-2025:18815. |  | 6 | 1
| RHEL 9 : libxml2 (RHSA-2025:13428): Update the RHEL libxml2 package based on the guidance in RHSA-2025:13428. |  | 6 | 1
| RHEL 9 : libxml2 (RHSA-2025:22376): Update the RHEL libxml2 package based on the guidance in RHSA-2025:22376. |  | 6 | 1
| RHEL 9 : python3.9 (RHSA-2025:15019): Update the RHEL python3.9 package based on the guidance in RHSA-2025:15019. |  | 6 | 1
| RHEL 9 : shim update (Important) (RHSA-2024:1903): Update the affected shim-aa64 and / or shim-x64 packages. |  | 6 | 1
| RHEL 8 / 9 : java-11-openjdk (RHSA-2024:8121): Update the RHEL java-11-openjdk package based on the guidance in RHSA-2024:8121. |  | 5 | 1
| RHEL 9 : .NET 9.0 (RHSA-2025:18151): Update the RHEL .NET 9.0 package based on the guidance in RHSA-2025:18151. |  | 5 | 1
| RHEL 9 : libsoup (RHSA-2025:20959): Update the RHEL libsoup package based on the guidance in RHSA-2025:20959. |  | 5 | 1
| RHEL 9 : podman (RHSA-2025:15900): Update the RHEL podman package based on the guidance in RHSA-2025:15900. |  | 5 | 1
| RHEL 9 : gnutls (RHSA-2025:16116): Update the affected packages. |  | 4 | 1
| RHEL 9 : rsync (RHSA-2025:7050): Update the RHEL rsync package based on the guidance in RHSA-2025:7050. |  | 4 | 1
| RHEL 9 : bind (RHSA-2025:21110): Update the RHEL bind package based on the guidance in RHSA-2025:21110. |  | 3 | 1
| RHEL 9 : expat (RHSA-2025:22175): Update the RHEL expat package based on the guidance in RHSA-2025:22175. |  | 3 | 1
| RHEL 9 : glibc (RHSA-2025:12748): Update the RHEL glibc package based on the guidance in RHSA-2025:12748. |  | 3 | 1
| RHEL 9 : microcode_ctl (RHSA-2025:7043): Update the RHEL microcode_ctl package based on the guidance in RHSA-2025:7043. |  | 3 | 1
| RHEL 9 : openssh (RHSA-2025:23480): Update the RHEL openssh package based on the guidance in RHSA-2025:23480. |  | 3 | 1
| RHEL 9 : rhc (RHSA-2025:7326): Update the RHEL rhc package based on the guidance in RHSA-2025:7326. |  | 3 | 1
| RHEL 9 : vim (RHSA-2025:17742): Update the RHEL vim package based on the guidance in RHSA-2025:17742. |  | 3 | 1
| RHEL 9 : xorg-x11-server-Xwayland update (Moderate) (RHSA-2025:19623): Update the affected xorg-x11-server-Xwayland and / or xorg-x11-server-Xwayland-devel packages. |  | 3 | 1
| RHEL 9 : avahi (RHSA-2025:11402): Update the RHEL avahi package based on the guidance in RHSA-2025:11402. |  | 2 | 1
| RHEL 9 : bind (RHSA-2025:19951): Update the RHEL bind package based on the guidance in RHSA-2025:19951. |  | 2 | 1
| RHEL 9 : buildah (RHSA-2025:9147): Update the RHEL buildah package based on the guidance in RHSA-2025:9147. |  | 2 | 1
| RHEL 9 : cups (RHSA-2025:15700): Update the RHEL cups package based on the guidance in RHSA-2025:15700. |  | 2 | 1
| RHEL 9 : emacs (RHSA-2025:4787): Update the RHEL emacs package based on the guidance in RHSA-2025:4787. |  | 2 | 1
| RHEL 9 : glib2 (RHSA-2025:11140): Update the RHEL glib2 package based on the guidance in RHSA-2025:11140. |  | 2 | 1
| RHEL 9 : gstreamer1, gstreamer1-plugins-bad-free, gstreamer1-plugins-ugly-free, and gstreamer1-rtsp-server (RHSA-2025:7178): Update the RHEL gstreamer1 / gstreamer1-plugins-bad-free / gstreamer1-plugins-ugly-free / gstreamer1-rtsp-server packages based on the guidance in RHSA-2025:7178. |  | 2 | 1
| RHEL 9 : iputils (RHSA-2025:17558): Update the RHEL iputils package based on the guidance in RHSA-2025:17558. |  | 2 | 1
| RHEL 9 : jq (RHSA-2025:10585): Update the RHEL jq package based on the guidance in RHSA-2025:10585. |  | 2 | 1
| RHEL 9 : krb5 (RHSA-2025:7067): Update the RHEL krb5 package based on the guidance in RHSA-2025:7067. |  | 2 | 1
| RHEL 9 : libarchive (RHSA-2025:14130): Update the RHEL libarchive package based on the guidance in RHSA-2025:14130. |  | 2 | 1
| RHEL 9 : libssh (RHSA-2025:23483): Update the RHEL libssh package based on the guidance in RHSA-2025:23483. |  | 2 | 1
| RHEL 9 : libtiff (RHSA-2025:19113): Update the RHEL libtiff package based on the guidance in RHSA-2025:19113. |  | 2 | 1
| RHEL 9 : libtiff (RHSA-2025:20801): Update the RHEL libtiff package based on the guidance in RHSA-2025:20801. |  | 2 | 1
| RHEL 9 : libtiff (RHSA-2025:20956): Update the RHEL libtiff package based on the guidance in RHSA-2025:20956. |  | 2 | 1
| RHEL 9 : libxslt (RHSA-2025:4025): Update the RHEL libxslt package based on the guidance in RHSA-2025:4025. |  | 2 | 1
| RHEL 9 : openjpeg2 (RHSA-2025:7309): Update the RHEL openjpeg2 package based on the guidance in RHSA-2025:7309. |  | 2 | 1
| RHEL 9 : openssl (RHSA-2025:21255): Update the RHEL openssl package based on the guidance in RHSA-2025:21255. |  | 2 | 1
| RHEL 9 : pam (RHSA-2024:11250): Update the RHEL pam package based on the guidance in RHSA-2024:11250. |  | 2 | 1
| RHEL 9 : pam (RHSA-2025:15099): Update the RHEL pam package based on the guidance in RHSA-2025:15099. |  | 2 | 1
| RHEL 9 : qemu-kvm (RHSA-2025:4492): Update the RHEL qemu-kvm package based on the guidance in RHSA-2025:4492. |  | 2 | 1
| RHEL 9 : tuned (RHSA-2024:10384): Update the RHEL tuned package based on the guidance in RHSA-2024:10384. |  | 2 | 1
| RHEL 9 : unbound (RHSA-2025:11849): Update the RHEL unbound package based on the guidance in RHSA-2025:11849. |  | 2 | 1
| RHEL 9 : vim (RHSA-2025:20945): Update the RHEL vim package based on the guidance in RHSA-2025:20945. |  | 2 | 1
| RHEL 8 / 9 : texlive (RHSA-2023:3661): Update the RHEL texlive package based on the guidance in RHSA-2023:3661. |  | 1 | 1
| RHEL 9 : .NET 9.0 (RHSA-2025:2668): Update the affected packages. |  | 1 | 1
| RHEL 9 : Securityes for NetworkManager (Moderate) (RHSA-2025:0377): Update the affected packages. |  | 1 | 1
| RHEL 9 : aardvark-dns (RHSA-2025:7094): Update the RHEL aardvark-dns package based on the guidance in RHSA-2025:7094. |  | 1 | 1
| RHEL 9 : binutils (RHSA-2025:23343): Update the RHEL binutils package based on the guidance in RHSA-2025:23343. |  | 1 | 1
| RHEL 9 : bubblewrap and flatpak (RHSA-2024:6356): Update the RHEL bubblewrap / flatpak packages based on the guidance in RHSA-2024:6356. |  | 1 | 1
| RHEL 9 : bubblewrap and flatpak (RHSA-2024:9449): Update the RHEL bubblewrap / flatpak packages based on the guidance in RHSA-2024:9449. |  | 1 | 1
| RHEL 9 : bzip2 (RHSA-2025:0925): Update the RHEL bzip2 package based on the guidance in RHSA-2025:0925. |  | 1 | 1
| RHEL 9 : compat-openssl11 (RHSA-2025:7937): Update the RHEL compat-openssl11 package based on the guidance in RHSA-2025:7937. |  | 1 | 1
| RHEL 9 : containernetworking-plugins (RHSA-2024:11216): Update the RHEL containernetworking-plugins package based on the guidance in RHSA-2024:11216. |  | 1 | 1
| RHEL 9 : containernetworking-plugins (RHSA-2025:9143): Update the RHEL containernetworking-plugins package based on the guidance in RHSA-2025:9143. |  | 1 | 1
| RHEL 9 : cups (RHSA-2024:9470): Update the RHEL cups package based on the guidance in RHSA-2024:9470. |  | 1 | 1
| RHEL 9 : emacs (RHSA-2024:6510): Update the RHEL emacs package based on the guidance in RHSA-2024:6510. |  | 1 | 1
| RHEL 9 : emacs (RHSA-2025:9448): Update the RHEL emacs package based on the guidance in RHSA-2025:9448. |  | 1 | 1
| RHEL 9 : expat (RHSA-2025:7444): Update the RHEL expat package based on the guidance in RHSA-2025:7444. |  | 1 | 1
| RHEL 9 : flatpak (RHSA-2024:3959): Update the RHEL flatpak package based on the guidance in RHSA-2024:3959. |  | 1 | 1
| RHEL 9 : freetype (RHSA-2025:3407): Update the RHEL freetype package based on the guidance in RHSA-2025:3407. |  | 1 | 1
| RHEL 9 : gcc (RHSA-2025:1346): Update the RHEL gcc package based on the guidance in RHSA-2025:1346. |  | 1 | 1
| RHEL 9 : gcc-toolset-13-binutils (RHSA-2025:23336): Update the RHEL gcc-toolset-13-binutils package based on the guidance in RHSA-2025:23336. |  | 1 | 1
| RHEL 9 : gcc-toolset-13-gcc (RHSA-2025:1309): Update the RHEL gcc-toolset-13-gcc package based on the guidance in RHSA-2025:1309. |  | 1 | 1
| RHEL 9 : gcc-toolset-14-gcc (RHSA-2025:1300): Update the RHEL gcc-toolset-14-gcc package based on the guidance in RHSA-2025:1300. |  | 1 | 1
| RHEL 9 : gdk-pixbuf2 (RHSA-2025:12841): Update the RHEL gdk-pixbuf2 package based on the guidance in RHSA-2025:12841. |  | 1 | 1
| RHEL 9 : glibc (RHSA-2025:4244): Update the RHEL glibc package based on the guidance in RHSA-2025:4244. |  | 1 | 1
| RHEL 9 : gnome-remote-desktop (RHSA-2025:10631): Update the RHEL gnome-remote-desktop package based on the guidance in RHSA-2025:10631. |  | 1 | 1
| RHEL 9 : gnutls (RHSA-2025:7076): Update the RHEL gnutls package based on the guidance in RHSA-2025:7076. |  | 1 | 1
| RHEL 9 : go-rpm-macros (RHSA-2025:22005): Update the RHEL go-rpm-macros package based on the guidance in RHSA-2025:22005. |  | 1 | 1
| RHEL 9 : gstreamer1-plugins-bad-free (RHSA-2025:8183): Update the RHEL gstreamer1-plugins-bad-free package based on the guidance in RHSA-2025:8183. |  | 1 | 1
| RHEL 9 : icu (RHSA-2025:12083): Update the RHEL icu package based on the guidance in RHSA-2025:12083. |  | 1 | 1
| RHEL 9 : krb5 (RHSA-2025:9430): Update the RHEL krb5 package based on the guidance in RHSA-2025:9430. |  | 1 | 1
| RHEL 9 : libblockdev (RHSA-2025:9327): Update the RHEL libblockdev package based on the guidance in RHSA-2025:9327. |  | 1 | 1
| RHEL 9 : libsndfile:1.0.31 (RHSA-2024:11237): Update the RHEL libsndfile:1.0.31 package based on the guidance in RHSA-2024:11237. |  | 1 | 1
| RHEL 9 : libssh (RHSA-2025:18275): Update the RHEL libssh package based on the guidance in RHSA-2025:18275. |  | 1 | 1
| RHEL 9 : libtasn1 (RHSA-2025:7077): Update the RHEL libtasn1 package based on the guidance in RHSA-2025:7077. |  | 1 | 1
| RHEL 9 : libvpx (RHSA-2024:9827): Update the RHEL libvpx package based on the guidance in RHSA-2024:9827. |  | 1 | 1
| RHEL 9 : libvpx (RHSA-2025:9118): Update the RHEL libvpx package based on the guidance in RHSA-2025:9118. |  | 1 | 1
| RHEL 9 : libxslt (RHSA-2025:7410): Update the RHEL libxslt package based on the guidance in RHSA-2025:7410. |  | 1 | 1
| RHEL 9 : mpg123:1.32.9 (RHSA-2024:11242): Update the RHEL mpg123:1.32.9 package based on the guidance in RHSA-2024:11242. |  | 1 | 1
| RHEL 9 : ncurses (RHSA-2025:12876): Update the RHEL ncurses package based on the guidance in RHSA-2025:12876. |  | 1 | 1
| RHEL 9 : open-vm-tools (RHSA-2025:17428): Update the RHEL open-vm-tools package based on the guidance in RHSA-2025:17428. |  | 1 | 1
| RHEL 9 : perl (RHSA-2025:11804): Update the RHEL perl package based on the guidance in RHSA-2025:11804. |  | 1 | 1
| RHEL 9 : pesign (RHSA-2023:1067): Update the RHEL pesign package based on the guidance in RHSA-2023:1067. |  | 1 | 1
| RHEL 9 : pixman (RHSA-2023:7754): Update the RHEL pixman package based on the guidance in RHSA-2023:7754. |  | 1 | 1
| RHEL 9 : protobuf (RHSA-2025:7138): Update the RHEL protobuf package based on the guidance in RHSA-2025:7138. |  | 1 | 1
| RHEL 9 : python-requests (RHSA-2025:12519): Update the RHEL python-requests package based on the guidance in RHSA-2025:12519. |  | 1 | 1
| RHEL 9 : python-requests (RHSA-2025:7049): Update the RHEL python-requests package based on the guidance in RHSA-2025:7049. |  | 1 | 1
| RHEL 9 : python-setuptools (RHSA-2025:10407): Update the RHEL python-setuptools package based on the guidance in RHSA-2025:10407. |  | 1 | 1
| RHEL 9 : shadow-utils (RHSA-2025:20559): Update the RHEL shadow-utils package based on the guidance in RHSA-2025:20559. |  | 1 | 1
| RHEL 9 : sqlite (RHSA-2025:11992): Update the RHEL sqlite package based on the guidance in RHSA-2025:11992. |  | 1 | 1
| RHEL 9 : sqlite (RHSA-2025:20936): Update the RHEL sqlite package based on the guidance in RHSA-2025:20936. |  | 1 | 1
| RHEL 9 : sssd (RHSA-2025:20954): Update the RHEL sssd package based on the guidance in RHSA-2025:20954. |  | 1 | 1
| RHEL 9 : sudo (RHSA-2025:9978): Update the RHEL sudo package based on the guidance in RHSA-2025:9978. |  | 1 | 1
| RHEL 9 : systemd (RHSA-2025:22660): Update the RHEL systemd package based on the guidance in RHSA-2025:22660. |  | 1 | 1
| RHEL 9 : tbb (RHSA-2025:1210): Update the RHEL tbb package based on the guidance in RHSA-2025:1210. |  | 1 | 1
| RHEL 9 : udisks2 (RHSA-2025:15018): Update the RHEL udisks2 package based on the guidance in RHSA-2025:15018. |  | 1 | 1
| RHEL 9 : unbound:1.16.2 (RHSA-2024:11232): Update the RHEL unbound:1.16.2 package based on the guidance in RHSA-2024:11232. |  | 1 | 1
| RHEL 9 : xdg-utils (RHSA-2025:7672): Update the RHEL xdg-utils package based on the guidance in RHSA-2025:7672. |  | 1 | 1
| RHEL 9 : yelp (RHSA-2025:7430): Update the RHEL yelp package based on the guidance in RHSA-2025:7430. |  | 1 | 1

© 2026 Tenable™, Inc. All rights reserved.